Macros
#define	DETECT_CI_FLAGS_START BIT_U8(0)

#define	DETECT_CI_FLAGS_END BIT_U8(1)

#define	DETECT_CI_FLAGS_DCE_LE BIT_U8(2)

#define	DETECT_CI_FLAGS_DCE_BE BIT_U8(3)

#define	DETECT_CI_FLAGS_SINGLE (DETECT_CI_FLAGS_START\|DETECT_CI_FLAGS_END)

Enumerations
enum	DetectContentInspectionType { DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD = 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_HEADER, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STREAM, DETECT_ENGINE_CONTENT_INSPECTION_MODE_FRAME, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE }

Functions
bool	DetectEngineContentInspection (DetectEngineCtx de_ctx, DetectEngineThreadCtx det_ctx, const Signature s, const SigMatchData smd, Packet p, Flow f, const uint8_t *buffer, const uint32_t buffer_len, const uint32_t stream_start_offset, const uint8_t flags, const enum DetectContentInspectionType inspection_mode)
	wrapper around DetectEngineContentInspectionInternal to return true/false only More...

bool	DetectEngineContentInspectionBuffer (DetectEngineCtx de_ctx, DetectEngineThreadCtx det_ctx, const Signature s, const SigMatchData smd, Packet p, Flow f, const InspectionBuffer *b, const enum DetectContentInspectionType inspection_mode)
	content inspect entry for inspection buffers More...

void	DetectEngineContentInspectionRegisterTests (void)

Detailed Description

Author: Anoop Saldanha anoop.nosp@m.sald.nosp@m.anha@.nosp@m.gmai.nosp@m.l.com; Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Macro Definition Documentation

#define DETECT_CI_FLAGS_DCE_BE BIT_U8(3)

DCERPC record in big endian

#define DETECT_CI_FLAGS_DCE_LE BIT_U8(2)

DCERPC record in little endian

#define DETECT_CI_FLAGS_END BIT_U8(1)

indication that current buffer is the end of the data

buffer is a single, non-streaming, buffer. Data sent to the content inspection function contains both start and end of the data.

#define DETECT_CI_FLAGS_START BIT_U8(0)

indication that current buffer is the start of the data

indication to content engine what type of data we're inspecting

Enumerator
DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD
DETECT_ENGINE_CONTENT_INSPECTION_MODE_HEADER
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STREAM
DETECT_ENGINE_CONTENT_INSPECTION_MODE_FRAME
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE

bool DetectEngineContentInspection	(	DetectEngineCtx *	de_ctx,
		DetectEngineThreadCtx *	det_ctx,
		const Signature *	s,
		const SigMatchData *	smd,
		Packet *	p,
		Flow *	f,
		const uint8_t *	buffer,
		const uint32_t	buffer_len,
		const uint32_t	stream_start_offset,
		const uint8_t	flags,
		const enum DetectContentInspectionType	inspection_mode
	)

wrapper around DetectEngineContentInspectionInternal to return true/false only

Parameters

smd	sigmatches to evaluate

Here is the caller graph for this function:

bool DetectEngineContentInspectionBuffer	(	DetectEngineCtx *	de_ctx,
		DetectEngineThreadCtx *	det_ctx,
		const Signature *	s,
		const SigMatchData *	smd,
		Packet *	p,
		Flow *	f,
		const InspectionBuffer *	b,
		const enum DetectContentInspectionType	inspection_mode
	)

content inspect entry for inspection buffers

Parameters

de_ctx	detection engine
det_ctx	detect engine thread ctx
s	signature being inspected
smd	array of content inspection matches
p	packet
f	flow
b	inspection buffer to inspect
inspection_mode	inspection mode to use