libqsearch provides an API for searching for a set of patterns. The API exists as a C library (for normal programs) and as a Linux kernel library (for in-kernel IDS). The patterns may be case sensitive or not, with wildcards and regexps. The API uses states that summarize the past searches, allowing it to handle patterns which overlap two or more buffers. It is also possible to replay a search on a given buffer with a stored state. The underlying search algorithm can be chosen by the user. The currently available algorithms include a simple one and an extended Boyer-Moore implementation. A skeleton and a test suite are available to help anyone write new search algorithms under the API.
