detect-ttl.c File Reference

#include "suricata-common.h"
#include "stream-tcp.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine-prefilter-common.h"
#include "detect-ttl.h"
#include "util-debug.h"
#include "tests/detect-ttl.c"

Include dependency graph for detect-ttl.c:

Go to the source code of this file.

Macros
#define	PARSE_REGEX   "^\\s*([0-9]*)?\\s*([<>=-]+)?\\s*([0-9]+)?\\s*$"
	Regex for parsing our ttl options. More...
#define	MAX_SUBSTRINGS   30

Functions
void	DetectTtlFree (void *ptr)
	this function will free memory associated with DetectTtlData More...
void	DetectTtlRegisterTests (void)
	this function registers unit tests for DetectTtl More...
void	DetectTtlRegister (void)
	Registration function for ttl: keyword. More...

Detailed Description

Author

Gurvinder Singh gurvi.nosp@m.nder.nosp@m.sighd.nosp@m.ahiy.nosp@m.a@gma.nosp@m.il.c.nosp@m.om

Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Implements the ttl keyword including prefilter support.

Definition in file detect-ttl.c.

Macro Definition Documentation

#define MAX_SUBSTRINGS   30

Referenced by DetectTtlRegister().

#define PARSE_REGEX   "^\\s*([0-9]*)?\\s*([<>=-]+)?\\s*([0-9]+)?\\s*$"

Regex for parsing our ttl options.

Definition at line 40 of file detect-ttl.c.

Referenced by DetectTtlRegister().

Function Documentation

void DetectTtlFree

(

void *

ptr

)

this function will free memory associated with DetectTtlData

Parameters

ptr	pointer to DetectTtlData

Definition at line 289 of file detect-ttl.c.

References DETECT_SM_LIST_MATCH, DETECT_TTL, FALSE, Signature_::init_data, IPV4_GET_IPTTL, IPV6_GET_HLIM, DetectTtlData_::mode, SigMatch_::next, PKT_IS_IPV4, PKT_IS_IPV6, PKT_IS_PSEUDOPKT, DetectEngineThreadCtx_::pmq, PrefilterSetupPacketHeader(), SCFree, SCLogDebug, SCReturn, PrefilterPacketHeaderCtx_::sigs_array, PrefilterPacketHeaderCtx_::sigs_cnt, SignatureInitData_::smlists, TRUE, DetectTtlData_::ttl1, DetectTtlData_::ttl2, SigMatch_::type, PrefilterPacketHeaderValue::u8, and PrefilterPacketHeaderCtx_::v1.

Referenced by DetectTtlRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectTtlRegister

(

void

)

Registration function for ttl: keyword.

Definition at line 60 of file detect-ttl.c.

References SigMatch_::ctx, SigTableElmt_::desc, DETECT_SM_LIST_MATCH, DETECT_TTL, DETECT_TTL_EQ, DETECT_TTL_GT, DETECT_TTL_LT, DETECT_TTL_RA, DetectSetupParseRegexes(), DetectTtlFree(), DetectTtlRegisterTests(), DOC_URL, DOC_VERSION, Signature_::flags, SigTableElmt_::Free, IPV4_GET_IPTTL, IPV6_GET_HLIM, SigTableElmt_::Match, MAX_SUBSTRINGS, DetectTtlData_::mode, SigTableElmt_::name, PARSE_REGEX, PKT_IS_IPV4, PKT_IS_IPV6, PKT_IS_PSEUDOPKT, SigTableElmt_::RegisterTests, res, SC_ERR_INVALID_SIGNATURE, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_MATCH, SCLogDebug, SCLogError, SCMalloc, SigTableElmt_::Setup, SigTableElmt_::SetupPrefilter, SIG_FLAG_REQUIRE_PACKET, sigmatch_table, SigMatchAlloc(), SigMatchAppendSMToList(), SigTableElmt_::SupportsPrefilter, DetectTtlData_::ttl1, DetectTtlData_::ttl2, SigMatch_::type, unlikely, and SigTableElmt_::url.

Referenced by SigTableSetup().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectTtlRegisterTests

(

void

)

this function registers unit tests for DetectTtl

Definition at line 209 of file detect-ttl.c.

References UtRegisterTest().

Referenced by DetectTtlRegister().

Here is the call graph for this function:

Here is the caller graph for this function: