Go to the documentation of this file.
46 #define PARSE_REGEX "^\\s*(!?\\s*[0-9]{1,3}|!?\\s*[xX][0-9a-fA-F]{1,2})\\s*$"
54 static void DetectTosRegisterTests(
void);
58 #define DETECT_IPTOS_MIN 0
59 #define DETECT_IPTOS_MAX 255
77 "/rules/header-keywords.html#tos";
100 if (!PacketIsIPv4(p)) {
104 const IPV4Hdr *ip4h = PacketGetIPv4(p);
110 return (tosd->
negated ^ result);
113 static DetectTosData *DetectTosParse(
const char *arg,
bool negate)
118 pcre2_match_data *match = NULL;
122 "The tos option value must be in the range "
129 char tosbytes_str[64] =
"";
130 pcre2len =
sizeof(tosbytes_str);
131 int res = pcre2_substring_copy_bynumber(match, 1, (PCRE2_UCHAR8 *)tosbytes_str, &pcre2len);
133 SCLogError(
"pcre2_substring_copy_bynumber failed");
139 if (tosbytes_str[0] ==
'x' || tosbytes_str[0] ==
'X') {
151 "%s. The tos option value must be in the range "
160 tosd->
tos = (uint8_t)tos;
163 pcre2_match_data_free(match);
168 pcre2_match_data_free(match);
192 DetectTosFree(
de_ctx, tosd);
213 static int DetectTosTest01(
void)
216 tosd = DetectTosParse(
"12",
false);
217 if (tosd != NULL && tosd->
tos == 12 && !tosd->
negated) {
218 DetectTosFree(NULL, tosd);
225 static int DetectTosTest02(
void)
228 tosd = DetectTosParse(
"123",
false);
229 if (tosd != NULL && tosd->
tos == 123 && !tosd->
negated) {
230 DetectTosFree(NULL, tosd);
237 static int DetectTosTest04(
void)
240 tosd = DetectTosParse(
"256",
false);
242 DetectTosFree(NULL, tosd);
249 static int DetectTosTest05(
void)
252 tosd = DetectTosParse(
"boom",
false);
254 DetectTosFree(NULL, tosd);
261 static int DetectTosTest06(
void)
264 tosd = DetectTosParse(
"x12",
false);
265 if (tosd != NULL && tosd->
tos == 0x12 && !tosd->
negated) {
266 DetectTosFree(NULL, tosd);
273 static int DetectTosTest07(
void)
276 tosd = DetectTosParse(
"X12",
false);
277 if (tosd != NULL && tosd->
tos == 0x12 && !tosd->
negated) {
278 DetectTosFree(NULL, tosd);
285 static int DetectTosTest08(
void)
288 tosd = DetectTosParse(
"x121",
false);
290 DetectTosFree(NULL, tosd);
297 static int DetectTosTest09(
void)
300 tosd = DetectTosParse(
"12",
true);
301 if (tosd != NULL && tosd->
tos == 12 && tosd->
negated) {
302 DetectTosFree(NULL, tosd);
309 static int DetectTosTest10(
void)
312 tosd = DetectTosParse(
"x12",
true);
313 if (tosd != NULL && tosd->
tos == 0x12 && tosd->
negated) {
314 DetectTosFree(NULL, tosd);
321 static int DetectTosTest12(
void)
324 uint8_t *buf = (uint8_t *)
"Hi all!";
325 uint16_t buflen = strlen((
char *)buf);
336 sigs[0]=
"alert ip any any -> any any (msg:\"Testing id 1\"; tos: 10 ; sid:1;)";
337 sigs[1]=
"alert ip any any -> any any (msg:\"Testing id 2\"; tos: ! 10; sid:2;)";
338 sigs[2]=
"alert ip any any -> any any (msg:\"Testing id 3\"; tos:20 ; sid:3;)";
339 sigs[3]=
"alert ip any any -> any any (msg:\"Testing id 3\"; tos:! 20; sid:4;)";
341 uint32_t sid[4] = {1, 2, 3, 4};
356 void DetectTosRegisterTests(
void)
SigTableElmt * sigmatch_table
void(* Free)(DetectEngineCtx *, void *)
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
#define SIGMATCH_QUOTES_OPTIONAL
struct DetectRfbSecresult_ results[]
main detection engine ctx
union PacketL3::Hdrs hdrs
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
int DetectParsePcreExec(DetectParseRegex *parse_regex, pcre2_match_data **match, const char *str, int start_offset, int options)
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
#define IPV4_GET_RAW_IPTOS(ip4h)
void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *detect_parse)
#define SIGMATCH_HANDLE_NEGATION
SignatureInitData * init_data
Data structures and function prototypes for keeping state for the detection engine.
int StringParseInt64(int64_t *res, int base, size_t len, const char *str)
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
int UTHGenericTest(Packet **pkt, int numpkts, const char *sigs[], uint32_t sids[], uint32_t *results, int numsigs)
UTHGenericTest: function that perform a generic check taking care of as maximum common unittest eleme...
void DetectTosRegister(void)
Register Tos keyword.
#define SCLogError(...)
Macro used to log ERROR messages.
SigMatch * SigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
#define DEBUG_VALIDATE_BUG_ON(exp)
void(* RegisterTests)(void)
#define SIG_FLAG_REQUIRE_PACKET
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.