|
Data Structures |
| struct | Rlp_Node_t |
| | Node structure - basically a cons list. More...
|
| struct | RlpIntAttribute_t |
| | Struct to represent a single int entry. More...
|
| struct | Rlp_SampleAttribute_t |
| | Sampling threshold. More...
|
| struct | Rlp_IfAttribute_t |
| | Interface to check against. More...
|
| struct | Rlp_AckAttribute_t |
| | TCP ack value to check against. More...
|
| struct | Rlp_ByteJumpAttribute_t |
| | Byte jump operation. More...
|
| struct | Rlp_ByteTestAttribute_t |
| | Byte test operation. More...
|
| struct | Rlp_ContentAttribute_t |
| | Content to test for. More...
|
| struct | Rlp_DepthAttribute_t |
| | Sets maximum search depth for the content pattern match to search from beginning of region. More...
|
| struct | Rlp_DistanceAttribute_t |
| | Look for at least N bytes between pattern matches using content. More...
|
| struct | Rlp_DsizeAttribute_t |
| | The dsize option is used to test the packet payload size. It may be set to any value, plus use the greater than/less than signs to indicate ranges and limits. More...
|
| struct | Rlp_FlagsAttribute_t |
| | Test the TCP flags for a match. More...
|
| struct | Rlp_FragbitsAttribute_t |
| | This rule inspects the fragment and reserved bits in the IP header. More...
|
| struct | Rlp_IcmpIdAttribute_t |
| | The icmp_id option examines an ICMP ECHO packet's ICMP ID number for a specific value. More...
|
| struct | Rlp_IcmpSeqAttribute_t |
| | The icmp_id option examines an ICMP ECHO packet's ICMP sequence field for a specific value. More...
|
| struct | Rlp_IcodeAttribute_t |
| | itype rule, just set a numeric value in here and Detect any traffic using that ICMP code value. More...
|
| struct | Rlp_IpOptsAttribute_t |
| | Ip options. More...
|
| struct | Rlp_IpProtoAttribute_t |
| | Check the ip proto field. More...
|
| struct | Rlp_ItypeAttribute_t |
| | This rule tests the value of the ICMP type field. It is set using the numeric value of this field. More...
|
| struct | Rlp_NocaseAttribute_t |
| | The nocase option is used to deactivate case sensitivity in a content rule. More...
|
| struct | Rlp_OffsetAttribute_t |
| | The offset rule option is used as a modifier to rules using the content option keyword. More...
|
| struct | Rlp_RpcAttribute_t |
| | This option looks at RPC requests and automatically decodes the application, procedure, and program version, indicating success when all three variables are matched. More...
|
| struct | Rlp_SameIpAttribute_t |
| | Check if source and dest ip are the same. More...
|
| struct | Rlp_SeqAttribute_t |
| | This rule option refers to the TCP sequence number. More...
|
| struct | Rlp_TtlAttribute_t |
| | This rule option is used to set a specific time-to-live value to test against. More...
|
| struct | Rlp_WithinAttribute_t |
| | The within keyword is a content modifier that makes sure that at least N bytes are between pattern matches. More...
|
| struct | Rlp_ContentCheckAttribute_t |
| | Struct for checking a content type rule. More...
|
| struct | Rlp_PcreAttribute_t |
| | Struct for pcre checking. More...
|
| struct | Rlp_L7Check_t |
| | A struct for holding the content tests on a formula. More...
|
| struct | Rlp_L4Check_t |
| | A struct for holding the layer 4 check on a formula. More...
|
| struct | Rlp_Action_t |
| | Struct encoding the action to be taken. More...
|
Defines |
| #define | RLP_SKIP_SPACE(s) while ( isspace(*s) ) s++; |
| | Macros to help parse formulas.
|
| #define | RLP_SKIP_TEXT(s) while ( !isspace(*s) ) s++; |
| #define | RLP_STRNCPY_TERMINATE(dest, src, N) strncpy( dest, src, N ); dest[N] = '\0'; |
| #define | RLP_EXTRACT_FIELD(dest, tmpPtr, linePtr, tmpbuf) |
Typedefs |
| typedef Rlp_Node_t | Rlp_Formula_t |
| typedef util_attrib_val_t | Rlp_RuleComponent_t |
| typedef RlpIntAttribute_t | Rlp_IntAttribute_t |
| typedef Rlp_SampleAttribute_t | Rlp_SampleAttribute_t |
| typedef Rlp_IfAttribute_t | Rlp_IfAttribute_t |
| typedef Rlp_AckAttribute_t | Rlp_AckAttribute_t |
| typedef Rlp_ByteJumpAttribute_t | Rlp_ByteJumpAttribute_t |
| typedef Rlp_ByteTestAttribute_t | Rlp_ByteTestAttribute_t |
| typedef Rlp_ContentAttribute_t | Rlp_ContentAttribute_t |
| typedef Rlp_DepthAttribute_t | Rlp_DepthAttribute_t |
| typedef Rlp_DistanceAttribute_t | Rlp_DistanceAttribute_t |
| typedef Rlp_DsizeAttribute_t | Rlp_DsizeAttribute_t |
| typedef Rlp_FlagsAttribute_t | Rlp_FlagsAttribute_t |
| typedef Rlp_FragbitsAttribute_t | Rlp_FragbitsAttribute_t |
| typedef Rlp_IcmpIdAttribute_t | Rlp_IcmpIdAttribute_t |
| typedef Rlp_IcmpSeqAttribute_t | Rlp_IcmpSeqAttribute_t |
| typedef Rlp_IcodeAttribute_t | Rlp_IcodeAttribute_t |
| typedef Rlp_IpOptsAttribute_t | Rlp_IpOptsAttribute_t |
| | Struct for IP options checking.
|
| typedef Rlp_IpProtoAttribute_t | Rlp_IpProtoAttribute_t |
| typedef Rlp_IpProtoAttribute_t | Rlp_IdAttribute_t |
| | This option keyword is used to test for an exact match in the IP header fragment ID field.
|
| typedef Rlp_ItypeAttribute_t | Rlp_ItypeAttribute_t |
| typedef Rlp_NocaseAttribute_t | Rlp_NocaseAttribute_t |
| typedef Rlp_OffsetAttribute_t | Rlp_OffsetAttribute_t |
| typedef Rlp_RpcAttribute_t | Rlp_RpcAttribute_t |
| typedef Rlp_SameIpAttribute_t | Rlp_SameIpAttribute_t |
| typedef Rlp_SeqAttribute_t | Rlp_SeqAttribute_t |
| typedef Rlp_TtlAttribute_t | Rlp_TtlAttribute_t |
| typedef Rlp_ContentAttribute_t | Rlp_UriContentAttribute_t |
| | This rule allows searches to be matched against only the URI portion of a request.
|
| typedef Rlp_WithinAttribute_t | Rlp_WithinAttribute_t |
| typedef Rlp_ContentCheckAttribute_t | Rlp_ContentCheck_t |
| typedef Rlp_ByteTestAttribute_t | Rlp_ByteTestCheck_t |
| | Struct for checking a byte test type rule.
|
| typedef Rlp_ByteJumpAttribute_t | Rlp_ByteJumpCheck_t |
| | Struct for checking a byte jump type rule.
|
| typedef Rlp_PcreAttribute_t | Rlp_PcreAttribute_t |
| typedef Rlp_PcreAttribute_t | Rlp_PcreCheck_t |
| typedef Rlp_L7Check_t | Rlp_L7Check_t |
| typedef Rlp_L4Check_t | Rlp_L4Check_t |
| typedef Rlp_Action_t | Rlp_Action_t |
Enumerations |
| enum | Rlp_OperatorEnum_t {
Rlp_List_c,
Rlp_Undef_c,
Rlp_Ack_c,
Rlp_Byte_Jump_c,
Rlp_Byte_Test_c,
Rlp_Content_c,
Rlp_Depth_c,
Rlp_Distance_c,
Rlp_Dsize_c,
Rlp_Flags_c,
Rlp_Fragbits_c,
Rlp_Icmp_Id_c,
Rlp_Icmp_Seq_c,
Rlp_Icode_c,
Rlp_Id_c,
Rlp_Ip_Proto_c,
Rlp_IpOpts_c,
Rlp_Itype_c,
Rlp_Nocase_c,
Rlp_Offset_c,
Rlp_Pcre_c,
Rlp_Rpc_c,
Rlp_Sameip_c,
Rlp_Seq_c,
Rlp_Ttl_c,
Rlp_Uricontent_c,
Rlp_Within_c,
Rlp_Interface_c,
Rlp_Sample_c,
Rlp_Tcp_c,
Rlp_Udp_c,
Rlp_Icmp_c,
Rlp_Ip_c,
Rlp_Num_c,
Rlp_Text_c,
Rlp_IpBlock_c,
Rlp_PortUnion_c,
Rlp_IpUnion_c,
Rlp_Negation_c,
Rlp_PortRange_c,
Rlp_IpEntry_c,
Rlp_Alert_c,
Rlp_Define_c,
Rlp_ClassOfService_c,
Rlp_Any_c,
Rlp_Generic_c
} |
| | Types of operators allowed in formulas. More...
|
| enum | Rlp_FlagType_t { zero_c,
one_c,
X_c
} |
| | Possible ack flag values. More...
|
| enum | Rlp_IpOpts_t {
Rlp_unassigned_c,
Rlp_rr_c,
Rlp_eol_c,
Rlp_nop_c,
Rlp_ts_c,
Rlp_sec_c,
Rlp_lsrr_c,
Rlp_lsrre_c,
Rlp_ssrr_c,
Rlp_satid_c
} |
| | Differnet types of ip options. More...
|
| enum | Rlp_L7CheckType_t {
Rlp_L7UndefCheck_c,
Rlp_L7ContentCheck_c,
Rlp_L7UriContentCheck_c,
Rlp_L7ByteJumpCheck_c,
Rlp_L7ByteTestCheck_c,
Rlp_L7PcreCheck_c
} |
| | Possible types of L7 checks. More...
