diff options
Diffstat (limited to 'framework/src/suricata/src/detect-bytejump.h')
| -rw-r--r-- | framework/src/suricata/src/detect-bytejump.h | 121 |
1 files changed, 0 insertions, 121 deletions
diff --git a/framework/src/suricata/src/detect-bytejump.h b/framework/src/suricata/src/detect-bytejump.h deleted file mode 100644 index 35051486..00000000 --- a/framework/src/suricata/src/detect-bytejump.h +++ /dev/null @@ -1,121 +0,0 @@ -/* Copyright (C) 2007-2010 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Brian Rectanus <brectanu@gmail.com> - */ - -#ifndef __DETECT_BYTEJUMP_H__ -#define __DETECT_BYTEJUMP_H__ - -/** Bytejump Base */ -#define DETECT_BYTEJUMP_BASE_UNSET 0 /**< Unset type value string (automatic)*/ -#define DETECT_BYTEJUMP_BASE_OCT 8 /**< "oct" type value string */ -#define DETECT_BYTEJUMP_BASE_DEC 10 /**< "dec" type value string */ -#define DETECT_BYTEJUMP_BASE_HEX 16 /**< "hex" type value string */ - -/** Bytejump Flags */ -#define DETECT_BYTEJUMP_BEGIN 0x01 /**< "from_beginning" jump */ -#define DETECT_BYTEJUMP_LITTLE 0x02 /**< "little" endian value */ -#define DETECT_BYTEJUMP_BIG 0x04 /**< "big" endian value */ -#define DETECT_BYTEJUMP_STRING 0x08 /**< "string" value */ -#define DETECT_BYTEJUMP_RELATIVE 0x10 /**< "relative" offset */ -#define DETECT_BYTEJUMP_ALIGN 0x20 /**< "align" offset */ -#define DETECT_BYTEJUMP_DCE 0x40 /**< "dce" enabled */ -#define DETECT_BYTEJUMP_OFFSET_BE 0x80 /**< "byte extract" enabled */ - -typedef struct DetectBytejumpData_ { - uint8_t nbytes; /**< Number of bytes to compare */ - uint8_t base; /**< String value base (oct|dec|hex) */ - uint8_t flags; /**< Flags (big|little|relative|string) */ - uint32_t multiplier; /**< Multiplier for nbytes (multiplier n)*/ - int32_t offset; /**< Offset in payload to extract value */ - int32_t post_offset; /**< Offset to adjust post-jump */ -} DetectBytejumpData; - -/* prototypes */ - -/** - * Registration function for byte_jump. - * - * \todo add support for no_stream and stream_only - */ -void DetectBytejumpRegister (void); - -/** - * This function is used to add the parsed byte_jump data - * into the current signature. - * - * \param de_ctx pointer to the Detection Engine Context - * \param s pointer to the Current Signature - * \param optstr pointer to the user provided options - * - * \retval 0 on Success - * \retval -1 on Failure - */ -int DetectBytejumpSetup(DetectEngineCtx *, Signature *, char *); - -/** - * \brief this function will free memory associated with DetectBytejumpData - * - * \param data pointer to DetectBytejumpData - */ -void DetectBytejumpFree(void *ptr); - -/** - * This function is used to parse byte_jump options passed via - * - * byte_jump: bytes, offset [,flags [, ...]] - * - * flags: "big", "little", "relative", "string", "oct", "dec", "hex" - * "align", "from beginning", "multiplier N", "post_offset N" - * - * \param optstr Pointer to the user provided byte_jump options - * \param offset Used to pass the offset back, if byte_jump uses a byte_extract - * var. - * - * \retval data pointer to DetectBytejumpData on success - * \retval NULL on failure - */ -DetectBytejumpData *DetectBytejumpParse(char *optstr, char **offset); - -/** - * This function is used to match byte_jump - * - * \param t pointer to thread vars - * \param det_ctx pointer to the pattern matcher thread - * \param p pointer to the current packet - * \param m pointer to the sigmatch that we will cast into DetectBytejumpData - * - * \retval -1 error - * \retval 0 no match - * \retval 1 match - * - * \todo The return seems backwards. We should return a non-zero error code. - * One of the error codes is "no match". As-is if someone accidentally - * does: if (DetectBytejumpMatch(...)) { match }, then they catch an - * error as a match. - */ -int DetectBytejumpMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, - Packet *p, Signature *s, const SigMatchCtx *ctx); -int DetectBytejumpDoMatch(DetectEngineThreadCtx *, Signature *, const SigMatchCtx *, - uint8_t *, uint32_t, uint8_t, int32_t); - -#endif /* __DETECT_BYTEJUMP_H__ */ - |