suricata
|
Go to the source code of this file.
Data Structures | |
struct | DetectBytetestData_ |
Macros | |
#define | DETECT_BYTETEST_OP_LT 1 |
#define | DETECT_BYTETEST_OP_GT 2 |
#define | DETECT_BYTETEST_OP_EQ 3 |
#define | DETECT_BYTETEST_OP_AND 4 |
#define | DETECT_BYTETEST_OP_OR 5 |
#define | DETECT_BYTETEST_OP_GE 6 |
#define | DETECT_BYTETEST_OP_LE 7 |
#define | DETECT_BYTETEST_BASE_UNSET 0 |
#define | DETECT_BYTETEST_BASE_OCT 8 |
#define | DETECT_BYTETEST_BASE_DEC 10 |
#define | DETECT_BYTETEST_BASE_HEX 16 |
#define | DETECT_BYTETEST_NEGOP 0x01 |
#define | DETECT_BYTETEST_LITTLE 0x02 |
#define | DETECT_BYTETEST_BIG 0x04 |
#define | DETECT_BYTETEST_STRING 0x08 |
#define | DETECT_BYTETEST_RELATIVE 0x10 |
#define | DETECT_BYTETEST_DCE 0x20 |
#define | DETECT_BYTETEST_VALUE_BE 0x40 |
#define | DETECT_BYTETEST_OFFSET_BE 0x80 |
Typedefs | |
typedef struct DetectBytetestData_ | DetectBytetestData |
Functions | |
void | DetectBytetestRegister (void) |
int | DetectBytetestDoMatch (DetectEngineThreadCtx *, const Signature *, const SigMatchCtx *ctx, const uint8_t *, uint32_t, uint8_t, int32_t, uint64_t) |
Bytetest detection code. More... | |
Definition in file detect-bytetest.h.
#define DETECT_BYTETEST_BASE_DEC 10 |
"dec" type value string
Definition at line 39 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_BASE_HEX 16 |
"hex" type value string
Definition at line 40 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_BASE_OCT 8 |
"oct" type value string
Definition at line 38 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_BASE_UNSET 0 |
Bytetest Base Unset type value string (automatic)
Definition at line 37 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_BIG 0x04 |
"bi" endian value
Definition at line 45 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_DCE 0x20 |
dce enabled
Definition at line 48 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch(), and DetectEngineContentInspection().
#define DETECT_BYTETEST_LITTLE 0x02 |
"little" endian value
Definition at line 44 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch(), and DetectEngineContentInspection().
#define DETECT_BYTETEST_NEGOP 0x01 |
Bytetest Flags "!" negated operator
Definition at line 43 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_OFFSET_BE 0x80 |
byte extract value enabled
Definition at line 50 of file detect-bytetest.h.
Referenced by DetectByteExtractRetrieveSMVar(), DetectBytetestDoMatch(), and DetectEngineContentInspection().
#define DETECT_BYTETEST_OP_AND 4 |
"bitwise and" operator
Definition at line 31 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_OP_EQ 3 |
"equals" operator
Definition at line 30 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_OP_GE 6 |
greater than equal operator
Definition at line 33 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_OP_GT 2 |
"greater than" operator
Definition at line 29 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_OP_LE 7 |
less than equal operator
Definition at line 34 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_OP_LT 1 |
Bytetest Operators "less than" operator
Definition at line 28 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_OP_OR 5 |
"bitwise or" operator
Definition at line 32 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_RELATIVE 0x10 |
"relative" offset
Definition at line 47 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_STRING 0x08 |
"string" value
Definition at line 46 of file detect-bytetest.h.
Referenced by DetectBytetestDoMatch().
#define DETECT_BYTETEST_VALUE_BE 0x40 |
byte extract value enabled
Definition at line 49 of file detect-bytetest.h.
Referenced by DetectByteExtractRetrieveSMVar(), DetectBytetestDoMatch(), and DetectEngineContentInspection().
typedef struct DetectBytetestData_ DetectBytetestData |
int DetectBytetestDoMatch | ( | DetectEngineThreadCtx * | det_ctx, |
const Signature * | s, | ||
const SigMatchCtx * | ctx, | ||
const uint8_t * | payload, | ||
uint32_t | payload_len, | ||
uint8_t | flags, | ||
int32_t | offset, | ||
uint64_t | value | ||
) |
Bytetest detection code.
Byte test works on the packet payload.
det_ctx | thread de ctx |
s | signature |
m | sigmatch for this bytettest |
payload | ptr to the start of the buffer to inspect |
payload_len | length of the payload |
1 | match |
0 | no match |
Definition at line 96 of file detect-bytetest.c.
References ALPROTO_DCERPC, DetectBytetestData_::base, DetectEngineThreadCtx_::buffer_offset, BYTE_BIG_ENDIAN, BYTE_LITTLE_ENDIAN, ByteExtractStringInt32(), ByteExtractStringUint32(), ByteExtractStringUint64(), ByteExtractUint64(), SigMatch_::ctx, DE_QUIET, DETECT_BYTE_EXTRACT, DETECT_BYTEJUMP, DETECT_BYTETEST, DETECT_BYTETEST_BASE_DEC, DETECT_BYTETEST_BASE_HEX, DETECT_BYTETEST_BASE_OCT, DETECT_BYTETEST_BASE_UNSET, DETECT_BYTETEST_BIG, DETECT_BYTETEST_DCE, DETECT_BYTETEST_LITTLE, DETECT_BYTETEST_NEGOP, DETECT_BYTETEST_OFFSET_BE, DETECT_BYTETEST_OP_AND, DETECT_BYTETEST_OP_EQ, DETECT_BYTETEST_OP_GE, DETECT_BYTETEST_OP_GT, DETECT_BYTETEST_OP_LE, DETECT_BYTETEST_OP_LT, DETECT_BYTETEST_OP_OR, DETECT_BYTETEST_RELATIVE, DETECT_BYTETEST_STRING, DETECT_BYTETEST_VALUE_BE, DETECT_CONTENT, DETECT_CONTENT_RELATIVE_NEXT, DETECT_ISDATAAT, DETECT_PCRE, DETECT_PCRE_RELATIVE_NEXT, DETECT_SM_LIST_NOTSET, DETECT_SM_LIST_PMATCH, DetectBufferGetActiveList(), DetectBufferTypeGetByName(), DetectByteExtractRetrieveSMVar(), DetectBytetestDoMatch(), DetectEngineCtxFree(), DetectEngineCtxInit(), DetectGetLastSMFromLists(), DetectSignatureSetAppProto(), DetectPcreData_::flags, DetectBytetestData_::flags, DetectContentData_::flags, DetectEngineCtx_::flags, Signature_::init_data, len, SignatureInitData_::list, MAX_SUBSTRINGS, DetectBytetestData_::nbytes, Signature_::next, DetectBytetestData_::offset, offset, DetectBytetestData_::op, Packet_::payload, Packet_::payload_len, res, SC_ERR_CONFLICTING_RULE_KEYWORDS, SC_ERR_INVALID_ARGUMENT, SC_ERR_INVALID_OPERATOR, SC_ERR_INVALID_SIGNATURE, SC_ERR_INVALID_VALUE, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_PARSE, SC_ERR_UNKNOWN_VALUE, SCEnter, SCFree, SCLogDebug, SCLogError, SCMalloc, SCReturnInt, SCStrdup, DetectEngineCtx_::sig_list, SigAlloc(), SigCleanSignatures(), SigFree(), SigGroupCleanup(), SigInit(), SigMatchAlloc(), SigMatchAppendSMToList(), SigMatchListSMBelongsTo(), SigMatch_::type, unlikely, UTHBuildPacket(), UTHFreePacket(), UTHPacketMatchSig(), UtRegisterTest(), and DetectBytetestData_::value.
Referenced by DetectBytetestDoMatch(), and DetectEngineContentInspection().
void DetectBytetestRegister | ( | void | ) |
Registration function for byte_test.
Definition at line 71 of file detect-bytetest.c.
References SigTableElmt_::desc, DETECT_BYTETEST, DetectSetupParseRegexes(), DOC_URL, DOC_VERSION, SigTableElmt_::Free, SigTableElmt_::Match, SigTableElmt_::name, PARSE_REGEX, SigTableElmt_::RegisterTests, SigTableElmt_::Setup, sigmatch_table, and SigTableElmt_::url.
Referenced by SigTableSetup().