suricata
detect-detection-filter.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "debug.h"
#include "decode.h"
#include "detect.h"
#include "host.h"
#include "detect-detection-filter.h"
#include "detect-threshold.h"
#include "detect-parse.h"
#include "util-byte.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-debug.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-threshold.h"
#include "util-time.h"
#include "util-hashlist.h"
Include dependency graph for detect-detection-filter.c:

Go to the source code of this file.

Macros

#define TRACK_DST   1
 
#define TRACK_SRC   2
 
#define PARSE_REGEX   "^\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*,\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*,\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*$"
 Regex for parsing our detection_filter options. More...
 
#define MAX_SUBSTRINGS   30
 

Functions

void DetectDetectionFilterRegister (void)
 Registration function for detection_filter: keyword. More...
 

Detailed Description

Author
Gerardo Iglesias igles.nosp@m.iasg.nosp@m.@gmai.nosp@m.l.co.nosp@m.m

Implements the detection_filter keyword

Definition in file detect-detection-filter.c.

Macro Definition Documentation

#define MAX_SUBSTRINGS   30
#define PARSE_REGEX   "^\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*,\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*,\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*$"

Regex for parsing our detection_filter options.

Definition at line 49 of file detect-detection-filter.c.

Referenced by DetectDetectionFilterRegister().

Function Documentation

void DetectDetectionFilterRegister ( void  )

Registration function for detection_filter: keyword.

Registration function for detection_filter: keyword

Definition at line 63 of file detect-detection-filter.c.

References Packet_::action, ACTION_DROP, ByteExtractStringUint32(), DetectThresholdData_::count, SigMatch_::ctx, DE_QUIET, SigTableElmt_::desc, DETECT_DETECTION_FILTER, DETECT_SM_LIST_THRESHOLD, DETECT_THRESHOLD, DetectEngineCtxFree(), DetectEngineCtxInit(), DetectEngineThreadCtxDeinit(), DetectEngineThreadCtxInit(), DetectGetLastSMFromLists(), DetectSetupParseRegexes(), DOC_URL, DOC_VERSION, DetectEngineCtx_::flags, SigTableElmt_::flags, SigTableElmt_::Free, HOST_QUIET, HostInitConfig(), HostShutdown(), SigTableElmt_::Match, MAX_SUBSTRINGS, SigTableElmt_::name, PACKET_TEST_ACTION, PacketAlertCheck(), PARSE_REGEX, SigTableElmt_::RegisterTests, res, SC_ERR_INVALID_SIGNATURE, SC_ERR_INVALID_VALUE, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_MATCH, SCEnter, SCFree, SCLogError, SCMalloc, SCReturnInt, SCStrdup, DetectThresholdData_::seconds, SigTableElmt_::Setup, DetectEngineCtx_::sig_list, SigCleanSignatures(), SigGroupBuild(), SigGroupCleanup(), SigInit(), SIGMATCH_IPONLY_COMPAT, sigmatch_table, SigMatchAlloc(), SigMatchAppendSMToList(), SigMatchSignatures(), TimeGet(), TimeSetIncrementTime(), DetectThresholdData_::track, TRACK_DST, TRACK_SRC, Packet_::ts, DetectThresholdData_::type, SigMatch_::type, TYPE_DETECTION, unlikely, SigTableElmt_::url, UTHBuildPacketReal(), UTHFreePackets(), and UtRegisterTest().

Referenced by SigTableSetup().

Here is the call graph for this function:

Here is the caller graph for this function: