Go to the documentation of this file.
65 static void DetectHttpResponseLineRegisterTests(
void);
69 Flow *_f,
const uint8_t _flow_flags,
70 void *txv,
const int list_id);
71 static int g_http_response_line_id = 0;
95 "http response line");
126 Flow *_f,
const uint8_t _flow_flags,
127 void *txv,
const int list_id)
131 htp_tx_t *tx = (htp_tx_t *)txv;
132 if (
unlikely(tx->response_line == NULL)) {
135 const uint32_t data_len = bstr_len(tx->response_line);
136 const uint8_t *data = bstr_ptr(tx->response_line);
154 static int DetectHttpResponseLineTest01(
void)
161 "(http_response_line; content:\"200 OK\"; sid:1;)");
168 void DetectHttpResponseLineRegisterTests(
void)
170 UtRegisterTest(
"DetectHttpResponseLineTest01", DetectHttpResponseLineTest01);
int DetectSignatureSetAppProto(Signature *s, AppProto alproto)
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
#define SIGMATCH_INFO_STICKY_BUFFER
uint8_t DetectEngineInspectBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id)
main detection engine ctx
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
#define SIG_FLAG_TOCLIENT
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
InspectionBuffer * InspectionBufferGet(DetectEngineThreadCtx *det_ctx, const int list_id)
int DetectBufferTypeGetByName(const char *name)
#define PASS
Pass the test.
Signature * SigInit(DetectEngineCtx *de_ctx, const char *sigstr)
Parses a signature and adds it to the Detection Engine Context.
void DetectAppLayerInspectEngineRegister2(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr2 Callback2, InspectionBufferGetDataPtr GetData)
register inspect engine at start up time
Data structures and function prototypes for keeping state for the detection engine.
@ DETECT_AL_HTTP_RESPONSE_LINE
void DetectHttpResponseLineRegister(void)
Registers the keyword handlers for the "http_response_line" keyword.
void DetectAppLayerMpmRegister2(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register a MPM engine
void InspectionBufferApplyTransforms(InspectionBuffer *buffer, const DetectEngineTransforms *transforms)
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
void InspectionBufferSetup(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
DetectEngineCtx * DetectEngineCtxInit(void)
int DetectBufferSetActiveList(Signature *s, const int list)
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
void(* RegisterTests)(void)