suricata
|
Go to the source code of this file.
Data Structures | |
struct | DetectBytejumpData_ |
Macros | |
#define | DETECT_BYTEJUMP_BASE_UNSET 0 |
#define | DETECT_BYTEJUMP_BASE_OCT 8 |
#define | DETECT_BYTEJUMP_BASE_DEC 10 |
#define | DETECT_BYTEJUMP_BASE_HEX 16 |
#define | DETECT_BYTEJUMP_BEGIN BIT_U16(0) |
#define | DETECT_BYTEJUMP_LITTLE BIT_U16(1) |
#define | DETECT_BYTEJUMP_BIG BIT_U16(2) |
#define | DETECT_BYTEJUMP_STRING BIT_U16(3) |
#define | DETECT_BYTEJUMP_RELATIVE BIT_U16(4) |
#define | DETECT_BYTEJUMP_ALIGN BIT_U16(5) |
#define | DETECT_BYTEJUMP_DCE BIT_U16(6) |
#define | DETECT_BYTEJUMP_OFFSET_BE BIT_U16(7) |
#define | DETECT_BYTEJUMP_END BIT_U16(8) |
Typedefs | |
typedef struct DetectBytejumpData_ | DetectBytejumpData |
Functions | |
void | DetectBytejumpRegister (void) |
int | DetectBytejumpDoMatch (DetectEngineThreadCtx *, const Signature *, const SigMatchCtx *, const uint8_t *, uint32_t, uint16_t, int32_t) |
Byte jump match function. More... | |
Definition in file detect-bytejump.h.
#define DETECT_BYTEJUMP_ALIGN BIT_U16(5) |
"align" offset
Definition at line 40 of file detect-bytejump.h.
#define DETECT_BYTEJUMP_BASE_DEC 10 |
"dec" type value string
Definition at line 31 of file detect-bytejump.h.
#define DETECT_BYTEJUMP_BASE_HEX 16 |
"hex" type value string
Definition at line 32 of file detect-bytejump.h.
#define DETECT_BYTEJUMP_BASE_OCT 8 |
"oct" type value string
Definition at line 30 of file detect-bytejump.h.
#define DETECT_BYTEJUMP_BASE_UNSET 0 |
Bytejump Base Unset type value string (automatic)
Definition at line 29 of file detect-bytejump.h.
#define DETECT_BYTEJUMP_BEGIN BIT_U16(0) |
Bytejump Flags "from_beginning" jump
Definition at line 35 of file detect-bytejump.h.
#define DETECT_BYTEJUMP_BIG BIT_U16(2) |
"big" endian value
Definition at line 37 of file detect-bytejump.h.
#define DETECT_BYTEJUMP_DCE BIT_U16(6) |
"dce" enabled
Definition at line 41 of file detect-bytejump.h.
#define DETECT_BYTEJUMP_END BIT_U16(8) |
"from_end" jump
Definition at line 43 of file detect-bytejump.h.
#define DETECT_BYTEJUMP_LITTLE BIT_U16(1) |
"little" endian value
Definition at line 36 of file detect-bytejump.h.
#define DETECT_BYTEJUMP_OFFSET_BE BIT_U16(7) |
"byte extract" enabled
Definition at line 42 of file detect-bytejump.h.
#define DETECT_BYTEJUMP_RELATIVE BIT_U16(4) |
"relative" offset
Definition at line 39 of file detect-bytejump.h.
#define DETECT_BYTEJUMP_STRING BIT_U16(3) |
"string" value
Definition at line 38 of file detect-bytejump.h.
typedef struct DetectBytejumpData_ DetectBytejumpData |
int DetectBytejumpDoMatch | ( | DetectEngineThreadCtx * | det_ctx, |
const Signature * | s, | ||
const SigMatchCtx * | ctx, | ||
const uint8_t * | payload, | ||
uint32_t | payload_len, | ||
uint16_t | flags, | ||
int32_t | offset | ||
) |
Byte jump match function.
This function is used to match byte_jump
t | pointer to thread vars |
det_ctx | pointer to the pattern matcher thread |
p | pointer to the current packet |
m | pointer to the sigmatch that we will cast into DetectBytejumpData |
-1 | error |
0 | no match |
1 | match |
det_ctx | thread detect engine ctx |
s | signature |
m | byte jump sigmatch |
payload | ptr to the payload |
payload_len | length of the payload |
1 | match |
0 | no match |
Definition at line 96 of file detect-bytejump.c.
References DetectBytejumpData_::base, DetectEngineThreadCtx_::buffer_offset, BYTE_BIG_ENDIAN, BYTE_LITTLE_ENDIAN, ByteExtractStringUint64(), ByteExtractUint64(), DETECT_BYTEJUMP_ALIGN, DETECT_BYTEJUMP_BEGIN, DETECT_BYTEJUMP_END, DETECT_BYTEJUMP_LITTLE, DETECT_BYTEJUMP_RELATIVE, DETECT_BYTEJUMP_STRING, flags, len, DetectBytejumpData_::multiplier, DetectBytejumpData_::nbytes, offset, payload_len, DetectBytejumpData_::post_offset, SCEnter, SCLogDebug, SCLogDebugEnabled(), and SCReturnInt.
void DetectBytejumpRegister | ( | void | ) |
Registration function for byte_jump.
Definition at line 73 of file detect-bytejump.c.
References SigTableElmt_::desc, DETECT_BYTEJUMP, SigTableElmt_::Match, SigTableElmt_::name, sigmatch_table, and SigTableElmt_::url.
Referenced by SigTableSetup().