suricata
detect-bytejump.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Brian Rectanus <brectanu@gmail.com>
22  */
23 
24 #ifndef SURICATA_DETECT_BYTEJUMP_H
25 #define SURICATA_DETECT_BYTEJUMP_H
26 
27 /** Bytejump Base */
28 #define DETECT_BYTEJUMP_BASE_UNSET 0 /**< Unset type value string (automatic)*/
29 #define DETECT_BYTEJUMP_BASE_OCT 8 /**< "oct" type value string */
30 #define DETECT_BYTEJUMP_BASE_DEC 10 /**< "dec" type value string */
31 #define DETECT_BYTEJUMP_BASE_HEX 16 /**< "hex" type value string */
32 
33 /** Bytejump Flags */
34 #define DETECT_BYTEJUMP_BEGIN BIT_U16(0) /**< "from_beginning" jump */
35 #define DETECT_BYTEJUMP_LITTLE BIT_U16(1) /**< "little" endian value */
36 #define DETECT_BYTEJUMP_BIG BIT_U16(2) /**< "big" endian value */
37 #define DETECT_BYTEJUMP_STRING BIT_U16(3) /**< "string" value */
38 #define DETECT_BYTEJUMP_RELATIVE BIT_U16(4) /**< "relative" offset */
39 #define DETECT_BYTEJUMP_ALIGN BIT_U16(5) /**< "align" offset */
40 #define DETECT_BYTEJUMP_DCE BIT_U16(6) /**< "dce" enabled */
41 #define DETECT_BYTEJUMP_OFFSET_BE BIT_U16(7) /**< "byte extract" enabled */
42 #define DETECT_BYTEJUMP_END BIT_U16(8) /**< "from_end" jump */
43 #define DETECT_BYTEJUMP_NBYTES_VAR BIT_U16(9) /**< nbytes string*/
44 #define DETECT_BYTEJUMP_OFFSET_VAR BIT_U16(10) /**< byte extract value enabled */
45 
46 typedef struct DetectBytejumpData_ {
47  uint8_t nbytes; /**< Number of bytes to compare */
48  uint8_t base; /**< String value base (oct|dec|hex) */
49  uint16_t flags; /**< Flags (big|little|relative|string) */
50  int32_t offset; /**< Offset in payload to extract value */
51  int32_t post_offset; /**< Offset to adjust post-jump */
52  uint16_t multiplier; /**< Multiplier for nbytes (multiplier n)*/
54 
55 /* prototypes */
56 
57 /**
58  * Registration function for byte_jump.
59  *
60  * \todo add support for no_stream and stream_only
61  */
62 void DetectBytejumpRegister (void);
63 
64 /**
65  * This function is used to match byte_jump
66  *
67  * \param t pointer to thread vars
68  * \param det_ctx pointer to the pattern matcher thread
69  * \param p pointer to the current packet
70  * \param m pointer to the sigmatch that we will cast into DetectBytejumpData
71  *
72  * \retval false no match
73  * \retval true
74  */
76  const uint8_t *, uint32_t, uint16_t, int32_t, int32_t);
77 
78 #endif /* SURICATA_DETECT_BYTEJUMP_H */
DetectBytejumpData_::post_offset
int32_t post_offset
Definition: detect-bytejump.h:51
DetectBytejumpRegister
void DetectBytejumpRegister(void)
Definition: detect-bytejump.c:72
DetectBytejumpData_::base
uint8_t base
Definition: detect-bytejump.h:48
DetectBytejumpData_
Definition: detect-bytejump.h:46
DetectBytejumpData_::offset
int32_t offset
Definition: detect-bytejump.h:50
DetectBytejumpData_::multiplier
uint16_t multiplier
Definition: detect-bytejump.h:52
DetectEngineThreadCtx_
Definition: detect.h:1093
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:344
DetectBytejumpData
struct DetectBytejumpData_ DetectBytejumpData
DetectBytejumpData_::nbytes
uint8_t nbytes
Definition: detect-bytejump.h:47
Signature_
Signature container.
Definition: detect.h:601
DetectBytejumpDoMatch
bool DetectBytejumpDoMatch(DetectEngineThreadCtx *, const Signature *, const SigMatchCtx *, const uint8_t *, uint32_t, uint16_t, int32_t, int32_t)
Byte jump match function.
Definition: detect-bytejump.c:136
DetectBytejumpData_::flags
uint16_t flags
Definition: detect-bytejump.h:49