suricata
detect-nocase.c
Go to the documentation of this file.
1
/* Copyright (C) 2007-2010 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \file
20
*
21
* \author Victor Julien <victor@inliniac.net>
22
*
23
* Implements the nocase keyword
24
*/
25
26
#include "
suricata-common.h
"
27
#include "
suricata.h
"
28
#include "
decode.h
"
29
30
#include "
detect.h
"
31
#include "
detect-parse.h
"
32
#include "
detect-content.h
"
33
#include "
detect-nocase.h
"
34
35
#include "
util-debug.h
"
36
37
static
int
DetectNocaseSetup (
DetectEngineCtx
*,
Signature
*,
const
char
*);
38
39
void
DetectNocaseRegister
(
void
)
40
{
41
sigmatch_table
[
DETECT_NOCASE
].
name
=
"nocase"
;
42
sigmatch_table
[
DETECT_NOCASE
].
desc
=
"modify content match to be case insensitive"
;
43
sigmatch_table
[
DETECT_NOCASE
].
url
=
"/rules/payload-keywords.html#nocase"
;
44
sigmatch_table
[
DETECT_NOCASE
].
Setup
= DetectNocaseSetup;
45
sigmatch_table
[
DETECT_NOCASE
].
flags
|=
SIGMATCH_NOOPT
;
46
}
47
48
/**
49
* \internal
50
* \brief Apply the nocase keyword to the last pattern match, either content or uricontent
51
* \param det_ctx detection engine ctx
52
* \param s signature
53
* \param nullstr should be null
54
* \retval 0 ok
55
* \retval -1 failure
56
*/
57
static
int
DetectNocaseSetup (
DetectEngineCtx
*
de_ctx
,
Signature
*s,
const
char
*nullstr)
58
{
59
SCEnter
();
60
61
SigMatch
*pm = NULL;
62
int
ret = -1;
63
64
if
(nullstr != NULL) {
65
SCLogError
(
"nocase has value"
);
66
goto
end;
67
}
68
69
/* retrieve the sm to apply the nocase against */
70
pm =
DetectGetLastSMFromLists
(s,
DETECT_CONTENT
, -1);
71
if
(pm == NULL) {
72
SCLogError
(
"nocase needs "
73
"preceding content option"
);
74
goto
end;
75
}
76
77
DetectContentData
*cd = (
DetectContentData
*)pm->
ctx
;
78
ret =
DetectContentConvertToNocase
(
de_ctx
, cd);
79
end:
80
SCReturnInt
(ret);
81
}
SigTableElmt_::url
const char * url
Definition:
detect.h:1304
detect-content.h
SigTableElmt_::desc
const char * desc
Definition:
detect.h:1303
sigmatch_table
SigTableElmt * sigmatch_table
Definition:
detect-parse.c:127
SigTableElmt_::name
const char * name
Definition:
detect.h:1301
DETECT_CONTENT
@ DETECT_CONTENT
Definition:
detect-engine-register.h:70
SigTableElmt_::flags
uint16_t flags
Definition:
detect.h:1295
DetectEngineCtx_
main detection engine ctx
Definition:
detect.h:841
DetectContentConvertToNocase
int DetectContentConvertToNocase(DetectEngineCtx *de_ctx, DetectContentData *cd)
Definition:
detect-content.c:765
DetectContentData_
Definition:
detect-content.h:93
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition:
detect.h:1286
DETECT_NOCASE
@ DETECT_NOCASE
Definition:
detect-engine-register.h:80
decode.h
util-debug.h
de_ctx
DetectEngineCtx * de_ctx
Definition:
fuzz_siginit.c:17
SCEnter
#define SCEnter(...)
Definition:
util-debug.h:271
detect.h
SigMatch_::ctx
SigMatchCtx * ctx
Definition:
detect.h:352
detect-nocase.h
suricata-common.h
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition:
util-debug.h:261
detect-parse.h
Signature_
Signature container.
Definition:
detect.h:601
SigMatch_
a single match condition for a signature
Definition:
detect.h:349
suricata.h
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition:
detect.h:1485
DetectGetLastSMFromLists
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us.
Definition:
detect-parse.c:606
DetectNocaseRegister
void DetectNocaseRegister(void)
Definition:
detect-nocase.c:39
SCReturnInt
#define SCReturnInt(x)
Definition:
util-debug.h:275
src
detect-nocase.c
Generated on Fri Sep 6 2024 23:30:32 for suricata by
1.8.18