suricata
detect-bytejump.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Brian Rectanus <brectanu@gmail.com>
22  */
23 
24 #ifndef __DETECT_BYTEJUMP_H__
25 #define __DETECT_BYTEJUMP_H__
26 
27 /** Bytejump Base */
28 #define DETECT_BYTEJUMP_BASE_UNSET 0 /**< Unset type value string (automatic)*/
29 #define DETECT_BYTEJUMP_BASE_OCT 8 /**< "oct" type value string */
30 #define DETECT_BYTEJUMP_BASE_DEC 10 /**< "dec" type value string */
31 #define DETECT_BYTEJUMP_BASE_HEX 16 /**< "hex" type value string */
32 
33 /** Bytejump Flags */
34 #define DETECT_BYTEJUMP_BEGIN BIT_U16(0) /**< "from_beginning" jump */
35 #define DETECT_BYTEJUMP_LITTLE BIT_U16(1) /**< "little" endian value */
36 #define DETECT_BYTEJUMP_BIG BIT_U16(2) /**< "big" endian value */
37 #define DETECT_BYTEJUMP_STRING BIT_U16(3) /**< "string" value */
38 #define DETECT_BYTEJUMP_RELATIVE BIT_U16(4) /**< "relative" offset */
39 #define DETECT_BYTEJUMP_ALIGN BIT_U16(5) /**< "align" offset */
40 #define DETECT_BYTEJUMP_DCE BIT_U16(6) /**< "dce" enabled */
41 #define DETECT_BYTEJUMP_OFFSET_BE BIT_U16(7) /**< "byte extract" enabled */
42 #define DETECT_BYTEJUMP_END BIT_U16(8) /**< "from_end" jump */
43 #define DETECT_BYTEJUMP_NBYTES_VAR BIT_U16(9) /**< nbytes string*/
44 
45 typedef struct DetectBytejumpData_ {
46  uint8_t nbytes; /**< Number of bytes to compare */
47  uint8_t base; /**< String value base (oct|dec|hex) */
48  uint16_t flags; /**< Flags (big|little|relative|string) */
49  int32_t offset; /**< Offset in payload to extract value */
50  int32_t post_offset; /**< Offset to adjust post-jump */
51  uint16_t multiplier; /**< Multiplier for nbytes (multiplier n)*/
53 
54 /* prototypes */
55 
56 /**
57  * Registration function for byte_jump.
58  *
59  * \todo add support for no_stream and stream_only
60  */
61 void DetectBytejumpRegister (void);
62 
63 /**
64  * This function is used to match byte_jump
65  *
66  * \param t pointer to thread vars
67  * \param det_ctx pointer to the pattern matcher thread
68  * \param p pointer to the current packet
69  * \param m pointer to the sigmatch that we will cast into DetectBytejumpData
70  *
71  * \retval false no match
72  * \retval true
73  */
75  const uint8_t *, uint32_t, uint16_t, int32_t, int32_t);
76 
77 #endif /* __DETECT_BYTEJUMP_H__ */
78 
DetectBytejumpData_::post_offset
int32_t post_offset
Definition: detect-bytejump.h:50
DetectBytejumpRegister
void DetectBytejumpRegister(void)
Definition: detect-bytejump.c:72
DetectBytejumpData_::base
uint8_t base
Definition: detect-bytejump.h:47
DetectBytejumpData_
Definition: detect-bytejump.h:45
DetectBytejumpData_::offset
int32_t offset
Definition: detect-bytejump.h:49
DetectBytejumpData_::multiplier
uint16_t multiplier
Definition: detect-bytejump.h:51
DetectEngineThreadCtx_
Definition: detect.h:1080
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:339
DetectBytejumpData
struct DetectBytejumpData_ DetectBytejumpData
DetectBytejumpData_::nbytes
uint8_t nbytes
Definition: detect-bytejump.h:46
Signature_
Signature container.
Definition: detect.h:587
DetectBytejumpDoMatch
bool DetectBytejumpDoMatch(DetectEngineThreadCtx *, const Signature *, const SigMatchCtx *, const uint8_t *, uint32_t, uint16_t, int32_t, int32_t)
Byte jump match function.
Definition: detect-bytejump.c:136
DetectBytejumpData_::flags
uint16_t flags
Definition: detect-bytejump.h:48