detect-bytemath.h File Reference

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions
void	DetectBytemathRegister (void)
	Registers the keyword handlers for the "byte_math" keyword. More...
SigMatch *	DetectByteMathRetrieveSMVar (const char *, const Signature *)
	Lookup the SigMatch for a named byte_math variable. More...
int	DetectByteMathDoMatch (DetectEngineThreadCtx *, const DetectByteMathData *, const Signature *, const uint8_t *, const uint32_t, uint8_t, uint64_t, uint64_t *, uint8_t)

Detailed Description

Author

Jeff Lucovsky jeff@.nosp@m.luco.nosp@m.vsky..nosp@m.org

Definition in file detect-bytemath.h.

Function Documentation

DetectByteMathDoMatch()

int DetectByteMathDoMatch	(	DetectEngineThreadCtx *	,
		const DetectByteMathData *	,
		const Signature *	,
		const uint8_t *	,
		const uint32_t	,
		uint8_t	,
		uint64_t	,
		uint64_t *	,
		uint8_t
	)

Definition at line 87 of file detect-bytemath.c.

References payload_len.

DetectBytemathRegister()

void DetectBytemathRegister

(

void

)

Registers the keyword handlers for the "byte_math" keyword.

Definition at line 70 of file detect-bytemath.c.

References DETECT_BYTEMATH, SigTableElmt_::Match, SigTableElmt_::name, SigTableElmt_::Setup, and sigmatch_table.

Referenced by SigTableSetup().

Here is the caller graph for this function:

DetectByteMathRetrieveSMVar()

SigMatch* DetectByteMathRetrieveSMVar	(	const char *	arg,
		const Signature *	s
	)

Lookup the SigMatch for a named byte_math variable.

Parameters

arg	The name of the byte_math variable to lookup.
s	Pointer the signature to look in.

Return values

A	pointer to the SigMatch if found, otherwise NULL.

Definition at line 441 of file detect-bytemath.c.

References SignatureInitData_::buffer_index, SignatureInitData_::buffers, SigMatch_::ctx, DETECT_BYTEMATH, SignatureInitDataBuffer_::head, Signature_::init_data, SigMatch_::next, SCLogDebug, and SigMatch_::type.

Referenced by DetectByteRetrieveSMVar().

Here is the caller graph for this function: