suricata
detect-bytemath.h
Go to the documentation of this file.
1 /* Copyright (C) 2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Jeff Lucovsky <jeff@lucovsky.org>
22  */
23 
24 #ifndef __DETECT_BYTEMATH_H__
25 #define __DETECT_BYTEMATH_H__
26 
27 /* flags */
28 #define DETECT_BYTEMATH_FLAG_RELATIVE 0x01
29 #define DETECT_BYTEMATH_FLAG_STRING 0x02
30 #define DETECT_BYTEMATH_FLAG_BITMASK 0x04
31 #define DETECT_BYTEMATH_FLAG_ENDIAN 0x08
32 #define DETECT_BYTEMATH_RVALUE_VAR 0x10
33 
34 /* endian value to be used. Would be stored in DetectByteMathData->endian */
35 #define DETECT_BYTEMATH_ENDIAN_NONE 0
36 #define DETECT_BYTEMATH_ENDIAN_BIG 1
37 #define DETECT_BYTEMATH_ENDIAN_LITTLE 2
38 #define DETECT_BYTEMATH_ENDIAN_DCE 3
39 
40 #define DETECT_BYTEMATH_OPERATOR_NONE 1
41 #define DETECT_BYTEMATH_OPERATOR_PLUS 2
42 #define DETECT_BYTEMATH_OPERATOR_MINUS 3
43 #define DETECT_BYTEMATH_OPERATOR_DIVIDE 4
44 #define DETECT_BYTEMATH_OPERATOR_MULTIPLY 5
45 #define DETECT_BYTEMATH_OPERATOR_LSHIFT 6
46 #define DETECT_BYTEMATH_OPERATOR_RSHIFT 7
47 
48 /**
49  * \brief Holds data related to byte_math keyword.
50  */
51 typedef struct DetectByteMathData_ {
52  /* local id used by other keywords in the sig to reference this */
53  uint8_t local_id;
54  uint8_t nbytes;
55  uint16_t offset;
56 
57  uint32_t rvalue;
58 
59  /* "result" variable, if present */
60  const char *result; /* consumed */
61 
62  uint8_t flags;
63  uint8_t endian;
64  uint8_t base;
65  uint8_t oper;
66 
67  uint32_t bitmask_val;
68 
70  /* unique id used to reference this byte_math keyword */
71  uint16_t id;
72 
74 
75 void DetectBytemathRegister(void);
76 
77 SigMatch *DetectByteMathRetrieveSMVar(const char *, const Signature *);
79  const uint8_t *, uint16_t, uint64_t, uint64_t *, uint8_t);
80 
81 #endif /* __DETECT_BYTEMATH_H__ */
DetectByteMathData_
Holds data related to byte_math keyword.
Definition: detect-bytemath.h:51
DetectByteMathData
struct DetectByteMathData_ DetectByteMathData
Holds data related to byte_math keyword.
DetectByteMathData_::base
uint8_t base
Definition: detect-bytemath.h:64
DetectByteMathData_::bitmask_shift_count
uint16_t bitmask_shift_count
Definition: detect-bytemath.h:69
DetectByteMathData_::endian
uint8_t endian
Definition: detect-bytemath.h:63
SigMatchData_
Data needed for Match()
Definition: detect.h:329
DetectByteMathData_::result
const char * result
Definition: detect-bytemath.h:60
DetectByteMathData_::nbytes
uint8_t nbytes
Definition: detect-bytemath.h:54
DetectEngineThreadCtx_
Definition: detect.h:1010
DetectByteMathData_::local_id
uint8_t local_id
Definition: detect-bytemath.h:53
DetectByteMathData_::id
uint16_t id
Definition: detect-bytemath.h:71
DetectBytemathRegister
void DetectBytemathRegister(void)
Registers the keyword handlers for the "byte_math" keyword.
Definition: detect-bytemath.c:124
DetectByteMathData_::rvalue
uint32_t rvalue
Definition: detect-bytemath.h:57
DetectByteMathData_::flags
uint8_t flags
Definition: detect-bytemath.h:62
DetectByteMathData_::offset
uint16_t offset
Definition: detect-bytemath.h:55
DetectByteMathData_::bitmask_val
uint32_t bitmask_val
Definition: detect-bytemath.h:67
Signature_
Signature container.
Definition: detect.h:528
SigMatch_
a single match condition for a signature
Definition: detect.h:320
DetectByteMathDoMatch
int DetectByteMathDoMatch(DetectEngineThreadCtx *, const SigMatchData *, const Signature *, const uint8_t *, uint16_t, uint64_t, uint64_t *, uint8_t)
Definition: detect-bytemath.c:136
DetectByteMathRetrieveSMVar
SigMatch * DetectByteMathRetrieveSMVar(const char *, const Signature *)
Lookup the SigMatch for a named byte_math variable.
Definition: detect-bytemath.c:735
DetectByteMathData_::oper
uint8_t oper
Definition: detect-bytemath.h:65