suricata
detect-tcp-session.c File Reference
#include "suricata-common.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-parse.h"
#include "flow.h"
#include "stream-tcp.h"
#include "stream-tcp-private.h"
#include "util-debug.h"
#include "util-unittest.h"
#include "detect-tcp-session.h"
#include "util-unittest-helper.h"
#include "detect-flow.h"
Include dependency graph for detect-tcp-session.c:

Go to the source code of this file.

Macros

#define DETECT_TCP_SESSION_ARG_MAX_LEN   32
 

Functions

void DetectTcpSessionRegister (void)
 
int DetectFlowMatch (DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
 This function is used to match flow flags set on a packet with those passed via flow: More...
 

Macro Definition Documentation

◆ DETECT_TCP_SESSION_ARG_MAX_LEN

#define DETECT_TCP_SESSION_ARG_MAX_LEN   32

Upper bound on the total length of the keyword argument.

Definition at line 37 of file detect-tcp-session.c.

Function Documentation

◆ DetectFlowMatch()

int DetectFlowMatch ( DetectEngineThreadCtx det_ctx,
Packet p,
const Signature s,
const SigMatchCtx ctx 
)

This function is used to match flow flags set on a packet with those passed via flow:

Parameters
tpointer to thread vars
det_ctxpointer to the pattern matcher thread
ppointer to the current packet
mpointer to the sigmatch that we will cast into DetectFlowData
Return values
0no match
1match

Definition at line 134 of file detect-flow.c.

References ctx, FLOW_PKT_ESTABLISHED, FLOW_PKT_TOCLIENT, FLOW_PKT_TOSERVER, Packet_::flowflags, p, SCEnter, and SCLogDebug.

Referenced by DetectFlowRegister().

Here is the caller graph for this function:

◆ DetectTcpSessionRegister()

void DetectTcpSessionRegister ( void  )

Registration function for the tcp.session: keyword.

Definition at line 223 of file detect-tcp-session.c.

References SigTableElmt_::desc, DETECT_TCP_SESSION, SigTableElmt_::Match, SigTableElmt_::name, sigmatch_table, and SigTableElmt_::url.

Referenced by SigTableSetup().

Here is the caller graph for this function: