/* * An abstracted interface to the Multi-Pattern Matching routines, * thats why we're passing 'void *' objects around. * */ #include "log/messages.h" #include "framework/mpse.h" #include #include using namespace snort; //------------------------------------------------------------------------- // "bruteforce" //------------------------------------------------------------------------- class BruteforceMpse : public Mpse { private: std::vector patterns; public: BruteforceMpse(const MpseAgent* agent) : Mpse("bruteforce") { } ~BruteforceMpse() override { } /** * * @param P the new pattern. * @param m length of the pattern. * @param desc found in mpse.h. info about no_case, negated, literal, multi_match, flags. * @param user ??? * @return 0 for succes. */ int add_pattern(const uint8_t* P, unsigned m, const PatternDescriptor& desc, void* user) override { patterns.push_back(std::string()); patterns.back().reserve(m); std::copy(P, P+m, patterns.back().begin()); return 0; } /** * probably called after all add_pattern(). * @param sc found in ??? (snort::SnortConfig). Doesn't seem modified anywhere by lowmem. * @return 0 for succes. */ int prep_patterns(SnortConfig* sc) override { return 0; } /** * * @param T text in which we have to search all patterns. * @param n length of T. * @param match * @param context * @param current_state * @return count of found patterns. (?) if the first pattern was found 2x, and the second one 1x, return 3. */ int _search(const uint8_t* T, int n, MpseMatch match, void* context, int* current_state) override { int matches = 0; for (std::string &pat: patterns) { for (int i = 0; i + pat.size() - 1 < n; i++) { int j = 0; while (j < (int)pat.size() && T[i + j] == pat[j]) j++; if (j >= (int)pat.size()) matches++; } } return matches; } /** * how many times was add_pattern called? * @return how many patterns do I have. */ int get_pattern_count() const override { return (int)patterns.size(); } }; //------------------------------------------------------------------------- // api //------------------------------------------------------------------------- static Mpse* bf_ctor(const SnortConfig*, class Module*, const MpseAgent* agent) { return new BruteforceMpse(agent); } static void bf_dtor(Mpse* p) { delete p; } static void bf_init() { } static void bf_print() { LogMessage("bruteforce idk."); } static const MpseApi bf_api = { { PT_SEARCH_ENGINE, sizeof(MpseApi), SEAPI_VERSION, 0, API_RESERVED, API_OPTIONS, "bruteforce", "Bruteforce MPSE", nullptr, nullptr }, MPSE_BASE, nullptr, nullptr, nullptr, nullptr, bf_ctor, bf_dtor, bf_init, bf_print, nullptr }; const BaseApi* se_bruteforce = &bf_api.base;