suricata
detect-bytemath.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions

void DetectBytemathRegister (void)
 Registers the keyword handlers for the "byte_math" keyword. More...
 
SigMatchDetectByteMathRetrieveSMVar (const char *, const Signature *)
 Lookup the SigMatch for a named byte_math variable. More...
 
int DetectByteMathDoMatch (DetectEngineThreadCtx *, const DetectByteMathData *, const Signature *, const uint8_t *, const uint32_t, uint8_t, uint64_t, uint64_t *, uint8_t)
 

Detailed Description

Author
Jeff Lucovsky jeff@.nosp@m.luco.nosp@m.vsky..nosp@m.org

Definition in file detect-bytemath.h.

Function Documentation

◆ DetectByteMathDoMatch()

int DetectByteMathDoMatch ( DetectEngineThreadCtx ,
const DetectByteMathData *  ,
const Signature ,
const uint8_t *  ,
const uint32_t  ,
uint8_t  ,
uint64_t  ,
uint64_t *  ,
uint8_t   
)

Definition at line 88 of file detect-bytemath.c.

References payload_len.

◆ DetectBytemathRegister()

void DetectBytemathRegister ( void  )

Registers the keyword handlers for the "byte_math" keyword.

Definition at line 71 of file detect-bytemath.c.

References DETECT_BYTEMATH, SigTableElmt_::Match, SigTableElmt_::name, SigTableElmt_::Setup, and sigmatch_table.

Referenced by SigTableSetup().

Here is the caller graph for this function:

◆ DetectByteMathRetrieveSMVar()

SigMatch* DetectByteMathRetrieveSMVar ( const char *  arg,
const Signature s 
)

Lookup the SigMatch for a named byte_math variable.

Parameters
argThe name of the byte_math variable to lookup.
sPointer the signature to look in.
Return values
Apointer to the SigMatch if found, otherwise NULL.

Definition at line 442 of file detect-bytemath.c.

References SignatureInitData_::buffer_index, SignatureInitData_::buffers, SigMatch_::ctx, DETECT_BYTEMATH, SignatureInitDataBuffer_::head, Signature_::init_data, SigMatch_::next, SCLogDebug, and SigMatch_::type.

Referenced by DetectByteRetrieveSMVar().

Here is the caller graph for this function: