Go to the documentation of this file.
47 static void DetectITypeRegisterTests(
void);
52 static bool PrefilterITypeIsPrefilterable(
const Signature *s);
134 itd = DetectITypeParse(
de_ctx, itypestr);
135 if (itd == NULL)
goto error;
138 if (sm == NULL)
goto error;
150 if (sm != NULL)
SCFree(sm);
162 rs_detect_u8_free(itd);
172 Packet *p,
const void *pectx)
191 PrefilterAddSids(&det_ctx->
pmq, sa->
sigs, sa->
cnt);
201 static bool PrefilterITypeIsPrefilterable(
const Signature *s)
221 static int DetectITypeParseTest01(
void)
224 itd = DetectITypeParse(NULL,
"8");
237 static int DetectITypeParseTest02(
void)
240 itd = DetectITypeParse(NULL,
">8");
253 static int DetectITypeParseTest03(
void)
256 itd = DetectITypeParse(NULL,
"<8");
269 static int DetectITypeParseTest04(
void)
272 itd = DetectITypeParse(NULL,
"8<>20");
286 static int DetectITypeParseTest05(
void)
289 itd = DetectITypeParse(NULL,
" 8 ");
302 static int DetectITypeParseTest06(
void)
305 itd = DetectITypeParse(NULL,
" > 8 ");
318 static int DetectITypeParseTest07(
void)
321 itd = DetectITypeParse(NULL,
" 8 <> 20 ");
334 static int DetectITypeParseTest08(
void)
337 itd = DetectITypeParse(NULL,
"> 8 <> 20");
347 void DetectITypeRegisterTests(
void)
void DetectITypeRegister(void)
Registration function for itype: keyword.
void DetectITypeFree(DetectEngineCtx *, void *)
this function will free memory associated with DetectU8Data
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
void SigMatchAppendSMToList(Signature *s, SigMatch *new, const int list)
Append a SigMatch to the list type.
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
void(* Free)(DetectEngineCtx *, void *)
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Container for matching data for a signature group.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
main detection engine ctx
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
DetectUintData_u8 * DetectU8Parse(const char *u8str)
This function is used to parse u8 options passed via some u8 keyword.
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
#define PASS
Pass the test.
#define ICMPV4_GET_TYPE(p)
DetectUintData_u8 DetectU8Data
void PrefilterPacketU8Set(PrefilterPacketHeaderValue *v, void *smctx)
SignatureInitData * init_data
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
SigMatch * SigMatchAlloc(void)
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
int DetectU8Match(const uint8_t parg, const DetectUintData_u8 *du8)
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
bool(* SupportsPrefilter)(const Signature *s)
a single match condition for a signature
#define ICMPV6_GET_TYPE(p)
bool PrefilterPacketU8Compare(PrefilterPacketHeaderValue v, void *smctx)
int PrefilterSetupPacketHeaderU8Hash(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
void(* RegisterTests)(void)
#define SIG_FLAG_REQUIRE_PACKET