47 #define PARSE_REGEX "^\\s*(?:([\\+\\*!]))?\\s*([SAPRFU120CE\\+\\*!]+)(?:\\s*,\\s*([SAPRFU12CE]+))?\\s*$"
54 #define MODIFIER_NOT 1
55 #define MODIFIER_PLUS 2
56 #define MODIFIER_ANY 3
65 static bool PrefilterTcpFlagsIsPrefilterable(
const Signature *s);
68 static void FlagsRegisterTests(
void);
93 static inline int FlagsMatch(
const uint8_t pflags,
const uint8_t modifier,
94 const uint8_t dflags,
const uint8_t iflags)
96 if (!dflags && pflags) {
104 const uint8_t
flags = pflags & iflags;
108 if ((
flags & dflags) > 0) {
114 if (((
flags & dflags) == dflags)) {
120 if ((
flags & dflags) != dflags) {
127 if (
flags == dflags) {
160 return FlagsMatch(
flags,
de->modifier,
de->flags,
de->ignored_flags);
176 int ret = 0, found = 0, ignore = 0, res = 0;
185 SCLogDebug(
"input '%s', pcre said %d", rawstr, ret);
191 pcre2len =
sizeof(arg1);
194 SCLogError(
"pcre2_substring_copy_bynumber failed");
198 pcre2len =
sizeof(arg2);
199 res = pcre2_substring_copy_bynumber(parse_regex.
match, 2, (PCRE2_UCHAR8 *)arg2, &pcre2len);
201 SCLogError(
"pcre2_substring_copy_bynumber failed");
206 pcre2len =
sizeof(arg3);
209 SCLogError(
"pcre2_substring_copy_bynumber failed");
213 SCLogDebug(
"args '%s', '%s', '%s'", arg1, arg2, arg3);
215 if (strlen(arg2) == 0) {
224 de->ignored_flags = 0xff;
228 while (*ptr !=
'\0') {
297 if (strlen(arg2) > 0) {
299 while (*ptr !=
'\0') {
349 if (
de->modifier != 0) {
351 " one modifier at a time");
358 if (
de->modifier != 0) {
360 " one modifier at a time");
367 if (
de->modifier != 0) {
369 " one modifier at a time");
386 if (strlen(arg3) > 0) {
389 while (*ptr !=
'\0') {
453 SCLogDebug(
"found %"PRId32
" ignore %"PRId32
"", found, ignore);
480 de = DetectFlagsParse(rawstr);
560 if (!PrefilterPacketHeaderExtraMatch(ctx, p))
595 PrefilterPacketFlagsSet,
596 PrefilterPacketFlagsCompare,
597 PrefilterPacketFlagsMatch);
601 static bool PrefilterTcpFlagsIsPrefilterable(
const Signature *s)
624 static int FlagsTestParse01 (
void)
629 DetectFlagsFree(NULL,
de);
639 static int FlagsTestParse02 (
void)
642 de = DetectFlagsParse(
"G");
644 DetectFlagsFree(NULL,
de);
657 static int FlagsTestParse03 (
void)
670 memset(&ipv4h, 0,
sizeof(
IPV4Hdr));
671 memset(&tcph, 0,
sizeof(TCPHdr));
677 de = DetectFlagsParse(
"AP+");
689 ret = DetectFlagsMatch(NULL, p, NULL, sm->
ctx);
711 static int FlagsTestParse04 (
void)
724 memset(&ipv4h, 0,
sizeof(
IPV4Hdr));
725 memset(&tcph, 0,
sizeof(TCPHdr));
731 de = DetectFlagsParse(
"A");
743 ret = DetectFlagsMatch(NULL, p, NULL, sm->
ctx);
766 static int FlagsTestParse05 (
void)
