You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/src/detect-offset.c

68 lines
1.9 KiB
C

/* OFFSET part of the detection engine. */
#include "suricata-common.h"
#include "decode.h"
#include "detect.h"
#include "flow-var.h"
#include "detect-content.h"
#include "detect-pcre.h"
#include "util-debug.h"
static int DetectOffsetSetup (DetectEngineCtx *, Signature *, char *);
void DetectOffsetRegister (void) {
sigmatch_table[DETECT_OFFSET].name = "offset";
sigmatch_table[DETECT_OFFSET].Match = NULL;
sigmatch_table[DETECT_OFFSET].Setup = DetectOffsetSetup;
sigmatch_table[DETECT_OFFSET].Free = NULL;
sigmatch_table[DETECT_OFFSET].RegisterTests = NULL;
sigmatch_table[DETECT_OFFSET].flags |= SIGMATCH_PAYLOAD;
}
int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
{
char *str = offsetstr;
char dubbed = 0;
/* strip "'s */
if (offsetstr[0] == '\"' && offsetstr[strlen(offsetstr)-1] == '\"') {
str = SCStrdup(offsetstr+1);
str[strlen(offsetstr)-2] = '\0';
dubbed = 1;
}
/* Search for the first previous DetectContent
* SigMatch (it can be the same as this one) */
SigMatch *pm = DetectContentFindPrevApplicableSM(s->pmatch_tail);
if (pm == NULL) {
SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "offset needs a preceeding content option");
if (dubbed) SCFree(str);
return -1;
}
DetectContentData *cd = (DetectContentData *)pm->ctx;
if (cd == NULL) {
SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid argument");
if (dubbed) SCFree(str);
return -1;
}
cd->offset = (uint32_t)atoi(str);
/* check if offset and depth make sense with the pattern len */
if (cd->depth != 0) {
if (cd->content_len + cd->offset > cd->depth) {
SCLogDebug("depth increased to %"PRIu32" to match pattern len and offset", cd->content_len + cd->offset);
cd->depth = cd->content_len + cd->offset;
}
}
if (dubbed) SCFree(str);
return 0;
}