Go to the documentation of this file.
50 static void DetectICodeRegisterTests(
void);
55 static bool PrefilterICodeIsPrefilterable(
const Signature *s);
123 if (icd == NULL)
goto error;
135 rs_detect_u8_free(icd);
146 rs_detect_u8_free(ptr);
152 Packet *p,
const void *pectx)
171 PrefilterAddSids(&det_ctx->
pmq, sa->
sigs, sa->
cnt);
181 static bool PrefilterICodeIsPrefilterable(
const Signature *s)
201 static int DetectICodeParseTest01(
void)
216 static int DetectICodeParseTest02(
void)
231 static int DetectICodeParseTest03(
void)
246 static int DetectICodeParseTest04(
void)
262 static int DetectICodeParseTest05(
void)
277 static int DetectICodeParseTest06(
void)
292 static int DetectICodeParseTest07(
void)
307 static int DetectICodeParseTest08(
void)
320 static int DetectICodeParseTest09(
void)
334 static int DetectICodeMatchTest01(
void)
342 memset(&th_v, 0,
sizeof(th_v));
389 void DetectICodeRegisterTests(
void)
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
#define ICMPV4_GET_CODE(p)
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
void(* Free)(DetectEngineCtx *, void *)
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Container for matching data for a signature group.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
main detection engine ctx
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
#define ICMPV6_GET_CODE(p)
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
DetectUintData_u8 * DetectU8Parse(const char *u8str)
This function is used to parse u8 options passed via some u8 keyword.
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
#define PASS
Pass the test.
void DetectICodeRegister(void)
Registration function for icode: keyword.
Per thread variable structure.
DetectUintData_u8 DetectU8Data
void PrefilterPacketU8Set(PrefilterPacketHeaderValue *v, void *smctx)
SignatureInitData * init_data
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
int DetectU8Match(const uint8_t parg, const DetectUintData_u8 *du8)
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
void DetectICodeFree(DetectEngineCtx *, void *)
this function will free memory associated with DetectU8Data
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
bool(* SupportsPrefilter)(const Signature *s)
a single match condition for a signature
DetectEngineCtx * DetectEngineCtxInit(void)
bool PrefilterPacketU8Compare(PrefilterPacketHeaderValue v, void *smctx)
SigMatch * SigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
int PrefilterSetupPacketHeaderU8Hash(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
void(* RegisterTests)(void)
#define SIG_FLAG_REQUIRE_PACKET
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.