suricata
detect-engine-content-inspection.c File Reference
#include "../suricata-common.h"
#include "../decode.h"
#include "../flow.h"
#include "../detect.h"
Include dependency graph for detect-engine-content-inspection.c:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Macros

#define TEST_HEADER
 
#define TEST_RUN(buf, buflen, sig, match, steps)
 
#define TEST_FOOTER   PASS
 

Functions

void DetectEngineContentInspectionRegisterTests (void)
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Tests for the content inspection engine.

Definition in file detect-engine-content-inspection.c.

Macro Definition Documentation

◆ TEST_FOOTER

#define TEST_FOOTER   PASS

Definition at line 58 of file detect-engine-content-inspection.c.

◆ TEST_HEADER

#define TEST_HEADER
Value:
ThreadVars tv; \
memset(&tv, 0, sizeof(tv)); \
Flow f; \
memset(&f, 0, sizeof(f));

Definition at line 31 of file detect-engine-content-inspection.c.

◆ TEST_RUN

#define TEST_RUN (   buf,
  buflen,
  sig,
  match,
  steps 
)
Value:
{ \
DetectEngineCtx *de_ctx = DetectEngineCtxInit(); \
FAIL_IF_NULL(de_ctx); \
DetectEngineThreadCtx *det_ctx = NULL; \
char rule[2048]; \
snprintf(rule, sizeof(rule), "alert tcp any any -> any any (%s sid:1; rev:1;)", (sig)); \
Signature *s = DetectEngineAppendSig(de_ctx, rule); \
FAIL_IF_NULL(s); \
SigGroupBuild(de_ctx); \
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); \
FAIL_IF_NULL(det_ctx); \
int r = DetectEngineContentInspection(de_ctx, det_ctx, \
s, s->sm_arrays[DETECT_SM_LIST_PMATCH], NULL, &f, \
(uint8_t *)(buf), (buflen), 0, DETECT_CI_FLAGS_SINGLE, \
FAIL_IF_NOT(r == (match)); \
FAIL_IF_NOT(det_ctx->inspection_recursion_counter == (steps)); \
DetectEngineThreadCtxDeinit(&tv, det_ctx); \
DetectEngineCtxFree(de_ctx); \
}

Definition at line 37 of file detect-engine-content-inspection.c.

Function Documentation

◆ DetectEngineContentInspectionRegisterTests()

void DetectEngineContentInspectionRegisterTests ( void  )

Definition at line 266 of file detect-engine-content-inspection.c.

References UtRegisterTest().

Here is the call graph for this function:
DETECT_SM_LIST_PMATCH
@ DETECT_SM_LIST_PMATCH
Definition: detect.h:90
DetectEngineContentInspection
int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Packet *p, Flow *f, const uint8_t *buffer, uint32_t buffer_len, uint32_t stream_start_offset, uint8_t flags, uint8_t inspection_mode)
Run the actual payload match functions.
Definition: detect-engine-content-inspection.c:103
DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD
@ DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD
Definition: detect-engine-content-inspection.h:32
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2301
DETECT_CI_FLAGS_SINGLE
#define DETECT_CI_FLAGS_SINGLE
Definition: detect-engine-content-inspection.h:46
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:1977