suricata
detect-bytemath.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  DetectByteMathData_
 Holds data related to byte_math keyword. More...
 

Macros

#define DETECT_BYTEMATH_FLAG_RELATIVE   0x01
 
#define DETECT_BYTEMATH_FLAG_STRING   0x02
 
#define DETECT_BYTEMATH_FLAG_BITMASK   0x04
 
#define DETECT_BYTEMATH_FLAG_ENDIAN   0x08
 
#define DETECT_BYTEMATH_RVALUE_VAR   0x10
 
#define DETECT_BYTEMATH_ENDIAN_NONE   0
 
#define DETECT_BYTEMATH_ENDIAN_BIG   1
 
#define DETECT_BYTEMATH_ENDIAN_LITTLE   2
 
#define DETECT_BYTEMATH_ENDIAN_DCE   3
 
#define DETECT_BYTEMATH_OPERATOR_NONE   1
 
#define DETECT_BYTEMATH_OPERATOR_PLUS   2
 
#define DETECT_BYTEMATH_OPERATOR_MINUS   3
 
#define DETECT_BYTEMATH_OPERATOR_DIVIDE   4
 
#define DETECT_BYTEMATH_OPERATOR_MULTIPLY   5
 
#define DETECT_BYTEMATH_OPERATOR_LSHIFT   6
 
#define DETECT_BYTEMATH_OPERATOR_RSHIFT   7
 

Typedefs

typedef struct DetectByteMathData_ DetectByteMathData
 Holds data related to byte_math keyword. More...
 

Functions

void DetectBytemathRegister (void)
 Registers the keyword handlers for the "byte_math" keyword. More...
 
SigMatchDetectByteMathRetrieveSMVar (const char *, const Signature *)
 Lookup the SigMatch for a named byte_math variable. More...
 
int DetectByteMathDoMatch (DetectEngineThreadCtx *, const SigMatchData *, const Signature *, const uint8_t *, uint16_t, uint64_t, uint64_t *, uint8_t)
 

Detailed Description

Author
Jeff Lucovsky jeff@.nosp@m.luco.nosp@m.vsky..nosp@m.org

Definition in file detect-bytemath.h.

Macro Definition Documentation

◆ DETECT_BYTEMATH_ENDIAN_BIG

#define DETECT_BYTEMATH_ENDIAN_BIG   1

Definition at line 37 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_ENDIAN_DCE

#define DETECT_BYTEMATH_ENDIAN_DCE   3

Definition at line 39 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_ENDIAN_LITTLE

#define DETECT_BYTEMATH_ENDIAN_LITTLE   2

Definition at line 38 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_ENDIAN_NONE

#define DETECT_BYTEMATH_ENDIAN_NONE   0

Definition at line 36 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_FLAG_BITMASK

#define DETECT_BYTEMATH_FLAG_BITMASK   0x04

Definition at line 31 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_FLAG_ENDIAN

#define DETECT_BYTEMATH_FLAG_ENDIAN   0x08

Definition at line 32 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_FLAG_RELATIVE

#define DETECT_BYTEMATH_FLAG_RELATIVE   0x01

Definition at line 29 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_FLAG_STRING

#define DETECT_BYTEMATH_FLAG_STRING   0x02

Definition at line 30 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_OPERATOR_DIVIDE

#define DETECT_BYTEMATH_OPERATOR_DIVIDE   4

Definition at line 44 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_OPERATOR_LSHIFT

#define DETECT_BYTEMATH_OPERATOR_LSHIFT   6

Definition at line 46 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_OPERATOR_MINUS

#define DETECT_BYTEMATH_OPERATOR_MINUS   3

Definition at line 43 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_OPERATOR_MULTIPLY

#define DETECT_BYTEMATH_OPERATOR_MULTIPLY   5

Definition at line 45 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_OPERATOR_NONE

#define DETECT_BYTEMATH_OPERATOR_NONE   1

Definition at line 41 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_OPERATOR_PLUS

#define DETECT_BYTEMATH_OPERATOR_PLUS   2

Definition at line 42 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_OPERATOR_RSHIFT

#define DETECT_BYTEMATH_OPERATOR_RSHIFT   7

Definition at line 47 of file detect-bytemath.h.

◆ DETECT_BYTEMATH_RVALUE_VAR

#define DETECT_BYTEMATH_RVALUE_VAR   0x10

Definition at line 33 of file detect-bytemath.h.

Typedef Documentation

◆ DetectByteMathData

Holds data related to byte_math keyword.

Function Documentation

◆ DetectByteMathDoMatch()

◆ DetectBytemathRegister()

void DetectBytemathRegister ( void  )

Registers the keyword handlers for the "byte_math" keyword.

Definition at line 125 of file detect-bytemath.c.

References DETECT_BYTEMATH, SigTableElmt_::Match, SigTableElmt_::name, SigTableElmt_::Setup, and sigmatch_table.

Referenced by SigTableSetup().

Here is the caller graph for this function:

◆ DetectByteMathRetrieveSMVar()

SigMatch* DetectByteMathRetrieveSMVar ( const char *  arg,
const Signature s 
)

Lookup the SigMatch for a named byte_math variable.

Parameters
argThe name of the byte_math variable to lookup.
sPointer the signature to look in.
Return values
Apointer to the SigMatch if found, otherwise NULL.

Definition at line 758 of file detect-bytemath.c.

References Signature_::init_data, and SignatureInitData_::smlists_array_size.

Referenced by DetectByteRetrieveSMVar().

Here is the caller graph for this function: