suricata
detect-engine-file.c File Reference
#include "suricata-common.h"
#include "decode.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-parse.h"
#include "detect-engine-state.h"
#include "detect-filestore.h"
#include "detect-engine-dcepayload.h"
#include "detect-engine-file.h"
#include "stream-tcp.h"
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "app-layer-parser.h"
#include "app-layer-protos.h"
#include "app-layer-htp.h"
#include "app-layer-dcerpc-common.h"
#include "app-layer-dcerpc.h"
#include "app-layer-smtp.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-profiling.h"
Include dependency graph for detect-engine-file.c:

Go to the source code of this file.

Functions

int DetectFileInspectGeneric (ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id)
 Inspect the file inspecting keywords against the state. More...
 

Detailed Description

Function Documentation

int DetectFileInspectGeneric ( ThreadVars tv,
DetectEngineCtx de_ctx,
DetectEngineThreadCtx det_ctx,
const Signature s,
const SigMatchData smd,
Flow f,
uint8_t  flags,
void *  alstate,
void *  tx,
uint64_t  tx_id 
)

Inspect the file inspecting keywords against the state.

Parameters
tvthread vars
det_ctxdetection engine thread ctx
fflow
ssignature to inspect
alstatestate
flagsdirection flag
Return values
0no match
1match
2can't match
3can't match filestore signature
Note
flow is not locked at this time

Definition at line 223 of file detect-engine-file.c.

References Flow_::alproto, AppLayerParserGetFiles(), DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILESTORE, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, Signature_::id, Flow_::proto, SCEnter, SCLogDebug, SCReturnInt, STREAM_TOCLIENT, and STREAM_TOSERVER.

Referenced by DetectFilenameRegister().

Here is the call graph for this function:

Here is the caller graph for this function: