Main Page | Modules | Class List | Directories | File List | Class Members | File Members | Related Pages
src / detection-plugins

sp_pattern_match.c File Reference

#include <errno.h>
#include "sp_pattern_match.h"
#include "bounds.h"
#include "rules.h"
#include "plugbase.h"
#include "debug.h"
#include "mstring.h"
#include "util.h"
#include "parser.h"
#include "plugin_enum.h"
#include "checksum.h"
#include "inline.h"

Go to the source code of this file.

Functions

static void PayloadSearchInit (char *, OptTreeNode *, int)
static void PayloadSearchListInit (char *, OptTreeNode *, int)
static void ParseContentListFile (char *, OptTreeNode *, int)
static void PayloadSearchUri (char *, OptTreeNode *, int)
static void ParsePattern (char *, OptTreeNode *, int)
static int CheckANDPatternMatch (Packet *, struct _OptTreeNode *, OptFpList *)
static int CheckORPatternMatch (Packet *, struct _OptTreeNode *, OptFpList *)
static int CheckUriPatternMatch (Packet *, struct _OptTreeNode *, OptFpList *)
static void PayloadSearchOffset (char *, OptTreeNode *, int)
static void PayloadSearchDepth (char *, OptTreeNode *, int)
static void PayloadSearchNocase (char *, OptTreeNode *, int)
static void PayloadSearchRegex (char *, OptTreeNode *, int)
static void PayloadSearchDistance (char *, OptTreeNode *, int)
static void PayloadSearchWithin (char *, OptTreeNode *, int)
static void PayloadSearchRawbytes (char *, OptTreeNode *, int)
static void PayloadReplaceInit (char *, OptTreeNode *, int)
static PatternMatchData * ParseReplacePattern (char *, OptTreeNode *)
int PayloadReplace (Packet *, struct _OptTreeNode *, OptFpList *, int depth)
static int uniSearchReal (char *data, int dlen, PatternMatchData *pmd, int nocase)
static PatternMatchData * NewNode (OptTreeNode *, int)
void PayloadSearchCompile ()
void SetupPatternMatch ()
static int computeDepth (int dlen, PatternMatchData *pmd)
static int computeWithin (int dlen, PatternMatchData *pmd)
static int uniSearchREG (char *data, int dlen, PatternMatchData *pmd)
static int uniSearch (char *data, int dlen, PatternMatchData *pmd)
static int uniSearchCI (char *data, int dlen, PatternMatchData *pmd)
static void make_precomp (PatternMatchData *idx)
int SetUseDoePtr (OptTreeNode *otn)
static unsigned int GetMaxJumpSize (char *data, int data_len)

Variables

int list_file_line
int lastType = PLUGIN_PATTERN_MATCH
u_int8_t * doe_ptr
int detect_depth
HttpUri UriBufs [URI_COUNT]
u_int8_t DecodeBuffer [DECODE_BLEN]
char * file_name
int file_line

Function Documentation

static int CheckANDPatternMatch (  Packet *  ,
struct _OptTreeNode *  ,
OptFpList * 
)  [static]
 

Definition at line 1678 of file sp_pattern_match.c.

References _Packet::alt_dsize, _OptFpList::context, _Packet::data, DEBUG_PATTERN_MATCH, DEBUG_PLUGIN, DEBUG_WRAP, DecodeBuffer, _PatternMatchData::depth, detect_depth, _PatternMatchData::distance, doe_ptr, _Packet::dsize, _PatternMatchData::exception_flag, InlineMode(), _OptFpList::next, NULL, _PatternMatchData::offset, _OptFpList::OptTestFunc, _Packet::packet_flags, _PatternMatchData::pattern_max_jump_size, _PatternMatchData::pattern_size, PayloadReplace(), PKT_ALT_DECODE, _PatternMatchData::rawbytes, _PatternMatchData::replace_buf, _PatternMatchData::search, _PatternMatchData::use_doe, and _PatternMatchData::within.

Referenced by PayloadSearchInit().

static int CheckORPatternMatch (  Packet *  ,
struct _OptTreeNode *  ,
OptFpList * 
)  [static]
 

Definition at line 1596 of file sp_pattern_match.c.

References _Packet::alt_dsize, _Packet::data, DEBUG_PATTERN_MATCH, DEBUG_WRAP, DecodeBuffer, _OptTreeNode::ds_list, _Packet::dsize, _PatternMatchData::next, _OptFpList::next, NULL, _PatternMatchData::offset, _OptFpList::OptTestFunc, _Packet::packet_flags, _PatternMatchData::pattern_buf, PKT_ALT_DECODE, PLUGIN_PATTERN_MATCH_OR, _PatternMatchData::rawbytes, and _PatternMatchData::search.