|
| enum | Rlp_ActionEnum_t {
Rlp_ActionUnassigned_c,
Rlp_ActionDrop_c,
Rlp_ActionRoute_c,
Rlp_ActionQueue_c,
Rlp_ActionUscript_c,
Rlp_ActionUcode_c
} |
| | Enum for the different possible actions for a packet. More...
|
Functions |
| Rlp_Formula_t * | car (Rlp_Formula_t *) |
| | LISP car function.
|
| Rlp_Formula_t * | cdr (Rlp_Formula_t *) |
| | LISP cdr function.
|
| Rlp_Formula_t * | cons (Rlp_Formula_t *, Rlp_Formula_t *) |
| Rlp_Formula_t * | new_node (Rlp_OperatorEnum_t, Rlp_Formula_t *, Rlp_Formula_t *) |
| | Allocate a new node.
|
| Rlp_Action_t * | Rlp_AllocActionStruct () |
| | Allocate an acction struct.
|
| Rlp_Action_t * | Rlp_CreateActionFromRawText (char *rawFormula) |
| | Create an action struct from raw text.
|
| void | Rlp_ActionPrint (Rlp_Action_t *action) |
| | Print an action structure.
|
| Rlp_L4Check_t * | Rlp_AllocL4CheckStruct () |
| | Allocate an L4 check struct.
|
| Rlp_L4Check_t * | Rlp_CreateL4CheckFromRawFormula (char *rawFormula) |
| | Create an l4 check struct from a raw formula.
|
| Rlp_Formula_t * | Rlp_ComputeIpFormulaFromString (char *ipString) |
| | Parse a raw string representing a set of IP addresses into an Rlp_Formula_t.
|
| u_int32_t | Rlp_DotToInt (char *dotString) |
| | Convert a string in dotted decimal notation to an unsigned 32 bit int.
|
| Rlp_Formula_t * | Rlp_ComputePortFormulaFromString (char *portString) |
| | Parse a raw string representing a set of ports into an Rlp_Formula_t.
|
| array_t * | Rlp_BuildContentCheckArrayFromL7Formula (Rlp_Formula_t *aL7Formula) |
| | Walk an L7 formula, build the list of checks.
|
| int | Rlp_FreeL7CheckArray (array_t *L7CheckArray) |
| | Free an array containing content check structs.
|
| Rlp_Formula_t * | make2eltlist (Rlp_Formula_t *a, Rlp_Formula_t *b) |
| | List is always a list node with right child another list node or nil.
|
| int | node_print (Rlp_Formula_t *a) |
| | print node
|
| char * | Rlp_ConvertParseTreeToText (Rlp_Formula_t *aFormula) |
| | Convert a rule parse tree to a formula text string.
|
| int | Rlp_PrintFormulaTree (Rlp_Formula_t *aFormula) |
| | Print a rule parse tree.
|
| void | Rlp_FormulaFree (Rlp_Formula_t *aFormula) |
| | Free a parse tree.
|
| Rlp_Formula_t * | Rlp_CreateParseTreeFromText (char *text) |
| | Create a parse tree for an L7 formula from raw text of formula.
|
| Rlp_Formula_t * | Rlp_CreateParseTreeFromAttribValuePairArray (array_t *aRule) |
| | Create a parse tree from a L7 formula that is presented as an array of (attribute,value) pairs.
|
| int | Rlp_ParsedRulePrint (Rlp_Formula_t *aTree) |
| | Print a parse tree.
|
| util_byte_array_t * | Rlp_ByteCodeToByteArray (char *byteCode) |
| | Convert byte code to a byte array.
|
| int | Rlp_NodePrint (Rlp_Formula_t *entry) |
| | Print a node, which is assumed to be an entry in a parse tree.
|
| array_t * | Rlp_TestReadL7FormulasFromFile (char *fileName) |
| | Read a bunch of L7 formulas from a file, return them in an array.
|
| char * | Rlp_GetL4ComponentFromRawRule (char *rawRule) |
| | Get the L4 text from a rule.
|
| char * | Rlp_GetL7ComponentFromRawRule (char *rawRule) |
| | Get the L7 text from a rule.
|
| char * | Rlp_GetActionComponentFromRawRule (char *rawRule) |
| | Get the action component from a rule.
|
| int | Rlp_FreeArrayOfStrings (array_t *stringArray) |
| | Free an array_t and the strings in it.
|
| st_table * | Rlp_L7CheckGetContentChecks (array_t *L7CheckArray) |
| | Return a hash containing all the content checks for in the given rule.
|
| void | Rlp_TestParseContent (char *fileName) |
| | Code to test parsing of content.
|
| int | Rlp_UpdateDefineTable (st_table *aTable, char *anEntry) |
| | Adds a mapping from a macro name to definition.
|
| array_t * | Rlp_L7StringParse (char *l7Rule) |
| | Parse a string encoding a Layer 7 formula.
|
