47 #define PARSE_REGEX "\\S[0-9A-z_]+[.][A-z0-9_+.]+$"
61 static bool PrefilterEventIsPrefilterable(
const Signature *s,
int smtype)
65 if (sm->
type == smtype) {
71 static bool PrefilterStreamEventIsPrefilterable(
const Signature *s)
76 static bool PrefilterDecodeEventIsPrefilterable(
const Signature *s)
92 DetectUintData_u8 du8;
102 for (uint8_t u = 0; u < p->
events.
cnt; u++) {
105 PrefilterAddSids(&det_ctx->
pmq, sa->
sigs, sa->
cnt);
114 PrefilterPacketEventMatch);
121 PrefilterPacketEventMatch);
142 "match on events triggered by structural or invalid values during packet decoding";
153 "match on events triggered by anomalies during TCP streaming";
187 static bool OutdatedEvent(
const char *raw)
189 if (strcmp(raw,
"decoder.udp.hlen_invalid") == 0) {
207 int res = 0, found = 0;
209 pcre2_match_data *match = NULL;
213 SCLogError(
"pcre_exec parse error, ret %" PRId32
", string %s", ret, rawstr);
217 char copy_str[128] =
"";
218 pcre2len =
sizeof(copy_str);
219 res = pcre2_substring_copy_bynumber(match, 0, (PCRE2_UCHAR8 *)copy_str, &pcre2len);
222 SCLogError(
"pcre2_substring_copy_bynumber failed");
227 if (strcasecmp(
DEvents[i].event_name,copy_str) == 0) {
234 SCLogError(
"unknown decode event \"%s\"", copy_str);
248 if (OutdatedEvent(rawstr)) {
250 SCLogError(
"decode-event keyword no longer supports event \"%s\"", rawstr);
253 SCLogWarning(
"decode-event keyword no longer supports event \"%s\"", rawstr);
257 pcre2_match_data_free(match);
264 pcre2_match_data_free(match);
279 static int DetectEngineEventSetupDo(
321 char drawstr[64] =
"decoder.";
324 strlcat(drawstr, rawstr,
sizeof(drawstr));
334 char srawstr[64] =
"stream.";
336 if (strcmp(rawstr,
"est_synack_resend_with_different_ack") == 0) {
337 rawstr =
"est_synack_resend_with_diff_ack";
338 }
else if (strcmp(rawstr,
"3whs_synack_resend_with_different_ack") == 0) {
339 rawstr =
"3whs_synack_resend_with_diff_ack";
343 strlcat(srawstr, rawstr,
sizeof(srawstr));
356 static int EngineEventTestParse01 (
void)
362 DetectEngineEventFree(NULL, de);
371 static int EngineEventTestParse02 (
void)
377 DetectEngineEventFree(NULL, de);
385 static int EngineEventTestParse03 (
void)
391 DetectEngineEventFree(NULL, de);
399 static int EngineEventTestParse04 (
void)
405 DetectEngineEventFree(NULL, de);
413 static int EngineEventTestParse05 (
void)
419 DetectEngineEventFree(NULL, de);
427 static int EngineEventTestParse06 (
void)