sp_pcre.c File Reference

#include "bounds.h"
#include "rules.h"
#include "debug.h"
#include "decode.h"
#include "plugbase.h"
#include "parser.h"
#include "plugin_enum.h"
#include "util.h"
#include "mstring.h"
#include <sys/types.h>
#include <pcre.h>

Go to the source code of this file.

Defines
#define	SNORT_PCRE_RELATIVE   1
#define	SNORT_PCRE_INVERT   2
#define	SNORT_PCRE_URI   4
#define	SNORT_PCRE_RAWBYTES   8
#define	SNORT_PCRE_OVECTOR_SIZE   3
Typedefs
typedef _PcreData	PcreData
Functions
void	SnortPcreInit (char *, OptTreeNode *, int)
void	SnortPcreParse (char *, PcreData *, OptTreeNode *)
void	SnortPcreDump (PcreData *)
int	SnortPcre (Packet *, struct _OptTreeNode *, OptFpList *)
void	SetupPcre (void)
static int	pcre_search (const PcreData *pcre_data, const char *buf, int len, int start_offset, int *found_offset)
Variables
u_int8_t	DecodeBuffer [DECODE_BLEN]
u_int8_t *	doe_ptr

---

Define Documentation

#define SNORT_PCRE_INVERT   2

Definition at line 52 of file sp_pcre.c. Referenced by pcre_search(), and SnortPcreParse().

#define SNORT_PCRE_OVECTOR_SIZE   3

Definition at line 62 of file sp_pcre.c. Referenced by pcre_search().

#define SNORT_PCRE_RAWBYTES   8

Definition at line 54 of file sp_pcre.c. Referenced by SnortPcre(), and SnortPcreParse().

#define SNORT_PCRE_RELATIVE   1

Definition at line 51 of file sp_pcre.c. Referenced by SnortPcre(), and SnortPcreParse().

#define SNORT_PCRE_URI   4

Definition at line 53 of file sp_pcre.c. Referenced by SnortPcre(), and SnortPcreParse().

---

Typedef Documentation

typedef struct _PcreData PcreData

---

Function Documentation

static int pcre_search (  const PcreData *  pcre_data, const char *  buf, int  len, int  start_offset, int *  found_offset )  [static]

Perform a search of the PCRE data. Parameters: pcre_data  structure that options and patterns are passed in buf  buffer to search len  size of buffer start_offset  initial offset into the buffer found_offset  pointer to an integer so that we know where the search ended *found_offset will be set to -1 when the find is unsucessful OR the routine is inverted Returns: 1 when we find the string, 0 when we don't (unless we've been passed a flag to invert) Definition at line 256 of file sp_pcre.c. References DEBUG_PATTERN_MATCH, DEBUG_WRAP, doe_ptr, NULL, _PcreData::options, PCRE_ERROR_NOMATCH, pcre_exec(), _PcreData::pe, _PcreData::re, SNORT_PCRE_INVERT, and SNORT_PCRE_OVECTOR_SIZE. Referenced by SnortPcre().

void SetupPcre (  void   )

Definition at line 72 of file sp_pcre.c. References RegisterPlugin(), and SnortPcreInit(). Referenced by InitPlugIns().

int SnortPcre (  Packet *  , struct _OptTreeNode *  , OptFpList *  )

Definition at line 320 of file sp_pcre.c. References _Packet::alt_dsize, _OptFpList::context, _Packet::data, DEBUG_PATTERN_MATCH, DEBUG_WRAP, DecodeBuffer, doe_ptr, _Packet::dsize, hex(), inBounds(), _OptFpList::next, _PcreData::options, _OptFpList::OptTestFunc, _Packet::packet_flags, pcre_search(), PKT_ALT_DECODE, SNORT_PCRE_RAWBYTES, SNORT_PCRE_RELATIVE, SNORT_PCRE_URI, _Packet::uri_count, URI_COUNT, and UriBufs. Referenced by SnortPcreInit().

void SnortPcreDump (  PcreData *   )

void SnortPcreInit (  char *  , OptTreeNode *  , int  )

Definition at line 77 of file sp_pcre.c. References AddOptFuncToList(), _OptFpList::context, FatalError(), file_line, file_name, NULL, SnortAlloc(), SnortPcre(), and SnortPcreParse(). Referenced by SetupPcre().

void SnortPcreParse (  char *  , PcreData *  , OptTreeNode *  )

Definition at line 106 of file sp_pcre.c. References DEBUG_PATTERN_MATCH, DEBUG_WRAP, FatalError(), file_line, file_name, NULL, _PcreData::options, PCRE_ANCHORED, PCRE_CASELESS, pcre_compile(), PCRE_DOLLAR_ENDONLY, PCRE_DOTALL, PCRE_EXTENDED, PCRE_MULTILINE, pcre_study(), PCRE_UNGREEDY, _PcreData::pe, _PcreData::re, SNORT_PCRE_INVERT, SNORT_PCRE_RAWBYTES, SNORT_PCRE_RELATIVE, and SNORT_PCRE_URI. Referenced by SnortPcreInit().

---

Variable Documentation

u_int8_t DecodeBuffer[DECODE_BLEN]

Definition at line 45 of file decode.c.

u_int8_t* doe_ptr

Definition at line 72 of file sp_pattern_match.c.

---