suricata
detect-filestore.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  DetectFilestoreData_
 

Macros

#define FILESTORE_DIR_DEFAULT   0 /* rule dir */
 
#define FILESTORE_DIR_TOSERVER   1
 
#define FILESTORE_DIR_TOCLIENT   2
 
#define FILESTORE_DIR_BOTH   3
 
#define FILESTORE_SCOPE_DEFAULT   0 /* per file */
 
#define FILESTORE_SCOPE_TX   1 /* per transaction */
 
#define FILESTORE_SCOPE_SSN   2 /* per flow/ssn */
 

Typedefs

typedef struct DetectFilestoreData_ DetectFilestoreData
 

Functions

void DetectFilestoreRegister (void)
 Registration function for keyword: filestore. More...
 
int DetectFilestorePostMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *)
 post-match function for filestore More...
 

Detailed Description

Macro Definition Documentation

#define FILESTORE_DIR_BOTH   3

Definition at line 30 of file detect-filestore.h.

Referenced by DetectFilestorePostMatch(), and DetectFilestoreRegister().

#define FILESTORE_DIR_DEFAULT   0 /* rule dir */

Definition at line 27 of file detect-filestore.h.

Referenced by DetectFilestorePostMatch(), and DetectFilestoreRegister().

#define FILESTORE_DIR_TOCLIENT   2

Definition at line 29 of file detect-filestore.h.

Referenced by DetectFilestorePostMatch(), and DetectFilestoreRegister().

#define FILESTORE_DIR_TOSERVER   1

Definition at line 28 of file detect-filestore.h.

Referenced by DetectFilestorePostMatch(), and DetectFilestoreRegister().

#define FILESTORE_SCOPE_DEFAULT   0 /* per file */

Definition at line 32 of file detect-filestore.h.

Referenced by DetectFilestorePostMatch(), and DetectFilestoreRegister().

#define FILESTORE_SCOPE_SSN   2 /* per flow/ssn */

Definition at line 34 of file detect-filestore.h.

Referenced by DetectFilestorePostMatch(), and DetectFilestoreRegister().

#define FILESTORE_SCOPE_TX   1 /* per transaction */

Definition at line 33 of file detect-filestore.h.

Referenced by DetectFilestorePostMatch(), and DetectFilestoreRegister().

Typedef Documentation

Function Documentation

int DetectFilestorePostMatch ( ThreadVars t,
DetectEngineThreadCtx det_ctx,
Packet p,
const Signature s 
)

post-match function for filestore

Parameters
tthread local vars
det_ctxpattern matcher thread local data
ppacket

The match function for filestore records store candidates in the det_ctx. When we are sure all parts of the signature matched, we run this function to finalize the filestore.

Definition at line 187 of file detect-filestore.c.

References Flow_::alproto, Signature_::alproto, ALPROTO_HTTP, Flow_::alstate, AppLayerHtpNeedFileInspection(), AppLayerParserGetFiles(), BUG_ON, SigMatch_::ctx, DE_QUIET, DETECT_FILESTORE, DETECT_FILESTORE_MAX, DetectEngineCtxFree(), DetectEngineCtxInit(), DetectFilestoreData_::direction, FAIL_IF, FAIL_IF_NOT_NULL, DetectEngineThreadCtx_::file_id, File_::file_store_id, FileReassemblyDepth(), DetectEngineThreadCtx_::filestore, DetectEngineThreadCtx_::filestore_cnt, Signature_::filestore_ctx, FILESTORE_DIR_BOTH, FILESTORE_DIR_DEFAULT, FILESTORE_DIR_TOCLIENT, FILESTORE_DIR_TOSERVER, FILESTORE_SCOPE_DEFAULT, FILESTORE_SCOPE_SSN, FILESTORE_SCOPE_TX, FileStoreFileById(), flags, Signature_::flags, DetectEngineCtx_::flags, Packet_::flow, FLOW_PKT_TOCLIENT, Packet_::flowflags, m, MAX_SUBSTRINGS, Flow_::proto, Flow_::protoctx, res, SC_ERR_CONFLICTING_RULE_KEYWORDS, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_MATCH, SCEnter, SCFree, SCLogDebug, SCLogError, SCMalloc, DetectFilestoreData_::scope, SCReturnInt, SIG_FLAG_BYPASS, SIG_FLAG_FILESTORE, DetectEngineCtx_::sig_list, SigInit(), SigMatchAlloc(), SigMatchAppendSMToList(), str, STREAM_TOCLIENT, STREAM_TOSERVER, TcpSessionSetReassemblyDepth(), DetectEngineThreadCtx_::tx_id, SigMatch_::type, unlikely, and UtRegisterTest().

Here is the call graph for this function: