suricata
detect-content.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef SURICATA_DETECT_CONTENT_H
25 #define SURICATA_DETECT_CONTENT_H
26 
27 /* Flags affecting this content */
28 
29 #define DETECT_CONTENT_NOCASE BIT_U32(0)
30 #define DETECT_CONTENT_DISTANCE BIT_U32(1)
31 #define DETECT_CONTENT_WITHIN BIT_U32(2)
32 #define DETECT_CONTENT_OFFSET BIT_U32(3)
33 #define DETECT_CONTENT_DEPTH BIT_U32(4)
34 #define DETECT_CONTENT_FAST_PATTERN BIT_U32(5)
35 #define DETECT_CONTENT_FAST_PATTERN_ONLY BIT_U32(6)
36 #define DETECT_CONTENT_FAST_PATTERN_CHOP BIT_U32(7)
37 /** content applies to a "raw"/undecoded field if applicable */
38 #define DETECT_CONTENT_RAWBYTES BIT_U32(8)
39 /** content is negated */
40 #define DETECT_CONTENT_NEGATED BIT_U32(9)
41 
42 #define DETECT_CONTENT_ENDS_WITH BIT_U32(10)
43 
44 /* BE - byte extract */
45 #define DETECT_CONTENT_OFFSET_VAR BIT_U32(11)
46 #define DETECT_CONTENT_DEPTH_VAR BIT_U32(12)
47 #define DETECT_CONTENT_DISTANCE_VAR BIT_U32(13)
48 #define DETECT_CONTENT_WITHIN_VAR BIT_U32(14)
49 
50 /* replace data */
51 #define DETECT_CONTENT_REPLACE BIT_U32(15)
52 /* this flag is set during the staging phase. It indicates that a content
53  * has been added to the mpm phase and requires no further inspection inside
54  * the inspection phase */
55 #define DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED BIT_U32(16)
56 
57 #define DETECT_CONTENT_WITHIN_NEXT BIT_U32(17)
58 #define DETECT_CONTENT_DISTANCE_NEXT BIT_U32(18)
59 #define DETECT_CONTENT_STARTS_WITH BIT_U32(19)
60 /** MPM pattern selected by the engine or forced by fast_pattern keyword */
61 #define DETECT_CONTENT_MPM BIT_U32(20)
62 #define DETECT_CONTENT_WITHIN2DEPTH BIT_U32(21)
63 #define DETECT_CONTENT_DISTANCE2OFFSET BIT_U32(22)
64 
65 /** a relative match to this content is next, used in matching phase */
66 #define DETECT_CONTENT_RELATIVE_NEXT (DETECT_CONTENT_WITHIN_NEXT|DETECT_CONTENT_DISTANCE_NEXT)
67 
68 #define DETECT_CONTENT_IS_SINGLE(c) (!( ((c)->flags & DETECT_CONTENT_DISTANCE) || \
69  ((c)->flags & DETECT_CONTENT_WITHIN) || \
70  ((c)->flags & DETECT_CONTENT_RELATIVE_NEXT) || \
71  ((c)->flags & DETECT_CONTENT_DEPTH) || \
72  ((c)->flags & DETECT_CONTENT_OFFSET) ))
73 
74 /* if a pattern has no depth/offset limits, no relative specifiers and isn't
75  * chopped for the mpm, we can take the mpm and consider this pattern a match
76  * w/o further inspection. Warning: this may still mean other patterns depend
77  * on this pattern that force match validation anyway. */
78 #define DETECT_CONTENT_MPM_IS_CONCLUSIVE(c) \
79  !( ((c)->flags & DETECT_CONTENT_DISTANCE) || \
80  ((c)->flags & DETECT_CONTENT_WITHIN) || \
81  ((c)->flags & DETECT_CONTENT_DEPTH) || \
82  ((c)->flags & DETECT_CONTENT_OFFSET) || \
83  ((c)->flags & DETECT_CONTENT_FAST_PATTERN_CHOP))
84 
85 /*
86  * Values for distance, and within must be less than or equal
87  * to this value (absolute value where required).
88  */
89 #define DETECT_CONTENT_VALUE_MAX 1024 * 1024
90 
91 #include "util-spm.h"
92 
93 typedef struct DetectContentData_ {
94  uint8_t *content;
95  uint16_t content_len;
96  uint16_t replace_len;
97  /* for chopped fast pattern, the length */
98  uint16_t fp_chop_len;
99  /* for chopped fast pattern, the offset */
100  uint16_t fp_chop_offset;
101  /* would want to move PatIntId here and flags down to remove the padding
102  * gap, but I think the first four members was used as a template for
103  * casting. \todo check this and fix it if possible */
104  uint32_t flags;
106  uint16_t depth;
107  uint16_t offset;
108  int32_t distance;
109  int32_t within;
110  /* SPM search context. */
112  /* pointer to replacement data */
113  uint8_t *replace;
115 
116 /* prototypes */
117 void DetectContentRegister(void);
119  const char *contentstr);
120 int DetectContentDataParse(const char *keyword, const char *contentstr,
121  uint8_t **pstr, uint16_t *plen);
123  const char *contentstr);
124 
125 int DetectContentSetup(DetectEngineCtx *de_ctx, Signature *s, const char *contentstr);
127 
128 void DetectContentFree(DetectEngineCtx *, void *);
131 
132 void DetectContentPatternPrettyPrint(const DetectContentData *cd, char *str, size_t str_len);
134  const Signature *s, const int max, const SigMatch *sm, int *len, int *offset);
136 
137 #endif /* SURICATA_DETECT_CONTENT_H */
DetectContentData_::offset
uint16_t offset
Definition: detect-content.h:107
DetectContentRegister
void DetectContentRegister(void)
Definition: detect-content.c:58
DetectContentData
struct DetectContentData_ DetectContentData
len
uint8_t len
Definition: app-layer-dnp3.h:2
DetectContentData_::fp_chop_len
uint16_t fp_chop_len
Definition: detect-content.h:98
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
DetectContentPMATCHValidateCallback
bool DetectContentPMATCHValidateCallback(const Signature *s)
Definition: detect-content.c:454
DetectContentData_::within
int32_t within
Definition: detect-content.h:109
DetectContentSetup
int DetectContentSetup(DetectEngineCtx *de_ctx, Signature *s, const char *contentstr)
Function to setup a content pattern.
Definition: detect-content.c:328
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:836
DetectContentDataParse
int DetectContentDataParse(const char *keyword, const char *contentstr, uint8_t **pstr, uint16_t *plen)
Parse a content string, ie "abc|DE|fgh".
Definition: detect-content.c:83
PatIntId
#define PatIntId
Definition: suricata-common.h:318
DetectContentData_
Definition: detect-content.h:93
DetectContentData_::fp_chop_offset
uint16_t fp_chop_offset
Definition: detect-content.h:100
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectContentFree
void DetectContentFree(DetectEngineCtx *, void *)
this function will SCFree memory associated with DetectContentData
Definition: detect-content.c:372
SigParseRequiredContentSize
void SigParseRequiredContentSize(const Signature *s, const int max, const SigMatch *sm, int *len, int *offset)
Determine the size needed to accommodate the content elements of a signature.
Definition: detect-content.c:408
DetectContentParseEncloseQuotes
DetectContentData * DetectContentParseEncloseQuotes(SpmGlobalThreadCtx *spm_global_thread_ctx, const char *contentstr)
Definition: detect-content.c:253
DetectContentData_::id
PatIntId id
Definition: detect-content.h:105
DetectContentData_::depth
uint16_t depth
Definition: detect-content.h:106
DetectContentPrint
void DetectContentPrint(DetectContentData *)
Helper function to print a DetectContentData.
Definition: detect-content.c:262
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:104
DetectContentData_::replace_len
uint16_t replace_len
Definition: detect-content.h:96
DetectContentData_::replace
uint8_t * replace
Definition: detect-content.h:113
SpmCtx_
Definition: util-spm.h:40
DetectContentParse
DetectContentData * DetectContentParse(SpmGlobalThreadCtx *spm_global_thread_ctx, const char *contentstr)
DetectContentParse \initonly.
Definition: detect-content.c:211
DetectContentData_::distance
int32_t distance
Definition: detect-content.h:108
util-spm.h
DetectContentData_::content
uint8_t * content
Definition: detect-content.h:94
DetectContentPropagateLimits
void DetectContentPropagateLimits(Signature *s)
Definition: detect-content.c:716
SpmGlobalThreadCtx_
Definition: util-spm.h:47
DetectContentData_::spm_ctx
SpmCtx * spm_ctx
Definition: detect-content.h:111
str
#define str(s)
Definition: suricata-common.h:291
Signature_
Signature container.
Definition: detect.h:593
SigMatch_
a single match condition for a signature
Definition: detect.h:347
DetectContentConvertToNocase
int DetectContentConvertToNocase(DetectEngineCtx *de_ctx, DetectContentData *cd)
Definition: detect-content.c:765
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:95
DetectContentPatternPrettyPrint
void DetectContentPatternPrettyPrint(const DetectContentData *cd, char *str, size_t str_len)
Definition: detect-content.c:744