44 #define PARSE_REGEX "(.*),(.*)" 45 static pcre *parse_regex;
46 static pcre_extra *parse_regex_study;
53 static void DetectFlowvarDataFree(
void *ptr);
78 static void DetectFlowvarDataFree(
void *ptr)
121 char *varname = NULL, *varcontent = NULL;
122 #define MAX_SUBSTRINGS 30 123 int ret = 0,
res = 0;
126 uint8_t *content = NULL;
127 uint16_t contentlen = 0;
130 ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov,
MAX_SUBSTRINGS);
141 varname = (
char *)str_ptr;
148 varcontent = (
char *)str_ptr;
150 if (strlen(varcontent) >= 2) {
151 if (varcontent[0] ==
'"')
153 if (varcontent[strlen(varcontent)-1] ==
'"')
154 varcontent[strlen(varcontent)-1] =
'\0';
165 memset(fd, 0x00,
sizeof(*fd));
171 memcpy(fd->
content, content, contentlen);
173 fd->
flags = contentflags;
196 DetectFlowvarDataFree(fd);
206 uint8_t *key, uint16_t key_len,
207 uint8_t *buffer, uint16_t
len,
int type)
227 uint8_t *buffer, uint16_t
len,
int type)
232 for ( ; fs != NULL; fs = fs->
next) {
233 if (fs->
idx == idx) {
269 memset(fv, 0x00,
sizeof(*fv));
285 DetectFlowvarDataFree(fv);
294 static int DetectFlowvarPostMatch(
309 if (fd->
idx == 0 || fd->
idx == fs->
idx) {
367 }
while (fs != NULL);
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
SignatureInitData * init_data
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
struct HtpBodyChunk_ * next
int DetectFlowvarPostMatchSetup(Signature *s, uint32_t idx)
Setup a post-match for flowvar storage We're piggyback riding the DetectFlowvarData struct...
int DetectContentDataParse(const char *keyword, const char *contentstr, uint8_t **pstr, uint16_t *plen)
Parse a content string, ie "abc|DE|fgh".
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
main detection engine ctx
int DetectFlowvarMatch(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
struct DetectVarList_ * next
void DetectVarProcessListInternal(DetectVarList *fs, Flow *f, Packet *p)
Handle flowvar candidate list in det_ctx: clean up the list.
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
int PktVarAdd(Packet *p, uint32_t id, uint8_t *value, uint16_t size)
add a key-value pktvar to the pkt
void DetectSetupParseRegexes(const char *parse_str, pcre **parse_regex, pcre_extra **parse_regex_study)
union FlowVar_::@117 data
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
int DetectVarStoreMatch(DetectEngineThreadCtx *det_ctx, uint32_t idx, uint8_t *buffer, uint16_t len, int type)
Store flowvar in det_ctx so we can exec it post-match.
FlowVar * FlowVarGet(Flow *f, uint32_t idx)
get the flowvar with index 'idx' from the flow
#define DETECT_CONTENT_NEGATED
uint32_t VarNameStoreSetupAdd(const char *name, const enum VarTypes type)
add to staging or return existing id if already in there
void FlowVarAddIdValue(Flow *f, uint32_t idx, uint8_t *value, uint16_t size)
int PktVarAddKeyValue(Packet *p, uint8_t *key, uint16_t ksize, uint8_t *value, uint16_t size)
add a key-value pktvar to the pkt
#define DETECT_VAR_TYPE_FLOW_POSTMATCH
SigMatch * SigMatchAlloc(void)
#define SpmSearch(text, textlen, needle, needlelen)
#define DETECT_VAR_TYPE_PKT_POSTMATCH
int DetectVarStoreMatchKeyValue(DetectEngineThreadCtx *det_ctx, uint8_t *key, uint16_t key_len, uint8_t *buffer, uint16_t len, int type)
Store flowvar in det_ctx so we can exec it post-match.
void(* RegisterTests)(void)
a single match condition for a signature
void DetectFlowvarRegister(void)