suricata
detect-flowbits.c File Reference
#include "suricata-common.h"
#include "decode.h"
#include "detect.h"
#include "threads.h"
#include "flow.h"
#include "flow-bit.h"
#include "flow-util.h"
#include "detect-flowbits.h"
#include "util-spm.h"
#include "app-layer-parser.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "detect-engine-build.h"
#include "util-var-name.h"
#include "util-unittest.h"
#include "util-debug.h"
#include "util-conf.h"
Include dependency graph for detect-flowbits.c:

Go to the source code of this file.

Data Structures

struct  FBAnalyze
 

Macros

#define PARSE_REGEX   "^([a-z]+)(?:,\\s*(.*))?"
 
#define MAX_TOKENS   100
 
#define MAX_SIDS   8
 

Functions

int DetectFlowbitMatch (DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
 
void DetectFlowbitFree (DetectEngineCtx *, void *)
 
void FlowBitsRegisterTests (void)
 this function registers unit tests for FlowBits More...
 
void DetectFlowbitsRegister (void)
 
int DetectFlowbitsAnalyze (DetectEngineCtx *de_ctx)
 

Variables

bool rule_engine_analysis_set
 
SCMutex g_flowbits_dump_write_m = SCMUTEX_INITIALIZER
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t
Breno Silva breno.nosp@m..sil.nosp@m.va@gm.nosp@m.ail..nosp@m.com

Implements the flowbits keyword

Definition in file detect-flowbits.c.

Macro Definition Documentation

◆ MAX_SIDS

#define MAX_SIDS   8

◆ MAX_TOKENS

#define MAX_TOKENS   100

Definition at line 54 of file detect-flowbits.c.

◆ PARSE_REGEX

#define PARSE_REGEX   "^([a-z]+)(?:,\\s*(.*))?"

Definition at line 51 of file detect-flowbits.c.

Function Documentation

◆ DetectFlowbitFree()

void DetectFlowbitFree ( DetectEngineCtx de_ctx,
void *  ptr 
)

◆ DetectFlowbitMatch()

int DetectFlowbitMatch ( DetectEngineThreadCtx det_ctx,
Packet p,
const Signature s,
const SigMatchCtx ctx 
)

Definition at line 196 of file detect-flowbits.c.

References DetectFlowbitsData_::cmd, and DETECT_FLOWBITS_CMD_ISSET.

Referenced by DetectFlowbitsRegister().

Here is the caller graph for this function:

◆ DetectFlowbitsAnalyze()

◆ DetectFlowbitsRegister()

void DetectFlowbitsRegister ( void  )

Definition at line 64 of file detect-flowbits.c.

References SigTableElmt_::desc, DETECT_FLOWBITS, DetectFlowbitMatch(), SigTableElmt_::Match, SigTableElmt_::name, SigTableElmt_::Setup, sigmatch_table, and SigTableElmt_::url.

Referenced by SigTableSetup().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ FlowBitsRegisterTests()

void FlowBitsRegisterTests ( void  )

this function registers unit tests for FlowBits

Definition at line 1164 of file detect-flowbits.c.

References UtRegisterTest().

Here is the call graph for this function:

Variable Documentation

◆ g_flowbits_dump_write_m

SCMutex g_flowbits_dump_write_m = SCMUTEX_INITIALIZER

Definition at line 655 of file detect-flowbits.c.

◆ rule_engine_analysis_set

bool rule_engine_analysis_set

Definition at line 56 of file detect-engine-loader.c.

Referenced by DetectFlowbitsAnalyze().