suricata
detect-filestore.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Implements the filestore keyword
24  */
25 
26 #include "suricata-common.h"
27 #include "threads.h"
28 #include "decode.h"
29 
30 #include "detect.h"
31 #include "detect-parse.h"
32 
33 #include "detect-engine.h"
34 #include "detect-engine-mpm.h"
35 #include "detect-engine-state.h"
36 
37 #include "feature.h"
38 
39 #include "flow.h"
40 #include "flow-var.h"
41 #include "flow-util.h"
42 
43 #include "util-debug.h"
44 #include "util-spm-bm.h"
45 #include "util-unittest.h"
46 #include "util-unittest-helper.h"
47 
48 #include "app-layer.h"
49 #include "app-layer-parser.h"
50 #include "app-layer-htp.h"
51 
52 #include "stream-tcp.h"
53 
54 #include "detect-filestore.h"
55 
56 #include "util-validate.h"
57 
58 /**
59  * \brief Regex for parsing our flow options
60  */
61 #define PARSE_REGEX "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$"
62 
63 static DetectParseRegex parse_regex;
64 
65 static int DetectFilestoreMatch (DetectEngineThreadCtx *,
66  Flow *, uint8_t, File *, const Signature *, const SigMatchCtx *);
67 static int DetectFilestorePostMatch(DetectEngineThreadCtx *det_ctx,
68  Packet *p, const Signature *s, const SigMatchCtx *ctx);
69 static int DetectFilestoreSetup (DetectEngineCtx *, Signature *, const char *);
70 static void DetectFilestoreFree(DetectEngineCtx *, void *);
71 #ifdef UNITTESTS
72 static void DetectFilestoreRegisterTests(void);
73 #endif
74 static int g_file_match_list_id = 0;
75 
76 /**
77  * \brief Registration function for keyword: filestore
78  */
80 {
81  sigmatch_table[DETECT_FILESTORE].name = "filestore";
82  sigmatch_table[DETECT_FILESTORE].desc = "stores files to disk if the rule matched";
83  sigmatch_table[DETECT_FILESTORE].url = "/rules/file-keywords.html#filestore";
84  sigmatch_table[DETECT_FILESTORE].FileMatch = DetectFilestoreMatch;
85  sigmatch_table[DETECT_FILESTORE].Setup = DetectFilestoreSetup;
86  sigmatch_table[DETECT_FILESTORE].Free = DetectFilestoreFree;
87 #ifdef UNITTESTS
88  sigmatch_table[DETECT_FILESTORE].RegisterTests = DetectFilestoreRegisterTests;
89 #endif
91 
92  sigmatch_table[DETECT_FILESTORE_POSTMATCH].name = "__filestore__postmatch__";
93  sigmatch_table[DETECT_FILESTORE_POSTMATCH].Match = DetectFilestorePostMatch;
94  sigmatch_table[DETECT_FILESTORE_POSTMATCH].Free = DetectFilestoreFree;
95 
96  DetectSetupParseRegexes(PARSE_REGEX, &parse_regex);
97 
98  g_file_match_list_id = DetectBufferTypeRegister("files");
99 }
100 
101 /**
102  * \brief apply the post match filestore with options
103  */
104 static int FilestorePostMatchWithOptions(Packet *p, Flow *f, const DetectFilestoreData *filestore,
105  FileContainer *fc, uint32_t file_id, uint64_t tx_id)
106 {
107  if (filestore == NULL) {
108  SCReturnInt(0);
109  }
110 
111  int this_file = 0;
112  int this_tx = 0;
113  int this_flow = 0;
114  int rule_dir = 0;
115  int toserver_dir = 0;
116  int toclient_dir = 0;
117 
118  switch (filestore->direction) {
120  rule_dir = 1;
121  break;
122  case FILESTORE_DIR_BOTH:
123  toserver_dir = 1;
124  toclient_dir = 1;
125  break;
127  toserver_dir = 1;
128  break;
130  toclient_dir = 1;
131  break;
132  }
133 
134  switch (filestore->scope) {
136  if (rule_dir) {
137  this_file = 1;
138  } else if ((p->flowflags & FLOW_PKT_TOCLIENT) && toclient_dir) {
139  this_file = 1;
140  } else if ((p->flowflags & FLOW_PKT_TOSERVER) && toserver_dir) {
141  this_file = 1;
142  }
143  break;
144  case FILESTORE_SCOPE_TX:
145  this_tx = 1;
146  break;
147  case FILESTORE_SCOPE_SSN:
148  this_flow = 1;
149  break;
150  }
151 
152  if (this_file) {
153  FileStoreFileById(fc, file_id);
154  } else if (this_tx) {
155  /* set in AppLayerTxData. Parsers and logger will propegate it to the
156  * individual files, both new and current. */
157  void *txv = AppLayerParserGetTx(f->proto, f->alproto, f->alstate, tx_id);
158  DEBUG_VALIDATE_BUG_ON(txv == NULL);
159  if (txv != NULL) {
161  DEBUG_VALIDATE_BUG_ON(txd == NULL);
162  if (txd != NULL) {
163  txd->file_flags |= FLOWFILE_STORE;
164  }
165  }
166  } else if (this_flow) {
167  /* set in flow and AppLayerStateData */
169 
170  AppLayerStateData *sd = AppLayerParserGetStateData(f->proto, f->alproto, f->alstate);
171  if (sd != NULL) {
172  sd->file_flags |= FLOWFILE_STORE;
173  }
174  } else {
175  FileStoreFileById(fc, file_id);
176  }
177 
178  SCReturnInt(0);
179 }
180 
181 /**
182  * \brief post-match function for filestore
183  *
184  * \param t thread local vars
185  * \param det_ctx pattern matcher thread local data
186  * \param p packet
187  *
188  * The match function for filestore records store candidates in the det_ctx.
189  * When we are sure all parts of the signature matched, we run this function
190  * to finalize the filestore.
191  */
192 static int DetectFilestorePostMatch(DetectEngineThreadCtx *det_ctx,
193  Packet *p, const Signature *s, const SigMatchCtx *ctx)
194 {
195  SCEnter();
196 
197  if (det_ctx->filestore_cnt == 0) {
198  SCReturnInt(0);
199  }
200 
201  if ((s->filestore_ctx == NULL && !(s->flags & SIG_FLAG_FILESTORE)) || p->flow == NULL) {
202 #ifndef DEBUG
203  SCReturnInt(0);
204 #else
205  BUG_ON(1);
206 #endif
207  }
208 
209  if (p->flow->proto == IPPROTO_TCP && p->flow->protoctx != NULL) {
210  /* set filestore depth for stream reassembling */
211  TcpSession *ssn = (TcpSession *)p->flow->protoctx;
213  }
214 
215  SCLogDebug("s->filestore_ctx %p", s->filestore_ctx);
216 
217  const uint8_t flags = STREAM_FLAGS_FOR_PACKET(p);
218  for (uint16_t u = 0; u < det_ctx->filestore_cnt; u++) {
219  void *alstate = FlowGetAppState(p->flow);
221  p->flow->proto, p->flow->alproto, alstate, det_ctx->filestore[u].tx_id, flags);
222 
223  void *txv = AppLayerParserGetTx(
224  p->flow->proto, p->flow->alproto, alstate, det_ctx->filestore[u].tx_id);
225  DEBUG_VALIDATE_BUG_ON(txv == NULL);
226  if (txv) {
227  AppLayerGetFileState files = AppLayerParserGetTxFiles(p->flow, alstate, txv, flags);
228  FileContainer *ffc_tx = files.fc;
229  DEBUG_VALIDATE_BUG_ON(ffc_tx == NULL);
230  if (ffc_tx) {
231  SCLogDebug("u %u txv %p ffc_tx %p file_id %u", u, txv, ffc_tx,
232  det_ctx->filestore[u].file_id);
233 
234  /* filestore for single files only */
235  if (s->filestore_ctx == NULL) {
236  FileStoreFileById(ffc_tx, det_ctx->filestore[u].file_id);
237  } else {
238  FilestorePostMatchWithOptions(p, p->flow, s->filestore_ctx, ffc_tx,
239  det_ctx->filestore[u].file_id, det_ctx->filestore[u].tx_id);
240  }
241  }
242  }
243  }
244  SCReturnInt(0);
245 }
246 
247 /**
248  * \brief match the specified filestore
249  *
250  * \param t thread local vars
251  * \param det_ctx pattern matcher thread local data
252  * \param f *LOCKED* flow
253  * \param flags direction flags
254  * \param file file being inspected
255  * \param s signature being inspected
256  * \param m sigmatch that we will cast into DetectFilestoreData
257  *
258  * \retval 0 no match
259  * \retval 1 match
260  *
261  * \todo when we start supporting more protocols, the logic in this function
262  * needs to be put behind a api.
