suricata
detect-bytejump.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Brian Rectanus <brectanu@gmail.com>
22  */
23 
24 #ifndef __DETECT_BYTEJUMP_H__
25 #define __DETECT_BYTEJUMP_H__
26 
27 /** Bytejump Base */
28 #define DETECT_BYTEJUMP_BASE_UNSET 0 /**< Unset type value string (automatic)*/
29 #define DETECT_BYTEJUMP_BASE_OCT 8 /**< "oct" type value string */
30 #define DETECT_BYTEJUMP_BASE_DEC 10 /**< "dec" type value string */
31 #define DETECT_BYTEJUMP_BASE_HEX 16 /**< "hex" type value string */
32 
33 /** Bytejump Flags */
34 #define DETECT_BYTEJUMP_BEGIN 0x01 /**< "from_beginning" jump */
35 #define DETECT_BYTEJUMP_LITTLE 0x02 /**< "little" endian value */
36 #define DETECT_BYTEJUMP_BIG 0x04 /**< "big" endian value */
37 #define DETECT_BYTEJUMP_STRING 0x08 /**< "string" value */
38 #define DETECT_BYTEJUMP_RELATIVE 0x10 /**< "relative" offset */
39 #define DETECT_BYTEJUMP_ALIGN 0x20 /**< "align" offset */
40 #define DETECT_BYTEJUMP_DCE 0x40 /**< "dce" enabled */
41 #define DETECT_BYTEJUMP_OFFSET_BE 0x80 /**< "byte extract" enabled */
42 
43 typedef struct DetectBytejumpData_ {
44  uint8_t nbytes; /**< Number of bytes to compare */
45  uint8_t base; /**< String value base (oct|dec|hex) */
46  uint8_t flags; /**< Flags (big|little|relative|string) */
47  uint32_t multiplier; /**< Multiplier for nbytes (multiplier n)*/
48  int32_t offset; /**< Offset in payload to extract value */
49  int32_t post_offset; /**< Offset to adjust post-jump */
51 
52 /* prototypes */
53 
54 /**
55  * Registration function for byte_jump.
56  *
57  * \todo add support for no_stream and stream_only
58  */
59 void DetectBytejumpRegister (void);
60 
61 /**
62  * This function is used to match byte_jump
63  *
64  * \param t pointer to thread vars
65  * \param det_ctx pointer to the pattern matcher thread
66  * \param p pointer to the current packet
67  * \param m pointer to the sigmatch that we will cast into DetectBytejumpData
68  *
69  * \retval -1 error
70  * \retval 0 no match
71  * \retval 1 match
72  *
73  * \todo The return seems backwards. We should return a non-zero error code.
74  * One of the error codes is "no match". As-is if someone accidentally
75  * does: if (DetectBytejumpMatch(...)) { match }, then they catch an
76  * error as a match.
77  */
79  const uint8_t *, uint32_t, uint8_t, int32_t);
80 
81 #endif /* __DETECT_BYTEJUMP_H__ */
82 
int DetectBytejumpDoMatch(DetectEngineThreadCtx *, const Signature *, const SigMatchCtx *, const uint8_t *, uint32_t, uint8_t, int32_t)
Byte jump match function.
Signature container.
Definition: detect.h:522
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:313
void DetectBytejumpRegister(void)
struct DetectBytejumpData_ DetectBytejumpData