suricata
detect-file-data.c File Reference
#include "suricata-common.h"
#include "threads.h"
#include "decode.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-buffer.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-content-inspection.h"
#include "detect-engine-file.h"
#include "detect-file-data.h"
#include "app-layer.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "app-layer-smtp.h"
#include "flow.h"
#include "flow-var.h"
#include "flow-util.h"
#include "util-debug.h"
#include "util-spm-bm.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-file-decompression.h"
#include "util-profiling.h"
#include "tests/detect-file-data.c"
Include dependency graph for detect-file-data.c:

Go to the source code of this file.

Data Structures

struct  DetectFileHandlerProtocol_t
 

Macros

#define ALPROTO_WITHFILES_MAX   16
 

Functions

int PrefilterMpmFiledataRegister (DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
 
void DetectFileRegisterProto (AppProto alproto, int direction, int to_client_progress, int to_server_progress)
 
void DetectFileRegisterFileProtocols (DetectFileHandlerTableElmt *reg)
 
void DetectFiledataRegister (void)
 Registration function for keyword: file_data. More...
 
uint8_t DetectEngineInspectFiledata (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
 

Variables

DetectFileHandlerTableElmt filehandler_table [DETECT_TBLSIZE_STATIC]
 
DetectFileHandlerProtocol_t al_protocols [ALPROTO_WITHFILES_MAX]
 

Detailed Description

Macro Definition Documentation

◆ ALPROTO_WITHFILES_MAX

#define ALPROTO_WITHFILES_MAX   16

Definition at line 81 of file detect-file-data.c.

Function Documentation

◆ DetectEngineInspectFiledata()

◆ DetectFiledataRegister()

void DetectFiledataRegister ( void  )

Registration function for keyword: file_data.

Definition at line 148 of file detect-file-data.c.

References SigTableElmt_::alias, SigTableElmt_::desc, DETECT_FILE_DATA, SigTableElmt_::name, SigTableElmt_::Setup, sigmatch_table, and SigTableElmt_::url.

Referenced by SigTableSetup().

Here is the caller graph for this function:

◆ DetectFileRegisterFileProtocols()

◆ DetectFileRegisterProto()

void DetectFileRegisterProto ( AppProto  alproto,
int  direction,
int  to_client_progress,
int  to_server_progress 
)

◆ PrefilterMpmFiledataRegister()

int PrefilterMpmFiledataRegister ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
MpmCtx mpm_ctx,
const DetectBufferMpmRegistry mpm_reg,
int  list_id 
)

Variable Documentation

◆ al_protocols

Initial value:
= {
{ .alproto = ALPROTO_NFS, .direction = SIG_FLAG_TOSERVER | SIG_FLAG_TOCLIENT },
{ .alproto = ALPROTO_SMB, .direction = SIG_FLAG_TOSERVER | SIG_FLAG_TOCLIENT },
{ .alproto = ALPROTO_FTP, .direction = SIG_FLAG_TOSERVER | SIG_FLAG_TOCLIENT },
{ .alproto = ALPROTO_FTPDATA, .direction = SIG_FLAG_TOSERVER | SIG_FLAG_TOCLIENT },
{ .alproto = ALPROTO_HTTP1,
.to_client_progress = HTP_RESPONSE_PROGRESS_BODY,
.to_server_progress = HTP_REQUEST_PROGRESS_BODY },
{ .alproto = ALPROTO_HTTP2,
.to_client_progress = HTTP2StateDataServer,
.to_server_progress = HTTP2StateDataClient },
{ .alproto = ALPROTO_SMTP, .direction = SIG_FLAG_TOSERVER }, { .alproto = ALPROTO_UNKNOWN }
}

Definition at line 83 of file detect-file-data.c.

Referenced by DetectFileRegisterFileProtocols(), and DetectFileRegisterProto().

◆ filehandler_table

Definition at line 78 of file detect-file-data.c.

ALPROTO_FTP
@ ALPROTO_FTP
Definition: app-layer-protos.h:37
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:272
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:271
ALPROTO_SMTP
@ ALPROTO_SMTP
Definition: app-layer-protos.h:38
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:69
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:36
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition: app-layer-protos.h:53
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_SMB
@ ALPROTO_SMB
Definition: app-layer-protos.h:43
ALPROTO_NFS
@ ALPROTO_NFS
Definition: app-layer-protos.h:51