suricata
detect-filestore.c File Reference
#include "suricata-common.h"
#include "threads.h"
#include "debug.h"
#include "decode.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "flow.h"
#include "flow-var.h"
#include "flow-util.h"
#include "util-debug.h"
#include "util-spm-bm.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "app-layer.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "stream-tcp.h"
#include "detect-filestore.h"
Include dependency graph for detect-filestore.c:

Go to the source code of this file.

Macros

#define PARSE_REGEX   "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$"
 Regex for parsing our flow options. More...
 
#define MAX_SUBSTRINGS   30
 

Functions

void DetectFilestoreRegister (void)
 Registration function for keyword: filestore. More...
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Implements the filestore keyword

Definition in file detect-filestore.c.

Macro Definition Documentation

#define MAX_SUBSTRINGS   30

Referenced by DetectFilestoreRegister().

#define PARSE_REGEX   "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$"

Regex for parsing our flow options.

Definition at line 58 of file detect-filestore.c.

Referenced by DetectFilestoreRegister().

Function Documentation

void DetectFilestoreRegister ( void  )

Registration function for keyword: filestore.

Definition at line 75 of file detect-filestore.c.

References Flow_::alproto, Signature_::alproto, ALPROTO_HTTP, Flow_::alstate, AppLayerHtpNeedFileInspection(), AppLayerParserGetFiles(), BUG_ON, SigMatch_::ctx, DE_QUIET, SigTableElmt_::desc, DETECT_FILESTORE, DETECT_FILESTORE_MAX, DETECT_FILESTORE_POSTMATCH, DETECT_SM_LIST_POSTMATCH, DetectBufferTypeRegister(), DetectEngineCtxFree(), DetectEngineCtxInit(), DetectSetupParseRegexes(), DetectFilestoreData_::direction, DOC_URL, DOC_VERSION, FAIL_IF, FAIL_IF_NOT_NULL, DetectEngineThreadCtx_::file_id, File_::file_track_id, SigTableElmt_::FileMatch, FileReassemblyDepth(), HtpState_::files_tc, HtpState_::files_ts, DetectEngineThreadCtx_::filestore, DetectEngineThreadCtx_::filestore_cnt, Signature_::filestore_ctx, FILESTORE_DIR_BOTH, FILESTORE_DIR_DEFAULT, FILESTORE_DIR_TOCLIENT, FILESTORE_DIR_TOSERVER, FILESTORE_SCOPE_DEFAULT, FILESTORE_SCOPE_SSN, FILESTORE_SCOPE_TX, FileStoreAllFiles(), FileStoreAllFilesForTx(), FileStoreFileById(), flags, HtpState_::flags, Signature_::flags, DetectEngineCtx_::flags, SigTableElmt_::flags, Packet_::flow, FLOW_PKT_TOCLIENT, FLOW_PKT_TOSERVER, Packet_::flowflags, SigTableElmt_::Free, HTP_FLAG_STORE_FILES_TC, HTP_FLAG_STORE_FILES_TS, HTP_FLAG_STORE_FILES_TX_TC, HTP_FLAG_STORE_FILES_TX_TS, Signature_::id, m, SigTableElmt_::Match, MAX_SUBSTRINGS, SigTableElmt_::name, PARSE_REGEX, Flow_::proto, Flow_::protoctx, SigTableElmt_::RegisterTests, res, SC_ERR_CONFLICTING_RULE_KEYWORDS, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_MATCH, SCEnter, SCFree, SCLogDebug, SCLogError, SCMalloc, DetectFilestoreData_::scope, SCRealloc, SCReturnInt, SigTableElmt_::Setup, File_::sid, File_::sid_cnt, File_::sid_max, SIG_FLAG_BYPASS, SIG_FLAG_FILESTORE, DetectEngineCtx_::sig_list, SigInit(), SIGMATCH_OPTIONAL_OPT, sigmatch_table, SigMatchAlloc(), SigMatchAppendSMToList(), HtpState_::store_tx_id, str, STREAM_TOCLIENT, STREAM_TOSERVER, TcpSessionSetReassemblyDepth(), tx_id, DetectEngineThreadCtx_::tx_id, SigMatch_::type, unlikely, SigTableElmt_::url, and UtRegisterTest().

Referenced by SigTableSetup().

Here is the call graph for this function:

Here is the caller graph for this function: