Go to the documentation of this file.
41 static void DetectTransformDotPrefixRegisterTests(
void);
49 "modify buffer to extract the dotprefix";
51 "/rules/transforms.html#dotprefix";
56 DetectTransformDotPrefixRegisterTests;
112 uint8_t output[input_len + 1];
115 memcpy(&output[1], buffer->
inspect, input_len);
121 static int DetectTransformDotPrefixTest01(
void)
123 const uint8_t *input = (
const uint8_t *)
"example.com";
124 uint32_t input_len = strlen((
char *)input);
126 const char *result =
".example.com";
127 uint32_t result_len = strlen((
char *)result);
133 TransformDotPrefix(&buffer, NULL);
141 static int DetectTransformDotPrefixTest02(
void)
143 const uint8_t *input = (
const uint8_t *)
"hello.example.com";
144 uint32_t input_len = strlen((
char *)input);
146 const char *result =
".hello.example.com";
147 uint32_t result_len = strlen((
char *)result);
153 TransformDotPrefix(&buffer, NULL);
161 static int DetectTransformDotPrefixTest03(
void)
163 const char rule[] =
"alert dns any any -> any any (dns.query; dotprefix; content:\".google.com\"; sid:1;)";
166 memset(&th_v, 0,
sizeof(th_v));
179 static void DetectTransformDotPrefixRegisterTests(
void)
181 UtRegisterTest(
"DetectTransformDotPrefixTest01", DetectTransformDotPrefixTest01);
182 UtRegisterTest(
"DetectTransformDotPrefixTest02", DetectTransformDotPrefixTest02);
183 UtRegisterTest(
"DetectTransformDotPrefixTest03", DetectTransformDotPrefixTest03);
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
main detection engine ctx
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
void InspectionBufferInit(InspectionBuffer *buffer, uint32_t initial_size)
#define PASS
Pass the test.
Per thread variable structure.
void PrintRawDataFp(FILE *fp, const uint8_t *buf, uint32_t buflen)
@ DETECT_TRANSFORM_DOTPREFIX
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
void InspectionBufferCopy(InspectionBuffer *buffer, uint8_t *buf, uint32_t buf_len)
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
void(* Transform)(InspectionBuffer *, void *context)
void InspectionBufferSetup(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
DetectEngineCtx * DetectEngineCtxInit(void)
int DetectSignatureAddTransform(Signature *s, int transform, void *options)
void InspectionBufferFree(InspectionBuffer *buffer)
void(* RegisterTests)(void)