suricata
detect-nocase.c
Go to the documentation of this file.
1
/* Copyright (C) 2007-2010 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \file
20
*
21
* \author Victor Julien <victor@inliniac.net>
22
*
23
* Implements the nocase keyword
24
*/
25
26
#include "
suricata-common.h
"
27
#include "
suricata.h
"
28
#include "
decode.h
"
29
30
#include "
detect.h
"
31
#include "
detect-parse.h
"
32
#include "
detect-content.h
"
33
#include "
detect-nocase.h
"
34
35
#include "
util-debug.h
"
36
37
static
int
DetectNocaseSetup (
DetectEngineCtx
*,
Signature
*,
const
char
*);
38
39
void
DetectNocaseRegister
(
void
)
40
{
41
sigmatch_table
[
DETECT_NOCASE
].
name
=
"nocase"
;
42
sigmatch_table
[
DETECT_NOCASE
].
desc
=
"modify content match to be case insensitive"
;
43
sigmatch_table
[
DETECT_NOCASE
].
url
=
"/rules/payload-keywords.html#nocase"
;
44
sigmatch_table
[
DETECT_NOCASE
].
Setup
= DetectNocaseSetup;
45
sigmatch_table
[
DETECT_NOCASE
].
flags
|=
SIGMATCH_NOOPT
;
46
}
47
48
/**
49
* \internal
50
* \brief Apply the nocase keyword to the last pattern match, either content or uricontent
51
* \param det_ctx detection engine ctx
52
* \param s signature
53
* \param nullstr should be null
54
* \retval 0 ok
55
* \retval -1 failure
56
*/
57
static
int
DetectNocaseSetup (
DetectEngineCtx
*
de_ctx
,
Signature
*s,
const
char
*nullstr)
58
{
59
SCEnter
();
60
61
SigMatch
*pm = NULL;
62
int
ret = -1;
63
64
if
(nullstr != NULL) {
65
SCLogError
(
"nocase has value"
);
66
goto
end;
67
}
68
69
/* retrive the sm to apply the nocase against */
70
pm =
DetectGetLastSMFromLists
(s,
DETECT_CONTENT
, -1);
71
if
(pm == NULL) {
72
SCLogError
(
"nocase needs "
73
"preceding content option"
);
74
goto
end;
75
}
76
77
/* verify other conditions. */
78
DetectContentData
*cd = (
DetectContentData
*)pm->
ctx
;
79
80
if (cd->
flags
&
DETECT_CONTENT_NOCASE
) {
81
SCLogError
(
"can't use multiple nocase modifiers with the same content"
);
82
goto
end;
83
}
84
85
/* for consistency in later use (e.g. by MPM construction and hashing),
86
* coerce the content string to lower-case. */
87
for
(uint8_t *c = cd->
content
; c < cd->content + cd->
content_len
; c++) {
88
*c =
u8_tolower
(*c);
89
}
90
91
cd->
flags
|=
DETECT_CONTENT_NOCASE
;
92
/* Recreate the context with nocase chars */
93
SpmDestroyCtx
(cd->
spm_ctx
);
94
cd->
spm_ctx
=
SpmInitCtx
(cd->
content
, cd->
content_len
, 1,
95
de_ctx
->
spm_global_thread_ctx
);
96
if
(cd->
spm_ctx
== NULL) {
97
goto
end;
98
}
99
100
ret = 0;
101
end:
102
SCReturnInt
(ret);
103
}
DETECT_CONTENT_NOCASE
#define DETECT_CONTENT_NOCASE
Definition:
detect-content.h:29
SigTableElmt_::url
const char * url
Definition:
detect.h:1241
detect-content.h
SigTableElmt_::desc
const char * desc
Definition:
detect.h:1240
SigTableElmt_::name
const char * name
Definition:
detect.h:1238
DETECT_CONTENT
@ DETECT_CONTENT
Definition:
detect-engine-register.h:62
SigTableElmt_::flags
uint16_t flags
Definition:
detect.h:1232
DetectEngineCtx_
main detection engine ctx
Definition:
detect.h:785
u8_tolower
#define u8_tolower(c)
Definition:
suricata-common.h:425
DetectContentData_
Definition:
detect-content.h:86
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition:
detect.h:1223
DETECT_NOCASE
@ DETECT_NOCASE
Definition:
detect-engine-register.h:72
decode.h
util-debug.h
de_ctx
DetectEngineCtx * de_ctx
Definition:
fuzz_siginit.c:17
SCEnter
#define SCEnter(...)
Definition:
util-debug.h:271
detect.h
SigMatch_::ctx
SigMatchCtx * ctx
Definition:
detect.h:316
DetectContentData_::flags
uint32_t flags
Definition:
detect-content.h:97
detect-nocase.h
suricata-common.h
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition:
detect-parse.c:76
DetectContentData_::content
uint8_t * content
Definition:
detect-content.h:87
DetectContentData_::spm_ctx
SpmCtx * spm_ctx
Definition:
detect-content.h:104
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition:
util-debug.h:261
detect-parse.h
Signature_
Signature container.
Definition:
detect.h:540
SigMatch_
a single match condition for a signature
Definition:
detect.h:313
suricata.h
DetectContentData_::content_len
uint16_t content_len
Definition:
detect-content.h:88
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition:
detect.h:1423
DetectGetLastSMFromLists
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us.
Definition:
detect-parse.c:474
DetectEngineCtx_::spm_global_thread_ctx
SpmGlobalThreadCtx * spm_global_thread_ctx
Definition:
detect.h:840
DetectNocaseRegister
void DetectNocaseRegister(void)
Definition:
detect-nocase.c:39
SpmDestroyCtx
void SpmDestroyCtx(SpmCtx *ctx)
Definition:
util-spm.c:183
SCReturnInt
#define SCReturnInt(x)
Definition:
util-debug.h:275
SpmInitCtx
SpmCtx * SpmInitCtx(const uint8_t *needle, uint16_t needle_len, int nocase, SpmGlobalThreadCtx *global_thread_ctx)
Definition:
util-spm.c:173
src
detect-nocase.c
Generated on Mon Feb 6 2023 23:30:35 for suricata by
1.8.18