suricata
detect-byte-extract.h
Go to the documentation of this file.
1
/* Copyright (C) 2007-2010 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \file
20
*
21
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
22
*/
23
24
#ifndef __DETECT_BYTEEXTRACT_H__
25
#define __DETECT_BYTEEXTRACT_H__
26
27
/* flags */
28
#define DETECT_BYTE_EXTRACT_FLAG_RELATIVE 0x01
29
#define DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER 0x02
30
#define DETECT_BYTE_EXTRACT_FLAG_STRING 0x04
31
#define DETECT_BYTE_EXTRACT_FLAG_ALIGN 0x08
32
#define DETECT_BYTE_EXTRACT_FLAG_ENDIAN 0x10
33
34
/* endian value to be used. Would be stored in DetectByteParseData->endian */
35
#define DETECT_BYTE_EXTRACT_ENDIAN_NONE 0
36
#define DETECT_BYTE_EXTRACT_ENDIAN_BIG 1
37
#define DETECT_BYTE_EXTRACT_ENDIAN_LITTLE 2
38
#define DETECT_BYTE_EXTRACT_ENDIAN_DCE 3
39
40
/**
41
* \brief Holds data related to byte_extract keyword.
42
*/
43
typedef
struct
DetectByteExtractData_
{
44
/* local id used by other keywords in the sig to reference this */
45
uint8_t
local_id
;
46
47
uint8_t
nbytes
;
48
int16_t
pad
;
49
int32_t
offset
;
50
const
char
*
name
;
51
uint8_t
flags
;
52
uint8_t
endian
;
53
uint8_t
base
;
54
uint8_t
align_value
;
55
56
uint16_t
multiplier_value
;
57
/* unique id used to reference this byte_extract keyword */
58
uint16_t
id
;
59
60
}
DetectByteExtractData
;
61
62
void
DetectByteExtractRegister
(
void
);
63
64
SigMatch
*
DetectByteExtractRetrieveSMVar
(
const
char
*,
const
Signature
*);
65
int
DetectByteExtractDoMatch
(
DetectEngineThreadCtx
*,
const
SigMatchData
*,
const
Signature
*,
66
const
uint8_t *, uint32_t, uint64_t *, uint8_t);
67
68
#endif
/* __DETECT_BYTEEXTRACT_H__ */
DetectByteExtractData_::local_id
uint8_t local_id
Definition:
detect-byte-extract.h:45
DetectByteExtractData_::id
uint16_t id
Definition:
detect-byte-extract.h:58
DetectByteExtractData_
Holds data related to byte_extract keyword.
Definition:
detect-byte-extract.h:43
DetectByteExtractData_::nbytes
uint8_t nbytes
Definition:
detect-byte-extract.h:47
SigMatchData_
Data needed for Match()
Definition:
detect.h:349
DetectEngineThreadCtx_
Definition:
detect.h:1074
DetectByteExtractData_::offset
int32_t offset
Definition:
detect-byte-extract.h:49
DetectByteExtractData_::align_value
uint8_t align_value
Definition:
detect-byte-extract.h:54
DetectByteExtractData_::endian
uint8_t endian
Definition:
detect-byte-extract.h:52
DetectByteExtractData_::pad
int16_t pad
Definition:
detect-byte-extract.h:48
DetectByteExtractData_::base
uint8_t base
Definition:
detect-byte-extract.h:53
DetectByteExtractData
struct DetectByteExtractData_ DetectByteExtractData
Holds data related to byte_extract keyword.
DetectByteExtractDoMatch
int DetectByteExtractDoMatch(DetectEngineThreadCtx *, const SigMatchData *, const Signature *, const uint8_t *, uint32_t, uint64_t *, uint8_t)
Definition:
detect-byte-extract.c:115
DetectByteExtractData_::name
const char * name
Definition:
detect-byte-extract.h:50
DetectByteExtractData_::multiplier_value
uint16_t multiplier_value
Definition:
detect-byte-extract.h:56
Signature_
Signature container.
Definition:
detect.h:581
SigMatch_
a single match condition for a signature
Definition:
detect.h:340
DetectByteExtractData_::flags
uint8_t flags
Definition:
detect-byte-extract.h:51
DetectByteExtractRetrieveSMVar
SigMatch * DetectByteExtractRetrieveSMVar(const char *, const Signature *)
Lookup the SigMatch for a named byte_extract variable.
Definition:
detect-byte-extract.c:668
DetectByteExtractRegister
void DetectByteExtractRegister(void)
Registers the keyword handlers for the "byte_extract" keyword.
Definition:
detect-byte-extract.c:101
src
detect-byte-extract.h
Generated on Fri Sep 22 2023 23:30:28 for suricata by
1.8.18