suricata
detect-dce-opnum.c File Reference
#include "suricata-common.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "flow.h"
#include "flow-var.h"
#include "flow-util.h"
#include "app-layer.h"
#include "app-layer-dcerpc.h"
#include "queue.h"
#include "stream-tcp-reassemble.h"
#include "detect-dce-opnum.h"
#include "detect-dce-iface.h"
#include "util-debug.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "stream-tcp.h"
Include dependency graph for detect-dce-opnum.c:

Go to the source code of this file.

Macros

#define PARSE_REGEX   "^\\s*([0-9]{1,5}(\\s*-\\s*[0-9]{1,5}\\s*)?)(,\\s*[0-9]{1,5}(\\s*-\\s*[0-9]{1,5})?\\s*)*$"
 
#define MAX_SUBSTRINGS   30
 

Functions

void DetectDceOpnumRegister (void)
 Registers the keyword handlers for the "dce_opnum" keyword. More...
 

Detailed Description

Author
Anoop Saldanha anoop.nosp@m.sald.nosp@m.anha@.nosp@m.gmai.nosp@m.l.com

Implements dce_opnum keyword

Definition in file detect-dce-opnum.c.

Macro Definition Documentation

#define MAX_SUBSTRINGS   30

Referenced by DetectDceOpnumRegister().

#define PARSE_REGEX   "^\\s*([0-9]{1,5}(\\s*-\\s*[0-9]{1,5}\\s*)?)(,\\s*[0-9]{1,5}(\\s*-\\s*[0-9]{1,5})?\\s*)*$"

Definition at line 56 of file detect-dce-opnum.c.

Referenced by DetectDceOpnumRegister().

Function Documentation

void DetectDceOpnumRegister ( void  )

Registers the keyword handlers for the "dce_opnum" keyword.

Definition at line 78 of file detect-dce-opnum.c.

References Flow_::alproto, ALPROTO_DCERPC, Flow_::alstate, AppLayerDestroyCtxThread(), AppLayerParserParse(), AppLayerParserThreadCtxAlloc(), AppLayerParserThreadCtxFree(), SigTableElmt_::AppLayerTxMatch, SigMatch_::ctx, DCE_OPNUM_RANGE_MAX, DCE_OPNUM_RANGE_UNINITIALIZED, DCERPCState_::dcerpc, DCERPC_::dcerpcrequest, DE_QUIET, DETECT_DCE_OPNUM, DetectBufferTypeRegister(), DetectDceGetState(), DetectEngineAppendSig(), DetectEngineCtxFree(), DetectEngineCtxInit(), DetectEngineThreadCtxDeinit(), DetectEngineThreadCtxInit(), DetectSetupParseRegexes(), flags, Packet_::flags, DetectEngineCtx_::flags, Packet_::flow, FLOW_DESTROY, FLOW_INITIALIZE, FLOW_PKT_ESTABLISHED, FLOW_PKT_TOCLIENT, FLOW_PKT_TOSERVER, Packet_::flowflags, FLOWLOCK_UNLOCK, FLOWLOCK_WRLOCK, SigTableElmt_::Free, index, m, SigTableElmt_::Match, MAX_SUBSTRINGS, SigTableElmt_::name, DetectDceOpnumRange_::next, DCERPCRequest_::opnum, PacketAlertCheck(), PARSE_REGEX, PKT_HAS_FLOW, PKT_STREAM_EST, Flow_::proto, Flow_::protoctx, DetectDceOpnumData_::range, DetectDceOpnumRange_::range1, DetectDceOpnumRange_::range2, SigTableElmt_::RegisterTests, res, SC_ERR_INVALID_SIGNATURE, SC_ERR_MEM_ALLOC, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_MATCH, SCEnter, SCFree, SCLogDebug, SCLogError, SCMalloc, SCReturnInt, SCStrdup, SigTableElmt_::Setup, DetectEngineCtx_::sig_list, SigAlloc(), SigCleanSignatures(), SigFree(), SigGroupBuild(), SigGroupCleanup(), SigInit(), sigmatch_table, SigMatchAlloc(), SigMatchAppendSMToList(), SigMatchSignatures(), STREAM_EOF, STREAM_START, STREAM_TOCLIENT, STREAM_TOSERVER, StreamTcpFreeConfig(), StreamTcpInitConfig(), TRUE, SigMatch_::type, UTHBuildPacket(), UTHFreePackets(), and UtRegisterTest().

Referenced by SigTableSetup().

Here is the call graph for this function:

Here is the caller graph for this function: