suricata
detect-pcre.h
Go to the documentation of this file.
1
/* Copyright (C) 2007-2020 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \file
20
*
21
* \author Victor Julien <victor@inliniac.net>
22
*/
23
24
#ifndef __DETECT_PCRE_H__
25
#define __DETECT_PCRE_H__
26
27
#include "
detect-parse.h
"
28
29
#define DETECT_PCRE_RELATIVE 0x00001
30
/* no-op other than in parsing */
31
#define DETECT_PCRE_RAWBYTES 0x00002
32
#define DETECT_PCRE_CASELESS 0x00004
33
34
#define DETECT_PCRE_MATCH_LIMIT 0x00020
35
#define DETECT_PCRE_RELATIVE_NEXT 0x00040
36
#define DETECT_PCRE_NEGATE 0x00080
37
38
#define DETECT_PCRE_CAPTURE_MAX 8
39
40
#define SC_MATCH_LIMIT_DEFAULT 3500
41
#define SC_MATCH_LIMIT_RECURSION_DEFAULT 1500
42
43
typedef
struct
DetectPcreData_
{
44
/* pcre options */
45
DetectParseRegex
parse_regex
;
46
47
int
opts
;
48
uint16_t
flags
;
49
uint8_t
idx
;
50
uint8_t
captypes
[
DETECT_PCRE_CAPTURE_MAX
];
51
uint32_t
capids
[
DETECT_PCRE_CAPTURE_MAX
];
52
int
thread_ctx_id
;
53
}
DetectPcreData
;
54
55
/* prototypes */
56
57
int
DetectPcrePayloadMatch
(
DetectEngineThreadCtx
*,
58
const
Signature
*,
const
SigMatchData
*,
59
Packet
*,
Flow
*,
const
uint8_t *, uint32_t);
60
61
void
DetectPcreRegister
(
void
);
62
63
#endif
/* __DETECT_PCRE_H__ */
64
DetectPcreData_::idx
uint8_t idx
Definition:
detect-pcre.h:49
DetectParseRegex
Definition:
detect-parse.h:44
Flow_
Flow data structure.
Definition:
flow.h:343
DetectPcreData
struct DetectPcreData_ DetectPcreData
DetectPcreData_::parse_regex
DetectParseRegex parse_regex
Definition:
detect-pcre.h:45
DetectPcreData_::opts
int opts
Definition:
detect-pcre.h:47
DetectPcreData_::flags
uint16_t flags
Definition:
detect-pcre.h:48
DETECT_PCRE_CAPTURE_MAX
#define DETECT_PCRE_CAPTURE_MAX
Definition:
detect-pcre.h:38
SigMatchData_
Data needed for Match()
Definition:
detect.h:350
DetectPcrePayloadMatch
int DetectPcrePayloadMatch(DetectEngineThreadCtx *, const Signature *, const SigMatchData *, Packet *, Flow *, const uint8_t *, uint32_t)
Match a regex on a single payload.
Definition:
detect-pcre.c:175
DetectPcreData_::capids
uint32_t capids[DETECT_PCRE_CAPTURE_MAX]
Definition:
detect-pcre.h:51
DetectEngineThreadCtx_
Definition:
detect.h:1058
DetectPcreData_::thread_ctx_id
int thread_ctx_id
Definition:
detect-pcre.h:52
Packet_
Definition:
decode.h:429
DetectPcreData_::captypes
uint8_t captypes[DETECT_PCRE_CAPTURE_MAX]
Definition:
detect-pcre.h:50
detect-parse.h
Signature_
Signature container.
Definition:
detect.h:582
DetectPcreRegister
void DetectPcreRegister(void)
Definition:
detect-pcre.c:96
DetectPcreData_
Definition:
detect-pcre.h:43
src
detect-pcre.h
Generated on Wed May 31 2023 23:30:34 for suricata by
1.8.18