Go to the documentation of this file.
24 #ifndef SURICATA_DETECT_ENGINE_HELPER_H
25 #define SURICATA_DETECT_ENGINE_HELPER_H
43 const void *txv,
const uint8_t flow_flags, uint32_t local_id,
const uint8_t **buf,
46 const void *txv,
const uint8_t flow_flags,
const uint8_t **buf, uint32_t *buf_len);
76 void (*
TransformId)(
const uint8_t **id_data, uint32_t *id_length,
void *context);
int(* AppLayerTxMatch)(DetectEngineThreadCtx *, Flow *, uint8_t flags, void *alstate, void *txv, const Signature *, const SigMatchCtx *)
function callback to match on an app-layer transaction
const char * url
keyword documentation url
const char * name
keyword name
int SCDetectHelperBufferRegister(const char *name, AppProto alproto, uint8_t direction)
int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress)
main detection engine ctx
int SCDetectHelperTransformRegister(const SCTransformTableElmt *kw)
const char * desc
keyword description
struct SCTransformTableElmt SCTransformTableElmt
App-layer light version of SigTableElmt.
void SCDetectHelperKeywordAliasRegister(uint16_t kwid, const char *alias)
int SCDetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData)
bool(* InspectionSingleBufferGetDataPtr)(const void *txv, const uint8_t flow_flags, const uint8_t **buf, uint32_t *buf_len)
struct SCSigTableAppLiteElmt SCSigTableAppLiteElmt
App-layer light version of SigTableElmt.
int SCDetectHelperNewKeywordId(void)
void(* Free)(DetectEngineCtx *, void *)
function callback to free structure allocated by setup if any
uint16_t SCDetectHelperKeywordRegister(const SCSigTableAppLiteElmt *kw)
bool(* InspectionMultiBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const void *txv, const uint8_t flow_flags, uint32_t local_id, const uint8_t **buf, uint32_t *buf_len)
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
function callback to parse and setup keyword in rule
int SCDetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionSingleBufferGetDataPtr GetData)
uint16_t flags
flags SIGMATCH_*