suricata
detect-flowint.c File Reference
#include "suricata-common.h"
#include "decode.h"
#include "detect.h"
#include "threads.h"
#include "flow.h"
#include "flow-var.h"
#include "detect-flowint.h"
#include "util-spm.h"
#include "util-var-name.h"
#include "util-debug.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-sigorder.h"
#include "pkt-var.h"
#include "host.h"
#include "util-profiling.h"
Include dependency graph for detect-flowint.c:

Go to the source code of this file.

Macros

#define PARSE_REGEX   "^\\s*([a-zA-Z][\\w\\d_./]+)\\s*,\\s*([+=-]{1}|==|!=|<|<=|>|>=|isset|notset)\\s*,?\\s*([a-zA-Z][\\w\\d]+|[\\d]{1,10})?\\s*$"
 
#define MAX_SUBSTRINGS   30
 

Functions

int DetectFlowintMatch (DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
 This function is used to create a flowint, add/substract values, compare it with other flowints, etc. More...
 
void DetectFlowintFree (void *tmp)
 This function is used to free the data of DetectFlowintData. More...
 
void DetectFlowintRegisterTests (void)
 this function registers unit tests for DetectFlowint More...
 
void DetectFlowintRegister (void)
 

Detailed Description

Author
Pablo Rincon pablo.nosp@m..rin.nosp@m.con.c.nosp@m.resp.nosp@m.o@gma.nosp@m.il.c.nosp@m.om

Flowvar management for integer types, part of the detection engine Keyword: flowint

Definition in file detect-flowint.c.

Macro Definition Documentation

#define MAX_SUBSTRINGS   30

Referenced by DetectFlowintMatch().

#define PARSE_REGEX   "^\\s*([a-zA-Z][\\w\\d_./]+)\\s*,\\s*([+=-]{1}|==|!=|<|<=|>|>=|isset|notset)\\s*,?\\s*([a-zA-Z][\\w\\d]+|[\\d]{1,10})?\\s*$"

Definition at line 50 of file detect-flowint.c.

Referenced by DetectFlowintRegister().

Function Documentation

int DetectFlowintMatch ( DetectEngineThreadCtx det_ctx,
Packet p,
const Signature s,
const SigMatchCtx ctx 
)

This function is used to create a flowint, add/substract values, compare it with other flowints, etc.

Parameters
tpointer to thread vars
det_ctxpointer to the pattern matcher thread
ppointer to the current packet
spointer to the current Signature
mpointer to the sigmatch that we will cast into DetectFlowintData
Return values
0no match, when a var doesn't exist
1match, when a var is initialized well, add/substracted, or a true condition

ATM If we are going to compare the current var with another that doesn't exist, the default value will be zero; if you don't want this behaviour, you can use the keyword "isset" to make it match or not before using the default value of zero; But it is mandatory that the current var exist, otherwise, it will return zero(not match).

Definition at line 89 of file detect-flowint.c.

References BUG_ON, SigMatch_::ctx, FlowVar_::data, FlowVar_::datatype, DETECT_FLOWINT, DETECT_SM_LIST_MATCH, DETECT_SM_LIST_POSTMATCH, DetectFlowintFree(), Packet_::flow, FLOWINT_MODIFIER_ADD, FLOWINT_MODIFIER_EQ, FLOWINT_MODIFIER_GE, FLOWINT_MODIFIER_GT, FLOWINT_MODIFIER_ISSET, FLOWINT_MODIFIER_LE, FLOWINT_MODIFIER_LT, FLOWINT_MODIFIER_NE, FLOWINT_MODIFIER_NOTSET, FLOWINT_MODIFIER_SET, FLOWINT_MODIFIER_SUB, FLOWINT_MODIFIER_UNKNOWN, FLOWINT_TARGET_SELF, FLOWINT_TARGET_VAL, FLOWINT_TARGET_VAR, FLOWVAR_TYPE_INT, FlowVarAddIntNoLock(), FlowVarGet(), FlowVar_::fv_int, DetectFlowintData_::idx, MAX_SUBSTRINGS, DetectFlowintData_::modifier, TargetVar_::name, DetectFlowintData_::name, res, SC_ERR_MEM_ALLOC, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_MATCH, SC_ERR_UNKNOWN_VALUE, SCFree, SCLogDebug, SCLogError, SCMalloc, SCStrdup, SigMatchAlloc(), SigMatchAppendSMToList(), DetectFlowintData_::target, DetectFlowintData_::targettype, DetectFlowintData_::tvar, SigMatch_::type, unlikely, FlowVarTypeInt_::value, DetectFlowintData_::value, VAR_TYPE_FLOW_INT, VarNameStoreLookupByName(), and VarNameStoreSetupAdd().

Referenced by DetectFlowintRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectFlowintRegister ( void  )
void DetectFlowintRegisterTests ( void  )

this function registers unit tests for DetectFlowint

Definition at line 1311 of file detect-flowint.c.

References UtRegisterTest().

Referenced by DetectFlowintRegister().

Here is the call graph for this function:

Here is the caller graph for this function: