suricata
detect-isdataat.c File Reference
#include "suricata-common.h"
#include "debug.h"
#include "decode.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-parse.h"
#include "app-layer.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "detect-isdataat.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#include "flow.h"
#include "flow-var.h"
#include "util-debug.h"
#include "util-byte.h"
#include "detect-pcre.h"
#include "detect-bytejump.h"
#include "detect-byte-extract.h"
Include dependency graph for detect-isdataat.c:

Go to the source code of this file.

Macros

#define PARSE_REGEX   "^\\s*!?([^\\s,]+)\\s*(,\\s*relative)?\\s*(,\\s*rawbytes\\s*)?\\s*$"
 Regex for parsing our isdataat options. More...
 
#define MAX_SUBSTRINGS   30
 

Functions

int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, const char *isdataatstr)
 This function is used to add the parsed isdataatdata into the current signature. More...
 
void DetectIsdataatRegisterTests (void)
 this function registers unit tests for DetectIsdataat More...
 
void DetectIsdataatFree (void *ptr)
 this function will free memory associated with DetectIsdataatData More...
 
void DetectIsdataatRegister (void)
 Registration function for isdataat: keyword. More...
 

Detailed Description

Author
Pablo Rincon pablo.nosp@m..rin.nosp@m.con.c.nosp@m.resp.nosp@m.o@gma.nosp@m.il.c.nosp@m.om

Implements isdataat keyword

Definition in file detect-isdataat.c.

Macro Definition Documentation

#define MAX_SUBSTRINGS   30

Referenced by DetectIsdataatRegister().

#define PARSE_REGEX   "^\\s*!?([^\\s,]+)\\s*(,\\s*relative)?\\s*(,\\s*rawbytes\\s*)?\\s*$"

Regex for parsing our isdataat options.

Definition at line 53 of file detect-isdataat.c.

Referenced by DetectIsdataatRegister().

Function Documentation

void DetectIsdataatRegisterTests ( void  )

this function registers unit tests for DetectIsdataat

Definition at line 671 of file detect-isdataat.c.

References DetectBufferTypeGetByName(), and UtRegisterTest().

Referenced by DetectIsdataatRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectIsdataatSetup ( DetectEngineCtx de_ctx,
Signature s,
const char *  isdataatstr 
)

This function is used to add the parsed isdataatdata into the current signature.

Parameters
de_ctxpointer to the Detection Engine Context
spointer to the Current Signature
isdataatstrpointer to the user provided isdataat options
Return values
0on Success
-1on Failure

Definition at line 206 of file detect-isdataat.c.

References SigMatch_::ctx, DetectIsdataatData_::dataat, DETECT_BYTE_EXTRACT, DETECT_BYTEJUMP, DETECT_BYTETEST, DETECT_CONTENT, DETECT_CONTENT_ENDS_WITH, DETECT_CONTENT_RELATIVE_NEXT, DETECT_ISDATAAT, DETECT_PCRE, DETECT_PCRE_RELATIVE_NEXT, DETECT_SM_LIST_NOTSET, DETECT_SM_LIST_PMATCH, DetectBufferGetActiveList(), DetectByteExtractRetrieveSMVar(), DetectGetLastSMFromLists(), DetectIsdataatFree(), DetectIsdataatData_::flags, DetectPcreData_::flags, DetectContentData_::flags, Signature_::init_data, ISDATAAT_NEGATED, ISDATAAT_OFFSET_BE, ISDATAAT_RELATIVE, SignatureInitData_::list, offset, SC_ERR_INVALID_SIGNATURE, SCFree, SCLogDebug, SCLogError, SigMatchAlloc(), SigMatchAppendSMToList(), SigMatchListSMBelongsTo(), and SigMatch_::type.

Referenced by DetectIsdataatFree(), and DetectIsdataatRegister().

Here is the call graph for this function:

Here is the caller graph for this function: