105 const uint8_t *buffer, uint32_t buffer_len,
106 uint32_t stream_start_offset, uint8_t
flags,
107 uint8_t inspection_mode)
120 if (smd == NULL || buffer_len == 0) {
129 SCLogDebug(
"inspecting content %"PRIu32
" buffer_len %"PRIu32, cd->
id, buffer_len);
145 const uint8_t *found = NULL;
147 uint32_t depth = buffer_len;
148 uint32_t prev_offset = 0;
156 offset = prev_buffer_offset;
164 if (distance < 0 && (uint32_t)(abs(distance)) >
offset)
169 SCLogDebug(
"cd->distance %"PRIi32
", offset %"PRIu32
", depth %"PRIu32,
175 if ((int32_t)depth > (int32_t)(prev_buffer_offset + det_ctx->
byte_values[cd->
within] + distance)) {
179 if ((int32_t)depth > (int32_t)(prev_buffer_offset + cd->
within + distance)) {
180 depth = prev_buffer_offset + cd->
within + distance;
183 SCLogDebug(
"cd->within %"PRIi32
", det_ctx->buffer_offset %"PRIu32
", depth %"PRIu32,
184 cd->
within, prev_buffer_offset, depth);
187 if (stream_start_offset != 0 && prev_buffer_offset == 0) {
188 if (depth <= stream_start_offset) {
190 }
else if (depth >= (stream_start_offset + buffer_len)) {
193 depth = depth - stream_start_offset;
203 if (cd->
depth != 0) {
204 if ((cd->
depth + prev_buffer_offset) < depth) {
205 depth = prev_buffer_offset + cd->
depth;
226 if (cd->
depth != 0) {
232 if (depth <= stream_start_offset) {
234 }
else if (depth >= (stream_start_offset + buffer_len)) {
237 depth = depth - stream_start_offset;
246 prev_buffer_offset = 0;
259 if (prev_offset != 0)
264 if (depth > buffer_len)
269 if (
offset > depth || depth == 0) {
277 const uint8_t *sbuffer = buffer +
offset;
278 uint32_t sbuffer_len = depth -
offset;
279 uint32_t match_offset = 0;
280 SCLogDebug(
"sbuffer_len %"PRIu32, sbuffer_len);
282 BUG_ON(sbuffer_len > buffer_len);
285 SCLogDebug(
"depth < buffer_len while DETECT_CONTENT_ENDS_WITH is set. Can't possibly match.");
311 SCLogDebug(
"content %"PRIu32
" matched at offset %"PRIu32
", but negated so no match", cd->
id, match_offset);
318 match_offset = (uint32_t)((found - buffer) + cd->
content_len);
319 SCLogDebug(
"content %"PRIu32
" matched at offset %"PRIu32
"", cd->
id, match_offset);
346 p, f, buffer, buffer_len, stream_start_offset,
flags,
354 SCLogDebug(
"'next sm' said to discontinue this right now");
360 SCLogDebug(
"'next sm' does not depend on me, so we can give up");
365 SCLogDebug(
"'next sm' depends on me %p, lets see what we can do (flags %u)", cd, cd->
flags);
368 prev_offset = (match_offset - (cd->
content_len - 1));
369 SCLogDebug(
"trying to see if there is another match after prev_offset %"PRIu32, prev_offset);
378 uint32_t dataat = id->
dataat;
381 if (be_value >= 100000000) {
383 SCLogDebug(
"extracted value %"PRIu64
" very big: no match", be_value);
386 SCLogDebug(
"extracted value way %"PRIu64
" very big: match", be_value);
389 dataat = (uint32_t)be_value;
390 SCLogDebug(
"isdataat: using value %u from byte_extract local_id %u", dataat, id->
dataat);
395 SCLogDebug(
"det_ctx->buffer_offset + dataat %"PRIu32
" > %"PRIu32, det_ctx->
buffer_offset + dataat, buffer_len);
406 if (dataat < buffer_len) {
412 SCLogDebug(
"absolute isdataat mismatch, id->isdataat %"PRIu32
", buffer_len %"PRIu32
"", dataat, buffer_len);
423 uint32_t prev_offset = 0;
435 SCLogDebug(
"no relative match coming up, so this is a match");
447 p, f, buffer, buffer_len, stream_start_offset,
flags,
462 uint8_t btflags = btd->
flags;
464 uint64_t value = btd->
value;
469 value = det_ctx->byte_values[value];
490 uint16_t bjflags = bjd->
flags;
516 uint8_t endian = bed->
endian;
532 &det_ctx->byte_values[bed->
local_id],
537 SCLogDebug(
"[BE] Fetched value for index %d: %"PRIu64,
544 uint8_t endian = bmd->
endian;
559 rvalue = det_ctx->byte_values[bmd->
local_id];
568 &det_ctx->byte_values[bmd->
local_id],
573 SCLogDebug(
"[BM] Fetched value for index %d: %"PRIu64,
580 const uint64_t data_size = buffer_len + stream_start_offset;
583 det_ctx->discontinue_matching = 1;
599 det_ctx->discontinue_matching = 1;
610 det_ctx->discontinue_matching = 1;
619 switch (urilend->
mode) {
621 if (buffer_len == urilend->
urilen1)
625 if (buffer_len < urilend->urilen1)
629 if (buffer_len > urilend->
urilen1)
633 if (buffer_len > urilend->
urilen1 &&
634 buffer_len < urilend->urilen2) {
644 det_ctx->discontinue_matching = 0;
653 det_ctx->buffer_offset, f) != 1)
688 p, f, buffer, buffer_len, stream_start_offset,
flags,