suricata
detect-flowbits.c File Reference
#include "suricata-common.h"
#include "decode.h"
#include "detect.h"
#include "threads.h"
#include "flow.h"
#include "flow-bit.h"
#include "flow-util.h"
#include "detect-flowbits.h"
#include "util-spm.h"
#include "app-layer-parser.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "util-var-name.h"
#include "util-unittest.h"
#include "util-debug.h"
Include dependency graph for detect-flowbits.c:

Go to the source code of this file.

Data Structures

struct  FBAnalyze
 

Macros

#define PARSE_REGEX   "^([a-z]+)(?:,\\s*(.*))?"
 
#define MAX_SIDS   8
 

Functions

int DetectFlowbitMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
 
void DetectFlowbitFree (void *)
 
void FlowBitsRegisterTests (void)
 this function registers unit tests for FlowBits More...
 
void DetectFlowbitsRegister (void)
 
void DetectFlowbitsAnalyze (DetectEngineCtx *de_ctx)
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t
Breno Silva breno.nosp@m..sil.nosp@m.va@gm.nosp@m.ail..nosp@m.com

Implements the flowbits keyword

Definition in file detect-flowbits.c.

Macro Definition Documentation

#define MAX_SIDS   8

Referenced by DetectFlowbitsAnalyze().

#define PARSE_REGEX   "^([a-z]+)(?:,\\s*(.*))?"

Definition at line 48 of file detect-flowbits.c.

Referenced by DetectFlowbitsRegister().

Function Documentation

void DetectFlowbitFree ( void *  ptr)

Definition at line 297 of file detect-flowbits.c.

References SCFree.

Referenced by DetectFlowbitsRegister().

Here is the caller graph for this function:

void DetectFlowbitsAnalyze ( DetectEngineCtx de_ctx)

Definition at line 338 of file detect-flowbits.c.

References BUG_ON, DetectFlowbitsData_::cmd, FBAnalyze::cnts, ConfigGetLogDirectory(), DE_QUIET, DETECT_FLOWBITS, DETECT_FLOWBITS_CMD_ISNOTSET, DETECT_FLOWBITS_CMD_ISSET, DETECT_FLOWBITS_CMD_SET, DETECT_FLOWBITS_CMD_TOGGLE, DETECT_FLOWBITS_CMD_UNSET, DETECT_SM_LIST_DYNAMIC_START, DETECT_SM_LIST_MATCH, DETECT_SM_LIST_POSTMATCH, DetectEngineCtxFree(), DetectEngineCtxInit(), DetectEngineThreadCtxDeinit(), DetectEngineThreadCtxInit(), Packet_::dst, FAIL_IF, FAIL_IF_NOT, FAIL_IF_NOT_NULL, FAIL_IF_NULL, Address_::family, Packet_::flags, Signature_::flags, DetectEngineCtx_::flags, Packet_::flow, FLOW_DESTROY, FLOW_INITIALIZE, FLOW_PKT_TOSERVER, Packet_::flowflags, Flow_::flowvar, Signature_::id, DetectFlowbitsData_::idx, GenericVar_::idx, Signature_::init_data, SignatureInitData_::init_flags, FBAnalyze::isnotset_sids, FBAnalyze::isnotset_sids_idx, FBAnalyze::isnotset_sids_size, FBAnalyze::isset_sids, FBAnalyze::isset_sids_idx, FBAnalyze::isset_sids_size, MAX, DetectEngineCtx_::max_fb_id, MAX_SIDS, MemBufferCreateNew(), MemBufferFree(), MemBufferPrintToFPAsString, MemBufferWriteString, GenericVar_::next, SigMatch_::next, Signature_::next, Signature_::num, PASS, Packet_::payload, Packet_::payload_len, PKT_HAS_FLOW, Packet_::proto, SC_ERR_SOCKET, SC_WARN_FLOWBIT, SCFree, SCLogDebug, SCLogWarning, SCMalloc, SCMutex, SCMUTEX_INITIALIZER, SCMutexLock, SCMutexUnlock, SCRealloc, FBAnalyze::set_sids, FBAnalyze::set_sids_idx, FBAnalyze::set_sids_size, DetectEngineCtx_::sig_array, DetectEngineCtx_::sig_array_len, SIG_FLAG_INIT_STATE_MATCH, SIG_FLAG_NOALERT, DetectEngineCtx_::sig_list, SigGroupBuild(), SigInit(), SigMatchSignatures(), SIZE_OF_PACKET, SignatureInitData_::smlists, SignatureInitData_::smlists_array_size, Packet_::src, FBAnalyze::state_cnts, FBAnalyze::toggle_sids, FBAnalyze::toggle_sids_idx, FBAnalyze::toggle_sids_size, GenericVar_::type, unlikely, FBAnalyze::unset_sids, FBAnalyze::unset_sids_idx, FBAnalyze::unset_sids_size, VAR_TYPE_FLOW_BIT, VarNameStoreSetupAdd(), and VarNameStoreSetupLookup().

Referenced by SigAddressPrepareStage1().

Here is the call graph for this function:

Here is the caller graph for this function:

void FlowBitsRegisterTests ( void  )

this function registers unit tests for FlowBits

Definition at line 1092 of file detect-flowbits.c.

References UtRegisterTest().

Referenced by DetectFlowbitsRegister().

Here is the call graph for this function:

Here is the caller graph for this function: