Go to the documentation of this file.
58 if (strcasecmp(
str,
"tcp") == 0) {
59 dp->
proto[IPPROTO_TCP / 8] |= 1 << (IPPROTO_TCP % 8);
61 }
else if (strcasecmp(
str,
"tcp-pkt") == 0) {
62 dp->
proto[IPPROTO_TCP / 8] |= 1 << (IPPROTO_TCP % 8);
63 SCLogDebug(
"TCP protocol detected, packets only");
65 }
else if (strcasecmp(
str,
"tcp-stream") == 0) {
66 dp->
proto[IPPROTO_TCP / 8] |= 1 << (IPPROTO_TCP % 8);
67 SCLogDebug(
"TCP protocol detected, stream only");
69 }
else if (strcasecmp(
str,
"udp") == 0) {
70 dp->
proto[IPPROTO_UDP / 8] |= 1 << (IPPROTO_UDP % 8);
72 }
else if (strcasecmp(
str,
"icmpv4") == 0) {
73 dp->
proto[IPPROTO_ICMP / 8] |= 1 << (IPPROTO_ICMP % 8);
75 }
else if (strcasecmp(
str,
"icmpv6") == 0) {
76 dp->
proto[IPPROTO_ICMPV6 / 8] |= 1 << (IPPROTO_ICMPV6 % 8);
78 }
else if (strcasecmp(
str,
"icmp") == 0) {
79 dp->
proto[IPPROTO_ICMP / 8] |= 1 << (IPPROTO_ICMP % 8);
80 dp->
proto[IPPROTO_ICMPV6 / 8] |= 1 << (IPPROTO_ICMPV6 % 8);
81 SCLogDebug(
"ICMP protocol detected, sig applies both to ICMPv4 and ICMPv6");
82 }
else if (strcasecmp(
str,
"sctp") == 0) {
85 }
else if (strcasecmp(
str,
"ipv4") == 0 ||
86 strcasecmp(
str,
"ip4") == 0 ) {
90 }
else if (strcasecmp(
str,
"ipv6") == 0 ||
91 strcasecmp(
str,
"ip6") == 0 ) {
95 }
else if (strcasecmp(
str,
"ip") == 0 ||
96 strcasecmp(
str,
"pkthdr") == 0) {
142 static uint32_t test_sid = 1;
146 if (snprintf(fullstr, 1024,
147 "alert %s any any -> any any (msg:\"DetectProto"
149 str, test_sid++) >= 1024) {
178 static int ProtoTestParse01 (
void)
193 static int ProtoTestParse02 (
void)
209 static int ProtoTestParse03 (
void)
226 static int ProtoTestParse04 (
void)
243 static int ProtoTestParse05 (
void)
259 static int ProtoTestParse06 (
void)
276 static int ProtoTestParse07 (
void)
294 static int DetectProtoTestSetup01(
void)
301 memset(&dp, 0,
sizeof(dp));
308 for (i = 2; i < 256 / 8; i++) {
321 static int DetectProtoTestSetup02(
void)
329 memset(&dp, 0,
sizeof(dp));
331 FAIL_IF(DetectProtoInitTest(&
de_ctx, &sig_icmpv4, &dp,
"icmpv4") == 0);
332 FAIL_IF(DetectProtoInitTest(&
de_ctx, &sig_icmpv6, &dp,
"icmpv6") == 0);
333 FAIL_IF(DetectProtoInitTest(&
de_ctx, &sig_icmp, &dp,
"icmp") == 0);
350 static int DetectProtoTestSig01(
void)
358 de_ctx,
"alert tcp-pkt any any -> any any (msg:\"tcp-pkt\"; content:\"blah\"; sid:1;)");
362 "alert tcp-stream any any -> any any (msg:\"tcp-stream\"; content:\"blah\"; sid:2;)");
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
#define DETECT_PROTO_IPV6
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
main detection engine ctx
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
#define PASS
Pass the test.
int DetectProtoParse(DetectProto *dp, const char *str)
Parses a protocol sent as a string.
Data structures and function prototypes for keeping state for the detection engine.
#define DETECT_PROTO_IPV4
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
#define DETECT_PROTO_ONLY_STREAM
#define DETECT_PROTO_ONLY_PKT
DetectEngineCtx * DetectEngineCtxInit(void)
int DetectProtoContainsProto(const DetectProto *dp, int proto)
see if a DetectProto contains a certain proto
void DetectProtoTests(void)
this function registers unit tests for DetectProto