Go to the documentation of this file.
50 static void DetectICodeRegisterTests(
void);
55 static bool PrefilterICodeIsPrefilterable(
const Signature *s);
124 if (icd == NULL)
goto error;
127 if (sm == NULL)
goto error;
139 rs_detect_u8_free(icd);
140 if (sm != NULL)
SCFree(sm);
151 rs_detect_u8_free(ptr);
157 Packet *p,
const void *pectx)
176 PrefilterAddSids(&det_ctx->
pmq, sa->
sigs, sa->
cnt);
186 static bool PrefilterICodeIsPrefilterable(
const Signature *s)
206 static int DetectICodeParseTest01(
void)
221 static int DetectICodeParseTest02(
void)
236 static int DetectICodeParseTest03(
void)
251 static int DetectICodeParseTest04(
void)
267 static int DetectICodeParseTest05(
void)
282 static int DetectICodeParseTest06(
void)
297 static int DetectICodeParseTest07(
void)
312 static int DetectICodeParseTest08(
void)
325 static int DetectICodeParseTest09(
void)
339 static int DetectICodeMatchTest01(
void)
347 memset(&th_v, 0,
sizeof(th_v));
394 void DetectICodeRegisterTests(
void)
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
#define ICMPV4_GET_CODE(p)
void SigMatchAppendSMToList(Signature *s, SigMatch *new, const int list)
Append a SigMatch to the list type.
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
void(* Free)(DetectEngineCtx *, void *)
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Container for matching data for a signature group.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
main detection engine ctx
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
#define ICMPV6_GET_CODE(p)
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
DetectUintData_u8 * DetectU8Parse(const char *u8str)
This function is used to parse u8 options passed via some u8 keyword.
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
#define PASS
Pass the test.
void DetectICodeRegister(void)
Registration function for icode: keyword.
Per thread variable structure.
DetectUintData_u8 DetectU8Data
void PrefilterPacketU8Set(PrefilterPacketHeaderValue *v, void *smctx)
SignatureInitData * init_data
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
SigMatch * SigMatchAlloc(void)
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
int DetectU8Match(const uint8_t parg, const DetectUintData_u8 *du8)
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
void DetectICodeFree(DetectEngineCtx *, void *)
this function will free memory associated with DetectU8Data
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
bool(* SupportsPrefilter)(const Signature *s)
a single match condition for a signature
DetectEngineCtx * DetectEngineCtxInit(void)
bool PrefilterPacketU8Compare(PrefilterPacketHeaderValue v, void *smctx)
int PrefilterSetupPacketHeaderU8Hash(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
void(* RegisterTests)(void)
#define SIG_FLAG_REQUIRE_PACKET
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.