aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix decode event compiler warning.

Browse Source
remotes/origin/master-1.0.x
Victor Julien 17 years ago
parent b6d55f84ac
commit 63d32f723f
2 changed files with 29 additions and 57 deletions
Show Stats Download Patch File Download Diff File

30
src/detect-decode-event.c
Unescape Escape View File

@ -3,7 +3,6 @@
* \author Breno Silva <breno.silva@gmail.com> * \author Breno Silva <breno.silva@gmail.com>
*/ */
#include "decode.h" #include "decode.h"
#include "detect.h" #include "detect.h"
#include "flow-var.h" #include "flow-var.h"
@ -18,7 +17,6 @@
#include <pcre.h> #include <pcre.h>
#include <ctype.h> #include <ctype.h>
/* XXX VJ stricter regex */
#define PARSE_REGEX "\\S[0-9A-z_]+[.][A-z+]+$" #define PARSE_REGEX "\\S[0-9A-z_]+[.][A-z+]+$"
static pcre *parse_regex; static pcre *parse_regex;
@ -32,7 +30,6 @@ void DecodeEventRegisterTests(void);
/** /**
* \brief Registration function for decode-event: keyword * \brief Registration function for decode-event: keyword
*/ */
void DetectDecodeEventRegister (void) { void DetectDecodeEventRegister (void) {
sigmatch_table[DETECT_DECODE_EVENT].name = "decode-event"; sigmatch_table[DETECT_DECODE_EVENT].name = "decode-event";
sigmatch_table[DETECT_DECODE_EVENT].Match = DetectDecodeEventMatch; sigmatch_table[DETECT_DECODE_EVENT].Match = DetectDecodeEventMatch;
@ -76,12 +73,9 @@ error:
* \retval 0 no match * \retval 0 no match
* \retval 1 match * \retval 1 match
*/ */
int DetectDecodeEventMatch (ThreadVars *t, PatternMatcherThread *pmt, Packet *p, Signature *s, SigMatch *m) int DetectDecodeEventMatch (ThreadVars *t, PatternMatcherThread *pmt, Packet *p, Signature *s, SigMatch *m)
{ {
int ret = 0; int ret = 0;
DetectDecodeEventData *de = (DetectDecodeEventData *)m->ctx; DetectDecodeEventData *de = (DetectDecodeEventData *)m->ctx;
if(de && DECODER_ISSET_EVENT(p, de->event)) if(de && DECODER_ISSET_EVENT(p, de->event))
@ -98,46 +92,37 @@ int DetectDecodeEventMatch (ThreadVars *t, PatternMatcherThread *pmt, Packet *p,
* \retval de pointer to DetectFlowData on success * \retval de pointer to DetectFlowData on success
* \retval NULL on failure * \retval NULL on failure
*/ */
DetectDecodeEventData *DetectDecodeEventParse (char *rawstr) DetectDecodeEventData *DetectDecodeEventParse (char *rawstr)
{ {
int i; int i;
DetectDecodeEventData *de = NULL; DetectDecodeEventData *de = NULL;
#define MAX_SUBSTRINGS 30 #define MAX_SUBSTRINGS 30
int ret = 0, res = 0, found = 0; int ret = 0, res = 0, found = 0;
int ov[MAX_SUBSTRINGS]; int ov[MAX_SUBSTRINGS];
ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS);
if (ret < 1) { if (ret < 1) {
goto error; goto error;
} }
const char *str_ptr; const char *str_ptr;
res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 0, &str_ptr); res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 0, &str_ptr);
if (res < 0) { if (res < 0) {
goto error; goto error;
} }
for(i = 0; DEvents[i].event_name != NULL; i++) {
for(i=0; DEvents[i].event_name != NULL; i++) {
if((strncasecmp(DEvents[i].event_name,str_ptr,strlen(DEvents[i].event_name))) == 0) { if((strncasecmp(DEvents[i].event_name,str_ptr,strlen(DEvents[i].event_name))) == 0) {
found = 1; found = 1;
break; break;
} }
} }
if(found == 0) if(found == 0)
goto error; goto error;
de = malloc(sizeof(DetectDecodeEventData)); de = malloc(sizeof(DetectDecodeEventData));
if (de == NULL) { if (de == NULL) {
printf("DetectDecodeEventSetup malloc failed\n"); printf("DetectDecodeEventSetup malloc failed\n");
goto error; goto error;
@ -162,8 +147,6 @@ error:
* \retval 0 on Success * \retval 0 on Success
* \retval -1 on Failure * \retval -1 on Failure
*/ */
int DetectDecodeEventSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *rawstr) int DetectDecodeEventSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *rawstr)
{ {
DetectDecodeEventData *de = NULL; DetectDecodeEventData *de = NULL;
@ -187,8 +170,6 @@ error:
if (de) free(de); if (de) free(de);
if (sm) free(sm); if (sm) free(sm);
return -1; return -1;
return 0;
} }
/** /**
@ -196,8 +177,6 @@ error:
* *
* \param de pointer to DetectDecodeEventData * \param de pointer to DetectDecodeEventData
*/ */
void DetectDecodeEventFree(DetectDecodeEventData *de) { void DetectDecodeEventFree(DetectDecodeEventData *de) {
if(de) free(de); if(de) free(de);
} }
@ -209,7 +188,6 @@ void DetectDecodeEventFree(DetectDecodeEventData *de) {
/** /**
* \test DecodeEventTestParse01 is a test for a valid decode-event value * \test DecodeEventTestParse01 is a test for a valid decode-event value
*/ */
int DecodeEventTestParse01 (void) { int DecodeEventTestParse01 (void) {
DetectDecodeEventData *de = NULL; DetectDecodeEventData *de = NULL;
de = DetectDecodeEventParse("ipv4.pkt_too_small"); de = DetectDecodeEventParse("ipv4.pkt_too_small");
@ -225,7 +203,6 @@ int DecodeEventTestParse01 (void) {
/** /**
* \test DecodeEventTestParse02 is a test for a valid upper + lower case decode-event value * \test DecodeEventTestParse02 is a test for a valid upper + lower case decode-event value
*/ */
int DecodeEventTestParse02 (void) { int DecodeEventTestParse02 (void) {
DetectDecodeEventData *de = NULL; DetectDecodeEventData *de = NULL;
de = DetectDecodeEventParse("PPP.pkt_too_small"); de = DetectDecodeEventParse("PPP.pkt_too_small");
@ -240,7 +217,6 @@ int DecodeEventTestParse02 (void) {
/** /**
* \test DecodeEventTestParse03 is a test for a valid upper case decode-event value * \test DecodeEventTestParse03 is a test for a valid upper case decode-event value
*/ */
int DecodeEventTestParse03 (void) { int DecodeEventTestParse03 (void) {
DetectDecodeEventData *de = NULL; DetectDecodeEventData *de = NULL;
de = DetectDecodeEventParse("IPV6.PKT_TOO_SMALL"); de = DetectDecodeEventParse("IPV6.PKT_TOO_SMALL");
@ -255,7 +231,6 @@ int DecodeEventTestParse03 (void) {
/** /**
* \test DecodeEventTestParse04 is a test for an invalid upper case decode-event value * \test DecodeEventTestParse04 is a test for an invalid upper case decode-event value
*/ */
int DecodeEventTestParse04 (void) { int DecodeEventTestParse04 (void) {
DetectDecodeEventData *de = NULL; DetectDecodeEventData *de = NULL;
de = DetectDecodeEventParse("IPV6.INVALID_EVENT"); de = DetectDecodeEventParse("IPV6.INVALID_EVENT");
@ -270,7 +245,6 @@ int DecodeEventTestParse04 (void) {
/** /**
* \test DecodeEventTestParse05 is a test for an invalid char into the decode-event value * \test DecodeEventTestParse05 is a test for an invalid char into the decode-event value
*/ */
int DecodeEventTestParse05 (void) { int DecodeEventTestParse05 (void) {
DetectDecodeEventData *de = NULL; DetectDecodeEventData *de = NULL;
de = DetectDecodeEventParse("IPV-6,INVALID_CHAR"); de = DetectDecodeEventParse("IPV-6,INVALID_CHAR");
@ -285,7 +259,6 @@ int DecodeEventTestParse05 (void) {
/** /**
* \test DecodeEventTestParse06 is a test for match function with valid decode-event value * \test DecodeEventTestParse06 is a test for match function with valid decode-event value
*/ */
int DecodeEventTestParse06 (void) { int DecodeEventTestParse06 (void) {
Packet p; Packet p;
ThreadVars tv; ThreadVars tv;
@ -326,7 +299,6 @@ error:
/** /**
* \brief this function registers unit tests for DecodeEvent * \brief this function registers unit tests for DecodeEvent
*/ */
void DecodeEventRegisterTests(void) { void DecodeEventRegisterTests(void) {
UtRegisterTest("DecodeEventTestParse01", DecodeEventTestParse01, 1); UtRegisterTest("DecodeEventTestParse01", DecodeEventTestParse01, 1);
UtRegisterTest("DecodeEventTestParse02", DecodeEventTestParse02, 1); UtRegisterTest("DecodeEventTestParse02", DecodeEventTestParse02, 1);

