Go to the documentation of this file.
39 #define PARSE_REGEX "^\\s*([a-zA-Z][a-zA-Z0-9-_]*)\\s*$"
45 static void DetectClasstypeRegisterTests(
void);
70 static int DetectClasstypeParseRawString(
const char *rawstr,
char *out,
size_t outsize)
84 ret = pcre2_substring_copy_bynumber(parse_regex.
match, 1, (PCRE2_UCHAR8 *)e, &pcre2len);
118 "keyword detected.");
122 "keyword detected. Using instance with highest priority");
126 if (DetectClasstypeParseRawString(rawstr, parsed_ct_name,
sizeof(parsed_ct_name)) < 0) {
143 "unknown classtype: \"%s\", using default priority %d. "
144 "This message won't be shown again for this classtype",
148 "unknown classtype: \"%s\", using default priority %d. "
149 "This message won't be shown again for this classtype",
154 "using default priority %d. "
155 "This message won't be shown again for this classtype",
160 snprintf(
str,
sizeof(
str),
161 "config classification: %s,Unknown Classtype,%d\n",
177 bool update_ct =
false;
181 }
else if (s->
prio == -1) {
191 if (real_ct && update_ct) {
203 static int DetectClasstypeTest01(
void)
212 "(msg:\"Classtype test\"; "
213 "Classtype:not_available; sid:1;)");
226 static int DetectClasstypeTest02(
void)
236 "(Classtype:bad-unknown; sid:1;)");
240 "(Classtype:not-there; sid:2;)");
244 "(Classtype:Bad-UnkNown; sid:3;)");
248 "(Classtype:nothing-wrong; sid:4;)");
252 "(Classtype:attempted_dos; Classtype:bad-unknown; sid:5;)");
258 "(Classtype:nothing-wrong; Classtype:Bad-UnkNown; sid:6;)");
270 static int DetectClasstypeTest03(
void)
280 "(msg:\"Classtype test\"; Classtype:bad-unknown; priority:1; sid:1;)");
285 "(msg:\"Classtype test\"; Classtype:unKnoWn; "
286 "priority:3; sid:2;)");
291 "Classtype:nothing-wrong; priority:1; sid:3;)");
295 "(msg:\"Classtype test\"; Classtype:bad-unknown; Classtype:undefined; "
296 "priority:5; sid:4;)");
307 static void DetectClasstypeRegisterTests(
void)
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
int DetectParsePcreExec(DetectParseRegex *parse_regex, const char *str, int start_offset, int options)
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
void SCClassConfLoadClassficationConfigFile(DetectEngineCtx *de_ctx, FILE *fd)
Loads the Classtype info from the classification.config file.
main detection engine ctx
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
@ SC_ERR_PCRE_GET_SUBSTRING
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
size_t strlcpy(char *dst, const char *src, size_t siz)
#define PASS
Pass the test.
Container for a Classtype from the Classification.config file.
void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *detect_parse)
int SCClassConfAddClasstype(DetectEngineCtx *de_ctx, char *rawstr, uint16_t index)
Parses a line from the classification file and adds it to Classtype hash table in DetectEngineCtx,...
bool SigMatchStrictEnabled(const enum DetectKeywordId id)
SCClassConfClasstype * SCClassConfGetClasstype(const char *ct_name, DetectEngineCtx *de_ctx)
Gets the classtype from the corresponding hash table stored in the Detection Engine Context's class c...
#define SIG_FLAG_INIT_PRIO_EXPLICT
SignatureInitData * init_data
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
#define CLASSTYPE_NAME_MAX_LEN
DetectEngineCtx * DetectEngineCtxInit(void)
FILE * SCClassConfGenerateValidDummyClassConfigFD01(void)
Creates a dummy classification file, with all valid Classtypes, for testing purposes.
#define DETECT_DEFAULT_PRIO
void DetectClasstypeRegister(void)
Registers the handler functions for the "Classtype" keyword.
void(* RegisterTests)(void)
@ SC_ERR_CONFLICTING_RULE_KEYWORDS