779 memset(&ipv4h, 0,
sizeof(
IPV4Hdr));
780 memset(&tcph, 0,
sizeof(TCPHdr));
786 de = DetectFlagsParse(
"+AP,SR");
798 ret = DetectFlagsMatch(NULL, p, NULL, sm->
ctx);
821 static int FlagsTestParse06 (
void)
834 memset(&ipv4h, 0,
sizeof(
IPV4Hdr));
835 memset(&tcph, 0,
sizeof(TCPHdr));
841 de = DetectFlagsParse(
"+AP,UR");
853 ret = DetectFlagsMatch(NULL, p, NULL, sm->
ctx);
875 static int FlagsTestParse07 (
void)
888 memset(&ipv4h, 0,
sizeof(
IPV4Hdr));
889 memset(&tcph, 0,
sizeof(TCPHdr));
895 de = DetectFlagsParse(
"*AP");
907 ret = DetectFlagsMatch(NULL, p, NULL, sm->
ctx);
930 static int FlagsTestParse08 (
void)
943 memset(&ipv4h, 0,
sizeof(
IPV4Hdr));
944 memset(&tcph, 0,
sizeof(TCPHdr));
950 de = DetectFlagsParse(
"*SA");
962 ret = DetectFlagsMatch(NULL, p, NULL, sm->
ctx);
984 static int FlagsTestParse09 (
void)
997 memset(&ipv4h, 0,
sizeof(
IPV4Hdr));
998 memset(&tcph, 0,
sizeof(TCPHdr));
1004 de = DetectFlagsParse(
"!PA");
1016 ret = DetectFlagsMatch(NULL, p, NULL, sm->
ctx);
1038 static int FlagsTestParse10 (
void)
1051 memset(&ipv4h, 0,
sizeof(
IPV4Hdr));
1052 memset(&tcph, 0,
sizeof(TCPHdr));
1058 de = DetectFlagsParse(
"!AP");
1070 ret = DetectFlagsMatch(NULL, p, NULL, sm->
ctx);
1092 static int FlagsTestParse11 (
void)
1105 memset(&ipv4h, 0,
sizeof(
IPV4Hdr));
1106 memset(&tcph, 0,
sizeof(TCPHdr));
1112 de = DetectFlagsParse(
"*AP,SR");
1124 ret = DetectFlagsMatch(NULL, p, NULL, sm->
ctx);
1147 static int FlagsTestParse12 (
void)
1160 memset(&ipv4h, 0,
sizeof(
IPV4Hdr));
1161 memset(&tcph, 0,
sizeof(TCPHdr));
1167 de = DetectFlagsParse(
"0");
1169 if (
de == NULL ||
de->flags != 0) {
1170 printf(
"de setup: ");
1181 ret = DetectFlagsMatch(NULL, p, NULL, sm->
ctx);
1204 static int FlagsTestParse13 (
void)
1207 de = DetectFlagsParse(
"+S*");
1209 DetectFlagsFree(NULL,
de);
1222 static int FlagsTestParse14(
void)
1226 DetectFlagsFree(NULL,
de);
1233 static int FlagsTestParse15(
void)
1246 memset(&ipv4h, 0,
sizeof(
IPV4Hdr));
1247 memset(&tcph, 0,
sizeof(TCPHdr));
1253 de = DetectFlagsParse(
"EC+");
1265 ret = DetectFlagsMatch(NULL, p, NULL, sm->
ctx);
1285 static int FlagsTestParse16(
void)
1298 memset(&ipv4h, 0,
sizeof(
IPV4Hdr));
1299 memset(&tcph, 0,
sizeof(TCPHdr));
1305 de = DetectFlagsParse(
"EC*");
1317 ret = DetectFlagsMatch(NULL, p, NULL, sm->
ctx);
1340 static int FlagsTestParse17(
void)
1353 memset(&ipv4h, 0,
sizeof(
IPV4Hdr));
1354 memset(&tcph, 0,
sizeof(TCPHdr));
1360 de = DetectFlagsParse(
"EC+");
1372 ret = DetectFlagsMatch(NULL, p, NULL, sm->
ctx);
1395 static void FlagsRegisterTests(
void)