56
src/detect-decode-event.h
Unescape Escape View File

@ -20,34 +20,34 @@ struct DetectDecodeEvents_ {
char *event_name; char *event_name;
u_int8_t code; u_int8_t code;
} DEvents[] = { } DEvents[] = {
"ipv4.pkt_too_small", IPV4_PKT_TOO_SMALL, { "ipv4.pkt_too_small", IPV4_PKT_TOO_SMALL, },
"ipv4.hlen_too_small", IPV4_HLEN_TOO_SMALL, { "ipv4.hlen_too_small", IPV4_HLEN_TOO_SMALL, },
"ipv4.iplen_smaller_than_hlen", IPV4_IPLEN_SMALLER_THAN_HLEN, { "ipv4.iplen_smaller_than_hlen", IPV4_IPLEN_SMALLER_THAN_HLEN, },
"ipv6.pkt_too_small", IPV6_PKT_TOO_SMALL, { "ipv6.pkt_too_small", IPV6_PKT_TOO_SMALL, },
"ipv6.trunc_exthdr", IPV6_TRUNC_EXTHDR, { "ipv6.trunc_exthdr", IPV6_TRUNC_EXTHDR, },
"ipv6.exthdr_dupl_fh", IPV6_EXTHDR_DUPL_FH, { "ipv6.exthdr_dupl_fh", IPV6_EXTHDR_DUPL_FH, },
"ipv6.exthdr_dupl_rh", IPV6_EXTHDR_DUPL_RH, { "ipv6.exthdr_dupl_rh", IPV6_EXTHDR_DUPL_RH, },
"ipv6.exthdr_dupl_hh", IPV6_EXTHDR_DUPL_HH, { "ipv6.exthdr_dupl_hh", IPV6_EXTHDR_DUPL_HH, },
"ipv6.exthdr_dupl_dh", IPV6_EXTHDR_DUPL_DH, { "ipv6.exthdr_dupl_dh", IPV6_EXTHDR_DUPL_DH, },
"ipv6.exthdr_dupl_ah", IPV6_EXTHDR_DUPL_AH, { "ipv6.exthdr_dupl_ah", IPV6_EXTHDR_DUPL_AH, },
"ipv6.exthdr_dupl_eh", IPV6_EXTHDR_DUPL_EH, { "ipv6.exthdr_dupl_eh", IPV6_EXTHDR_DUPL_EH, },
"ipv6.exthdr_invalid_optlen", IPV6_EXTHDR_INVALID_OPTLEN, { "ipv6.exthdr_invalid_optlen", IPV6_EXTHDR_INVALID_OPTLEN, },
"tcp.pkt_too_small", TCP_PKT_TOO_SMALL, { "tcp.pkt_too_small", TCP_PKT_TOO_SMALL, },
"tcp.hlen_too_small", TCP_HLEN_TOO_SMALL, { "tcp.hlen_too_small", TCP_HLEN_TOO_SMALL, },
"tcp.invalid_optlen", TCP_INVALID_OPTLEN, { "tcp.invalid_optlen", TCP_INVALID_OPTLEN, },
"tcp.opt_invalid_len", TCP_OPT_INVALID_LEN, { "tcp.opt_invalid_len", TCP_OPT_INVALID_LEN, },
"tcp.opt_duplicate", TCP_OPT_DUPLICATE, { "tcp.opt_duplicate", TCP_OPT_DUPLICATE, },
"udp.pkt_too_small", UDP_PKT_TOO_SMALL, { "udp.pkt_too_small", UDP_PKT_TOO_SMALL, },
"udp.hlen_too_small", UDP_HLEN_TOO_SMALL, { "udp.hlen_too_small", UDP_HLEN_TOO_SMALL, },
"udp.hlen_invalid", UDP_HLEN_INVALID, { "udp.hlen_invalid", UDP_HLEN_INVALID, },
"sll.pkt_too_small", SLL_PKT_TOO_SMALL, { "sll.pkt_too_small", SLL_PKT_TOO_SMALL, },
"ethernet.pkt_too_small", ETHERNET_PKT_TOO_SMALL, { "ethernet.pkt_too_small", ETHERNET_PKT_TOO_SMALL, },
"ppp.pkt_too_small", PPP_PKT_TOO_SMALL, { "ppp.pkt_too_small", PPP_PKT_TOO_SMALL, },
"ppp.ju_pkt_too_small", PPPVJU_PKT_TOO_SMALL, { "ppp.ju_pkt_too_small", PPPVJU_PKT_TOO_SMALL, },
"ppp.ip4_pkt_too_small", PPPIPV4_PKT_TOO_SMALL, { "ppp.ip4_pkt_too_small", PPPIPV4_PKT_TOO_SMALL, },
"ppp.ip6_pkt_too_small", PPPIPV6_PKT_TOO_SMALL, { "ppp.ip6_pkt_too_small", PPPIPV6_PKT_TOO_SMALL, },
"ppp.wrong_type", PPP_WRONG_TYPE, { "ppp.wrong_type", PPP_WRONG_TYPE, },
NULL, 0 { NULL, 0 },
}; };

Write Preview
Loading…
Cancel
Save