263  */
264 static int DetectFilestoreMatch (DetectEngineThreadCtx *det_ctx, Flow *f,
265  uint8_t flags, File *file, const Signature *s, const SigMatchCtx *m)
266 {
267  uint32_t file_id = 0;
268 
269  SCEnter();
270 
271  if (!RunmodeIsUnittests()) {
272  extern bool g_filedata_logger_enabled;
274  SCLogDebug("not storing file match: no filedata logger enabled");
275  SCReturnInt(1);
276  }
277  }
278  if (det_ctx->filestore_cnt >= DETECT_FILESTORE_MAX) {
279  SCReturnInt(1);
280  }
281 
282  /* file can be NULL when a rule with filestore scope > file
283  * matches. */
284  if (file != NULL) {
285  file_id = file->file_track_id;
286  if (file->sid != NULL && s->id > 0) {
287  if (file->sid_cnt >= file->sid_max) {
288  void *p = SCRealloc(file->sid, sizeof(uint32_t) * (file->sid_max + 8));
289  if (p == NULL) {
290  SCFree(file->sid);
291  file->sid = NULL;
292  file->sid_cnt = 0;
293  file->sid_max = 0;
294  goto continue_after_realloc_fail;
295  } else {
296  file->sid = p;
297  file->sid_max += 8;
298  }
299  }
300  file->sid[file->sid_cnt] = s->id;
301  file->sid_cnt++;
302  }
303  }
304 
305 continue_after_realloc_fail:
306 
307  det_ctx->filestore[det_ctx->filestore_cnt].file_id = file_id;
308  det_ctx->filestore[det_ctx->filestore_cnt].tx_id = det_ctx->tx_id;
309 
310  SCLogDebug("%u, file %u, tx %"PRIu64, det_ctx->filestore_cnt,
311  det_ctx->filestore[det_ctx->filestore_cnt].file_id,
312  det_ctx->filestore[det_ctx->filestore_cnt].tx_id);
313 
314  det_ctx->filestore_cnt++;
315  SCReturnInt(1);
316 }
317 
318 /**
319  * \brief this function is used to parse filestore options
320  * \brief into the current signature
321  *
322  * \param de_ctx pointer to the Detection Engine Context
323  * \param s pointer to the Current Signature
324  * \param str pointer to the user provided "filestore" option
325  *
326  * \retval 0 on Success
327  * \retval -1 on Failure
328  */
329 static int DetectFilestoreSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
330 {
331  SCEnter();
332 
333  static bool warn_not_configured = false;
334  static uint32_t de_version = 0;
335 
336  /* Check on first-time loads (includes following a reload) */
337  if (!warn_not_configured || (de_ctx->version != de_version)) {
338  if (de_version != de_ctx->version) {
339  SCLogDebug("reload-detected; re-checking feature presence; DE version now %"PRIu32,
340  de_ctx->version);
341  }
343  SCLogWarning("One or more rule(s) depends on the "
344  "file-store output log which is not enabled. "
345  "Enable the output \"file-store\".");
346  }
347  warn_not_configured = true;
348  de_version = de_ctx->version;
349  }
350 
351  DetectFilestoreData *fd = NULL;
352  SigMatch *sm = NULL;
353  char *args[3] = {NULL,NULL,NULL};
354  int ret = 0, res = 0;
355  size_t pcre2len;
356 
357  /* filestore and bypass keywords can't work together */
358  if (s->flags & SIG_FLAG_BYPASS) {
359  SCLogError("filestore can't work with bypass keyword");
360  return -1;
361  }
362 
363  sm = SigMatchAlloc();
364  if (sm == NULL)
365  goto error;
366 
367  sm->type = DETECT_FILESTORE;
368 
369  if (str != NULL && strlen(str) > 0) {
370  char str_0[32];
371  char str_1[32];
372  char str_2[32];
373  SCLogDebug("str %s", str);
374 
375  ret = DetectParsePcreExec(&parse_regex, str, 0, 0);
376  if (ret < 1 || ret > 4) {
377  SCLogError("parse error, ret %" PRId32 ", string %s", ret, str);
378  goto error;
379  }
380 
381  if (ret > 1) {
382  pcre2len = sizeof(str_0);
383  res = pcre2_substring_copy_bynumber(
384  parse_regex.match, 1, (PCRE2_UCHAR8 *)str_0, &pcre2len);
385  if (res < 0) {
386  SCLogError("pcre2_substring_copy_bynumber failed");
387  goto error;
388  }
389  args[0] = (char *)str_0;
390 
391  if (ret > 2) {
392  pcre2len = sizeof(str_1);
393  res = pcre2_substring_copy_bynumber(
394  parse_regex.match, 2, (PCRE2_UCHAR8 *)str_1, &pcre2len);
395  if (res < 0) {
396  SCLogError("pcre2_substring_copy_bynumber failed");
397  goto error;
398  }
399  args[1] = (char *)str_1;
400  }
401  if (ret > 3) {
402  pcre2len = sizeof(str_2);
403  res = pcre2_substring_copy_bynumber(
404  parse_regex.match, 3, (PCRE2_UCHAR8 *)str_2, &pcre2len);
405  if (res < 0) {
406  SCLogError("pcre2_substring_copy_bynumber failed");
407  goto error;
408  }
409  args[2] = (char *)str_2;
410  }
411  }
412 
413  fd = SCMalloc(sizeof(DetectFilestoreData));
414  if (unlikely(fd == NULL))
415  goto error;
416  memset(fd, 0x00, sizeof(DetectFilestoreData));
417 
418  if (args[0] != NULL) {
419  SCLogDebug("first arg %s", args[0]);
420 
421  if (strcasecmp(args[0], "request") == 0 ||
422  strcasecmp(args[0], "to_server") == 0)
423  {
426  }
427  else if (strcasecmp(args[0], "response") == 0 ||
428  strcasecmp(args[0], "to_client") == 0)
429  {
432  }
433  else if (strcasecmp(args[0], "both") == 0)
434  {
437  }
438  } else {
440  }
441 
442  if (args[1] != NULL) {
443  SCLogDebug("second arg %s", args[1]);
444 
445  if (strcasecmp(args[1], "file") == 0)
446  {
448  } else if (strcasecmp(args[1], "tx") == 0)
449  {
451  } else if (strcasecmp(args[1], "ssn") == 0 ||
452  strcasecmp(args[1], "flow") == 0)
453  {
455  }
456  } else {
457  if (fd->scope == 0)
459  }
460 
461  sm->ctx = (SigMatchCtx*)fd;
462  } else {
463  sm->ctx = (SigMatchCtx*)NULL;
464  }
465 
466  if (s->alproto == ALPROTO_HTTP1 || s->alproto == ALPROTO_HTTP) {
468  }
469 
470  SigMatchAppendSMToList(s, sm, g_file_match_list_id);
471  s->filestore_ctx = (const DetectFilestoreData *)sm->ctx;
472 
473  sm = SigMatchAlloc();
474  if (unlikely(sm == NULL))
475  goto error;
477  sm->ctx = NULL;
479 
480 
482  return 0;
483 
484 error:
485  if (sm != NULL)
486  SCFree(sm);
487  return -1;
488 }
489 
490 static void DetectFilestoreFree(DetectEngineCtx *de_ctx, void *ptr)
491 {
492  if (ptr != NULL) {
493  SCFree(ptr);
494  }
495 }
496 
497 #ifdef UNITTESTS
498 /*
499  * The purpose of this test is to confirm that
500  * filestore and bypass keywords can't
501  * can't work together
502  */
503 static int DetectFilestoreTest01(void)
504 {
505  DetectEngineCtx *de_ctx = NULL;
506  int result = 1;
507 
509  FAIL_IF(de_ctx == NULL);
510 
511  de_ctx->flags |= DE_QUIET;
512 
513  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
514  "(bypass; filestore; "
515  "content:\"message\"; http_host; "
516  "sid:1;)");
518 
520 
521  return result;
522 }
523 
524 void DetectFilestoreRegisterTests(void)
525 {
526  UtRegisterTest("DetectFilestoreTest01", DetectFilestoreTest01);
527 }
528 #endif /* UNITTESTS */
DetectParseRegex::match
pcre2_match_data * match
Definition: detect-parse.h:47
SigTableElmt_::url
const char * url
Definition: detect.h:1241
FileContainer_
Definition: util-file.h:113
AppLayerHtpNeedFileInspection
void AppLayerHtpNeedFileInspection(void)
Sets a flag that informs the HTP app layer that some module in the engine needs the http request file...
