Go to the documentation of this file.
66 SCLogError(
"no libmagic support built in, needed for filemagic keyword");
84 typedef struct DetectFilemagicThreadData {
86 } DetectFilemagicThreadData;
89 static int g_file_match_list_id = 0;
92 static int g_file_magic_buffer_id = 0;
98 void *alstate,
void *txv, uint64_t tx_id);
129 SCLogDebug(
"registering filemagic rule option");
133 #define FILEMAGIC_MIN_SIZE 512
143 int FilemagicThreadLookup(magic_t *ctx,
File *file)
145 if (ctx == NULL || file == NULL ||
FileDataSize(file) == 0) {
149 const uint8_t *data = NULL;
150 uint32_t data_len = 0;
154 &data, &data_len, &
offset);
157 file->magic = MagicThreadLookup(ctx, data, data_len);
159 file->magic = MagicThreadLookup(ctx, data, data_len);
165 static void *DetectFilemagicThreadInit(
void *data )
167 DetectFilemagicThreadData *t =
SCCalloc(1,
sizeof(DetectFilemagicThreadData));
173 t->ctx = MagicInitContext();
186 static void DetectFilemagicThreadFree(
void *ctx)
189 DetectFilemagicThreadData *t = (DetectFilemagicThreadData *)ctx;
210 SCLogError(
"previous transforms not consumed before 'filemagic'");
233 de_ctx,
"filemagic", DetectFilemagicThreadInit, NULL, DetectFilemagicThreadFree, 1);
258 de_ctx,
"filemagic", DetectFilemagicThreadInit, NULL, DetectFilemagicThreadFree, 1);
267 int list_id,
int local_file_id)
277 if (cur_file->magic == NULL) {
278 DetectFilemagicThreadData *tfilemagic =
281 if (tfilemagic == NULL) {
286 FilemagicThreadLookup(&tfilemagic->ctx, cur_file);
288 if (cur_file->magic == NULL) {
292 const uint8_t *data = (
const uint8_t *)cur_file->magic;
293 uint32_t data_len = (uint32_t)strlen(cur_file->magic);
302 void *alstate,
void *txv, uint64_t tx_id)
316 int local_file_id = 0;
317 for (
File *file = ffc->
head; file != NULL; file = file->
next) {
319 det_ctx, transforms, f,
flags, file, engine->
sm_list, local_file_id);
342 typedef struct PrefilterMpmFilemagic {
346 } PrefilterMpmFilemagic;
361 if (!AppLayerParserHasFilesInDir(txd,
flags))
364 const PrefilterMpmFilemagic *ctx = (
const PrefilterMpmFilemagic *)pectx;
365 const MpmCtx *mpm_ctx = ctx->mpm_ctx;
366 const int list_id = ctx->list_id;
371 int local_file_id = 0;
372 for (
File *file = ffc->
head; file != NULL; file = file->
next) {
374 det_ctx, ctx->transforms, f,
flags, file, list_id, local_file_id);
389 static void PrefilterMpmFilemagicFree(
void *ptr)
397 PrefilterMpmFilemagic *pectx =
SCCalloc(1,
sizeof(*pectx));
400 pectx->list_id = list_id;
401 pectx->mpm_ctx = mpm_ctx;
405 mpm_reg->
app_v2.alproto, mpm_reg->
app_v2.tx_min_progress,
406 pectx, PrefilterMpmFilemagicFree, mpm_reg->
pname);
#define SIGMATCH_INFO_STICKY_BUFFER
Container for matching data for a signature group.
void * DetectThreadCtxGetKeywordThreadCtx(DetectEngineThreadCtx *det_ctx, int id)
Retrieve thread local keyword ctx by id.
InspectEngineFuncPtr2 Callback
int DetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list)
main detection engine ctx
void DetectBufferTypeSupportsMultiInstance(const char *name)
int DetectContentConvertToNocase(DetectEngineCtx *de_ctx, DetectContentData *cd)
int StreamingBufferGetData(const StreamingBuffer *sb, const uint8_t **data, uint32_t *data_len, uint64_t *stream_offset)
one time registration of keywords at start up
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
DetectEngineTransforms transforms
void DetectFilemagicRegister(void)
Registration function for keyword: filemagic.
int DetectBufferTypeGetByName(const char *name)
#define SIGMATCH_QUOTES_MANDATORY
#define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILES
void InspectionBufferSetupMultiEmpty(InspectionBuffer *buffer)
setup the buffer empty
int DetectContentSetup(DetectEngineCtx *de_ctx, Signature *s, const char *contentstr)
Function to setup a content pattern.
#define FILE_SIG_NEED_MAGIC
#define DETECT_ENGINE_INSPECT_SIG_MATCH
int DetectEngineContentModifierBufferSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg, int sm_type, int sm_list, AppProto alproto)
#define SIGMATCH_HANDLE_NEGATION
SignatureInitData * init_data
#define SCReturnPtr(x, type)
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
uint64_t FileDataSize(const File *file)
get the size of the file data
uint16_t discontinue_matching
#define DETECT_SM_LIST_NOTSET
uint8_t DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Packet *p, Flow *f, const uint8_t *buffer, uint32_t buffer_len, uint32_t stream_start_offset, uint8_t flags, uint8_t inspection_mode)
Run the actual payload match functions.
struct AppLayerTxData AppLayerTxData
#define PREFILTER_PROFILING_ADD_BYTES(det_ctx, bytes)
#define DETECT_CI_FLAGS_SINGLE
int DetectBufferTypeRegister(const char *name)
int DetectRegisterThreadCtxFuncs(DetectEngineCtx *de_ctx, const char *name, void *(*InitFunc)(void *), void *data, void(*FreeFunc)(void *), int mode)
Register Thread keyword context Funcs.
struct DetectBufferMpmRegistry_::@86::@88 app_v2
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
int inspection_recursion_counter
PrefilterRegisterFunc PrefilterFn
void InspectionBufferSetupMulti(InspectionBuffer *buffer, const DetectEngineTransforms *transforms, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
int PrefilterAppendTxEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterTxFn PrefilterTxFunc, AppProto alproto, int tx_min_progress, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
#define DETECT_ENGINE_INSPECT_SIG_NO_MATCH
int filemagic_thread_ctx_id
struct DetectEngineAppInspectionEngine_::@83 v2
#define SCLogError(...)
Macro used to log ERROR messages.
a single match condition for a signature
const DetectEngineTransforms * transforms
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
InspectionBuffer * InspectionBufferMultipleForListGet(DetectEngineThreadCtx *det_ctx, const int list_id, const uint32_t local_id)
for a InspectionBufferMultipleForList get a InspectionBuffer
#define FILE_SIG_NEED_FILE
DetectFileHandlerTableElmt filehandler_table[DETECT_TBLSIZE]
@ DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us.
AppLayerGetFileState AppLayerParserGetTxFiles(const Flow *f, void *state, void *tx, const uint8_t direction)
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
DetectEngineTransforms transforms