suricata
detect-dce-iface.c File Reference
#include "suricata-common.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "detect-dce-iface.h"
#include "flow.h"
#include "flow-var.h"
#include "flow-util.h"
#include "app-layer.h"
#include "app-layer-dcerpc.h"
#include "queue.h"
#include "stream-tcp-reassemble.h"
#include "util-debug.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "stream-tcp.h"
#include "app-layer-smb.h"
Include dependency graph for detect-dce-iface.c:

Go to the source code of this file.

Macros

#define PARSE_REGEX   "^\\s*([0-9a-zA-Z]{8}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{12})(?:\\s*,(<|>|=|!)([0-9]{1,5}))?(?:\\s*,(any_frag))?\\s*$"
 
#define MAX_SUBSTRINGS   30
 

Functions

void DetectDceIfaceRegister (void)
 Registers the keyword handlers for the "dce_iface" keyword. More...
 
DCERPCStateDetectDceGetState (AppProto alproto, void *alstate)
 

Detailed Description

Author
Anoop Saldanha anoop.nosp@m.sald.nosp@m.anha@.nosp@m.gmai.nosp@m.l.com

Implements dce_iface keyword.

Definition in file detect-dce-iface.c.

Macro Definition Documentation

#define MAX_SUBSTRINGS   30

Referenced by DetectDceIfaceRegister().

#define PARSE_REGEX   "^\\s*([0-9a-zA-Z]{8}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{12})(?:\\s*,(<|>|=|!)([0-9]{1,5}))?(?:\\s*,(any_frag))?\\s*$"

Definition at line 55 of file detect-dce-iface.c.

Referenced by DetectDceIfaceRegister().

Function Documentation

DCERPCState* DetectDceGetState ( AppProto  alproto,
void *  alstate 
)

Definition at line 250 of file detect-dce-iface.c.

References DCERPCBindBindAck_::accepted_uuid_list, Flow_::alproto, ALPROTO_DCERPC, ALPROTO_SMB, ALPROTO_SMB2, Flow_::alstate, DetectDceIfaceData_::any_frag, AppLayerParserParse(), AppLayerParserThreadCtxAlloc(), AppLayerParserThreadCtxFree(), SigMatch_::ctx, DCERPCUuidEntry_::ctxid, DCERPCRequest_::ctxid, DCERPCState_::dcerpc, DCERPC_UUID_ENTRY_FLAG_FF, DCERPC_::dcerpcbindbindack, DCERPC_::dcerpchdr, DCERPC_::dcerpcrequest, DE_QUIET, DETECT_DCE_IFACE, DETECT_DCE_IFACE_OP_EQ, DETECT_DCE_IFACE_OP_GT, DETECT_DCE_IFACE_OP_LT, DETECT_DCE_IFACE_OP_NE, DETECT_DCE_IFACE_OP_NONE, DetectDceGetState(), DetectEngineAppendSig(), DetectEngineCtxFree(), DetectEngineCtxInit(), DetectEngineThreadCtxDeinit(), DetectEngineThreadCtxInit(), SMBState_::ds, FAIL_IF, DCERPCRequest_::first_request_seen, flags, DCERPCUuidEntry_::flags, Packet_::flags, DetectEngineCtx_::flags, Packet_::flow, FLOW_DESTROY, FLOW_INITIALIZE, FLOW_PKT_ESTABLISHED, FLOW_PKT_TOCLIENT, FLOW_PKT_TOSERVER, Packet_::flowflags, FLOWLOCK_UNLOCK, FLOWLOCK_WRLOCK, m, next, DetectDceIfaceData_::op, PacketAlertCheck(), PASS, PKT_HAS_FLOW, PKT_STREAM_EST, Flow_::proto, Flow_::protoctx, REQUEST, RESPONSE, DCERPCUuidEntry_::result, SC_ERR_INVALID_SIGNATURE, SCEnter, SCFree, SCLogDebug, SCLogError, SCReturnInt, SigAlloc(), SigCleanSignatures(), SigFree(), SigGroupBuild(), SigGroupCleanup(), SigMatchAlloc(), SigMatchAppendSMToList(), SigMatchSignatures(), STREAM_EOF, STREAM_START, STREAM_TOCLIENT, STREAM_TOSERVER, StreamTcpFreeConfig(), StreamTcpInitConfig(), TAILQ_FOREACH, TRUE, DCERPCHdr_::type, SigMatch_::type, UTHBuildPacket(), UTHFreePackets(), UtRegisterTest(), DetectDceIfaceData_::uuid, DCERPCUuidEntry_::uuid, DetectDceIfaceData_::version, DCERPCUuidEntry_::version, and version.

Referenced by DetectDceGetState(), and DetectDceOpnumRegister().

Here is the call graph for this function:

Here is the caller graph for this function: