suricata
detect-engine-payload.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "decode.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-parse.h"
#include "detect-engine-content-inspection.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-state.h"
#include "detect-engine-payload.h"
#include "stream.h"
#include "stream-tcp.h"
#include "util-debug.h"
#include "util-print.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-validate.h"
#include "util-mpm-ac.h"
Include dependency graph for detect-engine-payload.c:

Go to the source code of this file.

Data Structures

struct  StreamMpmData
 
struct  StreamContentInspectData
 
struct  StreamContentInspectEngineData
 

Functions

int PrefilterPktStreamRegister (DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
 
int PrefilterPktPayloadRegister (DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
 
int DetectEngineInspectPacketPayload (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p)
 Do the content inspection & validation for a signature. More...
 
int DetectEngineInspectStreamPayload (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p)
 Do the content inspection & validation for a signature on the raw stream. More...
 
int DetectEngineInspectStream (ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
 inspect engine for stateful rules More...
 
void PayloadRegisterTests (void)
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Performs payload matching functions

Definition in file detect-engine-payload.c.

Function Documentation

int DetectEngineInspectPacketPayload ( DetectEngineCtx de_ctx,
DetectEngineThreadCtx det_ctx,
const Signature s,
Flow f,
Packet p 
)

Do the content inspection & validation for a signature.

Parameters
de_ctxDetection engine context
det_ctxDetection engine thread context
sSignature to inspect
fflow (for pcre flowvar storage)
pPacket
Return values
0no match
1match

Definition at line 150 of file detect-engine-payload.c.

References DetectEngineThreadCtx_::buffer_offset, DETECT_CI_FLAGS_SINGLE, DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD, DETECT_SM_LIST_PMATCH, DetectEngineContentInspection(), DetectEngineThreadCtx_::discontinue_matching, DetectEngineThreadCtx_::inspection_recursion_counter, Packet_::payload, Packet_::payload_len, DetectEngineThreadCtx_::replist, SCEnter, SCReturnInt, and Signature_::sm_arrays.

Referenced by DetectBufferTypeGetByIdTransforms().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectEngineInspectStream ( ThreadVars tv,
DetectEngineCtx de_ctx,
DetectEngineThreadCtx det_ctx,
const Signature s,
const SigMatchData smd,
Flow f,
uint8_t  flags,
void *  alstate,
void *  txv,
uint64_t  tx_id 
)
int DetectEngineInspectStreamPayload ( DetectEngineCtx de_ctx,
DetectEngineThreadCtx det_ctx,
const Signature s,
Flow f,
Packet p 
)

Do the content inspection & validation for a signature on the raw stream.

Parameters
de_ctxDetection engine context
det_ctxDetection engine thread context
sSignature to inspect
fflow (for pcre flowvar storage)
Return values
0no match
1match

Definition at line 263 of file detect-engine-payload.c.

References StreamContentInspectData::de_ctx, StreamMpmData::det_ctx, Signature_::flags, StreamContentInspectData::s, SCEnter, SIG_FLAG_FLUSH, and StreamReassembleRaw().

Referenced by DetectBufferTypeGetByIdTransforms().

Here is the call graph for this function:

Here is the caller graph for this function:

void PayloadRegisterTests ( void  )

Definition at line 1316 of file detect-engine-payload.c.

References UtRegisterTest().

Here is the call graph for this function:

int PrefilterPktPayloadRegister ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
MpmCtx mpm_ctx 
)

Definition at line 130 of file detect-engine-payload.c.

References PrefilterAppendPayloadEngine().

Referenced by PatternMatchPrepareGroup().

Here is the call graph for this function:

Here is the caller graph for this function:

int PrefilterPktStreamRegister ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
MpmCtx mpm_ctx 
)