Definition: app-layer-htp.c:511
detect-engine.h
SigTableElmt_::desc
const char * desc
Definition: detect.h:1240
DetectParsePcreExec
int DetectParsePcreExec(DetectParseRegex *parse_regex, const char *str, int start_offset, int options)
Definition: detect-parse.c:2488
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1228
flow-util.h
Signature_::filestore_ctx
const struct DetectFilestoreData_ * filestore_ctx
Definition: detect.h:598
AppLayerParserSetStreamDepthFlag
void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags)
Definition: app-layer-parser.c:1618
DetectParseRegex
Definition: detect-parse.h:44
g_filedata_logger_enabled
bool g_filedata_logger_enabled
Definition: output-filedata.c:37
DetectFilestoreData_::scope
int16_t scope
Definition: detect-filestore.h:38
SigTableElmt_::name
const char * name
Definition: detect.h:1238
stream-tcp.h
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
FILESTORE_DIR_DEFAULT
#define FILESTORE_DIR_DEFAULT
Definition: detect-filestore.h:27
Signature_::alproto
AppProto alproto
Definition: detect.h:544
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
Flow_::proto
uint8_t proto
Definition: flow.h:379
DetectEngineThreadCtx_::tx_id
uint64_t tx_id
Definition: detect.h:1098
threads.h
Flow_
Flow data structure.
Definition: flow.h:357
SigTableElmt_::FileMatch
int(* FileMatch)(DetectEngineThreadCtx *, Flow *, uint8_t flags, File *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1214
DETECT_FILESTORE
@ DETECT_FILESTORE
Definition: detect-engine-register.h:210
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1232
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:785
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2442
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:227
DE_QUIET
#define DE_QUIET
Definition: detect.h:287
m
SCMutex m
Definition: flow-hash.h:6
AppLayerParserGetStateData
AppLayerStateData * AppLayerParserGetStateData(uint8_t ipproto, AppProto alproto, void *state)
Definition: app-layer-parser.c:1222
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:459
Flow_::protoctx
void * protoctx
Definition: flow.h:447
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1223
DetectEngineCtx_::version
uint32_t version
Definition: detect.h:880
util-unittest.h
util-unittest-helper.h
FILESTORE_SCOPE_TX
#define FILESTORE_SCOPE_TX
Definition: detect-filestore.h:33
DETECT_SM_LIST_POSTMATCH
@ DETECT_SM_LIST_POSTMATCH
Definition: detect.h:87
RequiresFeature
bool RequiresFeature(const char *feature_name)
Definition: feature.c:126
app-layer-htp.h
File_::file_track_id
uint32_t file_track_id
Definition: util-file.h:84
feature.h
decode.h
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
DETECT_FILESTORE_MAX
#define DETECT_FILESTORE_MAX
Definition: detect.h:999
FLOWFILE_STORE
#define FLOWFILE_STORE
Definition: flow.h:144
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1025
DetectEngineThreadCtx_::filestore
struct DetectEngineThreadCtx_::@99 filestore[DETECT_FILESTORE_MAX]
FILESTORE_SCOPE_SSN
#define FILESTORE_SCOPE_SSN
Definition: detect-filestore.h:34
SIG_FLAG_BYPASS
#define SIG_FLAG_BYPASS
Definition: detect.h:233
DetectSetupParseRegexes
void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *detect_parse)
Definition: detect-parse.c:2609
File_::sid_max
uint32_t sid_max
Definition: util-file.h:110
STREAM_FLAGS_FOR_PACKET
#define STREAM_FLAGS_FOR_PACKET(p)
Definition: stream.h:30
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect-engine-mpm.h
detect.h
FileStoreFileById
void FileStoreFileById(FileContainer *fc, uint32_t file_id)
flag a file with id "file_id" to be stored.
