110 Packet *p,
Flow *f,
const uint8_t *buffer,
const uint32_t buffer_len,
111 const uint32_t stream_start_offset,
const uint8_t
flags,
124 if (smd == NULL || buffer == NULL) {
131 SCLogDebug(
"inspecting content %"PRIu32
" buffer_len %"PRIu32, cd->
id, buffer_len);
147 uint32_t prev_offset = 0;
151 uint32_t depth = buffer_len;
156 offset = prev_buffer_offset;
163 if (distance < 0 && (uint32_t)(abs(distance)) >
offset)
168 SCLogDebug(
"cd->distance %"PRIi32
", offset %"PRIu32
", depth %"PRIu32,
174 if ((int32_t)depth > (int32_t)(prev_buffer_offset + det_ctx->
byte_values[cd->
within] + distance)) {
178 if ((int32_t)depth > (int32_t)(prev_buffer_offset + cd->
within + distance)) {
179 depth = prev_buffer_offset + cd->
within + distance;
182 SCLogDebug(
"cd->within %"PRIi32
", det_ctx->buffer_offset %"PRIu32
", depth %"PRIu32,
183 cd->
within, prev_buffer_offset, depth);
186 if (stream_start_offset != 0 && prev_buffer_offset == 0) {
187 if (depth <= stream_start_offset) {
189 }
else if (depth >= (stream_start_offset + buffer_len)) {
192 depth = depth - stream_start_offset;
202 if (cd->
depth != 0) {
203 if ((cd->
depth + prev_buffer_offset) < depth) {
204 depth = prev_buffer_offset + cd->
depth;
225 if (cd->
depth != 0) {
231 if (depth <= stream_start_offset) {
233 }
else if (depth >= (stream_start_offset + buffer_len)) {
236 depth = depth - stream_start_offset;
245 prev_buffer_offset = 0;
258 if (prev_offset != 0)
263 if (depth > buffer_len)
268 if (
offset > depth || depth == 0) {
276 const uint8_t *sbuffer = buffer +
offset;
277 uint32_t sbuffer_len = depth -
offset;
278 SCLogDebug(
"sbuffer_len %" PRIu32
" depth: %" PRIu32
", buffer_len: %" PRIu32,
279 sbuffer_len, depth, buffer_len);
281 BUG_ON(sbuffer_len > buffer_len);
283 const uint8_t *found;
285 SCLogDebug(
"depth < buffer_len while DETECT_CONTENT_ENDS_WITH is set. Can't possibly match.");
303 goto no_match_discontinue;
312 uint32_t match_offset = (uint32_t)((found - buffer) + cd->
content_len);
314 SCLogDebug(
"content %" PRIu32
" matched at offset %" PRIu32
315 ", but negated so no match",
316 cd->
id, match_offset);
322 if (sbuffer_len != match_offset) {
323 SCLogDebug(
"content \"%s\" %" PRIu32
" matched at offset %" PRIu32
324 ", but not at end of buffer so match",
330 goto no_match_discontinue;
335 SCLogDebug(
"content %" PRIu32
" matched at offset %" PRIu32
"", cd->
id, match_offset);
362 int r = DetectEngineContentInspectionInternal(det_ctx, ctx, s, smd + 1, p, f,
363 buffer, buffer_len, stream_start_offset,
flags, inspection_mode);
366 }
else if (r == -1) {
367 SCLogDebug(
"'next sm' said to discontinue this right now");
374 SCLogDebug(
"'next sm' does not depend on me, so we can give up");
378 SCLogDebug(
"'next sm' depends on me %p, lets see what we can do (flags %u)", cd,
382 prev_offset = (match_offset - (cd->
content_len - 1));
383 SCLogDebug(
"trying to see if there is another match after prev_offset %" PRIu32,
391 uint32_t dataat = id->
dataat;
394 if (be_value >= 100000000) {
396 SCLogDebug(
"extracted value %"PRIu64
" very big: no match", be_value);
399 SCLogDebug(
"extracted value way %"PRIu64
" very big: match", be_value);
402 dataat = (uint32_t)be_value;
403 SCLogDebug(
"isdataat: using value %u from byte_extract local_id %u", dataat, id->
dataat);
408 SCLogDebug(
"det_ctx->buffer_offset + dataat %"PRIu32
" > %"PRIu32, det_ctx->
buffer_offset + dataat, buffer_len);
412 goto no_match_discontinue;
423 if (dataat < buffer_len) {
427 goto no_match_discontinue;
433 SCLogDebug(
"absolute isdataat mismatch, id->isdataat %"PRIu32
", buffer_len %"PRIu32
"", dataat, buffer_len);
437 goto no_match_discontinue;
447 uint32_t prev_offset = 0;
457 SCLogDebug(
"no relative match coming up, so this is a match");
468 r = DetectEngineContentInspectionInternal(det_ctx, ctx, s, smd + 1, p, f, buffer,
469 buffer_len, stream_start_offset,
flags, inspection_mode);
472 }
else if (r == -1) {
482 uint16_t btflags = btd->
flags;
484 uint64_t value = btd->
value;
485 int32_t nbytes = btd->
nbytes;
514 uint16_t bjflags = bjd->
flags;
538 det_ctx, s, smd->
ctx, buffer, buffer_len, bjflags, nbytes,
offset)) {
547 uint8_t endian = bed->
endian;
566 SCLogDebug(
"[BE] Fetched value for index %d: %"PRIu64,
572 const DetectByteMathData *bmd = (
const DetectByteMathData *)smd->
ctx;
573 uint8_t endian = bmd->endian;
577 if ((bmd->flags & DETECT_BYTEMATH_FLAG_ENDIAN) && endian == (int)EndianDCE &&
584 if (bmd->flags & DETECT_BYTEMATH_FLAG_RVALUE_VAR) {
587 rvalue = bmd->rvalue;
591 if (bmd->flags & DETECT_BYTEMATH_FLAG_NBYTES_VAR) {
592 nbytes = (uint8_t)det_ctx->
byte_values[bmd->nbytes];
594 nbytes = bmd->nbytes;
598 &det_ctx->
byte_values[bmd->local_id], endian) != 1) {
602 SCLogDebug(
"[BM] Fetched value for index %d: %"PRIu64,
603 bmd->local_id, det_ctx->
byte_values[bmd->local_id]);
609 const uint64_t data_size = buffer_len + stream_start_offset;
612 goto no_match_discontinue;
626 goto no_match_discontinue;
636 goto no_match_discontinue;
642 const DetectUrilenData *urilend = (
const DetectUrilenData *)smd->
ctx;
643 if (buffer_len > UINT16_MAX) {
652 goto no_match_discontinue;
672 int r = DetectEngineContentInspectionInternal(det_ctx, ctx, s,
701 no_match_discontinue:
710 int r = DetectEngineContentInspectionInternal(det_ctx, ctx, s, smd + 1, p, f, buffer,
711 buffer_len, stream_start_offset,
flags, inspection_mode);
725 const uint32_t buffer_len,
const uint32_t stream_start_offset,
const uint8_t
flags,
732 int r = DetectEngineContentInspectionInternal(det_ctx, &ctx, s, smd, p, f, buffer, buffer_len,
733 stream_start_offset,
flags, inspection_mode);
756 int r = DetectEngineContentInspectionInternal(det_ctx, &ctx, s, smd, p, f, b->
inspect,