45 #define PARSE_REGEX "\\S[0-9A-z_]+[.][A-z0-9_+.]+$"
113 static bool OutdatedEvent(
const char *raw)
115 if (strcmp(raw,
"decoder.udp.hlen_invalid") == 0) {
133 int res = 0, found = 0;
135 pcre2_match_data *match = NULL;
139 SCLogError(
"pcre_exec parse error, ret %" PRId32
", string %s", ret, rawstr);
143 char copy_str[128] =
"";
144 pcre2len =
sizeof(copy_str);
145 res = pcre2_substring_copy_bynumber(match, 0, (PCRE2_UCHAR8 *)copy_str, &pcre2len);
148 SCLogError(
"pcre2_substring_copy_bynumber failed");
153 if (strcasecmp(
DEvents[i].event_name,copy_str) == 0) {
160 SCLogError(
"unknown decode event \"%s\"", copy_str);
174 if (OutdatedEvent(rawstr)) {
176 SCLogError(
"decode-event keyword no longer supports event \"%s\"", rawstr);
179 SCLogWarning(
"decode-event keyword no longer supports event \"%s\"", rawstr);
183 pcre2_match_data_free(match);
190 pcre2_match_data_free(match);
205 static int DetectEngineEventSetupDo(
247 char drawstr[64] =
"decoder.";
250 strlcat(drawstr, rawstr,
sizeof(drawstr));
260 char srawstr[64] =
"stream.";
262 if (strcmp(rawstr,
"est_synack_resend_with_different_ack") == 0) {
263 rawstr =
"est_synack_resend_with_diff_ack";
264 }
else if (strcmp(rawstr,
"3whs_synack_resend_with_different_ack") == 0) {
265 rawstr =
"3whs_synack_resend_with_diff_ack";
269 strlcat(srawstr, rawstr,
sizeof(srawstr));
271 return DetectEngineEventSetup(
de_ctx, s, srawstr);
282 static int EngineEventTestParse01 (
void)
288 DetectEngineEventFree(NULL,
de);
297 static int EngineEventTestParse02 (
void)
303 DetectEngineEventFree(NULL,
de);
311 static int EngineEventTestParse03 (
void)
317 DetectEngineEventFree(NULL,
de);
325 static int EngineEventTestParse04 (
void)
331 DetectEngineEventFree(NULL,
de);
339 static int EngineEventTestParse05 (
void)
345 DetectEngineEventFree(NULL,
de);
353 static int EngineEventTestParse06 (
void)