suricata
detect-fragbits.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "decode.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-prefilter-common.h"
#include "flow-var.h"
#include "decode-events.h"
#include "app-layer.h"
#include "app-layer-detect-proto.h"
#include "detect-fragbits.h"
#include "util-unittest.h"
#include "util-debug.h"
#include "pkt-var.h"
#include "host.h"
#include "util-profiling.h"
Include dependency graph for detect-fragbits.c:

Go to the source code of this file.

Macros

#define PARSE_REGEX   "^(?:([\\+\\*!]))?\\s*([MDR]+)"
 
#define MODIFIER_NOT   1
 
#define MODIFIER_PLUS   2
 
#define MODIFIER_ANY   3
 
#define FRAGBITS_HAVE_MF   0x01
 
#define FRAGBITS_HAVE_DF   0x02
 
#define FRAGBITS_HAVE_RF   0x04
 
#define MAX_SUBSTRINGS   30
 

Functions

void DetectFragBitsRegister (void)
 Registration function for fragbits: keyword. More...
 
void FragBitsRegisterTests (void)
 this function registers unit tests for FragBits More...
 

Detailed Description

Author
Breno Silva breno.nosp@m..sil.nosp@m.va@gm.nosp@m.ail..nosp@m.com
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Implements fragbits keyword

Definition in file detect-fragbits.c.

Macro Definition Documentation

#define FRAGBITS_HAVE_DF   0x02

Definition at line 65 of file detect-fragbits.c.

Referenced by DetectFragBitsRegister().

#define FRAGBITS_HAVE_MF   0x01

Definition at line 64 of file detect-fragbits.c.

Referenced by DetectFragBitsRegister().

#define FRAGBITS_HAVE_RF   0x04

Definition at line 66 of file detect-fragbits.c.

Referenced by DetectFragBitsRegister().

#define MAX_SUBSTRINGS   30

Referenced by DetectFragBitsRegister().

#define MODIFIER_ANY   3

Definition at line 62 of file detect-fragbits.c.

Referenced by DetectFragBitsRegister().

#define MODIFIER_NOT   1

FragBits args[0] *(3) +(2) !(1)

Definition at line 60 of file detect-fragbits.c.

Referenced by DetectFragBitsRegister().

#define MODIFIER_PLUS   2

Definition at line 61 of file detect-fragbits.c.

Referenced by DetectFragBitsRegister().

#define PARSE_REGEX   "^(?:([\\+\\*!]))?\\s*([MDR]+)"

Regex fragbits: [!+*](MDR)

Definition at line 53 of file detect-fragbits.c.

Referenced by DetectFragBitsRegister().

Function Documentation

void DetectFragBitsRegister ( void  )

Registration function for fragbits: keyword.

Registration function for fragbits: keyword

Definition at line 83 of file detect-fragbits.c.

References DecodeThreadVars_::app_tctx, AppLayerGetCtxThread(), SigMatch_::ctx, de, DecodeEthernet(), SigTableElmt_::desc, DETECT_FRAGBITS, DETECT_SM_LIST_MATCH, DetectSetupParseRegexes(), DOC_URL, DOC_VERSION, FAIL_IF, FALSE, Signature_::flags, FLOW_QUIET, FlowInitConfig(), FlowShutdown(), DetectFragBitsData_::fragbits, FRAGBITS_HAVE_DF, FRAGBITS_HAVE_MF, FRAGBITS_HAVE_RF, FragBitsRegisterTests(), SigTableElmt_::Free, Signature_::init_data, Packet_::ip4h, IPV4_GET_DF, IPV4_GET_MF, IPV4_GET_RF, SigTableElmt_::Match, MAX_SUBSTRINGS, DetectFragBitsData_::modifier, MODIFIER_ANY, MODIFIER_NOT, MODIFIER_PLUS, SigTableElmt_::name, SigMatch_::next, PACKET_RECYCLE, PARSE_REGEX, PASS, PKT_IS_IPV4, PKT_IS_PSEUDOPKT, DetectEngineThreadCtx_::pmq, PrefilterSetupPacketHeader(), SigTableElmt_::RegisterTests, res, SC_ERR_INVALID_VALUE, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_MATCH, SCFree, SCLogError, SCMalloc, SigTableElmt_::Setup, SigTableElmt_::SetupPrefilter, SIG_FLAG_REQUIRE_PACKET, sigmatch_table, SigMatchAlloc(), SigMatchAppendSMToList(), PrefilterPacketHeaderCtx_::sigs_array, PrefilterPacketHeaderCtx_::sigs_cnt, SIZE_OF_PACKET, SignatureInitData_::smlists, SigTableElmt_::SupportsPrefilter, TRUE, SigMatch_::type, PrefilterPacketHeaderValue::u8, unlikely, SigTableElmt_::url, and PrefilterPacketHeaderCtx_::v1.

Referenced by SigTableSetup().

Here is the call graph for this function:

Here is the caller graph for this function:

void FragBitsRegisterTests ( void  )

this function registers unit tests for FragBits

This function registers unit tests for FragBits

Definition at line 603 of file detect-fragbits.c.

References UtRegisterTest().

Referenced by DetectFragBitsRegister().

Here is the call graph for this function:

Here is the caller graph for this function: