suricata
detect-bytetest.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  DetectBytetestData_
 

Macros

#define DETECT_BYTETEST_OP_LT   1
 
#define DETECT_BYTETEST_OP_GT   2
 
#define DETECT_BYTETEST_OP_EQ   3
 
#define DETECT_BYTETEST_OP_AND   4
 
#define DETECT_BYTETEST_OP_OR   5
 
#define DETECT_BYTETEST_OP_GE   6
 
#define DETECT_BYTETEST_OP_LE   7
 
#define DETECT_BYTETEST_BASE_UNSET   0
 
#define DETECT_BYTETEST_BASE_OCT   8
 
#define DETECT_BYTETEST_BASE_DEC   10
 
#define DETECT_BYTETEST_BASE_HEX   16
 
#define DETECT_BYTETEST_LITTLE   BIT_U16(0)
 
#define DETECT_BYTETEST_BIG   BIT_U16(1)
 
#define DETECT_BYTETEST_STRING   BIT_U16(2)
 
#define DETECT_BYTETEST_RELATIVE   BIT_U16(3)
 
#define DETECT_BYTETEST_DCE   BIT_U16(4)
 
#define DETECT_BYTETEST_BITMASK   BIT_U16(5)
 
#define DETECT_BYTETEST_VALUE_VAR   BIT_U16(6)
 
#define DETECT_BYTETEST_OFFSET_VAR   BIT_U16(7)
 
#define DETECT_BYTETEST_NBYTES_VAR   BIT_U16(8)
 

Typedefs

typedef struct DetectBytetestData_ DetectBytetestData
 

Functions

void DetectBytetestRegister (void)
 
int DetectBytetestDoMatch (DetectEngineThreadCtx *, const Signature *, const SigMatchCtx *ctx, const uint8_t *, uint32_t, uint16_t, int32_t, int32_t, uint64_t)
 Bytetest detection code. More...
 

Detailed Description

Author
Brian Rectanus brect.nosp@m.anu@.nosp@m.gmail.nosp@m..com

Definition in file detect-bytetest.h.

Macro Definition Documentation

◆ DETECT_BYTETEST_BASE_DEC

#define DETECT_BYTETEST_BASE_DEC   10

"dec" type value string

Definition at line 40 of file detect-bytetest.h.

◆ DETECT_BYTETEST_BASE_HEX

#define DETECT_BYTETEST_BASE_HEX   16

"hex" type value string

Definition at line 41 of file detect-bytetest.h.

◆ DETECT_BYTETEST_BASE_OCT

#define DETECT_BYTETEST_BASE_OCT   8

"oct" type value string

Definition at line 39 of file detect-bytetest.h.

◆ DETECT_BYTETEST_BASE_UNSET

#define DETECT_BYTETEST_BASE_UNSET   0

Bytetest Base Unset type value string (automatic)

Definition at line 38 of file detect-bytetest.h.

◆ DETECT_BYTETEST_BIG

#define DETECT_BYTETEST_BIG   BIT_U16(1)

"bi" endian value

Definition at line 45 of file detect-bytetest.h.

◆ DETECT_BYTETEST_BITMASK

#define DETECT_BYTETEST_BITMASK   BIT_U16(5)

bitmask supplied

Definition at line 49 of file detect-bytetest.h.

◆ DETECT_BYTETEST_DCE

#define DETECT_BYTETEST_DCE   BIT_U16(4)

dce enabled

Definition at line 48 of file detect-bytetest.h.

◆ DETECT_BYTETEST_LITTLE

#define DETECT_BYTETEST_LITTLE   BIT_U16(0)

Bytetest Flags "little" endian value

Definition at line 44 of file detect-bytetest.h.

◆ DETECT_BYTETEST_NBYTES_VAR

#define DETECT_BYTETEST_NBYTES_VAR   BIT_U16(8)

byte extract value enabled

Definition at line 52 of file detect-bytetest.h.

◆ DETECT_BYTETEST_OFFSET_VAR

#define DETECT_BYTETEST_OFFSET_VAR   BIT_U16(7)

byte extract value enabled

Definition at line 51 of file detect-bytetest.h.

◆ DETECT_BYTETEST_OP_AND

#define DETECT_BYTETEST_OP_AND   4

"bitwise and" operator

Definition at line 32 of file detect-bytetest.h.

◆ DETECT_BYTETEST_OP_EQ

#define DETECT_BYTETEST_OP_EQ   3

"equals" operator

Definition at line 31 of file detect-bytetest.h.

◆ DETECT_BYTETEST_OP_GE

#define DETECT_BYTETEST_OP_GE   6

greater than equal operator

Definition at line 34 of file detect-bytetest.h.

◆ DETECT_BYTETEST_OP_GT

#define DETECT_BYTETEST_OP_GT   2

"greater than" operator

Definition at line 30 of file detect-bytetest.h.

◆ DETECT_BYTETEST_OP_LE

#define DETECT_BYTETEST_OP_LE   7

less than equal operator

Definition at line 35 of file detect-bytetest.h.

◆ DETECT_BYTETEST_OP_LT

#define DETECT_BYTETEST_OP_LT   1

Bytetest Operators "less than" operator

Definition at line 29 of file detect-bytetest.h.

◆ DETECT_BYTETEST_OP_OR

#define DETECT_BYTETEST_OP_OR   5

"bitwise or" operator

Definition at line 33 of file detect-bytetest.h.

◆ DETECT_BYTETEST_RELATIVE

#define DETECT_BYTETEST_RELATIVE   BIT_U16(3)

"relative" offset

Definition at line 47 of file detect-bytetest.h.

◆ DETECT_BYTETEST_STRING

#define DETECT_BYTETEST_STRING   BIT_U16(2)

"string" value

Definition at line 46 of file detect-bytetest.h.

◆ DETECT_BYTETEST_VALUE_VAR

#define DETECT_BYTETEST_VALUE_VAR   BIT_U16(6)

byte extract value enabled

Definition at line 50 of file detect-bytetest.h.

Typedef Documentation

◆ DetectBytetestData

Function Documentation

◆ DetectBytetestDoMatch()

int DetectBytetestDoMatch ( DetectEngineThreadCtx det_ctx,
const Signature s,
const SigMatchCtx ctx,
const uint8_t *  payload,
uint32_t  payload_len,
uint16_t  flags,
int32_t  offset,
int32_t  nbytes,
uint64_t  value 
)

Bytetest detection code.

Byte test works on the packet payload.

Parameters
det_ctxthread de ctx
ssignature
msigmatch for this bytetest
payloadptr to the start of the buffer to inspect
payload_lenlength of the payload
Return values
1match
0no match

Definition at line 154 of file detect-bytetest.c.

References ctx, DETECT_BYTETEST_NBYTES_VAR, DetectBytetestData_::flags, payload_len, SCEnter, and SCReturnInt.

◆ DetectBytetestRegister()

void DetectBytetestRegister ( void  )

Registration function for byte_test.

Todo:
add support for no_stream and stream_only

Definition at line 77 of file detect-bytetest.c.

References SigTableElmt_::desc, DETECT_BYTETEST, SigTableElmt_::name, SigTableElmt_::Setup, sigmatch_table, and SigTableElmt_::url.

Referenced by SigTableSetup().

Here is the caller graph for this function: