suricata
|
#include "suricata-common.h"
#include "decode.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-parse.h"
#include "detect-engine-build.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#include "detect-byte.h"
#include "detect-bytetest.h"
#include "detect-bytejump.h"
#include "detect-byte-extract.h"
#include "app-layer.h"
#include "util-byte.h"
#include "util-unittest.h"
#include "util-debug.h"
#include "detect-pcre.h"
#include "util-unittest-helper.h"
#include "app-layer-parser.h"
#include "flow-util.h"
Go to the source code of this file.
Macros | |
#define | VALID_KW "relative|big|little|string|oct|dec|hex|dce|bitmask" |
Regex for parsing our options. More... | |
#define | PARSE_REGEX |
Functions | |
void | DetectBytetestRegister (void) |
int | DetectBytetestDoMatch (DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchCtx *ctx, const uint8_t *payload, uint32_t payload_len, uint8_t flags, int32_t offset, uint64_t value) |
Bytetest detection code. More... | |
Implements byte_test keyword.
Definition in file detect-bytetest.c.
#define PARSE_REGEX |
Definition at line 58 of file detect-bytetest.c.
#define VALID_KW "relative|big|little|string|oct|dec|hex|dce|bitmask" |
Regex for parsing our options.
Definition at line 57 of file detect-bytetest.c.
int DetectBytetestDoMatch | ( | DetectEngineThreadCtx * | det_ctx, |
const Signature * | s, | ||
const SigMatchCtx * | ctx, | ||
const uint8_t * | payload, | ||
uint32_t | payload_len, | ||
uint8_t | flags, | ||
int32_t | offset, | ||
uint64_t | value | ||
) |
Bytetest detection code.
Byte test works on the packet payload.
det_ctx | thread de ctx |
s | signature |
m | sigmatch for this bytettest |
payload | ptr to the start of the buffer to inspect |
payload_len | length of the payload |
1 | match |
0 | no match |
Definition at line 105 of file detect-bytetest.c.
References DetectBytetestData_::base, DetectBytetestData_::bitmask, DetectBytetestData_::bitmask_shift_count, DetectEngineThreadCtx_::buffer_offset, BYTE_BIG_ENDIAN, BYTE_LITTLE_ENDIAN, ByteExtractStringUint64(), ByteExtractUint64(), DETECT_BYTETEST_BITMASK, DETECT_BYTETEST_LITTLE, DETECT_BYTETEST_OP_AND, DETECT_BYTETEST_OP_EQ, DETECT_BYTETEST_OP_GE, DETECT_BYTETEST_OP_GT, DETECT_BYTETEST_OP_LE, DETECT_BYTETEST_OP_LT, DETECT_BYTETEST_OP_OR, DETECT_BYTETEST_RELATIVE, DETECT_BYTETEST_STRING, flags, len, DetectBytetestData_::nbytes, DetectBytetestData_::neg_op, offset, DetectBytetestData_::offset, DetectBytetestData_::op, payload_len, SCEnter, SCLogDebug, SCReturnInt, and DetectBytetestData_::value.
void DetectBytetestRegister | ( | void | ) |
Registration function for byte_test.
Definition at line 79 of file detect-bytetest.c.
References SigTableElmt_::desc, DETECT_BYTETEST, SigTableElmt_::Match, SigTableElmt_::name, sigmatch_table, and SigTableElmt_::url.
Referenced by SigTableSetup().