Go to the documentation of this file.
42 static void DetectTransformDotPrefixRegisterTests(
void);
50 "modify buffer to extract the dotprefix";
52 "/rules/transforms.html#dotprefix";
57 DetectTransformDotPrefixRegisterTests;
113 uint8_t output[input_len + 1];
116 memcpy(&output[1], buffer->
inspect, input_len);
122 static int DetectTransformDotPrefixTest01(
void)
124 const uint8_t *input = (
const uint8_t *)
"example.com";
125 uint32_t input_len = strlen((
char *)input);
127 const char *result =
".example.com";
128 uint32_t result_len = strlen((
char *)result);
134 TransformDotPrefix(&buffer, NULL);
142 static int DetectTransformDotPrefixTest02(
void)
144 const uint8_t *input = (
const uint8_t *)
"hello.example.com";
145 uint32_t input_len = strlen((
char *)input);
147 const char *result =
".hello.example.com";
148 uint32_t result_len = strlen((
char *)result);
154 TransformDotPrefix(&buffer, NULL);
162 static int DetectTransformDotPrefixTest03(
void)
164 const char rule[] =
"alert dns any any -> any any (dns.query; dotprefix; content:\".google.com\"; sid:1;)";
167 memset(&th_v, 0,
sizeof(th_v));
180 static void DetectTransformDotPrefixRegisterTests(
void)
182 UtRegisterTest(
"DetectTransformDotPrefixTest01", DetectTransformDotPrefixTest01);
183 UtRegisterTest(
"DetectTransformDotPrefixTest02", DetectTransformDotPrefixTest02);
184 UtRegisterTest(
"DetectTransformDotPrefixTest03", DetectTransformDotPrefixTest03);
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
main detection engine ctx
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
void InspectionBufferInit(InspectionBuffer *buffer, uint32_t initial_size)
#define PASS
Pass the test.
Per thread variable structure.
void PrintRawDataFp(FILE *fp, const uint8_t *buf, uint32_t buflen)
@ DETECT_TRANSFORM_DOTPREFIX
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
void InspectionBufferCopy(InspectionBuffer *buffer, uint8_t *buf, uint32_t buf_len)
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
void(* Transform)(InspectionBuffer *, void *context)
void InspectionBufferSetup(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
DetectEngineCtx * DetectEngineCtxInit(void)
int DetectSignatureAddTransform(Signature *s, int transform, void *options)
void InspectionBufferFree(InspectionBuffer *buffer)
void(* RegisterTests)(void)