Go to the documentation of this file.
50 static void DetectICodeRegisterTests(
void);
55 static bool PrefilterICodeIsPrefilterable(
const Signature *s);
94 if (PacketIsICMPv4(p)) {
96 }
else if (PacketIsICMPv6(p)) {
97 const ICMPV6Hdr *icmpv6h = PacketGetICMPv6(p);
150 Packet *p,
const void *pectx)
155 if (PacketIsICMPv4(p)) {
157 }
else if (PacketIsICMPv6(p)) {
158 const ICMPV6Hdr *icmpv6h = PacketGetICMPv6(p);
168 PrefilterAddSids(&det_ctx->
pmq, sa->
sigs, sa->
cnt);
178 static bool PrefilterICodeIsPrefilterable(
const Signature *s)
198 static int DetectICodeParseTest01(
void)
213 static int DetectICodeParseTest02(
void)
228 static int DetectICodeParseTest03(
void)
243 static int DetectICodeParseTest04(
void)
259 static int DetectICodeParseTest05(
void)
274 static int DetectICodeParseTest06(
void)
289 static int DetectICodeParseTest07(
void)
304 static int DetectICodeParseTest08(
void)
316 static int DetectICodeParseTest09(
void)
329 static int DetectICodeMatchTest01(
void)
335 memset(&th_v, 0,
sizeof(th_v));
383 void DetectICodeRegisterTests(
void)
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
#define SIG_MASK_REQUIRE_REAL_PKT
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
SigTableElmt * sigmatch_table
void(* Free)(DetectEngineCtx *, void *)
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Container for matching data for a signature group.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
main detection engine ctx
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
struct Packet_::@33::@40 icmp_s
#define SIGMATCH_SUPPORT_FIREWALL
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
DetectUintData_u8 * DetectU8Parse(const char *u8str)
This function is used to parse u8 options passed via some u8 keyword.
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
int PrefilterSetupPacketHeaderU8Hash(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, SignatureMask mask, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
#define PASS
Pass the test.
void DetectICodeRegister(void)
Registration function for icode: keyword.
SigMatch * SCSigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
Per thread variable structure.
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
DetectUintData_u8 DetectU8Data
void PrefilterPacketU8Set(PrefilterPacketHeaderValue *v, void *smctx)
#define ICMPV6_GET_CODE(icmp6h)
SignatureInitData * init_data
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
int DetectU8Match(const uint8_t parg, const DetectUintData_u8 *du8)
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
void DetectICodeFree(DetectEngineCtx *, void *)
this function will free memory associated with DetectU8Data
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
bool(* SupportsPrefilter)(const Signature *s)
a single match condition for a signature
#define SIGMATCH_INFO_UINT8
union PacketL4::L4Hdrs hdrs
DetectEngineCtx * DetectEngineCtxInit(void)
bool PrefilterPacketU8Compare(PrefilterPacketHeaderValue v, void *smctx)
void StatsThreadCleanup(ThreadVars *tv)
#define DEBUG_VALIDATE_BUG_ON(exp)
void(* RegisterTests)(void)
#define SIG_FLAG_REQUIRE_PACKET
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.