109 Packet *p,
Flow *f,
const uint8_t *buffer,
const uint32_t buffer_len,
110 const uint32_t stream_start_offset,
const uint8_t
flags,
116 ctx->recursion.count++;
123 if (smd == NULL || buffer == NULL) {
130 SCLogDebug(
"inspecting content %"PRIu32
" buffer_len %"PRIu32, cd->
id, buffer_len);
146 uint32_t prev_offset = 0;
150 uint32_t depth = buffer_len;
155 offset = prev_buffer_offset;
162 if (distance < 0 && (uint32_t)(abs(distance)) >
offset)
167 SCLogDebug(
"cd->distance %"PRIi32
", offset %"PRIu32
", depth %"PRIu32,
173 if ((int32_t)depth > (int32_t)(prev_buffer_offset + det_ctx->
byte_values[cd->
within] + distance)) {
177 if ((int32_t)depth > (int32_t)(prev_buffer_offset + cd->
within + distance)) {
178 depth = prev_buffer_offset + cd->
within + distance;
181 SCLogDebug(
"cd->within %"PRIi32
", det_ctx->buffer_offset %"PRIu32
", depth %"PRIu32,
182 cd->
within, prev_buffer_offset, depth);
185 if (stream_start_offset != 0 && prev_buffer_offset == 0) {
186 if (depth <= stream_start_offset) {
188 }
else if (depth >= (stream_start_offset + buffer_len)) {
191 depth = depth - stream_start_offset;
201 if (cd->
depth != 0) {
202 if ((cd->
depth + prev_buffer_offset) < depth) {
203 depth = prev_buffer_offset + cd->
depth;
224 if (cd->
depth != 0) {
230 if (depth <= stream_start_offset) {
232 }
else if (depth >= (stream_start_offset + buffer_len)) {
235 depth = depth - stream_start_offset;
244 prev_buffer_offset = 0;
257 if (prev_offset != 0)
262 if (depth > buffer_len)
267 if (
offset > depth || depth == 0) {
275 const uint8_t *sbuffer = buffer +
offset;
276 uint32_t sbuffer_len = depth -
offset;
277 SCLogDebug(
"sbuffer_len %" PRIu32
" depth: %" PRIu32
", buffer_len: %" PRIu32,
278 sbuffer_len, depth, buffer_len);
280 BUG_ON(sbuffer_len > buffer_len);
282 const uint8_t *found;
284 SCLogDebug(
"depth < buffer_len while DETECT_CONTENT_ENDS_WITH is set. Can't possibly match.");
302 goto no_match_discontinue;
311 uint32_t match_offset = (uint32_t)((found - buffer) + cd->
content_len);
313 SCLogDebug(
"content %" PRIu32
" matched at offset %" PRIu32
314 ", but negated so no match",
315 cd->
id, match_offset);
321 if (sbuffer_len != match_offset) {
322 SCLogDebug(
"content \"%s\" %" PRIu32
" matched at offset %" PRIu32
323 ", but not at end of buffer so match",
329 goto no_match_discontinue;
334 SCLogDebug(
"content %" PRIu32
" matched at offset %" PRIu32
"", cd->
id, match_offset);
361 int r = DetectEngineContentInspectionInternal(det_ctx,
ctx, s, smd + 1, p, f,
362 buffer, buffer_len, stream_start_offset,
flags, inspection_mode);
365 }
else if (r == -1) {
366 SCLogDebug(
"'next sm' said to discontinue this right now");
373 SCLogDebug(
"'next sm' does not depend on me, so we can give up");
377 SCLogDebug(
"'next sm' depends on me %p, lets see what we can do (flags %u)", cd,
381 prev_offset = (match_offset - (cd->
content_len - 1));
382 SCLogDebug(
"trying to see if there is another match after prev_offset %" PRIu32,
397 uint32_t dataat =
id->dataat;
400 if (be_value >= 100000000) {
402 SCLogDebug(
"extracted value %"PRIu64
" very big: no match", be_value);
405 SCLogDebug(
"extracted value way %"PRIu64
" very big: match", be_value);
408 dataat = (uint32_t)be_value;
409 SCLogDebug(
"isdataat: using value %u from byte_extract local_id %u", dataat,
id->dataat);
414 SCLogDebug(
"det_ctx->buffer_offset + dataat %"PRIu32
" > %"PRIu32, det_ctx->
buffer_offset + dataat, buffer_len);
418 goto no_match_discontinue;
429 if (dataat < buffer_len) {
433 goto no_match_discontinue;
439 SCLogDebug(
"absolute isdataat mismatch, id->isdataat %"PRIu32
", buffer_len %"PRIu32
"", dataat, buffer_len);
443 goto no_match_discontinue;
453 uint32_t prev_offset = 0;
462 SCLogDebug(
"no relative match coming up, so this is a match");
473 r = DetectEngineContentInspectionInternal(det_ctx,
ctx, s, smd + 1, p, f, buffer,
474 buffer_len, stream_start_offset,
flags, inspection_mode);
477 }
else if (r == -1) {
481 if (prev_offset == 0) {
497 uint16_t btflags = btd->
flags;
499 uint64_t value = btd->
value;
500 int32_t nbytes = btd->
nbytes;
529 uint16_t bjflags = bjd->
flags;
553 det_ctx, s, smd->
ctx, buffer, buffer_len, bjflags, nbytes,
offset)) {
561 const SCDetectByteExtractData *bed = (
const SCDetectByteExtractData *)smd->
ctx;
562 uint8_t endian = bed->endian;
566 if ((bed->flags & DETECT_BYTE_EXTRACT_FLAG_ENDIAN) && endian == EndianDCE &&
575 &det_ctx->
byte_values[bed->local_id], endian) != 1) {
579 SCLogDebug(
"[BE] Fetched value for index %d: %"PRIu64,
580 bed->local_id, det_ctx->
byte_values[bed->local_id]);
585 const DetectByteMathData *bmd = (
const DetectByteMathData *)smd->
ctx;
586 uint8_t endian = bmd->endian;
590 if ((bmd->flags & DETECT_BYTEMATH_FLAG_ENDIAN) && endian == (int)EndianDCE &&
597 if (bmd->flags & DETECT_BYTEMATH_FLAG_RVALUE_VAR) {
600 rvalue = bmd->rvalue;
604 if (bmd->flags & DETECT_BYTEMATH_FLAG_NBYTES_VAR) {
605 nbytes = (uint8_t)det_ctx->
byte_values[bmd->nbytes];
607 nbytes = bmd->nbytes;
611 &det_ctx->
byte_values[bmd->local_id], endian) != 1) {
615 SCLogDebug(
"[BM] Fetched value for index %d: %"PRIu64,
616 bmd->local_id, det_ctx->
byte_values[bmd->local_id]);
622 const uint64_t data_size = buffer_len + stream_start_offset;
625 goto no_match_discontinue;
639 goto no_match_discontinue;
649 goto no_match_discontinue;
655 const DetectUrilenData *urilend = (
const DetectUrilenData *)smd->
ctx;
656 if (buffer_len > UINT16_MAX) {
665 goto no_match_discontinue;
682 int r = DetectEngineContentInspectionInternal(det_ctx,
ctx, s,
711 no_match_discontinue:
720 int r = DetectEngineContentInspectionInternal(det_ctx,
ctx, s, smd + 1, p, f, buffer,
721 buffer_len, stream_start_offset,
flags, inspection_mode);
735 const uint32_t buffer_len,
const uint32_t stream_start_offset,
const uint8_t
flags,
742 int r = DetectEngineContentInspectionInternal(det_ctx, &
ctx, s, smd, p, f, buffer, buffer_len,
743 stream_start_offset,
flags, inspection_mode);
766 int r = DetectEngineContentInspectionInternal(det_ctx, &
ctx, s, smd, p, f, b->
inspect,
780 bool absent_data =
false;