suricata
detect-bytejump.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Brian Rectanus <brectanu@gmail.com>
22  */
23 
24 #ifndef __DETECT_BYTEJUMP_H__
25 #define __DETECT_BYTEJUMP_H__
26 
27 /** Bytejump Base */
28 #define DETECT_BYTEJUMP_BASE_UNSET 0 /**< Unset type value string (automatic)*/
29 #define DETECT_BYTEJUMP_BASE_OCT 8 /**< "oct" type value string */
30 #define DETECT_BYTEJUMP_BASE_DEC 10 /**< "dec" type value string */
31 #define DETECT_BYTEJUMP_BASE_HEX 16 /**< "hex" type value string */
32 
33 /** Bytejump Flags */
34 #define DETECT_BYTEJUMP_BEGIN BIT_U16(0) /**< "from_beginning" jump */
35 #define DETECT_BYTEJUMP_LITTLE BIT_U16(1) /**< "little" endian value */
36 #define DETECT_BYTEJUMP_BIG BIT_U16(2) /**< "big" endian value */
37 #define DETECT_BYTEJUMP_STRING BIT_U16(3) /**< "string" value */
38 #define DETECT_BYTEJUMP_RELATIVE BIT_U16(4) /**< "relative" offset */
39 #define DETECT_BYTEJUMP_ALIGN BIT_U16(5) /**< "align" offset */
40 #define DETECT_BYTEJUMP_DCE BIT_U16(6) /**< "dce" enabled */
41 #define DETECT_BYTEJUMP_OFFSET_BE BIT_U16(7) /**< "byte extract" enabled */
42 #define DETECT_BYTEJUMP_END BIT_U16(8) /**< "from_end" jump */
43 
44 typedef struct DetectBytejumpData_ {
45  uint8_t nbytes; /**< Number of bytes to compare */
46  uint8_t base; /**< String value base (oct|dec|hex) */
47  uint16_t flags; /**< Flags (big|little|relative|string) */
48  uint32_t multiplier; /**< Multiplier for nbytes (multiplier n)*/
49  int32_t offset; /**< Offset in payload to extract value */
50  int32_t post_offset; /**< Offset to adjust post-jump */
52 
53 /* prototypes */
54 
55 /**
56  * Registration function for byte_jump.
57  *
58  * \todo add support for no_stream and stream_only
59  */
60 void DetectBytejumpRegister (void);
61 
62 /**
63  * This function is used to match byte_jump
64  *
65  * \param t pointer to thread vars
66  * \param det_ctx pointer to the pattern matcher thread
67  * \param p pointer to the current packet
68  * \param m pointer to the sigmatch that we will cast into DetectBytejumpData
69  *
70  * \retval -1 error
71  * \retval 0 no match
72  * \retval 1 match
73  *
74  * \todo The return seems backwards. We should return a non-zero error code.
75  * One of the error codes is "no match". As-is if someone accidentally
76  * does: if (DetectBytejumpMatch(...)) { match }, then they catch an
77  * error as a match.
78  */
80  const uint8_t *, uint32_t, uint16_t, int32_t);
81 
82 #endif /* __DETECT_BYTEJUMP_H__ */
83 
DetectBytejumpData_::post_offset
int32_t post_offset
Definition: detect-bytejump.h:50
DetectBytejumpRegister
void DetectBytejumpRegister(void)
Definition: detect-bytejump.c:72
DetectBytejumpData_::base
uint8_t base
Definition: detect-bytejump.h:46
DetectBytejumpData_
Definition: detect-bytejump.h:44
DetectBytejumpData_::offset
int32_t offset
Definition: detect-bytejump.h:49
DetectBytejumpData_::multiplier
uint32_t multiplier
Definition: detect-bytejump.h:48
DetectEngineThreadCtx_
Definition: detect.h:1011
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:315
DetectBytejumpData
struct DetectBytejumpData_ DetectBytejumpData
DetectBytejumpData_::nbytes
uint8_t nbytes
Definition: detect-bytejump.h:45
Signature_
Signature container.
Definition: detect.h:528
DetectBytejumpDoMatch
int DetectBytejumpDoMatch(DetectEngineThreadCtx *, const Signature *, const SigMatchCtx *, const uint8_t *, uint32_t, uint16_t, int32_t)
Byte jump match function.
Definition: detect-bytejump.c:95
DetectBytejumpData_::flags
uint16_t flags
Definition: detect-bytejump.h:47