suricata
detect-bytemath.h
Go to the documentation of this file.
1
/* Copyright (C) 2020 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \file
20
*
21
* \author Jeff Lucovsky <jeff@lucovsky.org>
22
*/
23
24
#ifndef __DETECT_BYTEMATH_H__
25
#define __DETECT_BYTEMATH_H__
26
27
/* flags */
28
#define DETECT_BYTEMATH_FLAG_RELATIVE 0x01
29
#define DETECT_BYTEMATH_FLAG_STRING 0x02
30
#define DETECT_BYTEMATH_FLAG_BITMASK 0x04
31
#define DETECT_BYTEMATH_FLAG_ENDIAN 0x08
32
#define DETECT_BYTEMATH_RVALUE_VAR 0x10
33
34
/* endian value to be used. Would be stored in DetectByteMathData->endian */
35
#define DETECT_BYTEMATH_ENDIAN_NONE 0
36
#define DETECT_BYTEMATH_ENDIAN_BIG 1
37
#define DETECT_BYTEMATH_ENDIAN_LITTLE 2
38
#define DETECT_BYTEMATH_ENDIAN_DCE 3
39
40
#define DETECT_BYTEMATH_OPERATOR_NONE 1
41
#define DETECT_BYTEMATH_OPERATOR_PLUS 2
42
#define DETECT_BYTEMATH_OPERATOR_MINUS 3
43
#define DETECT_BYTEMATH_OPERATOR_DIVIDE 4
44
#define DETECT_BYTEMATH_OPERATOR_MULTIPLY 5
45
#define DETECT_BYTEMATH_OPERATOR_LSHIFT 6
46
#define DETECT_BYTEMATH_OPERATOR_RSHIFT 7
47
48
/**
49
* \brief Holds data related to byte_math keyword.
50
*/
51
typedef
struct
DetectByteMathData_
{
52
/* local id used by other keywords in the sig to reference this */
53
uint8_t
local_id
;
54
uint8_t
nbytes
;
55
int32_t
offset
;
56
57
uint32_t
rvalue
;
58
59
/* "result" variable, if present */
60
const
char
*
result
;
/* consumed */
61
62
uint8_t
flags
;
63
uint8_t
endian
;
64
uint8_t
base
;
65
uint8_t
oper
;
66
67
uint32_t
bitmask_val
;
68
69
uint16_t
bitmask_shift_count
;
70
/* unique id used to reference this byte_math keyword */
71
uint16_t
id
;
72
73
}
DetectByteMathData
;
74
75
void
DetectBytemathRegister
(
void
);
76
77
SigMatch
*
DetectByteMathRetrieveSMVar
(
const
char
*,
const
Signature
*);
78
int
DetectByteMathDoMatch
(
DetectEngineThreadCtx
*,
const
SigMatchData
*,
const
Signature
*,
79
const
uint8_t *, uint16_t, uint64_t, uint64_t *, uint8_t);
80
81
#endif
/* __DETECT_BYTEMATH_H__ */
DetectByteMathData_
Holds data related to byte_math keyword.
Definition:
detect-bytemath.h:51
DetectByteMathData
struct DetectByteMathData_ DetectByteMathData
Holds data related to byte_math keyword.
DetectByteMathData_::base
uint8_t base
Definition:
detect-bytemath.h:64
DetectByteMathData_::bitmask_shift_count
uint16_t bitmask_shift_count
Definition:
detect-bytemath.h:69
DetectByteMathData_::endian
uint8_t endian
Definition:
detect-bytemath.h:63
SigMatchData_
Data needed for Match()
Definition:
detect.h:323
DetectByteMathData_::result
const char * result
Definition:
detect-bytemath.h:60
DetectByteMathData_::nbytes
uint8_t nbytes
Definition:
detect-bytemath.h:54
DetectEngineThreadCtx_
Definition:
detect.h:1034
DetectByteMathData_::local_id
uint8_t local_id
Definition:
detect-bytemath.h:53
DetectByteMathData_::offset
int32_t offset
Definition:
detect-bytemath.h:55
DetectByteMathData_::id
uint16_t id
Definition:
detect-bytemath.h:71
DetectBytemathRegister
void DetectBytemathRegister(void)
Registers the keyword handlers for the "byte_math" keyword.
Definition:
detect-bytemath.c:126
DetectByteMathData_::rvalue
uint32_t rvalue
Definition:
detect-bytemath.h:57
DetectByteMathData_::flags
uint8_t flags
Definition:
detect-bytemath.h:62
DetectByteMathData_::bitmask_val
uint32_t bitmask_val
Definition:
detect-bytemath.h:67
Signature_
Signature container.
Definition:
detect.h:540
SigMatch_
a single match condition for a signature
Definition:
detect.h:314
DetectByteMathDoMatch
int DetectByteMathDoMatch(DetectEngineThreadCtx *, const SigMatchData *, const Signature *, const uint8_t *, uint16_t, uint64_t, uint64_t *, uint8_t)
Definition:
detect-bytemath.c:138
DetectByteMathRetrieveSMVar
SigMatch * DetectByteMathRetrieveSMVar(const char *, const Signature *)
Lookup the SigMatch for a named byte_math variable.
Definition:
detect-bytemath.c:759
DetectByteMathData_::oper
uint8_t oper
Definition:
detect-bytemath.h:65
src
detect-bytemath.h
Generated on Wed Aug 17 2022 23:30:27 for suricata by
1.8.18