suricata
detect-bytejump.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  DetectBytejumpData_
 

Macros

#define DETECT_BYTEJUMP_BASE_UNSET   0
 
#define DETECT_BYTEJUMP_BASE_OCT   8
 
#define DETECT_BYTEJUMP_BASE_DEC   10
 
#define DETECT_BYTEJUMP_BASE_HEX   16
 
#define DETECT_BYTEJUMP_BEGIN   0x01
 
#define DETECT_BYTEJUMP_LITTLE   0x02
 
#define DETECT_BYTEJUMP_BIG   0x04
 
#define DETECT_BYTEJUMP_STRING   0x08
 
#define DETECT_BYTEJUMP_RELATIVE   0x10
 
#define DETECT_BYTEJUMP_ALIGN   0x20
 
#define DETECT_BYTEJUMP_DCE   0x40
 
#define DETECT_BYTEJUMP_OFFSET_BE   0x80
 

Typedefs

typedef struct DetectBytejumpData_ DetectBytejumpData
 

Functions

void DetectBytejumpRegister (void)
 
int DetectBytejumpDoMatch (DetectEngineThreadCtx *, const Signature *, const SigMatchCtx *, uint8_t *, uint32_t, uint8_t, int32_t)
 Byte jump match function. More...
 

Detailed Description

Author
Brian Rectanus brect.nosp@m.anu@.nosp@m.gmail.nosp@m..com

Definition in file detect-bytejump.h.

Macro Definition Documentation

#define DETECT_BYTEJUMP_ALIGN   0x20

"align" offset

Definition at line 39 of file detect-bytejump.h.

Referenced by DetectBytejumpDoMatch().

#define DETECT_BYTEJUMP_BASE_DEC   10

"dec" type value string

Definition at line 30 of file detect-bytejump.h.

Referenced by DetectBytejumpDoMatch().

#define DETECT_BYTEJUMP_BASE_HEX   16

"hex" type value string

Definition at line 31 of file detect-bytejump.h.

Referenced by DetectBytejumpDoMatch().

#define DETECT_BYTEJUMP_BASE_OCT   8

"oct" type value string

Definition at line 29 of file detect-bytejump.h.

Referenced by DetectBytejumpDoMatch().

#define DETECT_BYTEJUMP_BASE_UNSET   0

Bytejump Base Unset type value string (automatic)

Definition at line 28 of file detect-bytejump.h.

Referenced by DetectBytejumpDoMatch().

#define DETECT_BYTEJUMP_BEGIN   0x01

Bytejump Flags "from_beginning" jump

Definition at line 34 of file detect-bytejump.h.

Referenced by DetectBytejumpDoMatch().

#define DETECT_BYTEJUMP_BIG   0x04

"big" endian value

Definition at line 36 of file detect-bytejump.h.

Referenced by DetectBytejumpDoMatch().

#define DETECT_BYTEJUMP_DCE   0x40

"dce" enabled

Definition at line 40 of file detect-bytejump.h.

Referenced by DetectBytejumpDoMatch(), and DetectEngineContentInspection().

#define DETECT_BYTEJUMP_LITTLE   0x02

"little" endian value

Definition at line 35 of file detect-bytejump.h.

Referenced by DetectBytejumpDoMatch(), and DetectEngineContentInspection().

#define DETECT_BYTEJUMP_OFFSET_BE   0x80

"byte extract" enabled

Definition at line 41 of file detect-bytejump.h.

Referenced by DetectByteExtractRetrieveSMVar(), DetectBytejumpDoMatch(), and DetectEngineContentInspection().

#define DETECT_BYTEJUMP_RELATIVE   0x10

"relative" offset

Definition at line 38 of file detect-bytejump.h.

Referenced by DetectBytejumpDoMatch().

#define DETECT_BYTEJUMP_STRING   0x08

"string" value

Definition at line 37 of file detect-bytejump.h.

Referenced by DetectBytejumpDoMatch().

Typedef Documentation

Function Documentation

int DetectBytejumpDoMatch ( DetectEngineThreadCtx det_ctx,
const Signature s,
const SigMatchCtx ctx,
uint8_t *  payload,
uint32_t  payload_len,
uint8_t  flags,
int32_t  offset 
)

Byte jump match function.

This function is used to match byte_jump

Parameters
tpointer to thread vars
det_ctxpointer to the pattern matcher thread
ppointer to the current packet
mpointer to the sigmatch that we will cast into DetectBytejumpData
Return values
-1error
0no match
1match
Todo:
The return seems backwards. We should return a non-zero error code. One of the error codes is "no match". As-is if someone accidentally does: if (DetectBytejumpMatch(...)) { match }, then they catch an error as a match.
Parameters
det_ctxthread detect engine ctx
ssignature
mbyte jump sigmatch
payloadptr to the payload
payload_lenlength of the payload
Return values
1match
0no match

Definition at line 90 of file detect-bytejump.c.

References Signature_::alproto, ALPROTO_DCERPC, DetectBytejumpData_::base, DetectEngineThreadCtx_::buffer_offset, BYTE_BIG_ENDIAN, BYTE_LITTLE_ENDIAN, ByteExtractStringInt32(), ByteExtractStringUint32(), ByteExtractStringUint64(), ByteExtractUint64(), SigMatch_::ctx, DE_QUIET, DETECT_BYTE_EXTRACT, DETECT_BYTEJUMP, DETECT_BYTEJUMP_ALIGN, DETECT_BYTEJUMP_BASE_DEC, DETECT_BYTEJUMP_BASE_HEX, DETECT_BYTEJUMP_BASE_OCT, DETECT_BYTEJUMP_BASE_UNSET, DETECT_BYTEJUMP_BEGIN, DETECT_BYTEJUMP_BIG, DETECT_BYTEJUMP_DCE, DETECT_BYTEJUMP_LITTLE, DETECT_BYTEJUMP_OFFSET_BE, DETECT_BYTEJUMP_RELATIVE, DETECT_BYTEJUMP_STRING, DETECT_BYTETEST, DETECT_CONTENT, DETECT_CONTENT_RELATIVE_NEXT, DETECT_ISDATAAT, DETECT_PCRE, DETECT_PCRE_RELATIVE_NEXT, DETECT_SM_LIST_NOTSET, DETECT_SM_LIST_PMATCH, DetectBufferGetActiveList(), DetectBufferTypeGetByName(), DetectByteExtractRetrieveSMVar(), DetectEngineCtxFree(), DetectEngineCtxInit(), DetectGetLastSMFromLists(), DetectSignatureSetAppProto(), DetectPcreData_::flags, DetectBytejumpData_::flags, DetectContentData_::flags, DetectEngineCtx_::flags, Signature_::init_data, len, SignatureInitData_::list, MAX_SUBSTRINGS, DetectBytejumpData_::multiplier, DetectBytejumpData_::nbytes, Signature_::next, DetectBytejumpData_::offset, offset, Packet_::payload, payload_len, Packet_::payload_len, DetectBytejumpData_::post_offset, res, SC_ERR_BYTE_EXTRACT_FAILED, SC_ERR_CONFLICTING_RULE_KEYWORDS, SC_ERR_INVALID_ARGUMENT, SC_ERR_INVALID_SIGNATURE, SC_ERR_INVALID_VALUE, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_PARSE, SCEnter, SCFree, SCLogDebug, SCLogDebugEnabled(), SCLogError, SCMalloc, SCReturnInt, SCStrdup, DetectEngineCtx_::sig_list, SigAlloc(), SigCleanSignatures(), SigFree(), SigGroupCleanup(), SigInit(), SigMatchAlloc(), SigMatchAppendSMToList(), SigMatchListSMBelongsTo(), str, strlcpy(), SigMatch_::type, unlikely, UTHBuildPacket(), UTHFreePacket(), UTHPacketMatchSig(), and UtRegisterTest().

Referenced by DetectEngineContentInspection().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectBytejumpRegister ( void  )

Registration function for byte_jump.

Todo:
add support for no_stream and stream_only

Definition at line 70 of file detect-bytejump.c.

References DETECT_BYTEJUMP, DetectSetupParseRegexes(), SigTableElmt_::Free, SigTableElmt_::Match, SigTableElmt_::name, PARSE_REGEX, SigTableElmt_::RegisterTests, SigTableElmt_::Setup, and sigmatch_table.

Referenced by SigTableSetup().

Here is the call graph for this function:

Here is the caller graph for this function: