suricata
detect-xbits.c File Reference
#include "suricata-common.h"
#include "decode.h"
#include "detect.h"
#include "threads.h"
#include "flow.h"
#include "flow-util.h"
#include "detect-xbits.h"
#include "detect-hostbits.h"
#include "util-spm.h"
#include "detect-engine-sigorder.h"
#include "app-layer-parser.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "flow-bit.h"
#include "host-bit.h"
#include "ippair-bit.h"
#include "util-var-name.h"
#include "util-unittest.h"
#include "util-debug.h"
Include dependency graph for detect-xbits.c:

Go to the source code of this file.

Macros

#define PARSE_REGEX   "([a-z]+)" "(?:,\\s*([^,]+))?" "(?:,\\s*(?:track\\s+([^,]+)))" "(?:,\\s*(?:expire\\s+([^,]+)))?"
 
#define MAX_SUBSTRINGS   30
 
#define BAD_INPUT(str)   FAIL_IF_NOT(DetectXbitParse(de_ctx, (str), &cd) == -1);
 
#define GOOD_INPUT(str, command, trk, typ, exp)
 

Functions

void DetectXbitFree (void *)
 
void XBitsRegisterTests (void)
 this function registers unit tests for XBits More...
 
void DetectXbitsRegister (void)
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Implements the xbits keyword

Definition in file detect-xbits.c.

Macro Definition Documentation

#define BAD_INPUT (   str)    FAIL_IF_NOT(DetectXbitParse(de_ctx, (str), &cd) == -1);

Referenced by DetectXbitFree().

#define GOOD_INPUT (   str,
  command,
  trk,
  typ,
  exp 
)
Value:
FAIL_IF_NOT(DetectXbitParse(de_ctx, (str), &cd) == 0); \
FAIL_IF_NOT(cd->cmd == (command)); \
FAIL_IF_NOT(cd->tracker == (trk)); \
FAIL_IF_NOT(cd->type == (typ)); \
FAIL_IF_NOT(cd->expire == (exp)); \
cd = NULL;
#define str(s)
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
void DetectXbitFree(void *)
Definition: detect-xbits.c:368
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82

Referenced by DetectXbitFree().

#define MAX_SUBSTRINGS   30

Referenced by DetectXbitsRegister().

#define PARSE_REGEX   "([a-z]+)" "(?:,\\s*([^,]+))?" "(?:,\\s*(?:track\\s+([^,]+)))" "(?:,\\s*(?:expire\\s+([^,]+)))?"

Definition at line 56 of file detect-xbits.c.

Referenced by DetectXbitsRegister().

Function Documentation

void DetectXbitsRegister ( void  )

Definition at line 65 of file detect-xbits.c.

References DetectXbitsData_::cmd, SigMatch_::ctx, SigTableElmt_::desc, DETECT_SM_LIST_MATCH, DETECT_SM_LIST_POSTMATCH, DETECT_XBITS, DETECT_XBITS_CMD_ISNOTSET, DETECT_XBITS_CMD_ISSET, DETECT_XBITS_CMD_NOALERT, DETECT_XBITS_CMD_SET, DETECT_XBITS_CMD_TOGGLE, DETECT_XBITS_CMD_UNSET, DETECT_XBITS_EXPIRE_DEFAULT, DETECT_XBITS_TRACK_IPDST, DETECT_XBITS_TRACK_IPPAIR, DETECT_XBITS_TRACK_IPSRC, DetectSetupParseRegexes(), DetectXbitFree(), DetectXbitMatchHost(), DOC_URL, DOC_VERSION, Packet_::dst, DetectXbitsData_::expire, Signature_::flags, SigTableElmt_::flags, SigTableElmt_::Free, DetectXbitsData_::idx, IPPairBitIsnotset(), IPPairBitIsset(), IPPairBitSet(), IPPairBitToggle(), IPPairBitUnset(), IPPairGetIPPairFromHash(), IPPairLookupIPPairFromHash(), IPPairRelease(), SigTableElmt_::Match, MAX_SUBSTRINGS, SigTableElmt_::name, PARSE_REGEX, SigTableElmt_::RegisterTests, res, SC_ERR_INVALID_VALUE, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_MATCH, SC_ERR_UNKNOWN_VALUE, SCFree, SCLogDebug, SCLogError, SCMalloc, SigTableElmt_::Setup, SIG_FLAG_NOALERT, SIGMATCH_IPONLY_COMPAT, sigmatch_table, SigMatchAlloc(), SigMatchAppendSMToList(), Packet_::src, DetectXbitsData_::tracker, Packet_::ts, DetectXbitsData_::type, SigMatch_::type, unlikely, SigTableElmt_::url, VAR_TYPE_HOST_BIT, VAR_TYPE_IPPAIR_BIT, VAR_TYPE_NOT_SET, VarNameStoreSetupAdd(), and XBitsRegisterTests().

Referenced by SigTableSetup().

Here is the call graph for this function:

Here is the caller graph for this function:

void XBitsRegisterTests ( void  )

this function registers unit tests for XBits

Definition at line 540 of file detect-xbits.c.

References UtRegisterTest().

Referenced by DetectXbitsRegister().

Here is the call graph for this function:

Here is the caller graph for this function: