suricata/src/detect-engine-content-inspe...

/* Copyright (C) 2007-2011 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

/**
 * \file
 *
 * \author Anoop Saldanha <anoopsaldanha@gmail.com>
 */

#ifndef __DETECT_ENGINE_CONTENT_INSPECTION_H__
#define __DETECT_ENGINE_CONTENT_INSPECTION_H__

enum {
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD = 0,
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_STREAM,
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_DCE,
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_URI,
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRUD,
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_HHD,
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRHD,
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_HCBD,
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_HSBD,
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_HCD,
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_HMD,
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_HSCD,
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_HSMD,
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_HUAD,
    DETECT_ENGINE_CONTENT_INSPECTION_MODE_HHHD,
};

int DetectEngineContentInspection(DetectEngineCtx *,
                                  DetectEngineThreadCtx *,
                                  Signature *, SigMatch *,
                                  Flow *,
                                  uint8_t *, uint32_t,
                                  uint8_t,
                                  void *data);

#endif /* __DETECT_ENGINE_CONTENT_INSPECTION_H__ */
unify payload detection engines + fix other bugs in pcre init 14 years ago			`/* Copyright (C) 2007-2011 Open Information Security Foundation`
			`*`
			`* You can copy, redistribute or modify this Program under the terms of`
			`* the GNU General Public License version 2 as published by the Free`
			`* Software Foundation.`
			`*`
			`* This program is distributed in the hope that it will be useful,`
			`* but WITHOUT ANY WARRANTY; without even the implied warranty of`
			`* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the`
			`* GNU General Public License for more details.`
			`*`
			`* You should have received a copy of the GNU General Public License`
			`* version 2 along with this program; if not, write to the Free Software`
			`* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA`
			`* 02110-1301, USA.`
			`*/`

			`/**`
			`* \file`
			`*`
			`* \author Anoop Saldanha <anoopsaldanha@gmail.com>`
			`*/`

			`#ifndef __DETECT_ENGINE_CONTENT_INSPECTION_H__`
			`#define __DETECT_ENGINE_CONTENT_INSPECTION_H__`

			`enum {`
			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD = 0,`
			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_STREAM,`
			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_DCE,`
			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_URI,`
			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRUD,`
			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_HHD,`
			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRHD,`
			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_HCBD,`
			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_HSBD,`
			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_HCD,`
			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_HMD,`
remove det_ctx->payload_offset and use det_ctx->buffer_offset. Update hscd and hsmd to use the new generic content inspection engine 14 years ago			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_HSCD,`
			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_HSMD,`
http user agent keyword + mpm + inspection + fast pattern support added 13 years ago			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_HUAD,`
Add support for a new keyword to inspect http_host header. The corresponding content keyword would now be - http_host. The corresponding pcre modifier would be W. 13 years ago			`DETECT_ENGINE_CONTENT_INSPECTION_MODE_HHHD,`
unify payload detection engines + fix other bugs in pcre init 14 years ago			`};`

			`int DetectEngineContentInspection(DetectEngineCtx *,`
			`DetectEngineThreadCtx *,`
			`Signature , SigMatch ,`
			`Flow *,`
			`uint8_t *, uint32_t,`
			`uint8_t,`
			`void *data);`

			`#endif /* __DETECT_ENGINE_CONTENT_INSPECTION_H__ */`