suricata
|
Go to the source code of this file.
Functions | |
int | PrefilterPktPayloadRegister (DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx) |
int | PrefilterPktStreamRegister (DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx) |
int | DetectEngineInspectPacketPayload (DetectEngineCtx *, DetectEngineThreadCtx *, const Signature *, Flow *, Packet *) |
Do the content inspection & validation for a signature. More... | |
int | DetectEngineInspectStreamPayload (DetectEngineCtx *, DetectEngineThreadCtx *, const Signature *, Flow *, Packet *) |
Do the content inspection & validation for a signature on the raw stream. More... | |
int | DetectEngineInspectStream (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) |
inspect engine for stateful rules More... | |
void | PayloadRegisterTests (void) |
Definition in file detect-engine-payload.h.
int DetectEngineInspectPacketPayload | ( | DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
const Signature * | s, | ||
Flow * | f, | ||
Packet * | p | ||
) |
Do the content inspection & validation for a signature.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
f | flow (for pcre flowvar storage) |
p | Packet |
0 | no match |
1 | match |
Definition at line 148 of file detect-engine-payload.c.
References DetectEngineThreadCtx_::buffer_offset, de_ctx, StreamMpmData::det_ctx, DETECT_CI_FLAGS_SINGLE, DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD, DETECT_SM_LIST_PMATCH, DetectEngineContentInspection(), DetectEngineThreadCtx_::discontinue_matching, DetectEngineThreadCtx_::inspection_recursion_counter, Packet_::payload, Packet_::payload_len, DetectEngineThreadCtx_::replist, SCEnter, SCReturnInt, and Signature_::sm_arrays.
int DetectEngineInspectStream | ( | DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
const struct DetectEngineAppInspectionEngine_ * | engine, | ||
const Signature * | s, | ||
Flow * | f, | ||
uint8_t | flags, | ||
void * | alstate, | ||
void * | txv, | ||
uint64_t | tx_id | ||
) |
inspect engine for stateful rules
Caches results as it may be called multiple times if we inspect multiple transactions in one packet.
Returns "can't match" if depth is reached.
Definition at line 317 of file detect-engine-payload.c.
References StreamContentInspectEngineData::det_ctx, DetectEngineThreadCtx_::p, and Packet_::proto.
int DetectEngineInspectStreamPayload | ( | DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
const Signature * | s, | ||
Flow * | f, | ||
Packet * | p | ||
) |
Do the content inspection & validation for a signature on the raw stream.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
f | flow (for pcre flowvar storage) |
0 | no match |
1 | match |
Definition at line 262 of file detect-engine-payload.c.
References de_ctx, StreamContentInspectData::det_ctx, StreamContentInspectData::f, Signature_::flags, Flow_::protoctx, StreamContentInspectData::s, SCEnter, SCLogDebug, SIG_FLAG_FLUSH, and StreamReassembleRaw().
void PayloadRegisterTests | ( | void | ) |
Definition at line 1160 of file detect-engine-payload.c.
References UtRegisterTest().
int PrefilterPktPayloadRegister | ( | DetectEngineCtx * | de_ctx, |
SigGroupHead * | sgh, | ||
MpmCtx * | mpm_ctx | ||
) |
Definition at line 128 of file detect-engine-payload.c.
References de_ctx, and PrefilterAppendPayloadEngine().
Referenced by PatternMatchPrepareGroup().
int PrefilterPktStreamRegister | ( | DetectEngineCtx * | de_ctx, |
SigGroupHead * | sgh, | ||
MpmCtx * | mpm_ctx | ||
) |
Definition at line 107 of file detect-engine-payload.c.
References de_ctx, and PrefilterAppendPayloadEngine().
Referenced by PatternMatchPrepareGroup().