suricata
detect-flow.c File Reference
#include "suricata-common.h"
#include "debug.h"
#include "decode.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-prefilter-common.h"
#include "flow.h"
#include "flow-var.h"
#include "detect-flow.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-debug.h"
Include dependency graph for detect-flow.c:

Go to the source code of this file.

Macros

#define PARSE_REGEX   "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$"
 Regex for parsing our flow options. More...
 
#define MAX_SUBSTRINGS   30
 
#define SIG_FLAG_BOTH   (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)
 

Functions

int DetectFlowMatch (DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
 This function is used to match flow flags set on a packet with those passed via flow: More...
 
void DetectFlowRegisterTests (void)
 this function registers unit tests for DetectFlow More...
 
void DetectFlowFree (void *ptr)
 this function will free memory associated with DetectFlowData More...
 
void DetectFlowRegister (void)
 Registration function for flow: keyword. More...
 
int DetectFlowSetupImplicit (Signature *s, uint32_t flags)
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

FLOW part of the detection engine.

Definition in file detect-flow.c.

Macro Definition Documentation

#define MAX_SUBSTRINGS   30

Referenced by DetectFlowMatch().

#define PARSE_REGEX   "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$"

Regex for parsing our flow options.

Definition at line 47 of file detect-flow.c.

Referenced by DetectFlowRegister().

#define SIG_FLAG_BOTH   (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)

Referenced by DetectFlowSetupImplicit().

Function Documentation

int DetectFlowMatch ( DetectEngineThreadCtx det_ctx,
Packet p,
const Signature s,
const SigMatchCtx ctx 
)

This function is used to match flow flags set on a packet with those passed via flow:

Parameters
tpointer to thread vars
det_ctxpointer to the pattern matcher thread
ppointer to the current packet
mpointer to the sigmatch that we will cast into DetectFlowData
Return values
0no match
1match

Definition at line 136 of file detect-flow.c.

References DETECT_FLOW_FLAG_ESTABLISHED, DETECT_FLOW_FLAG_NO_FRAG, DETECT_FLOW_FLAG_NOSTREAM, DETECT_FLOW_FLAG_NOT_ESTABLISHED, DETECT_FLOW_FLAG_ONLY_FRAG, DETECT_FLOW_FLAG_ONLYSTREAM, DETECT_FLOW_FLAG_STATELESS, DETECT_FLOW_FLAG_TOCLIENT, DETECT_FLOW_FLAG_TOSERVER, DetectFlowFree(), DetectFlowData_::flags, Packet_::flags, DetectEngineThreadCtx_::flags, FLOW_PKT_ESTABLISHED, FLOW_PKT_TOCLIENT, FLOW_PKT_TOSERVER, Packet_::flowflags, DetectFlowData_::match_cnt, MAX_SUBSTRINGS, res, SC_ERR_FLAGS_MODIFIER, SC_ERR_INVALID_VALUE, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_MATCH, SCEnter, SCLogDebug, SCLogError, SCMalloc, SCReturnInt, and unlikely.

Referenced by DetectFlowRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectFlowRegisterTests ( void  )

this function registers unit tests for DetectFlow

Definition at line 1070 of file detect-flow.c.

References UtRegisterTest().

Referenced by DetectFlowRegister().

Here is the call graph for this function:

Here is the caller graph for this function: