suricata
detect-offset.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  *
24  * Implements the offset keyword.
25  */
26 
27 #include "suricata-common.h"
28 
29 #include "decode.h"
30 
31 #include "detect.h"
32 #include "detect-parse.h"
33 #include "detect-content.h"
34 #include "detect-uricontent.h"
35 #include "detect-byte-extract.h"
36 #include "detect-offset.h"
37 
38 #include "flow-var.h"
39 
40 #include "util-byte.h"
41 #include "util-debug.h"
42 
43 static int DetectOffsetSetup(DetectEngineCtx *, Signature *, const char *);
44 
46 {
47  sigmatch_table[DETECT_OFFSET].name = "offset";
48  sigmatch_table[DETECT_OFFSET].desc = "designate from which byte in the payload will be checked to find a match";
49  sigmatch_table[DETECT_OFFSET].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#offset";
51  sigmatch_table[DETECT_OFFSET].Setup = DetectOffsetSetup;
54 }
55 
56 int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, const char *offsetstr)
57 {
58  const char *str = offsetstr;
59  SigMatch *pm = NULL;
60  int ret = -1;
61 
62  /* retrive the sm to apply the offset against */
64  if (pm == NULL) {
66  "preceding content option");
67  goto end;
68  }
69 
70  /* verify other conditions */
72 
74  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use offset with startswith");
75  goto end;
76  }
77  if (cd->flags & DETECT_CONTENT_OFFSET) {
78  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple offsets for the same content. ");
79  goto end;
80  }
82  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a relative "
83  "keyword like within/distance with a absolute "
84  "relative keyword like depth/offset for the same "
85  "content." );
86  goto end;
87  }
89  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
90  "negated keyword set along with a fast_pattern");
91  goto end;
92  }
94  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
95  "keyword set along with a fast_pattern:only;");
96  goto end;
97  }
98  if (str[0] != '-' && isalpha((unsigned char)str[0])) {
99  SigMatch *bed_sm =
101  if (bed_sm == NULL) {
102  SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var "
103  "seen in offset - %s\n", str);
104  goto end;
105  }
106  cd->offset = ((DetectByteExtractData *)bed_sm->ctx)->local_id;
108  } else {
109  if (ByteExtractStringUint16(&cd->offset, 0, 0, str) != (int)strlen(str))
110  {
111  SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid value for offset: %s", str);
112  goto end;
113  }
114  if (cd->depth != 0) {
115  if (cd->depth < cd->content_len) {
116  SCLogDebug("depth increased to %"PRIu32" to match pattern len",
117  cd->content_len);
118  cd->depth = cd->content_len;
119  }
120  /* Updating the depth as is relative to the offset */
121  cd->depth += cd->offset;
122  }
123  }
125 
126  ret = 0;
127  end:
128  return ret;
129 }
130 
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect.h:1403
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1146
#define SCLogDebug(...)
Definition: util-debug.h:335
#define DETECT_CONTENT_FAST_PATTERN
#define DETECT_CONTENT_DISTANCE
const char * name
Definition: detect.h:1160
Signature container.
Definition: detect.h:492
main detection engine ctx
Definition: detect.h:720
int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str)
Definition: util-byte.c:217
#define str(s)
void(* Free)(void *)
Definition: detect.h:1151
void DetectOffsetRegister(void)
Definition: detect-offset.c:45
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
#define DETECT_CONTENT_STARTS_WITH
#define DETECT_CONTENT_FAST_PATTERN_ONLY
const char * desc
Definition: detect.h:1162
SigMatch * DetectByteExtractRetrieveSMVar(const char *arg, const Signature *s)
Lookup the SigMatch for a named byte_extract variable.
SigMatchCtx * ctx
Definition: detect.h:327
#define DETECT_CONTENT_OFFSET_BE
#define DETECT_CONTENT_NEGATED
int(* Match)(ThreadVars *, DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1129
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us. ...
Definition: detect-parse.c:401
const char * url
Definition: detect.h:1163
#define DETECT_CONTENT_WITHIN
#define DOC_URL
Definition: suricata.h:86
Holds data related to byte_extract keyword.
#define DOC_VERSION
Definition: suricata.h:91
#define DETECT_CONTENT_OFFSET
void(* RegisterTests)(void)
Definition: detect.h:1152
a single match condition for a signature
Definition: detect.h:324