std::vector<Pattern::Byte> Pattern::Transform(const std::string & patterntext)
{
std::vector<Byte> pattern;
auto formattext = FormatPattern(patterntext);
auto len = formattext.length();
if (!len)
return pattern;
if (len % 2) //not a multiple of 2
{
formattext += '?';
len++;
}
pattern.reserve(len / 2);
auto hexChToInt = [](char ch)
{
if (ch >= '0' && ch <= '9')
return ch - '0';
if (ch >= 'A' && ch <= 'F')
return ch - 'A' + 10;
if (ch >= 'a' && ch <= 'f')
return ch - 'a' + 10;
return -1;
};
Byte newByte;
auto j = 0;
for (auto ch : formattext)
{
if (ch == '?') //wildcard
{
newByte.nibble[j].wildcard = true; //match anything
}
else //hex
{
newByte.nibble[j].wildcard = false;
newByte.nibble[j].data = hexChToInt(ch) & 0xF;
}
j++;
if (j == 2) //two nibbles = one byte
{
j = 0;
pattern.push_back(newByte);
}
}
return pattern;
}
SNORTRULEHDR void CPcreOption::FromPattern(const CDllString &strPat)
{
CDllString strTemp = strPat;
FormatPattern(strTemp);
if (HasFlags(CRuleOption::HASNOT))
{
return;
}
STRING str = strTemp.Data();
STRING_ITER iBeg = str.begin(), iEnd = str.end();
STRING strSuffix;
if (*iBeg == '/')
{
++iBeg;
for(--iEnd; *iEnd != '/' && iEnd != str.begin(); --iEnd);
if (iBeg >= iEnd)
{
TTHROW(TI_INVALIDDATA);
}
strSuffix = STRING(iEnd + 1, str.end());
}
m_strPcre.Assign(STRING(iBeg, iEnd).c_str());
for(STRING_ITER j = strSuffix.begin(); j != strSuffix.end(); ++j)
{
switch (*j)
{
case 'A':
AddFlags(PF_A);
if (m_strPcre[0] != '^')
{
m_strPcre.Insert(0, '^');
}
continue;
case 'R':
AddFlags(PF_R);
continue;
case 'i':
AddFlags(PF_i);
continue;
case 's':
AddFlags(PF_s);
continue;
case 'm':
AddFlags(PF_m);
continue;
case 'x':
AddFlags(PF_x);
continue;
case 'E':
AddFlags(PF_E);
continue;
case 'G':
AddFlags(PF_G);
continue;
case 'U':
AddFlags(PF_U);
continue;
case 'B':
AddFlags(PF_B);
continue;
case 'P':
AddFlags(PF_P);
continue;
case 'H':
AddFlags(PF_H);
continue;
case 'M':
AddFlags(PF_M);
continue;
case 'C':
AddFlags(PF_C);
continue;
case 'O':
AddFlags(PF_O);
continue;
case 'I':
AddFlags(PF_I);
continue;
case 'D':
AddFlags(PF_D);
continue;
case 'K':
AddFlags(PF_K);
continue;
case 'S':
AddFlags(PF_S);
continue;
case 'Y':
AddFlags(PF_Y);
continue;
default:
TTHROW(TI_INVALIDDATA);
}
}
if (m_strPcre[0] == '^')
{
AddFlags(PF_A);
}
}
