suricata
detect-bytetest.c File Reference
#include "suricata-common.h"
#include "debug.h"
#include "decode.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-parse.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#include "detect-bytetest.h"
#include "detect-bytejump.h"
#include "detect-byte-extract.h"
#include "app-layer.h"
#include "util-byte.h"
#include "util-unittest.h"
#include "util-debug.h"
#include "detect-pcre.h"
#include "util-unittest-helper.h"
Include dependency graph for detect-bytetest.c:

Go to the source code of this file.

Macros

#define PARSE_REGEX
 Regex for parsing our options. More...
 
#define MAX_SUBSTRINGS   30
 

Functions

void DetectBytetestRegister (void)
 
int DetectBytetestDoMatch (DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchCtx *ctx, const uint8_t *payload, uint32_t payload_len, uint8_t flags, int32_t offset, uint64_t value)
 Bytetest detection code. More...
 

Detailed Description

Author
Brian Rectanus brect.nosp@m.anu@.nosp@m.gmail.nosp@m..com

Implements byte_test keyword.

Definition in file detect-bytetest.c.

Macro Definition Documentation

#define MAX_SUBSTRINGS   30

Referenced by DetectBytetestDoMatch().

#define PARSE_REGEX
Value:
"^\\s*" \
"([^\\s,]+)" \
"\\s*,\\s*(\\!?)\\s*([^\\s,]*)" \
"\\s*,\\s*([^\\s,]+)" \
"\\s*,\\s*([^\\s,]+)" \
"(?:\\s*,\\s*([^\\s,]+))?" \
"(?:\\s*,\\s*([^\\s,]+))?" \
"(?:\\s*,\\s*([^\\s,]+))?" \
"(?:\\s*,\\s*([^\\s,]+))?" \
"(?:\\s*,\\s*([^\\s,]+))?" \
"\\s*$"

Regex for parsing our options.

Todo:
We probably just need a simple tokenizer here

Definition at line 50 of file detect-bytetest.c.

Referenced by DetectBytetestRegister().

Function Documentation

int DetectBytetestDoMatch ( DetectEngineThreadCtx det_ctx,
const Signature s,
const SigMatchCtx ctx,
const uint8_t *  payload,
uint32_t  payload_len,
uint8_t  flags,
int32_t  offset,
uint64_t  value 
)

Bytetest detection code.

Byte test works on the packet payload.

Parameters
det_ctxthread de ctx
ssignature
msigmatch for this bytettest
payloadptr to the start of the buffer to inspect
payload_lenlength of the payload
Return values
1match
0no match

Definition at line 96 of file detect-bytetest.c.

References ALPROTO_DCERPC, DetectBytetestData_::base, DetectEngineThreadCtx_::buffer_offset, BYTE_BIG_ENDIAN, BYTE_LITTLE_ENDIAN, ByteExtractStringInt32(), ByteExtractStringUint32(), ByteExtractStringUint64(), ByteExtractUint64(), SigMatch_::ctx, DE_QUIET, DETECT_BYTE_EXTRACT, DETECT_BYTEJUMP, DETECT_BYTETEST, DETECT_BYTETEST_BASE_DEC, DETECT_BYTETEST_BASE_HEX, DETECT_BYTETEST_BASE_OCT, DETECT_BYTETEST_BASE_UNSET, DETECT_BYTETEST_BIG, DETECT_BYTETEST_DCE, DETECT_BYTETEST_LITTLE, DETECT_BYTETEST_NEGOP, DETECT_BYTETEST_OFFSET_BE, DETECT_BYTETEST_OP_AND, DETECT_BYTETEST_OP_EQ, DETECT_BYTETEST_OP_GE, DETECT_BYTETEST_OP_GT, DETECT_BYTETEST_OP_LE, DETECT_BYTETEST_OP_LT, DETECT_BYTETEST_OP_OR, DETECT_BYTETEST_RELATIVE, DETECT_BYTETEST_STRING, DETECT_BYTETEST_VALUE_BE, DETECT_CONTENT, DETECT_CONTENT_RELATIVE_NEXT, DETECT_ISDATAAT, DETECT_PCRE, DETECT_PCRE_RELATIVE_NEXT, DETECT_SM_LIST_NOTSET, DETECT_SM_LIST_PMATCH, DetectBufferGetActiveList(), DetectBufferTypeGetByName(), DetectByteExtractRetrieveSMVar(), DetectBytetestDoMatch(), DetectEngineCtxFree(), DetectEngineCtxInit(), DetectGetLastSMFromLists(), DetectSignatureSetAppProto(), DetectPcreData_::flags, DetectBytetestData_::flags, DetectContentData_::flags, DetectEngineCtx_::flags, Signature_::init_data, len, SignatureInitData_::list, MAX_SUBSTRINGS, DetectBytetestData_::nbytes, Signature_::next, DetectBytetestData_::offset, offset, DetectBytetestData_::op, Packet_::payload, Packet_::payload_len, res, SC_ERR_CONFLICTING_RULE_KEYWORDS, SC_ERR_INVALID_ARGUMENT, SC_ERR_INVALID_OPERATOR, SC_ERR_INVALID_SIGNATURE, SC_ERR_INVALID_VALUE, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_PARSE, SC_ERR_UNKNOWN_VALUE, SCEnter, SCFree, SCLogDebug, SCLogError, SCMalloc, SCReturnInt, SCStrdup, DetectEngineCtx_::sig_list, SigAlloc(), SigCleanSignatures(), SigFree(), SigGroupCleanup(), SigInit(), SigMatchAlloc(), SigMatchAppendSMToList(), SigMatchListSMBelongsTo(), SigMatch_::type, unlikely, UTHBuildPacket(), UTHFreePacket(), UTHPacketMatchSig(), UtRegisterTest(), and DetectBytetestData_::value.

Referenced by DetectBytetestDoMatch(), and DetectEngineContentInspection().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectBytetestRegister ( void  )

Registration function for byte_test.

Todo:
add support for no_stream and stream_only

Definition at line 71 of file detect-bytetest.c.

References SigTableElmt_::desc, DETECT_BYTETEST, DetectSetupParseRegexes(), DOC_URL, DOC_VERSION, SigTableElmt_::Free, SigTableElmt_::Match, SigTableElmt_::name, PARSE_REGEX, SigTableElmt_::RegisterTests, SigTableElmt_::Setup, sigmatch_table, and SigTableElmt_::url.

Referenced by SigTableSetup().

Here is the call graph for this function:

Here is the caller graph for this function: