aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: implement byte_extract support for isdataat

Browse Source
pull/3042/head
Victor Julien 9 years ago
parent f8a4848e98
commit 148d6e9fb7
1 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File

16
src/detect-engine-content-inspection.c
Unescape Escape View File

@ -357,10 +357,16 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
} else if (sm->type == DETECT_ISDATAAT) {
SCLogDebug("inspecting isdataat");
DetectIsdataatData *id = (DetectIsdataatData *)sm->ctx;
const DetectIsdataatData *id = (DetectIsdataatData *)sm->ctx;
uint32_t dataat = id->dataat;
if (id->flags & ISDATAAT_OFFSET_BE) {
dataat = det_ctx->bj_values[dataat];
SCLogDebug("isdataat: using value %u from byte_extract local_id %u", dataat, id->dataat);
}
if (id->flags & ISDATAAT_RELATIVE) {
if (det_ctx->buffer_offset + id->dataat > buffer_len) {
SCLogDebug("det_ctx->buffer_offset + id->dataat %"PRIu32" > %"PRIu32, det_ctx->buffer_offset + id->dataat, buffer_len);
if (det_ctx->buffer_offset + dataat > buffer_len) {
SCLogDebug("det_ctx->buffer_offset + dataat %"PRIu32" > %"PRIu32, det_ctx->buffer_offset + dataat, buffer_len);
if (id->flags & ISDATAAT_NEGATED)
goto match;
goto no_match;
@ -371,13 +377,13 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
goto match;
}
} else {
if (id->dataat < buffer_len) {
if (dataat < buffer_len) {
SCLogDebug("absolute isdataat match");
if (id->flags & ISDATAAT_NEGATED)
goto no_match;
goto match;
} else {
SCLogDebug("absolute isdataat mismatch, id->isdataat %"PRIu32", buffer_len %"PRIu32"", id->dataat, buffer_len);
SCLogDebug("absolute isdataat mismatch, id->isdataat %"PRIu32", buffer_len %"PRIu32"", dataat, buffer_len);
if (id->flags & ISDATAAT_NEGATED)
goto match;
goto no_match;

Write Preview
Loading…
Cancel
Save