Definition: util-file.c:1175
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
SigInit
Signature * SigInit(DetectEngineCtx *de_ctx, const char *sigstr)
Parses a signature and adds it to the Detection Engine Context.
Definition: detect-parse.c:2129
app-layer-parser.h
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:316
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:289
FileReassemblyDepth
uint32_t FileReassemblyDepth(void)
Definition: util-file.c:133
Signature_::flags
uint32_t flags
Definition: detect.h:541
Packet_
Definition: decode.h:428
DetectEngineThreadCtx_::filestore_cnt
uint16_t filestore_cnt
Definition: detect.h:1058
FILESTORE_DIR_TOCLIENT
#define FILESTORE_DIR_TOCLIENT
Definition: detect-filestore.h:29
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
detect-filestore.h
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1206
File_::sid
uint32_t * sid
Definition: util-file.h:108
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:228
File_::sid_cnt
uint32_t sid_cnt
Definition: util-file.h:109
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:232
SigMatchAlloc
SigMatch * SigMatchAlloc(void)
Definition: detect-parse.c:239
AppLayerParserGetTx
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:1143
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:308
FILESTORE_DIR_BOTH
#define FILESTORE_DIR_BOTH
Definition: detect-filestore.h:30
FILESTORE_DIR_TOSERVER
#define FILESTORE_DIR_TOSERVER
Definition: detect-filestore.h:28
DetectFilestoreRegister
void DetectFilestoreRegister(void)
Registration function for keyword: filestore.
Definition: detect-filestore.c:79
File_
Definition: util-file.h:79
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1303
Packet_::flow
struct Flow_ * flow
Definition: decode.h:465
FEATURE_OUTPUT_FILESTORE
#define FEATURE_OUTPUT_FILESTORE
Definition: feature.h:28
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
DetectBufferTypeRegister
int DetectBufferTypeRegister(const char *name)
Definition: detect-engine.c:1025
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:314
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:30
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:76
AppLayerParserGetTxData
AppLayerTxData * AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:1215
util-spm-bm.h
DetectEngineCtx_::sig_list
Signature * sig_list
Definition: detect.h:791
SIGMATCH_OPTIONAL_OPT
#define SIGMATCH_OPTIONAL_OPT
Definition: detect.h:1432
util-validate.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
DetectFilestoreData_
Definition: detect-filestore.h:36
str
#define str(s)
Definition: suricata-common.h:280
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
PARSE_REGEX
#define PARSE_REGEX
Regex for parsing our flow options.
Definition: detect-filestore.c:61
SCFree
#define SCFree(p)
Definition: util-mem.h:61
TcpSessionSetReassemblyDepth
void TcpSessionSetReassemblyDepth(TcpSession *ssn, uint32_t size)
Definition: stream-tcp.c:6530
Flow_::alstate
void * alstate
Definition: flow.h:482
Signature_::id
uint32_t id
Definition: detect.h:574
DetectFilestoreData_::direction
int16_t direction
Definition: detect-filestore.h:37
detect-parse.h
Signature_
Signature container.
Definition: detect.h:540
SigMatch_
a single match condition for a signature
Definition: detect.h:313
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition: app-layer-protos.h:66
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2403
FILESTORE_SCOPE_DEFAULT
#define FILESTORE_SCOPE_DEFAULT
Definition: detect-filestore.h:32
AppLayerParserGetTxFiles
AppLayerGetFileState AppLayerParserGetTxFiles(const Flow *f, void *state, void *tx, const uint8_t direction)
Definition: app-layer-parser.c:890
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:786
TcpSession_
Definition: stream-tcp-private.h:272
flow.h
Flow_::file_flags
uint16_t file_flags
Definition: flow.h:429
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:456
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
flow-var.h
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
SigMatchAppendSMToList
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:354
SIG_FLAG_FILESTORE
#define SIG_FLAG_FILESTORE
Definition: detect.h:226
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1230
DetectEngineThreadCtx_::file_id
uint32_t file_id
Definition: detect.h:1155
app-layer.h
DETECT_FILESTORE_POSTMATCH
@ DETECT_FILESTORE_POSTMATCH
Definition: detect-engine-register.h:211