You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

snf_HeaderFinder.hpp 5.5KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798
  1. // snf_HeaderFinder.hpp
  2. // Copyright (C) 2007 - 2009 ARM Research Labs, LLC.
  3. // See www.armresearch.com for the copyright terms.
  4. //
  5. // SNF Header Finder used for identifying headers in a message. A header match
  6. // is defined by the name of the header, it's ordinal, and some string that is
  7. // contained in that header. If the pattern is matched then one or more bits
  8. // are set in a 32 bit status flag. Usually, one bit at a time. Other matchers
  9. // that intend to set the same bits as are already set are turned off to save
  10. // cycles.
  11. //
  12. // The initial implementation of this engine is for turning off GBUdb learning
  13. // when one of the defined headers is matched. Other uses are likely to be
  14. // developed. This engine will have to evolve as that occurrs.
  15. //
  16. // The evaluation of the status flag is defined by the application.
  17. #ifndef snf_HeaderFinder_included
  18. #define snf_HeaderFinder_included
  19. #include <string>
  20. #include <set>
  21. #include <map>
  22. #include <vector>
  23. namespace SNFMulti {
  24. struct HeaderFinderPattern { // Input pattern for header finder.
  25. std::string Header; // Header name to match.
  26. int Ordinal; // Which instance to match.
  27. int Context; // Context link (for pairing patterns).
  28. std::string Contains; // What to find in the header.
  29. unsigned long int Directive; // What directive to present.
  30. HeaderFinderPattern(): // When constructing a finder parttern
  31. Header(""),Ordinal(0),Context(0),Contains(""),Directive(0){} // initialize it like this.
  32. HeaderFinderPattern(const HeaderFinderPattern& P); // Copy constructor.
  33. void clear(); // Do this to make fresh and clean.
  34. HeaderFinderPattern& operator=(const HeaderFinderPattern& R); // Assignment operator.
  35. const bool operator<(const HeaderFinderPattern& R) const; // Comparator for set<> living.
  36. };
  37. typedef std::set<HeaderFinderPattern> HeaderDirectiveSet; // Convenient set typedef.
  38. typedef std::set<HeaderFinderPattern>::iterator HeaderDirectiveIterator; // Convenient iterator typedef.
  39. typedef std::map<const std::string, int> NameOrdinalMap; // Header Ordinal Count Map.
  40. // Upon construction the HeaderFinder scans the headers for matching directives
  41. // and leaves the composite results ready for inspection via the () operator.
  42. // UnfoldHeaders() strips and unfolds the headers then passes them to
  43. // MatchHeaders() which tracks the ordinals for matching directives and passes
  44. // those headers to CheckContent() to see if the required patterns are found.
  45. // CheckContent() then updates the Directives if the appropriate content is
  46. // found.
  47. class snfScanData; // Yes, this does exist.
  48. class HeaderFinder { // Header Finder Object.
  49. private:
  50. snfScanData* ScanData; // Scanner control data.
  51. const HeaderDirectiveSet& HeaderDirectives; // Handle for the directives/patterns.
  52. const unsigned char* Bfr; // Message buffer.
  53. const int Len; // Message length.
  54. std::vector<bool> ImpossibleBytes; // Cache of known impossible bytes.
  55. unsigned long int Directives; // Composite result given this message.
  56. std::set<int> ActivatedContexts; // Set of activated contexts.
  57. NameOrdinalMap Ordinals; // Map of current header ordinals.
  58. void CheckContent(std::string& Header, const HeaderFinderPattern& P); // Check for a match in the header.
  59. void MatchHeaders(std::string& Header); // Check that the header matches.
  60. bool ByteIsImpossible(unsigned char b); // Is b not first byte of any pattern?
  61. void UnfoldHeaders(); // Unfold and check headers.
  62. public:
  63. HeaderFinder( // The constructor reads the message.
  64. snfScanData* EngineScanData, // -- Scanner control data ptr.
  65. const HeaderDirectiveSet& Patterns, // -- this is the set of patterns.
  66. const unsigned char* MessageBuffer, // -- this is the message buffer.
  67. const int MessageLength // -- this is the length of the buffer.
  68. );
  69. const unsigned long int operator()() const; // How to read the composite directives.
  70. std::string EstablishedSourceIP; // Source IP from directive if any.
  71. };
  72. #include "snf_HeaderFinder.inline.hpp"
  73. } // namespace SNFMulti
  74. #endif