Go to the documentation of this file.
46 #define PARSE_REGEX "^\\s*(!?\\s*[0-9]{1,3}|!?\\s*[xX][0-9a-fA-F]{1,2})\\s*$"
54 static void DetectTosRegisterTests(
void);
58 #define DETECT_IPTOS_MIN 0
59 #define DETECT_IPTOS_MAX 255
77 "/rules/header-keywords.html#tos";
108 return (tosd->
negated ^ result);
111 static DetectTosData *DetectTosParse(
const char *arg,
bool negate)
114 int ret = 0, res = 0;
120 "The tos option value must be in the range "
127 char tosbytes_str[64] =
"";
128 pcre2len =
sizeof(tosbytes_str);
129 res = pcre2_substring_copy_bynumber(
130 parse_regex.
match, 1, (PCRE2_UCHAR8 *)tosbytes_str, &pcre2len);
132 SCLogError(
"pcre2_substring_copy_bynumber failed");
138 if (tosbytes_str[0] ==
'x' || tosbytes_str[0] ==
'X') {
150 "%s. The tos option value must be in the range "
159 tosd->
tos = (uint8_t)tos;
187 DetectTosFree(
de_ctx, tosd);
213 static int DetectTosTest01(
void)
216 tosd = DetectTosParse(
"12",
false);
217 if (tosd != NULL && tosd->
tos == 12 && !tosd->
negated) {
218 DetectTosFree(NULL, tosd);
225 static int DetectTosTest02(
void)
228 tosd = DetectTosParse(
"123",
false);
229 if (tosd != NULL && tosd->
tos == 123 && !tosd->
negated) {
230 DetectTosFree(NULL, tosd);
237 static int DetectTosTest04(
void)
240 tosd = DetectTosParse(
"256",
false);
242 DetectTosFree(NULL, tosd);
249 static int DetectTosTest05(
void)
252 tosd = DetectTosParse(
"boom",
false);
254 DetectTosFree(NULL, tosd);
261 static int DetectTosTest06(
void)
264 tosd = DetectTosParse(
"x12",
false);
265 if (tosd != NULL && tosd->
tos == 0x12 && !tosd->
negated) {
266 DetectTosFree(NULL, tosd);
273 static int DetectTosTest07(
void)
276 tosd = DetectTosParse(
"X12",
false);
277 if (tosd != NULL && tosd->
tos == 0x12 && !tosd->
negated) {
278 DetectTosFree(NULL, tosd);
285 static int DetectTosTest08(
void)
288 tosd = DetectTosParse(
"x121",
false);
290 DetectTosFree(NULL, tosd);
297 static int DetectTosTest09(
void)
300 tosd = DetectTosParse(
"12",
true);
301 if (tosd != NULL && tosd->
tos == 12 && tosd->
negated) {
302 DetectTosFree(NULL, tosd);
309 static int DetectTosTest10(
void)
312 tosd = DetectTosParse(
"x12",
true);
313 if (tosd != NULL && tosd->
tos == 0x12 && tosd->
negated) {
314 DetectTosFree(NULL, tosd);
321 static int DetectTosTest12(
void)
324 uint8_t *buf = (uint8_t *)
"Hi all!";
325 uint16_t buflen = strlen((
char *)buf);
336 sigs[0]=
"alert ip any any -> any any (msg:\"Testing id 1\"; tos: 10 ; sid:1;)";
337 sigs[1]=
"alert ip any any -> any any (msg:\"Testing id 2\"; tos: ! 10; sid:2;)";
338 sigs[2]=
"alert ip any any -> any any (msg:\"Testing id 3\"; tos:20 ; sid:3;)";
339 sigs[3]=
"alert ip any any -> any any (msg:\"Testing id 3\"; tos:! 20; sid:4;)";
341 uint32_t sid[4] = {1, 2, 3, 4};
356 void DetectTosRegisterTests(
void)
void SigMatchAppendSMToList(Signature *s, SigMatch *new, const int list)
Append a SigMatch to the list type.
int DetectParsePcreExec(DetectParseRegex *parse_regex, const char *str, int start_offset, int options)
void(* Free)(DetectEngineCtx *, void *)
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
#define SIGMATCH_QUOTES_OPTIONAL
struct DetectRfbSecresult_ results[]
main detection engine ctx
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *detect_parse)
#define SIGMATCH_HANDLE_NEGATION
SignatureInitData * init_data
Data structures and function prototypes for keeping state for the detection engine.
int StringParseInt64(int64_t *res, int base, size_t len, const char *str)
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
SigMatch * SigMatchAlloc(void)
#define IPV4_SET_RAW_IPTOS(ip4h, value)
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
int UTHGenericTest(Packet **pkt, int numpkts, const char *sigs[], uint32_t sids[], uint32_t *results, int numsigs)
UTHGenericTest: function that perform a generic check taking care of as maximum common unittest eleme...
void DetectTosRegister(void)
Register Tos keyword.
#define IPV4_GET_IPTOS(p)
#define SCLogError(...)
Macro used to log ERROR messages.
a single match condition for a signature
void(* RegisterTests)(void)
#define SIG_FLAG_REQUIRE_PACKET
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.