suricata
|
#include "suricata-common.h"
#include "decode.h"
#include "detect.h"
#include "app-layer-parser.h"
#include "flow-util.h"
#include "flow-var.h"
#include "detect-engine-siggroup.h"
#include "detect-engine-state.h"
#include "util-cidr.h"
#include "util-byte.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-debug.h"
#include "detect-engine.h"
#include "detect-parse.h"
#include "detect-engine-mpm.h"
Go to the source code of this file.
Functions | |
int | DetectProtoParse (DetectProto *dp, const char *str) |
Parses a protocol sent as a string. More... | |
int | DetectProtoContainsProto (const DetectProto *dp, int proto) |
see if a DetectProto contains a certain proto More... | |
void | DetectProtoTests (void) |
this function registers unit tests for DetectProto More... | |
Proto part of the detection engine.
Definition in file detect-engine-proto.c.
int DetectProtoContainsProto | ( | const DetectProto * | dp, |
int | proto | ||
) |
see if a DetectProto contains a certain proto
dp | detect proto to inspect |
proto | protocol (such as IPPROTO_TCP) to look for |
0 | protocol not in the set |
1 | protocol is in the set |
Definition at line 135 of file detect-engine-proto.c.
References DE_QUIET, DETECT_PROTO_ANY, DETECT_PROTO_ONLY_PKT, DETECT_PROTO_ONLY_STREAM, DetectEngineCtxFree(), DetectEngineCtxInit(), DetectEngineThreadCtxDeinit(), DetectEngineThreadCtxInit(), DetectProtoParse(), DetectProto_::flags, Packet_::flags, DetectEngineCtx_::flags, Packet_::flow, FLOW_DESTROY, FLOW_INITIALIZE, FLOW_PKT_TOSERVER, Packet_::flowflags, Signature_::next, PacketAlertCheck(), PKT_HAS_FLOW, DetectProto_::proto, Signature_::proto, SCLogDebug, DetectEngineCtx_::sig_list, SigCleanSignatures(), SigGroupBuild(), SigGroupCleanup(), SigInit(), SigMatchSignatures(), str, UTHBuildPacket(), and UTHFreePackets().
Referenced by EngineAnalysisRules(), IPOnlyMatchPacket(), and SigMatchSignaturesGetSgh().
int DetectProtoParse | ( | DetectProto * | dp, |
const char * | str | ||
) |
Parses a protocol sent as a string.
dp | Pointer to the DetectProto instance which will be updated with the incoming protocol information. |
str | Pointer to the string containing the protocol name. |
>=0 | If proto is detected, -1 otherwise. |
Definition at line 56 of file detect-engine-proto.c.
References ByteExtractStringUint8(), DETECT_PROTO_ANY, DETECT_PROTO_IPV4, DETECT_PROTO_IPV6, DETECT_PROTO_ONLY_PKT, DETECT_PROTO_ONLY_STREAM, DetectProto_::flags, DetectProto_::proto, proto, and SCLogDebug.
Referenced by DetectProtoContainsProto(), and SigMatchListSMBelongsTo().
void DetectProtoTests | ( | void | ) |
this function registers unit tests for DetectProto
Definition at line 579 of file detect-engine-proto.c.
References UtRegisterTest().