Referenced by PayloadSearchListInit().

static int CheckUriPatternMatch (  Packet *  ,
struct _OptTreeNode *  ,
OptFpList * 
)  [static]
 

Definition at line 1852 of file sp_pattern_match.c.

References _OptFpList::context, DEBUG_HTTP_DECODE, DEBUG_PATTERN_MATCH, DEBUG_PLUGIN, DEBUG_WRAP, doe_ptr, _PatternMatchData::exception_flag, _HttpUri::length, _OptFpList::next, NULL, _OptFpList::OptTestFunc, _PatternMatchData::search, and _Packet::uri_count.

Referenced by PayloadSearchUri().

static int computeDepth (  int  dlen,
PatternMatchData *  pmd
)  [inline, static]
 

Definition at line 495 of file sp_pattern_match.c.

References DEBUG_PATTERN_MATCH, DEBUG_WRAP, _PatternMatchData::depth, int(), _PatternMatchData::offset, and _PatternMatchData::pattern_size.

Referenced by uniSearchREG().

static int computeWithin (  int  dlen,
PatternMatchData *  pmd
)  [inline, static]
 

Definition at line 540 of file sp_pattern_match.c.

References int(), _PatternMatchData::pattern_size, and _PatternMatchData::within.

Referenced by uniSearchReal().

static unsigned int GetMaxJumpSize (  char *  data,
int  data_len
)  [static]
 

Definition at line 1254 of file sp_pattern_match.c.

Referenced by ParsePattern().

static void make_precomp (  PatternMatchData *  idx  )  [static]
 

Definition at line 781 of file sp_pattern_match.c.

References make_shift(), make_skip(), _PatternMatchData::pattern_buf, _PatternMatchData::pattern_size, _PatternMatchData::shift_stride, and _PatternMatchData::skip_stride.

Referenced by ParsePattern(), PayloadSearchNocase(), PayloadSearchRegex(), and PayloadSearchUri().

static PatternMatchData * NewNode (  OptTreeNode *  ,
int 
)  [static]
 

Definition at line 1166 of file sp_pattern_match.c.

References _OptTreeNode::ds_list, FatalError(), _PatternMatchData::next, and NULL.

Referenced by ParseContentListFile(), PayloadSearchInit(), and PayloadSearchUri().

static void ParseContentListFile (  char *  ,
OptTreeNode *  ,
int 
)  [static]
 

Definition at line 1924 of file sp_pattern_match.c.

References bzero, DEBUG_PATTERN_MATCH, DEBUG_WRAP, _OptTreeNode::ds_list, FatalError(), list_file_line, NewNode(), _PatternMatchData::next, NULL, ParsePattern(), _PatternMatchData::pattern_buf, PLUGIN_PATTERN_MATCH_OR, STD_BUF, and strip().

Referenced by PayloadSearchListInit().

static void ParsePattern (  char *  ,
OptTreeNode *  ,
int 
)  [static]
 

Definition at line 1288 of file sp_pattern_match.c.

References bzero, DEBUG_PARSER, DEBUG_PATTERN_MATCH, DEBUG_WRAP, _OptTreeNode::ds_list, _PatternMatchData::exception_flag, FatalError(), file_line, file_name, GetMaxJumpSize(), index, make_precomp(), memcpy, memset, _PatternMatchData::next, NULL, _PatternMatchData::pattern_buf, _PatternMatchData::pattern_max_jump_size, _PatternMatchData::pattern_size, _PatternMatchData::search, strtol(), and uniSearch().

Referenced by ParseContentListFile(), PayloadSearchInit(), and PayloadSearchUri().

PatternMatchData * ParseReplacePattern (  char *  ,
OptTreeNode * 
)  [static]
 

Definition at line 142 of file sp_pattern_match.c.

References bzero, DEBUG_PARSER, DEBUG_WRAP, _OptTreeNode::ds_list, FatalError(), file_line, file_name, index, memset, _PatternMatchData::next, NULL, PLUGIN_PATTERN_MATCH, _PatternMatchData::replace_buf, _PatternMatchData::replace_size, SafeMemcpy(), and strtol().

Referenced by PayloadReplaceInit().

int PayloadReplace (  Packet *  ,
struct _OptTreeNode *  ,
OptFpList *  ,
int  depth
) 
 

Definition at line 422 of file sp_pattern_match.c.

References _OptFpList::context, _ICMPHdr::csum, _Packet::data, _Packet::dsize, _Packet::icmph, in_chksum_icmp(), in_chksum_ip(), in_chksum_tcp(), in_chksum_udp(), _IPHdr::ip_csum, _IPHdr::ip_dst, IP_HLEN, _IPHdr::ip_len, _IPHdr::ip_proto, _IPHdr::ip_src, _Packet::iph, _PatternMatchData::replace_buf, SafeMemcpy(), _Packet::tcph, _TCPHdr::th_sum, _Packet::udph, and _UDPHdr::uh_chk.

Referenced by CheckANDPatternMatch().

void PayloadReplaceInit (  char *  ,
OptTreeNode *  ,
int 
)  [static]
 

Definition at line 102 of file sp_pattern_match.c.

References _OptTreeNode::ds_list, FatalError(), file_line, file_name, InlineMode(), NULL, ParseReplacePattern(), _PatternMatchData::pattern_size, PLUGIN_PATTERN_MATCH, and _PatternMatchData::replace_size.

Referenced by SetupPatternMatch().

void PayloadSearchCompile (   ) 
 

void PayloadSearchDepth (  char *  ,
OptTreeNode *  ,
int 
)  [static]
 

Definition at line 933 of file sp_pattern_match.c.

References DEBUG_PATTERN_MATCH, DEBUG_WRAP, _PatternMatchData::depth, _OptTreeNode::ds_list, errno, FatalError(), file_line, file_name, int(), lastType, _PatternMatchData::next, NULL, _PatternMatchData::pattern_size, and strtol().

Referenced by SetupPatternMatch().

void PayloadSearchDistance (  char *  ,
OptTreeNode *  ,
int 
)  [static]
 

Definition at line 1035 of file sp_pattern_match.c.

References DEBUG_PATTERN_MATCH, DEBUG_WRAP, _PatternMatchData::distance, _OptTreeNode::ds_list, errno, FatalError(), file_line, file_name, lastType, _PatternMatchData::next, NULL, SetUseDoePtr(), and strtol().

Referenced by SetupPatternMatch().

void PayloadSearchInit (  char *  ,
OptTreeNode *  ,
int 
)  [static]
 

Definition at line 832 of file sp_pattern_match.c.

References AddOptFuncToList(), CheckANDPatternMatch(), _OptFpList::context, DEBUG_PATTERN_MATCH, DEBUG_WRAP, lastType, NewNode(), ParsePattern(), and PLUGIN_PATTERN_MATCH.

Referenced by SetupPatternMatch().

void PayloadSearchListInit (  char *  ,
OptTreeNode *  ,
int 
)  [static]
 

Definition at line 791 of file sp_pattern_match.c.

References AddOptFuncToList(), CheckORPatternMatch(), DEBUG_PATTERN_MATCH, DEBUG_WRAP, index, lastType, NULL, ParseContentListFile(), and PLUGIN_PATTERN_MATCH_OR.

Referenced by SetupPatternMatch().

void PayloadSearchNocase (  char *  ,
OptTreeNode *  ,
int 
)  [static]
 

Definition at line 982 of file sp_pattern_match.c.

References _OptTreeNode::ds_list, FatalError(), file_line, file_name, lastType, make_precomp(), _PatternMatchData::next, _PatternMatchData::nocase, NULL, _PatternMatchData::pattern_buf, _PatternMatchData::pattern_size, _PatternMatchData::search, and uniSearchCI().

Referenced by SetupPatternMatch().

void PayloadSearchOffset (  char *  ,
OptTreeNode *  ,
int 
)  [static]
 

Definition at line 889 of file sp_pattern_match.c.

References DEBUG_PARSER, DEBUG_PATTERN_MATCH, DEBUG_WRAP, _OptTreeNode::ds_list, errno, FatalError(), file_line, file_name, lastType, _PatternMatchData::next, NULL, _PatternMatchData::offset, and strtol().

Referenced by SetupPatternMatch().

void PayloadSearchRawbytes (  char *  ,
OptTreeNode *  ,
int 
)  [static]
 

Definition at line 1015 of file sp_pattern_match.c.

References _OptTreeNode::ds_list, FatalError(), file_line, lastType, _PatternMatchData::next, NULL, and _PatternMatchData::rawbytes.

Referenced by SetupPatternMatch().

void PayloadSearchRegex (  char *  ,
OptTreeNode *  ,
int 
)  [static]
 

Definition at line 1135 of file sp_pattern_match.c.

References _OptTreeNode::ds_list, FatalError(), file_line, file_name, lastType, make_precomp(), _PatternMatchData::next, NULL, _PatternMatchData::pattern_size, _PatternMatchData::search, and uniSearchREG().

Referenced by SetupPatternMatch().

void PayloadSearchUri (  char *  ,
OptTreeNode *  ,
int 
)  [static]
 

Definition at line 858 of file sp_pattern_match.c.

References AddOptFuncToList(), CheckUriPatternMatch(), _OptFpList::context, DEBUG_PATTERN_MATCH, DEBUG_WRAP, lastType, make_precomp(), NewNode(), ParsePattern(), PLUGIN_PATTERN_MATCH_URI, _PatternMatchData::search, and uniSearch().

Referenced by SetupPatternMatch().

void PayloadSearchWithin (  char *  ,
OptTreeNode *  ,
int 
)  [static]
 

Definition at line 1085 of file sp_pattern_match.c.

References DEBUG_PATTERN_MATCH, DEBUG_WRAP, _OptTreeNode::ds_list, errno, FatalError(), file_line, file_name, lastType, _PatternMatchData::next, NULL, SetUseDoePtr(), strtol(), and _PatternMatchData::within.

Referenced by SetupPatternMatch().

void SetupPatternMatch (  void   ) 
 

Definition at line 84 of file sp_pattern_match.c.

References DEBUG_PATTERN_MATCH, DEBUG_WRAP, PayloadReplaceInit(), PayloadSearchDepth(), PayloadSearchDistance(), PayloadSearchInit(), PayloadSearchListInit(), PayloadSearchNocase(), PayloadSearchOffset(), PayloadSearchRawbytes(), PayloadSearchRegex(), PayloadSearchUri(), PayloadSearchWithin(), and RegisterPlugin().

Referenced by InitPlugIns().

int SetUseDoePtr (  OptTreeNode *  otn  ) 
 

Definition at line 1206 of file sp_pattern_match.c.

References _OptTreeNode::ds_list, LogMessage(), _PatternMatchData::next, NULL, PLUGIN_PATTERN_MATCH, and _PatternMatchData::use_doe.

Referenced by PayloadSearchDistance(), and PayloadSearchWithin().

static int uniSearch (  char *  data,
int  dlen,
PatternMatchData *  pmd
)  [static]
 

Definition at line 598 of file sp_pattern_match.c.

References uniSearchReal().

Referenced by ParsePattern(), and PayloadSearchUri().

static int uniSearchCI (  char *  data,
int  dlen,
PatternMatchData *  pmd
)  [static]
 

Definition at line 611 of file sp_pattern_match.c.

References uniSearchReal().

Referenced by PayloadSearchNocase().

static int uniSearchReal (  char *  data,
int  dlen,
PatternMatchData *  pmd,
int  nocase
)  [static]
 

Definition at line 626 of file sp_pattern_match.c.

References computeWithin(), DEBUG_PATTERN_MATCH, DEBUG_WRAP, _PatternMatchData::depth, _PatternMatchData::distance, doe_ptr, hex(), inBounds(), mSearch(), mSearchCI(), NULL, _PatternMatchData::offset, _PatternMatchData::pattern_buf, _PatternMatchData::pattern_size, _PatternMatchData::shift_stride, _PatternMatchData::skip_stride, _PatternMatchData::use_doe, and _PatternMatchData::within.

Referenced by uniSearch(), and uniSearchCI().

static int uniSearchREG (  char *  data,
int  dlen,
PatternMatchData *  pmd
)  [static]
 

Definition at line 567 of file sp_pattern_match.c.

References computeDepth().

Referenced by PayloadSearchRegex().

Variable Documentation

u_int8_t DecodeBuffer[DECODE_BLEN]
 

Definition at line 45 of file decode.c.

int detect_depth
 

Definition at line 74 of file sp_pattern_match.c.

Referenced by CheckANDPatternMatch(), mSearch(), and mSearchCI().

u_int8_t* doe_ptr
 

Definition at line 72 of file sp_pattern_match.c.

int file_line
 

Definition at line 88 of file parser.c.

char* file_name
 

Definition at line 87 of file parser.c.

int lastType = PLUGIN_PATTERN_MATCH
 

Definition at line 71 of file sp_pattern_match.c.

Referenced by PayloadSearchDepth(), PayloadSearchDistance(), PayloadSearchInit(), PayloadSearchListInit(), PayloadSearchNocase(), PayloadSearchOffset(), PayloadSearchRawbytes(), PayloadSearchRegex(), PayloadSearchUri(), and PayloadSearchWithin().

int list_file_line
 

Definition at line 70 of file sp_pattern_match.c.

Referenced by ParseContentListFile().

HttpUri UriBufs[URI_COUNT]
 

Definition at line 44 of file decode.c.

Generated on Sun May 14 14:51:23 2006 by  doxygen 1.4.2