suricata
detect-engine-file.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions

int DetectFileInspectHttp (ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id)
 
int DetectFileInspectSmtp (ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id)
 
int DetectFileInspectGeneric (ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id)
 Inspect the file inspecting keywords against the state. More...
 

Detailed Description

Function Documentation

int DetectFileInspectGeneric ( ThreadVars tv,
DetectEngineCtx de_ctx,
DetectEngineThreadCtx det_ctx,
const Signature s,
const SigMatchData smd,
Flow f,
uint8_t  flags,
void *  alstate,
void *  tx,
uint64_t  tx_id 
)

Inspect the file inspecting keywords against the state.

Parameters
tvthread vars
det_ctxdetection engine thread ctx
fflow
ssignature to inspect
alstatestate
flagsdirection flag
Return values
0no match
1match
2can't match
3can't match filestore signature
Note
flow is not locked at this time

Definition at line 218 of file detect-engine-file.c.

References Flow_::alproto, AppLayerParserGetFiles(), DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILES, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, Signature_::id, Flow_::proto, SCEnter, SCLogDebug, SCReturnInt, STREAM_TOCLIENT, and STREAM_TOSERVER.

Referenced by DetectFilenameRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectFileInspectHttp ( ThreadVars tv,
DetectEngineCtx de_ctx,
DetectEngineThreadCtx det_ctx,
const Signature s,
const SigMatchData smd,
Flow f,
uint8_t  flags,
void *  alstate,
void *  tx,
uint64_t  tx_id 
)
int DetectFileInspectSmtp ( ThreadVars tv,
DetectEngineCtx de_ctx,
DetectEngineThreadCtx det_ctx,
const Signature s,
const SigMatchData smd,
Flow f,
uint8_t  flags,
void *  alstate,
void *  tx,
uint64_t  tx_id 
)