suricata
|
Go to the source code of this file.
Data Structures | |
struct | DetectByteExtractData_ |
Holds data related to byte_extract keyword. More... | |
Macros | |
#define | DETECT_BYTE_EXTRACT_FLAG_RELATIVE 0x01 |
#define | DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER 0x02 |
#define | DETECT_BYTE_EXTRACT_FLAG_STRING 0x04 |
#define | DETECT_BYTE_EXTRACT_FLAG_ALIGN 0x08 |
#define | DETECT_BYTE_EXTRACT_FLAG_ENDIAN 0x10 |
#define | DETECT_BYTE_EXTRACT_ENDIAN_NONE 0 |
#define | DETECT_BYTE_EXTRACT_ENDIAN_BIG 1 |
#define | DETECT_BYTE_EXTRACT_ENDIAN_LITTLE 2 |
#define | DETECT_BYTE_EXTRACT_ENDIAN_DCE 3 |
Typedefs | |
typedef struct DetectByteExtractData_ | DetectByteExtractData |
Holds data related to byte_extract keyword. More... | |
Functions | |
void | DetectByteExtractRegister (void) |
Registers the keyword handlers for the "byte_extract" keyword. More... | |
SigMatch * | DetectByteExtractRetrieveSMVar (const char *, const Signature *) |
Lookup the SigMatch for a named byte_extract variable. More... | |
int | DetectByteExtractDoMatch (DetectEngineThreadCtx *, const SigMatchData *, const Signature *, const uint8_t *, uint32_t, uint64_t *, uint8_t) |
Definition in file detect-byte-extract.h.
#define DETECT_BYTE_EXTRACT_ENDIAN_BIG 1 |
Definition at line 37 of file detect-byte-extract.h.
#define DETECT_BYTE_EXTRACT_ENDIAN_DCE 3 |
Definition at line 39 of file detect-byte-extract.h.
#define DETECT_BYTE_EXTRACT_ENDIAN_LITTLE 2 |
Definition at line 38 of file detect-byte-extract.h.
#define DETECT_BYTE_EXTRACT_ENDIAN_NONE 0 |
Definition at line 36 of file detect-byte-extract.h.
#define DETECT_BYTE_EXTRACT_FLAG_ALIGN 0x08 |
Definition at line 32 of file detect-byte-extract.h.
#define DETECT_BYTE_EXTRACT_FLAG_ENDIAN 0x10 |
Definition at line 33 of file detect-byte-extract.h.
#define DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER 0x02 |
Definition at line 30 of file detect-byte-extract.h.
#define DETECT_BYTE_EXTRACT_FLAG_RELATIVE 0x01 |
Definition at line 29 of file detect-byte-extract.h.
#define DETECT_BYTE_EXTRACT_FLAG_STRING 0x04 |
Definition at line 31 of file detect-byte-extract.h.
typedef struct DetectByteExtractData_ DetectByteExtractData |
Holds data related to byte_extract keyword.
int DetectByteExtractDoMatch | ( | DetectEngineThreadCtx * | , |
const SigMatchData * | , | ||
const Signature * | , | ||
const uint8_t * | , | ||
uint32_t | , | ||
uint64_t * | , | ||
uint8_t | |||
) |
Definition at line 115 of file detect-byte-extract.c.
References DetectByteExtractData_::align_value, DetectByteExtractData_::base, DetectEngineThreadCtx_::buffer_offset, BYTE_BIG_ENDIAN, BYTE_LITTLE_ENDIAN, ByteExtractStringUint64(), ByteExtractUint64(), SigMatchData_::ctx, DETECT_BYTE_EXTRACT_ENDIAN_BIG, DETECT_BYTE_EXTRACT_FLAG_ALIGN, DETECT_BYTE_EXTRACT_FLAG_RELATIVE, DETECT_BYTE_EXTRACT_FLAG_STRING, DetectByteExtractData_::flags, len, DetectByteExtractData_::multiplier_value, DetectByteExtractData_::nbytes, DetectByteExtractData_::offset, payload_len, and SCLogDebug.
void DetectByteExtractRegister | ( | void | ) |
Registers the keyword handlers for the "byte_extract" keyword.
Definition at line 101 of file detect-byte-extract.c.
References SigTableElmt_::desc, DETECT_BYTE_EXTRACT, SigTableElmt_::Match, SigTableElmt_::name, SigTableElmt_::Setup, sigmatch_table, and SigTableElmt_::url.
Referenced by SigTableSetup().
Lookup the SigMatch for a named byte_extract variable.
arg | The name of the byte_extract variable to lookup. |
s | Pointer the signature to look in. |
A | pointer to the SigMatch if found, otherwise NULL. |
Definition at line 668 of file detect-byte-extract.c.
References SignatureInitData_::buffer_index, SignatureInitData_::buffers, SigMatch_::ctx, DETECT_BYTE_EXTRACT, SignatureInitDataBuffer_::head, Signature_::init_data, DetectByteExtractData_::name, SigMatch_::next, and SigMatch_::type.
Referenced by DetectByteRetrieveSMVar().