suricata
detect-flowvar.c File Reference
#include "suricata-common.h"
#include "decode.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-content.h"
#include "threads.h"
#include "flow.h"
#include "flow-var.h"
#include "pkt-var.h"
#include "detect-flowvar.h"
#include "util-spm.h"
#include "util-var-name.h"
#include "util-debug.h"
#include "util-print.h"
Include dependency graph for detect-flowvar.c:

Go to the source code of this file.

Macros

#define PARSE_REGEX   "(.*),(.*)"
 
#define MAX_SUBSTRINGS   30
 

Functions

int DetectFlowvarMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
 
void DetectFlowvarRegister (void)
 
int DetectVarStoreMatchKeyValue (DetectEngineThreadCtx *det_ctx, uint8_t *key, uint16_t key_len, uint8_t *buffer, uint16_t len, int type)
 Store flowvar in det_ctx so we can exec it post-match. More...
 
int DetectVarStoreMatch (DetectEngineThreadCtx *det_ctx, uint32_t idx, uint8_t *buffer, uint16_t len, int type)
 Store flowvar in det_ctx so we can exec it post-match. More...
 
int DetectFlowvarPostMatchSetup (Signature *s, uint32_t idx)
 Setup a post-match for flowvar storage We're piggyback riding the DetectFlowvarData struct. More...
 
void DetectVarProcessListInternal (DetectVarList *fs, Flow *f, Packet *p)
 Handle flowvar candidate list in det_ctx: clean up the list. More...
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Simple flowvar content match part of the detection engine.

Definition in file detect-flowvar.c.

Macro Definition Documentation

#define MAX_SUBSTRINGS   30

Referenced by DetectFlowvarMatch().

#define PARSE_REGEX   "(.*),(.*)"

Definition at line 44 of file detect-flowvar.c.

Referenced by DetectFlowvarRegister().

Function Documentation

int DetectFlowvarPostMatchSetup ( Signature s,
uint32_t  idx 
)
void DetectFlowvarRegister ( void  )
void DetectVarProcessListInternal ( DetectVarList fs,
Flow f,
Packet p 
)

Handle flowvar candidate list in det_ctx: clean up the list.

Only called from DetectVarProcessList() when varlist is not NULL.

Definition at line 354 of file detect-flowvar.c.

References DetectVarList_::buffer, DetectVarList_::key, next, DetectVarList_::next, and SCFree.

int DetectVarStoreMatch ( DetectEngineThreadCtx det_ctx,
uint32_t  idx,
uint8_t *  buffer,
uint16_t  len,
int  type 
)

Store flowvar in det_ctx so we can exec it post-match.

Definition at line 225 of file detect-flowvar.c.

References DetectVarList_::buffer, DetectVarList_::idx, DetectVarList_::len, len, DetectVarList_::next, SCCalloc, SCFree, DetectVarList_::type, type, unlikely, and DetectEngineThreadCtx_::varlist.

Referenced by DetectPcrePayloadMatch().

Here is the caller graph for this function:

int DetectVarStoreMatchKeyValue ( DetectEngineThreadCtx det_ctx,
uint8_t *  key,
uint16_t  key_len,
uint8_t *  buffer,
uint16_t  len,
int  type 
)

Store flowvar in det_ctx so we can exec it post-match.

Definition at line 205 of file detect-flowvar.c.

References DetectVarList_::buffer, DetectVarList_::key, DetectVarList_::key_len, DetectVarList_::len, len, DetectVarList_::next, SCCalloc, DetectVarList_::type, type, unlikely, and DetectEngineThreadCtx_::varlist.

Referenced by DetectPcrePayloadMatch().

Here is the caller graph for this function: