aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Detection keyword cleanup

Browse Source
remotes/origin/master-1.0.x
Victor Julien 16 years ago
parent 6637873348
commit 8b30226914
62 changed files with 303 additions and 417 deletions
Show Stats Download Patch File Download Diff File

16
src/detect-ack.c
Unescape Escape View File

@ -22,13 +22,12 @@
#include "util-unittest.h"
#include "util-debug.h"
static int DetectAckSetup(DetectEngineCtx *, Signature *s, SigMatch *m,
char *sidstr);
static int DetectAckMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
Packet *p, Signature *s, SigMatch *m);
/* prototypes */
static int DetectAckSetup(DetectEngineCtx *, Signature *, char *);
static int DetectAckMatch(ThreadVars *, DetectEngineThreadCtx *,
Packet *, Signature *, SigMatch *);
static void DetectAckRegisterTests(void);
static void DetectAckFree(void *ptr);
static void DetectAckFree(void *);
void DetectAckRegister(void) {
sigmatch_table[DETECT_ACK].name = "ack";
@ -75,14 +74,11 @@ static int DetectAckMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
* \retval 0 on Success
* \retval -1 on Failure
*/
static int DetectAckSetup(DetectEngineCtx *de_ctx, Signature *s,
SigMatch *notused, char *optstr)
static int DetectAckSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
{
DetectAckData *data;
SigMatch *sm = NULL;
//printf("DetectAckSetup: \'%s\'\n", optstr);
data = SCMalloc(sizeof(DetectAckData));
if (data == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "malloc failed");

5
src/detect-bytejump.c
Unescape Escape View File

@ -481,14 +481,11 @@ error:
return NULL;
}
int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s,
SigMatch *notused, char *optstr)
int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
{
DetectBytejumpData *data = NULL;
SigMatch *sm = NULL;
//printf("DetectBytejumpSetup: \'%s\'\n", optstr);
data = DetectBytejumpParse(optstr);
if (data == NULL) goto error;

4
src/detect-bytejump.h
Unescape Escape View File

@ -43,14 +43,12 @@ void DetectBytejumpRegister (void);
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param optstr pointer to the user provided options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s,
SigMatch *m, char *optstr);
int DetectBytejumpSetup(DetectEngineCtx *, Signature *, char *);
/**
* \brief this function will free memory associated with DetectBytejumpData

3
src/detect-bytetest.c
Unescape Escape View File

@ -495,8 +495,7 @@ error:
return NULL;
}
int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s,
SigMatch *notused, char *optstr)
int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
{
DetectBytetestData *data = NULL;
SigMatch *sm = NULL;

4
src/detect-bytetest.h
Unescape Escape View File

@ -49,14 +49,12 @@ void DetectBytetestRegister (void);
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param optstr pointer to the user provided options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s,
SigMatch *m, char *optstr);
int DetectBytetestSetup(DetectEngineCtx *, Signature *, char *);
/**
* \brief this function will free memory associated with DetectBytetestData

10
src/detect-classtype.c
Unescape Escape View File

@ -1,4 +1,6 @@
/** Copyright (c) 2009 Open Information Security Foundation.
/* Copyright (c) 2009 Open Information Security Foundation. */
/** \file
* \author Anoop Saldanha <poonaatsoc@gmail.com>
*/
@ -21,7 +23,7 @@
static pcre *regex = NULL;
static pcre_extra *regex_study = NULL;
int DetectClasstypeSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectClasstypeSetup(DetectEngineCtx *, Signature *, char *);
void DetectClasstypeRegisterTests(void);
/**
@ -125,14 +127,12 @@ static inline SCClassConfClasstype *DetectClasstypeGetClasstypeInfo(const char *
*
* \param de_ctx Pointer to the Detection Engine Context.
* \param s Pointer the current Signature instance that is being parsed.
* \param m Pointer to the previous SigMatch.
* \param rawstr Pointer to the argument supplied to the classtype keyword.
*
* \retval 0 On success
* \retval -1 On failure
*/
int DetectClasstypeSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *m,
char *rawstr)
static int DetectClasstypeSetup(DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
const char *parsed_ct_name = NULL;
SCClassConfClasstype *ct = NULL;

4
src/detect-content.c
Unescape Escape View File

@ -52,7 +52,7 @@
#include "threads.h"
int DetectContentMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectContentSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectContentSetup (DetectEngineCtx *, Signature *, char *);
void DetectContentRegisterTests(void);
void DetectContentRegister (void) {
@ -1410,7 +1410,7 @@ error:
* \retval -1 if error
* \retval 0 if all was ok
*/
int DetectContentSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *contentstr)
static int DetectContentSetup (DetectEngineCtx *de_ctx, Signature *s, char *contentstr)
{
DetectContentData *cd = NULL;
SigMatch *sm = NULL;

219
src/detect-csum.c
Unescape Escape View File

@ -20,43 +20,43 @@
/* prototypes for the "ipv4-csum" rule keyword */
int DetectIPV4CsumMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *,
Signature *, SigMatch *);
int DetectIPV4CsumSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectIPV4CsumSetup(DetectEngineCtx *, Signature *, char *);
void DetectIPV4CsumFree(void *);
/* prototypes for the "tcpv4-csum" rule keyword */
int DetectTCPV4CsumMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *,
Signature *, SigMatch *);
int DetectTCPV4CsumSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectTCPV4CsumSetup(DetectEngineCtx *, Signature *, char *);
void DetectTCPV4CsumFree(void *);
/* prototypes for the "tcpv6-csum" rule keyword */
int DetectTCPV6CsumMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *,
Signature *, SigMatch *);
int DetectTCPV6CsumSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectTCPV6CsumSetup(DetectEngineCtx *, Signature *, char *);
void DetectTCPV6CsumFree(void *);
/* prototypes for the "udpv4-csum" rule keyword */
int DetectUDPV4CsumMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *,
Signature *, SigMatch *);
int DetectUDPV4CsumSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectUDPV4CsumSetup(DetectEngineCtx *, Signature *, char *);
void DetectUDPV4CsumFree(void *);
/* prototypes for the "udpv6-csum" rule keyword */
int DetectUDPV6CsumMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *,
Signature *, SigMatch *);
int DetectUDPV6CsumSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectUDPV6CsumSetup(DetectEngineCtx *, Signature *, char *);
void DetectUDPV6CsumFree(void *);
/* prototypes for the "icmpv4-csum" rule keyword */
int DetectICMPV4CsumMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *,
Signature *, SigMatch *);
int DetectICMPV4CsumSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectICMPV4CsumSetup(DetectEngineCtx *, Signature *, char *);
void DetectICMPV4CsumFree(void *);
/* prototypes for the "icmpv6-csum" rule keyword */
int DetectICMPV6CsumMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *,
Signature *, SigMatch *);
int DetectICMPV6CsumSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectICMPV6CsumSetup(DetectEngineCtx *, Signature *, char *);
void DetectICMPV6CsumFree(void *);
void DetectCsumRegisterTests(void);
@ -225,14 +225,11 @@ int DetectIPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
* \param de_ctx Pointer to the detection engine context
* \param s Pointer to signature for the current Signature being parsed
* from the rules
* \param m Pointer to the head of the SigMatchs for the current rule
* being parsed
* \param csum_str Pointer to the string holding the keyword value
*
* \retval 0 on success, -1 on failure
*/
int DetectIPV4CsumSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *csum_str)
static int DetectIPV4CsumSetup(DetectEngineCtx *de_ctx, Signature *s, char *csum_str)
{
DetectCsumData *cd = NULL;
SigMatch *sm = NULL;
@ -322,14 +319,11 @@ int DetectTCPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
* \param de_ctx Pointer to the detection engine context
* \param s Pointer to signature for the current Signature being parsed
* from the rules
* \param m Pointer to the head of the SigMatchs for the current rule
* being parsed
* \param csum_str Pointer to the string holding the keyword value
*
* \retval 0 on success, -1 on failure
*/
int DetectTCPV4CsumSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *csum_str)
static int DetectTCPV4CsumSetup(DetectEngineCtx *de_ctx, Signature *s, char *csum_str)
{
DetectCsumData *cd = NULL;
SigMatch *sm = NULL;
@ -419,14 +413,11 @@ int DetectTCPV6CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
* \param de_ctx Pointer to the detection engine context
* \param s Pointer to signature for the current Signature being parsed
* from the rules
* \param m Pointer to the head of the SigMatchs for the current rule
* being parsed
* \param csum_str Pointer to the string holding the keyword value
*
* \retval 0 on success, -1 on failure
*/
int DetectTCPV6CsumSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *csum_str)
static int DetectTCPV6CsumSetup(DetectEngineCtx *de_ctx, Signature *s, char *csum_str)
{
DetectCsumData *cd = NULL;
SigMatch *sm = NULL;
@ -516,14 +507,11 @@ int DetectUDPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
* \param de_ctx Pointer to the detection engine context
* \param s Pointer to signature for the current Signature being parsed
* from the rules
* \param m Pointer to the head of the SigMatchs for the current rule
* being parsed
* \param csum_str Pointer to the string holding the keyword value
*
* \retval 0 on success, -1 on failure
*/
int DetectUDPV4CsumSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *csum_str)
static int DetectUDPV4CsumSetup(DetectEngineCtx *de_ctx, Signature *s, char *csum_str)
{
DetectCsumData *cd = NULL;
SigMatch *sm = NULL;
@ -613,14 +601,11 @@ int DetectUDPV6CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
* \param de_ctx Pointer to the detection engine context
* \param s Pointer to signature for the current Signature being parsed
* from the rules
* \param m Pointer to the head of the SigMatchs for the current rule
* being parsed
* \param csum_str Pointer to the string holding the keyword value
*
* \retval 0 on success, -1 on failure
*/
int DetectUDPV6CsumSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *csum_str)
static int DetectUDPV6CsumSetup(DetectEngineCtx *de_ctx, Signature *s, char *csum_str)
{
DetectCsumData *cd = NULL;
SigMatch *sm = NULL;
@ -709,14 +694,11 @@ int DetectICMPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
* \param de_ctx Pointer to the detection engine context
* \param s Pointer to signature for the current Signature being parsed
* from the rules
* \param m Pointer to the head of the SigMatchs for the current rule
* being parsed
* \param csum_str Pointer to the string holding the keyword value
*
* \retval 0 on success, -1 on failure
*/
int DetectICMPV4CsumSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *csum_str)
static int DetectICMPV4CsumSetup(DetectEngineCtx *de_ctx, Signature *s, char *csum_str)
{
DetectCsumData *cd = NULL;
SigMatch *sm = NULL;
@ -805,20 +787,15 @@ int DetectICMPV6CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
* \param de_ctx Pointer to the detection engine context
* \param s Pointer to signature for the current Signature being parsed
* from the rules
* \param m Pointer to the head of the SigMatchs for the current rule
* being parsed
* \param csum_str Pointer to the string holding the keyword value
*
* \retval 0 on success, -1 on failure
*/
int DetectICMPV6CsumSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *csum_str)
static int DetectICMPV6CsumSetup(DetectEngineCtx *de_ctx, Signature *s, char *csum_str)
{
DetectCsumData *cd = NULL;
SigMatch *sm = NULL;
//printf("DetectCsumSetup: \'%s\'\n", csum_str);
sm = SigMatchAlloc();
if (sm == NULL)
goto error;
@ -869,11 +846,11 @@ int DetectCsumIPV4ValidArgsTestParse01(void)
memset(&s, 0, sizeof(Signature));
result = (DetectIPV4CsumSetup(NULL, &s, NULL, "\"valid\"") == 0);
result &= (DetectIPV4CsumSetup(NULL, &s, NULL, "\"invalid\"") == 0);
result &= (DetectIPV4CsumSetup(NULL, &s, NULL, "\"vaLid\"") == 0);
result &= (DetectIPV4CsumSetup(NULL, &s, NULL, "\"VALID\"") == 0);
result &= (DetectIPV4CsumSetup(NULL, &s, NULL, "\"iNvaLid\"") == 0);
result = (DetectIPV4CsumSetup(NULL, &s, "\"valid\"") == 0);
result &= (DetectIPV4CsumSetup(NULL, &s, "\"invalid\"") == 0);
result &= (DetectIPV4CsumSetup(NULL, &s, "\"vaLid\"") == 0);
result &= (DetectIPV4CsumSetup(NULL, &s, "\"VALID\"") == 0);
result &= (DetectIPV4CsumSetup(NULL, &s, "\"iNvaLid\"") == 0);
while (s.match != NULL) {
DetectIPV4CsumFree(s.match->ctx);
@ -893,11 +870,11 @@ int DetectCsumIPV4InValidArgsTestParse02(void)
memset(&s, 0, sizeof(Signature));
result = (DetectIPV4CsumSetup(NULL, &s, NULL, "vaid") == -1);
result &= (DetectIPV4CsumSetup(NULL, &s, NULL, "invaalid") == -1);
result &= (DetectIPV4CsumSetup(NULL, &s, NULL, "vaLiid") == -1);
result &= (DetectIPV4CsumSetup(NULL, &s, NULL, "VALieD") == -1);
result &= (DetectIPV4CsumSetup(NULL, &s, NULL, "iNvamid") == -1);
result = (DetectIPV4CsumSetup(NULL, &s, "vaid") == -1);
result &= (DetectIPV4CsumSetup(NULL, &s, "invaalid") == -1);
result &= (DetectIPV4CsumSetup(NULL, &s, "vaLiid") == -1);
result &= (DetectIPV4CsumSetup(NULL, &s, "VALieD") == -1);
result &= (DetectIPV4CsumSetup(NULL, &s, "iNvamid") == -1);
while (s.match != NULL) {
DetectIPV4CsumFree(s.match->ctx);
@ -918,7 +895,7 @@ int DetectCsumIPV4ValidArgsTestParse03(void)
memset(&s, 0, sizeof(Signature));
result = (DetectIPV4CsumSetup(NULL, &s, NULL, "valid") == 0);
result = (DetectIPV4CsumSetup(NULL, &s, "valid") == 0);
while (s.match != NULL) {
if (s.match->ctx != NULL) {
@ -932,7 +909,7 @@ int DetectCsumIPV4ValidArgsTestParse03(void)
}
s.match = NULL;
result &= (DetectIPV4CsumSetup(NULL, &s, NULL, "INVALID") == 0);
result &= (DetectIPV4CsumSetup(NULL, &s, "INVALID") == 0);
if (s.match != NULL) {
if (s.match->ctx != NULL) {
@ -956,11 +933,11 @@ int DetectCsumICMPV4ValidArgsTestParse01(void)
memset(&s, 0, sizeof(Signature));
result = (DetectICMPV4CsumSetup(NULL, &s, NULL, "valid") == 0);
result &= (DetectICMPV4CsumSetup(NULL, &s, NULL, "invalid") == 0);
result &= (DetectICMPV4CsumSetup(NULL, &s, NULL, "vaLid") == 0);
result &= (DetectICMPV4CsumSetup(NULL, &s, NULL, "VALID") == 0);
result &= (DetectICMPV4CsumSetup(NULL, &s, NULL, "iNvaLid") == 0);
result = (DetectICMPV4CsumSetup(NULL, &s, "valid") == 0);
result &= (DetectICMPV4CsumSetup(NULL, &s, "invalid") == 0);
result &= (DetectICMPV4CsumSetup(NULL, &s, "vaLid") == 0);
result &= (DetectICMPV4CsumSetup(NULL, &s, "VALID") == 0);
result &= (DetectICMPV4CsumSetup(NULL, &s, "iNvaLid") == 0);
while (s.match != NULL) {
DetectICMPV4CsumFree(s.match->ctx);
@ -979,11 +956,11 @@ int DetectCsumICMPV4InValidArgsTestParse02(void) {
memset(&s, 0, sizeof(Signature));
result = (DetectICMPV4CsumSetup(NULL, &s, NULL, "vaid") == -1);
result &= (DetectICMPV4CsumSetup(NULL, &s, NULL, "invaalid") == -1);
result &= (DetectICMPV4CsumSetup(NULL, &s, NULL, "vaLiid") == -1);
result &= (DetectICMPV4CsumSetup(NULL, &s, NULL, "VALieD") == -1);
result &= (DetectICMPV4CsumSetup(NULL, &s, NULL, "iNvamid") == -1);
result = (DetectICMPV4CsumSetup(NULL, &s, "vaid") == -1);
result &= (DetectICMPV4CsumSetup(NULL, &s, "invaalid") == -1);
result &= (DetectICMPV4CsumSetup(NULL, &s, "vaLiid") == -1);
result &= (DetectICMPV4CsumSetup(NULL, &s, "VALieD") == -1);
result &= (DetectICMPV4CsumSetup(NULL, &s, "iNvamid") == -1);
while (s.match != NULL) {
DetectICMPV4CsumFree(s.match->ctx);
@ -1003,7 +980,7 @@ int DetectCsumICMPV4ValidArgsTestParse03(void) {
memset(&s, 0, sizeof(Signature));
result = (DetectICMPV4CsumSetup(NULL, &s, NULL, "valid") == 0);
result = (DetectICMPV4CsumSetup(NULL, &s, "valid") == 0);
while (s.match != NULL) {
if (s.match->ctx != NULL) {
@ -1017,7 +994,7 @@ int DetectCsumICMPV4ValidArgsTestParse03(void) {
}
s.match = NULL;
result &= (DetectICMPV4CsumSetup(NULL, &s, NULL, "INVALID") == 0);
result &= (DetectICMPV4CsumSetup(NULL, &s, "INVALID") == 0);
if (s.match != NULL) {
if (s.match->ctx != NULL) {
@ -1041,11 +1018,11 @@ int DetectCsumTCPV4ValidArgsTestParse01(void)
memset(&s, 0, sizeof(Signature));
result = (DetectTCPV4CsumSetup(NULL, &s, NULL, "valid") == 0);
result &= (DetectTCPV4CsumSetup(NULL, &s, NULL, "invalid") == 0);
result &= (DetectTCPV4CsumSetup(NULL, &s, NULL, "vaLid") == 0);
result &= (DetectTCPV4CsumSetup(NULL, &s, NULL, "VALID") == 0);
result &= (DetectTCPV4CsumSetup(NULL, &s, NULL, "iNvaLid") == 0);
result = (DetectTCPV4CsumSetup(NULL, &s, "valid") == 0);
result &= (DetectTCPV4CsumSetup(NULL, &s, "invalid") == 0);
result &= (DetectTCPV4CsumSetup(NULL, &s, "vaLid") == 0);
result &= (DetectTCPV4CsumSetup(NULL, &s, "VALID") == 0);
result &= (DetectTCPV4CsumSetup(NULL, &s, "iNvaLid") == 0);
while (s.match != NULL) {
DetectTCPV4CsumFree(s.match->ctx);
@ -1064,11 +1041,11 @@ int DetectCsumTCPV4InValidArgsTestParse02(void) {
memset(&s, 0, sizeof(Signature));
result = (DetectTCPV4CsumSetup(NULL, &s, NULL, "vaid") == -1);
result &= (DetectTCPV4CsumSetup(NULL, &s, NULL, "invaalid") == -1);
result &= (DetectTCPV4CsumSetup(NULL, &s, NULL, "vaLiid") == -1);
result &= (DetectTCPV4CsumSetup(NULL, &s, NULL, "VALieD") == -1);
result &= (DetectTCPV4CsumSetup(NULL, &s, NULL, "iNvamid") == -1);
result = (DetectTCPV4CsumSetup(NULL, &s, "vaid") == -1);
result &= (DetectTCPV4CsumSetup(NULL, &s, "invaalid") == -1);
result &= (DetectTCPV4CsumSetup(NULL, &s, "vaLiid") == -1);
result &= (DetectTCPV4CsumSetup(NULL, &s, "VALieD") == -1);
result &= (DetectTCPV4CsumSetup(NULL, &s, "iNvamid") == -1);
while (s.match != NULL) {
DetectTCPV4CsumFree(s.match->ctx);
@ -1088,7 +1065,7 @@ int DetectCsumTCPV4ValidArgsTestParse03(void) {
memset(&s, 0, sizeof(Signature));
result = (DetectTCPV4CsumSetup(NULL, &s, NULL, "valid") == 0);
result = (DetectTCPV4CsumSetup(NULL, &s, "valid") == 0);
while (s.match != NULL) {
if (s.match->ctx != NULL) {
@ -1102,7 +1079,7 @@ int DetectCsumTCPV4ValidArgsTestParse03(void) {
}
s.match = NULL;
result &= (DetectTCPV4CsumSetup(NULL, &s, NULL, "INVALID") == 0);
result &= (DetectTCPV4CsumSetup(NULL, &s, "INVALID") == 0);
if (s.match != NULL) {
if (s.match->ctx != NULL) {
@ -1126,11 +1103,11 @@ int DetectCsumUDPV4ValidArgsTestParse01(void)
memset(&s, 0, sizeof(Signature));
result = (DetectUDPV4CsumSetup(NULL, &s, NULL, "valid") == 0);
result &= (DetectUDPV4CsumSetup(NULL, &s, NULL, "invalid") == 0);
result &= (DetectUDPV4CsumSetup(NULL, &s, NULL, "vaLid") == 0);
result &= (DetectUDPV4CsumSetup(NULL, &s, NULL, "VALID") == 0);
result &= (DetectUDPV4CsumSetup(NULL, &s, NULL, "iNvaLid") == 0);
result = (DetectUDPV4CsumSetup(NULL, &s, "valid") == 0);
result &= (DetectUDPV4CsumSetup(NULL, &s, "invalid") == 0);
result &= (DetectUDPV4CsumSetup(NULL, &s, "vaLid") == 0);
result &= (DetectUDPV4CsumSetup(NULL, &s, "VALID") == 0);
result &= (DetectUDPV4CsumSetup(NULL, &s, "iNvaLid") == 0);
while (s.match != NULL) {
DetectUDPV4CsumFree(s.match->ctx);
@ -1149,11 +1126,11 @@ int DetectCsumUDPV4InValidArgsTestParse02(void) {
memset(&s, 0, sizeof(Signature));
result = (DetectUDPV4CsumSetup(NULL, &s, NULL, "vaid") == -1);
result &= (DetectUDPV4CsumSetup(NULL, &s, NULL, "invaalid") == -1);
result &= (DetectUDPV4CsumSetup(NULL, &s, NULL, "vaLiid") == -1);
result &= (DetectUDPV4CsumSetup(NULL, &s, NULL, "VALieD") == -1);
result &= (DetectUDPV4CsumSetup(NULL, &s, NULL, "iNvamid") == -1);
result = (DetectUDPV4CsumSetup(NULL, &s, "vaid") == -1);
result &= (DetectUDPV4CsumSetup(NULL, &s, "invaalid") == -1);
result &= (DetectUDPV4CsumSetup(NULL, &s, "vaLiid") == -1);
result &= (DetectUDPV4CsumSetup(NULL, &s, "VALieD") == -1);
result &= (DetectUDPV4CsumSetup(NULL, &s, "iNvamid") == -1);
while (s.match != NULL) {
DetectUDPV4CsumFree(s.match->ctx);
@ -1173,7 +1150,7 @@ int DetectCsumUDPV4ValidArgsTestParse03(void) {
memset(&s, 0, sizeof(Signature));
result = (DetectUDPV4CsumSetup(NULL, &s, NULL, "valid") == 0);
result = (DetectUDPV4CsumSetup(NULL, &s, "valid") == 0);
while (s.match != NULL) {
if (s.match->ctx != NULL) {
@ -1187,7 +1164,7 @@ int DetectCsumUDPV4ValidArgsTestParse03(void) {
}
s.match = NULL;
result &= (DetectUDPV4CsumSetup(NULL, &s, NULL, "INVALID") == 0);
result &= (DetectUDPV4CsumSetup(NULL, &s, "INVALID") == 0);
if (s.match != NULL) {
if (s.match->ctx != NULL) {
@ -1211,11 +1188,11 @@ int DetectCsumTCPV6ValidArgsTestParse01(void)
memset(&s, 0, sizeof(Signature));
result = (DetectTCPV6CsumSetup(NULL, &s, NULL, "valid") == 0);
result &= (DetectTCPV6CsumSetup(NULL, &s, NULL, "invalid") == 0);
result &= (DetectTCPV6CsumSetup(NULL, &s, NULL, "vaLid") == 0);
result &= (DetectTCPV6CsumSetup(NULL, &s, NULL, "VALID") == 0);
result &= (DetectTCPV6CsumSetup(NULL, &s, NULL, "iNvaLid") == 0);
result = (DetectTCPV6CsumSetup(NULL, &s, "valid") == 0);
result &= (DetectTCPV6CsumSetup(NULL, &s, "invalid") == 0);
result &= (DetectTCPV6CsumSetup(NULL, &s, "vaLid") == 0);
result &= (DetectTCPV6CsumSetup(NULL, &s, "VALID") == 0);
result &= (DetectTCPV6CsumSetup(NULL, &s, "iNvaLid") == 0);
while (s.match != NULL) {
DetectTCPV6CsumFree(s.match->ctx);
@ -1234,11 +1211,11 @@ int DetectCsumTCPV6InValidArgsTestParse02(void) {
memset(&s, 0, sizeof(Signature));
result = (DetectTCPV6CsumSetup(NULL, &s, NULL, "vaid") == -1);
result &= (DetectTCPV6CsumSetup(NULL, &s, NULL, "invaalid") == -1);
result &= (DetectTCPV6CsumSetup(NULL, &s, NULL, "vaLiid") == -1);
result &= (DetectTCPV6CsumSetup(NULL, &s, NULL, "VALieD") == -1);
result &= (DetectTCPV6CsumSetup(NULL, &s, NULL, "iNvamid") == -1);
result = (DetectTCPV6CsumSetup(NULL, &s, "vaid") == -1);
result &= (DetectTCPV6CsumSetup(NULL, &s, "invaalid") == -1);
result &= (DetectTCPV6CsumSetup(NULL, &s, "vaLiid") == -1);
result &= (DetectTCPV6CsumSetup(NULL, &s, "VALieD") == -1);
result &= (DetectTCPV6CsumSetup(NULL, &s, "iNvamid") == -1);
while (s.match != NULL) {
DetectTCPV6CsumFree(s.match->ctx);
@ -1258,7 +1235,7 @@ int DetectCsumTCPV6ValidArgsTestParse03(void) {
memset(&s, 0, sizeof(Signature));
result = (DetectTCPV6CsumSetup(NULL, &s, NULL, "valid") == 0);
result = (DetectTCPV6CsumSetup(NULL, &s, "valid") == 0);
while (s.match != NULL) {
if (s.match->ctx != NULL) {
@ -1272,7 +1249,7 @@ int DetectCsumTCPV6ValidArgsTestParse03(void) {
}
s.match = NULL;
result &= (DetectTCPV6CsumSetup(NULL, &s, NULL, "INVALID") == 0);
result &= (DetectTCPV6CsumSetup(NULL, &s, "INVALID") == 0);
if (s.match != NULL) {
if (s.match->ctx != NULL) {
@ -1296,11 +1273,11 @@ int DetectCsumUDPV6ValidArgsTestParse01(void)
memset(&s, 0, sizeof(Signature));
result = (DetectUDPV6CsumSetup(NULL, &s, NULL, "valid") == 0);
result &= (DetectUDPV6CsumSetup(NULL, &s, NULL, "invalid") == 0);
result &= (DetectUDPV6CsumSetup(NULL, &s, NULL, "vaLid") == 0);
result &= (DetectUDPV6CsumSetup(NULL, &s, NULL, "VALID") == 0);
result &= (DetectUDPV6CsumSetup(NULL, &s, NULL, "iNvaLid") == 0);
result = (DetectUDPV6CsumSetup(NULL, &s, "valid") == 0);
result &= (DetectUDPV6CsumSetup(NULL, &s, "invalid") == 0);
result &= (DetectUDPV6CsumSetup(NULL, &s, "vaLid") == 0);
result &= (DetectUDPV6CsumSetup(NULL, &s, "VALID") == 0);
result &= (DetectUDPV6CsumSetup(NULL, &s, "iNvaLid") == 0);
while (s.match != NULL) {
DetectUDPV6CsumFree(s.match->ctx);
@ -1319,11 +1296,11 @@ int DetectCsumUDPV6InValidArgsTestParse02(void) {
memset(&s, 0, sizeof(Signature));
result = (DetectUDPV6CsumSetup(NULL, &s, NULL, "vaid") == -1);
result &= (DetectUDPV6CsumSetup(NULL, &s, NULL, "invaalid") == -1);
result &= (DetectUDPV6CsumSetup(NULL, &s, NULL, "vaLiid") == -1);
result &= (DetectUDPV6CsumSetup(NULL, &s, NULL, "VALieD") == -1);
result &= (DetectUDPV6CsumSetup(NULL, &s, NULL, "iNvamid") == -1);
result = (DetectUDPV6CsumSetup(NULL, &s, "vaid") == -1);
result &= (DetectUDPV6CsumSetup(NULL, &s, "invaalid") == -1);
result &= (DetectUDPV6CsumSetup(NULL, &s, "vaLiid") == -1);
result &= (DetectUDPV6CsumSetup(NULL, &s, "VALieD") == -1);
result &= (DetectUDPV6CsumSetup(NULL, &s, "iNvamid") == -1);
while (s.match != NULL) {
DetectUDPV6CsumFree(s.match->ctx);
@ -1343,7 +1320,7 @@ int DetectCsumUDPV6ValidArgsTestParse03(void) {
memset(&s, 0, sizeof(Signature));
result = (DetectUDPV6CsumSetup(NULL, &s, NULL, "valid") == 0);
result = (DetectUDPV6CsumSetup(NULL, &s, "valid") == 0);
while (s.match != NULL) {
if (s.match->ctx != NULL) {
@ -1357,7 +1334,7 @@ int DetectCsumUDPV6ValidArgsTestParse03(void) {
}
s.match = NULL;
result &= (DetectUDPV6CsumSetup(NULL, &s, NULL, "INVALID") == 0);
result &= (DetectUDPV6CsumSetup(NULL, &s, "INVALID") == 0);
if (s.match != NULL) {
if (s.match->ctx != NULL) {
@ -1381,11 +1358,11 @@ int DetectCsumICMPV6ValidArgsTestParse01(void)
memset(&s, 0, sizeof(Signature));
result = (DetectICMPV6CsumSetup(NULL, &s, NULL, "valid") == 0);
result &= (DetectICMPV6CsumSetup(NULL, &s, NULL, "invalid") == 0);
result &= (DetectICMPV6CsumSetup(NULL, &s, NULL, "vaLid") == 0);
result &= (DetectICMPV6CsumSetup(NULL, &s, NULL, "VALID") == 0);
result &= (DetectICMPV6CsumSetup(NULL, &s, NULL, "iNvaLid") == 0);
result = (DetectICMPV6CsumSetup(NULL, &s, "valid") == 0);
result &= (DetectICMPV6CsumSetup(NULL, &s, "invalid") == 0);
result &= (DetectICMPV6CsumSetup(NULL, &s, "vaLid") == 0);
result &= (DetectICMPV6CsumSetup(NULL, &s, "VALID") == 0);
result &= (DetectICMPV6CsumSetup(NULL, &s, "iNvaLid") == 0);
while (s.match != NULL) {
DetectICMPV6CsumFree(s.match->ctx);
@ -1404,11 +1381,11 @@ int DetectCsumICMPV6InValidArgsTestParse02(void) {
memset(&s, 0, sizeof(Signature));
result = (DetectICMPV6CsumSetup(NULL, &s, NULL, "vaid") == -1);
result &= (DetectICMPV6CsumSetup(NULL, &s, NULL, "invaalid") == -1);
result &= (DetectICMPV6CsumSetup(NULL, &s, NULL, "vaLiid") == -1);
result &= (DetectICMPV6CsumSetup(NULL, &s, NULL, "VALieD") == -1);
result &= (DetectICMPV6CsumSetup(NULL, &s, NULL, "iNvamid") == -1);
result = (DetectICMPV6CsumSetup(NULL, &s, "vaid") == -1);
result &= (DetectICMPV6CsumSetup(NULL, &s, "invaalid") == -1);
result &= (DetectICMPV6CsumSetup(NULL, &s, "vaLiid") == -1);
result &= (DetectICMPV6CsumSetup(NULL, &s, "VALieD") == -1);
result &= (DetectICMPV6CsumSetup(NULL, &s, "iNvamid") == -1);
while (s.match != NULL) {
DetectICMPV6CsumFree(s.match->ctx);
@ -1428,7 +1405,7 @@ int DetectCsumICMPV6ValidArgsTestParse03(void) {
memset(&s, 0, sizeof(Signature));
result = (DetectICMPV6CsumSetup(NULL, &s, NULL, "valid") == 0);
result = (DetectICMPV6CsumSetup(NULL, &s, "valid") == 0);
while (s.match != NULL) {
if (s.match->ctx != NULL) {
@ -1442,7 +1419,7 @@ int DetectCsumICMPV6ValidArgsTestParse03(void) {
}
s.match = NULL;
result &= (DetectICMPV6CsumSetup(NULL, &s, NULL, "INVALID") == 0);
result &= (DetectICMPV6CsumSetup(NULL, &s, "INVALID") == 0);
if (s.match != NULL) {
if (s.match->ctx != NULL) {

49
src/detect-dce-iface.c
Unescape Escape View File

@ -1,4 +1,6 @@
/** Copyright (c) 2009 Open Information Security Foundation.
/* Copyright (c) 2009 Open Information Security Foundation. */
/** \file
* \author Anoop Saldanha <poonaatsoc@gmail.com>
*/
@ -30,7 +32,7 @@ static pcre_extra *parse_regex_study = NULL;
int DetectDceIfaceMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t,
void *, Signature *, SigMatch *);
int DetectDceIfaceSetup(DetectEngineCtx *, Signature *s, SigMatch *m, char *arg);
static int DetectDceIfaceSetup(DetectEngineCtx *, Signature *, char *);
void DetectDceIfaceFree(void *);
/**
@ -310,15 +312,12 @@ int DetectDceIfaceMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f,
* \param de_ctx Pointer to the detection engine context.
* \param s Pointer to signature for the current Signature being parsed
* from the rules.
* \param m Pointer to the head of the SigMatchs for the current rule
* being parsed.
* \param arg Pointer to the string holding the keyword value.
*
* \retval 0 on success, -1 on failure.
*/
int DetectDceIfaceSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *arg)
static int DetectDceIfaceSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
{
DetectDceIfaceData *did = NULL;
SigMatch *sm = NULL;
@ -369,7 +368,7 @@ static int DetectDceIfaceTestParse01(void)
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC") == 0);
result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC") == 0);
if (s->match != NULL) {
temp = s->match;
@ -401,7 +400,7 @@ static int DetectDceIfaceTestParse02(void)
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>1") == 0);
result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>1") == 0);
if (s->match != NULL) {
temp = s->match;
@ -433,7 +432,7 @@ static int DetectDceIfaceTestParse03(void)
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,<10") == 0);
result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,<10") == 0);
if (s->match != NULL) {
temp = s->match;
@ -465,7 +464,7 @@ static int DetectDceIfaceTestParse04(void)
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,!10") == 0);
result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,!10") == 0);
if (s->match != NULL) {
temp = s->match;
@ -497,7 +496,7 @@ static int DetectDceIfaceTestParse05(void)
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,=10") == 0);
result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,=10") == 0);
if (s->match != NULL) {
temp = s->match;
@ -529,7 +528,7 @@ static int DetectDceIfaceTestParse06(void)
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,any_frag") == 0);
result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,any_frag") == 0);
if (s->match != NULL) {
temp = s->match;
@ -561,7 +560,7 @@ static int DetectDceIfaceTestParse07(void)
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>1,any_frag") == 0);
result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>1,any_frag") == 0);
if (s->match != NULL) {
temp = s->match;
@ -593,7 +592,7 @@ static int DetectDceIfaceTestParse08(void)
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,<1,any_frag") == 0);
result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,<1,any_frag") == 0);
if (s->match != NULL) {
temp = s->match;
@ -625,7 +624,7 @@ static int DetectDceIfaceTestParse09(void)
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,=1,any_frag") == 0);
result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,=1,any_frag") == 0);
if (s->match != NULL) {
temp = s->match;
@ -657,7 +656,7 @@ static int DetectDceIfaceTestParse10(void)
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,!1,any_frag") == 0);
result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,!1,any_frag") == 0);
if (s->match != NULL) {
temp = s->match;
@ -684,15 +683,15 @@ static int DetectDceIfaceTestParse11(void)
Signature *s = SigAlloc();
int result = 1;
result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>1,ay_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-12345679ABC,>1,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-134-123456789ABC,>1,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-123-124-1234-123456789ABC,>1,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, NULL, "1234568-1234-1234-1234-123456789ABC,>1,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>65536,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>=1,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,<0,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>65535,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>1,ay_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-12345679ABC,>1,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-134-123456789ABC,>1,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, "12345678-123-124-1234-123456789ABC,>1,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, "1234568-1234-1234-1234-123456789ABC,>1,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>65536,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>=1,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,<0,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>65535,any_frag") == -1);
SigFree(s);
return result;

33
src/detect-dce-opnum.c
Unescape Escape View File

@ -30,7 +30,7 @@ static pcre_extra *parse_regex_study = NULL;
int DetectDceOpnumMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t,
void *, Signature *, SigMatch *);
int DetectDceOpnumSetup(DetectEngineCtx *, Signature *s, SigMatch *m, char *arg);
static int DetectDceOpnumSetup(DetectEngineCtx *, Signature *, char *);
void DetectDceOpnumFree(void *);
/**
@ -267,15 +267,12 @@ int DetectDceOpnumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f,
* \param de_ctx Pointer to the detection engine context.
* \param s Pointer to signature for the current Signature being parsed
* from the rules.
* \param m Pointer to the head of the SigMatchs for the current rule
* being parsed.
* \param arg Pointer to the string holding the keyword value.
*
* \retval 0 on success, -1 on failure
*/
int DetectDceOpnumSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *arg)
static int DetectDceOpnumSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
{
DetectDceOpnumData *dod = NULL;
SigMatch *sm = NULL;
@ -336,13 +333,13 @@ static int DetectDceOpnumTestParse01(void)
memset(s, 0, sizeof(Signature));
result = (DetectDceOpnumSetup(NULL, s, NULL, "12") == 0);
result &= (DetectDceOpnumSetup(NULL, s, NULL, "12,24") == 0);
result &= (DetectDceOpnumSetup(NULL, s, NULL, "12,12-24") == 0);
result &= (DetectDceOpnumSetup(NULL, s, NULL, "12-14,12,121,62-78") == 0);
result &= (DetectDceOpnumSetup(NULL, s, NULL, "12,26,62,61,6513-6666") == 0);
result &= (DetectDceOpnumSetup(NULL, s, NULL, "12,26,62,61,6513--") == -1);
result &= (DetectDceOpnumSetup(NULL, s, NULL, "12-14,12,121,62-8") == -1);
result = (DetectDceOpnumSetup(NULL, s, "12") == 0);
result &= (DetectDceOpnumSetup(NULL, s, "12,24") == 0);
result &= (DetectDceOpnumSetup(NULL, s, "12,12-24") == 0);
result &= (DetectDceOpnumSetup(NULL, s, "12-14,12,121,62-78") == 0);
result &= (DetectDceOpnumSetup(NULL, s, "12,26,62,61,6513-6666") == 0);
result &= (DetectDceOpnumSetup(NULL, s, "12,26,62,61,6513--") == -1);
result &= (DetectDceOpnumSetup(NULL, s, "12-14,12,121,62-8") == -1);
if (s->match != NULL) {
SigFree(s);
@ -362,7 +359,7 @@ static int DetectDceOpnumTestParse02(void)
memset(s, 0, sizeof(Signature));
result = (DetectDceOpnumSetup(NULL, s, NULL, "12") == 0);
result = (DetectDceOpnumSetup(NULL, s, "12") == 0);
if (s->match != NULL) {
temp = s->match;
@ -389,7 +386,7 @@ static int DetectDceOpnumTestParse03(void)
memset(s, 0, sizeof(Signature));
result = (DetectDceOpnumSetup(NULL, s, NULL, "12-24") == 0);
result = (DetectDceOpnumSetup(NULL, s, "12-24") == 0);
if (s->match != NULL) {
temp = s->match;
@ -416,7 +413,7 @@ static int DetectDceOpnumTestParse04(void)
memset(s, 0, sizeof(Signature));
result = (DetectDceOpnumSetup(NULL, s, NULL, "12-24,24,62-72,623-635,62,25,213-235") == 0);
result = (DetectDceOpnumSetup(NULL, s, "12-24,24,62-72,623-635,62,25,213-235") == 0);
if (s->match != NULL) {
temp = s->match;
@ -480,7 +477,7 @@ static int DetectDceOpnumTestParse05(void)
memset(s, 0, sizeof(Signature));
result = (DetectDceOpnumSetup(NULL, s, NULL, "1,2,3,4,5,6,7") == 0);
result = (DetectDceOpnumSetup(NULL, s, "1,2,3,4,5,6,7") == 0);
if (s->match != NULL) {
temp = s->match;
@ -544,7 +541,7 @@ static int DetectDceOpnumTestParse06(void)
memset(s, 0, sizeof(Signature));
result = (DetectDceOpnumSetup(NULL, s, NULL, "1-2,3-4,5-6,7-8") == 0);
result = (DetectDceOpnumSetup(NULL, s, "1-2,3-4,5-6,7-8") == 0);
if (s->match != NULL) {
temp = s->match;
@ -591,7 +588,7 @@ static int DetectDceOpnumTestParse07(void)
memset(s, 0, sizeof(Signature));
result = (DetectDceOpnumSetup(NULL, s, NULL, "1-2,3-4,5-6,7-8,9") == 0);
result = (DetectDceOpnumSetup(NULL, s, "1-2,3-4,5-6,7-8,9") == 0);
if (s->match != NULL) {
temp = s->match;

9
src/detect-dce-stub-data.c
Unescape Escape View File

@ -26,7 +26,7 @@
int DetectDceStubDataMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t,
void *, Signature *, SigMatch *);
int DetectDceStubDataSetup(DetectEngineCtx *, Signature *s, SigMatch *m, char *arg);
static int DetectDceStubDataSetup(DetectEngineCtx *, Signature *, char *);
/**
* \brief Registers the keyword handlers for the "dce_stub_data" keyword.
@ -82,15 +82,12 @@ int DetectDceStubDataMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *
* \param de_ctx Pointer to the detection engine context
* \param s Pointer to signature for the current Signature being parsed
* from the rules
* \param m Pointer to the head of the SigMatchs for the current rule
* being parsed
* \param arg Pointer to the string holding the keyword value
*
* \retval 0 on success, -1 on failure
*/
int DetectDceStubDataSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *arg)
static int DetectDceStubDataSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
{
SigMatch *sm = NULL;
@ -122,7 +119,7 @@ static int DetectDceStubDataTestParse01(void)
memset(&s, 0, sizeof(Signature));
result = (DetectDceStubDataSetup(NULL, &s, NULL, NULL) == 0);
result = (DetectDceStubDataSetup(NULL, &s, NULL) == 0);
if (s.match != NULL) {
result = 1;

5
src/detect-decode-event.c
Unescape Escape View File

@ -26,7 +26,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectDecodeEventMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectDecodeEventSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *str);
static int DetectDecodeEventSetup (DetectEngineCtx *, Signature *, char *);
void DecodeEventRegisterTests(void);
@ -146,13 +146,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param rawstr pointer to the user provided decode-event options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectDecodeEventSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *rawstr)
static int DetectDecodeEventSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
DetectDecodeEventData *de = NULL;
SigMatch *sm = NULL;

6
src/detect-depth.c
Unescape Escape View File

@ -8,7 +8,7 @@
#include "detect-pcre.h"
#include "util-debug.h"
int DetectDepthSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *depthstr);
static int DetectDepthSetup (DetectEngineCtx *, Signature *, char *);
void DetectDepthRegister (void) {
sigmatch_table[DETECT_DEPTH].name = "depth";
@ -20,13 +20,11 @@ void DetectDepthRegister (void) {
sigmatch_table[DETECT_DEPTH].flags |= SIGMATCH_PAYLOAD;
}
int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *depthstr)
static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depthstr)
{
char *str = depthstr;
char dubbed = 0;
//printf("DetectDepthSetup: s->match:%p,m:%p,depthstr:\'%s\'\n", s->match, m, depthstr);
/* strip "'s */
if (depthstr[0] == '\"' && depthstr[strlen(depthstr)-1] == '\"') {
str = SCStrdup(depthstr+1);

4
src/detect-distance.c
Unescape Escape View File

@ -9,7 +9,7 @@
#include "detect-pcre.h"
#include "util-debug.h"
int DetectDistanceSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *distancestr);
static int DetectDistanceSetup(DetectEngineCtx *, Signature *, char *);
void DetectDistanceRegister (void) {
sigmatch_table[DETECT_DISTANCE].name = "distance";
@ -21,7 +21,7 @@ void DetectDistanceRegister (void) {
sigmatch_table[DETECT_DISTANCE].flags |= SIGMATCH_PAYLOAD;
}
int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *distancestr)
static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *distancestr)
{
char *str = distancestr;
char dubbed = 0;

8
src/detect-dsize.c
Unescape Escape View File

@ -1,6 +1,7 @@
/* DSIZE part of the detection engine. */
/* Copyright (c) 2009 Open Information Security Foundation */
/* DSIZE part of the detection engine. */
/** \file
* \author Victor Julien <victor@inliniac.net>
*/
@ -27,7 +28,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectDsizeMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectDsizeSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *str);
static int DetectDsizeSetup (DetectEngineCtx *, Signature *s, char *str);
void DsizeRegisterTests(void);
static void DetectDsizeFree(void *);
@ -221,13 +222,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param rawstr pointer to the user provided flags options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectDsizeSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *rawstr)
static int DetectDsizeSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
DetectDsizeData *dd = NULL;
SigMatch *sm = NULL;

5
src/detect-fast-pattern.c
Unescape Escape View File

@ -15,7 +15,7 @@
#include "util-debug.h"
#include "util-unittest.h"
int DetectFastPatternSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectFastPatternSetup(DetectEngineCtx *, Signature *, char *);
void DetectFastPatternRegisterTests(void);
/**
@ -44,8 +44,7 @@ void DetectFastPatternRegister(void)
* \retval 0 On success
* \retval -1 On failure
*/
int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *null_str)
static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *null_str)
{
if (null_str != NULL && strcmp(null_str, "") != 0) {
SCLogError(SC_ERR_INVALID_ARGUMENT, "DetectFastPatternSetup: fast_pattern "

4
src/detect-flags.c
Unescape Escape View File

@ -38,7 +38,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
static int DetectFlagsMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
static int DetectFlagsSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *str);
static int DetectFlagsSetup (DetectEngineCtx *, Signature *, char *);
static void DetectFlagsFree(void *);
/**
@ -424,7 +424,7 @@ error:
* \retval 0 on Success
* \retval -1 on Failure
*/
static int DetectFlagsSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *rawstr)
static int DetectFlagsSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
DetectFlagsData *de = NULL;
SigMatch *sm = NULL;

5
src/detect-flow.c
Unescape Escape View File

@ -29,7 +29,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectFlowMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectFlowSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectFlowSetup (DetectEngineCtx *, Signature *, char *);
void DetectFlowRegisterTests(void);
void DetectFlowFree(void *);
@ -251,13 +251,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param flowstr pointer to the user provided flow options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectFlowSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *flowstr)
int DetectFlowSetup (DetectEngineCtx *de_ctx, Signature *s, char *flowstr)
{
DetectFlowData *fd = NULL;
SigMatch *sm = NULL;

4
src/detect-flowbits.c
Unescape Escape View File

@ -28,7 +28,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectFlowbitMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectFlowbitSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectFlowbitSetup (DetectEngineCtx *, Signature *, char *);
void DetectFlowbitFree (void *);
void FlowBitsRegisterTests(void);
@ -133,7 +133,7 @@ int DetectFlowbitMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p
return 0;
}
int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *rawstr)
int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
DetectFlowbitsData *cd = NULL;
SigMatch *sm = NULL;

8
src/detect-flowint.c
Unescape Escape View File

@ -30,7 +30,7 @@ static pcre_extra *parse_regex_study;
int DetectFlowintMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *,
Signature *, SigMatch *);
int DetectFlowintSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectFlowintSetup(DetectEngineCtx *, Signature *, char *);
void DetectFlowintFree(void *);
void DetectFlowintRegisterTests(void);
@ -324,14 +324,12 @@ error:
*
* \param de_ctx pointer to the engine context
* \param s pointer to the current Signature
* \param m pointer to the sigmatch that we will cast into DetectFlowintData
* \param rawstr pointer to the string holding the options
*
* \retval 0 if all is ok
* \retval -1 if we find any problem
*/
int DetectFlowintSetup(DetectEngineCtx *de_ctx,
Signature *s, SigMatch *notused, char *rawstr)
static int DetectFlowintSetup(DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
DetectFlowintData *sfd = NULL;
SigMatch *sm = NULL;
@ -347,7 +345,7 @@ int DetectFlowintSetup(DetectEngineCtx *de_ctx,
goto error;
sm->type = DETECT_FLOWINT;
sm->ctx =(void *) sfd;
sm->ctx = (void *)sfd;
SigMatchAppendPacket(s, sm);

6
src/detect-flowvar.c
Unescape Escape View File

@ -22,7 +22,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectFlowvarMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectFlowvarSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectFlowvarSetup (DetectEngineCtx *, Signature *, char *);
void DetectFlowvarRegister (void) {
sigmatch_table[DETECT_FLOWVAR].name = "flowvar";
@ -82,7 +82,7 @@ int DetectFlowvarMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p
return ret;
}
int DetectFlowvarSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *rawstr)
static int DetectFlowvarSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
DetectFlowvarData *cd = NULL;
SigMatch *sm = NULL;
@ -117,8 +117,6 @@ int DetectFlowvarSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused
varcontent = (char *)str_ptr;
}
//printf("DetectFlowvarSetup: varname %s, varcontent %s\n", varname, varcontent);
if (varcontent[0] == '\"' && varcontent[strlen(varcontent)-1] == '\"') {
str = SCStrdup(varcontent+1);
str[strlen(varcontent)-2] = '\0';

4
src/detect-fragbits.c
Unescape Escape View File

@ -37,7 +37,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
static int DetectFragBitsMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
static int DetectFragBitsSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *str);
static int DetectFragBitsSetup (DetectEngineCtx *, Signature *, char *);
static void DetectFragBitsFree(void *);
/**
@ -255,7 +255,7 @@ error:
* \retval 0 on Success
* \retval -1 on Failure
*/
static int DetectFragBitsSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *rawstr)
static int DetectFragBitsSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
DetectFragBitsData *de = NULL;
SigMatch *sm = NULL;

5
src/detect-fragoffset.c
Unescape Escape View File

@ -25,7 +25,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectFragOffsetMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectFragOffsetSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectFragOffsetSetup(DetectEngineCtx *, Signature *, char *);
void DetectFragOffsetRegisterTests(void);
void DetectFragOffsetFree(void *);
@ -184,13 +184,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param fragoffsetstr pointer to the user provided fragoffset option
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectFragOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *fragoffsetstr) {
static int DetectFragOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *fragoffsetstr) {
DetectFragOffsetData *fragoff = NULL;
SigMatch *sm = NULL;

9
src/detect-ftpbounce.c
Unescape Escape View File

@ -30,7 +30,7 @@ int DetectFtpbounceMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *,
Signature *, SigMatch *);
int DetectFtpbounceALMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *,
uint8_t, void *, Signature *, SigMatch *);
int DetectFtpbounceSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectFtpbounceSetup(DetectEngineCtx *, Signature *, char *);
int DetectFtpbounceMatchArgs(uint8_t *payload, uint16_t payload_len,
uint32_t ip_orig, uint16_t offset);
void DetectFtpbounceRegisterTests(void);
@ -44,7 +44,6 @@ void DetectFtpbounceRegister(void)
{
sigmatch_table[DETECT_FTPBOUNCE].name = "ftpbounce";
sigmatch_table[DETECT_FTPBOUNCE].Setup = DetectFtpbounceSetup;
//sigmatch_table[DETECT_FTPBOUNCE].Match = DetectFtpbounceMatch;
sigmatch_table[DETECT_FTPBOUNCE].Match = NULL;
sigmatch_table[DETECT_FTPBOUNCE].AppLayerMatch = DetectFtpbounceALMatch;
sigmatch_table[DETECT_FTPBOUNCE].alproto = ALPROTO_FTP;
@ -219,8 +218,7 @@ int DetectFtpbounceMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectFtpbounceSetup(DetectEngineCtx *de_ctx, Signature *s,
SigMatch *notused, char *ftpbouncestr)
int DetectFtpbounceSetup(DetectEngineCtx *de_ctx, Signature *s, char *ftpbouncestr)
{
SigMatch *sm = NULL;
@ -257,13 +255,12 @@ int DetectFtpbounceTestSetup01(void)
{
int res = 0;
DetectEngineCtx *de_ctx = NULL;
SigMatch *m = NULL;
Signature *s = SigAlloc();
if (s == NULL)
return 0;
/* ftpbounce doesn't accept options so the str is NULL */
res = !DetectFtpbounceSetup(de_ctx, s, m, NULL);
res = !DetectFtpbounceSetup(de_ctx, s, NULL);
res &= s->match != NULL && s->match->type & DETECT_FTPBOUNCE;
SigFree(s);

7
src/detect-gid.c
Unescape Escape View File

@ -20,7 +20,7 @@
static pcre *parse_regex;
static pcre_extra *parse_regex_study;
static int DetectGidSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *str);
static int DetectGidSetup (DetectEngineCtx *, Signature *, char *);
/**
* \brief Registration function for gid: keyword
@ -103,18 +103,17 @@ static uint32_t DetectGidParse (char *rawstr)
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param rawstr pointer to the user provided gid options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
static int DetectGidSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *rawstr)
static int DetectGidSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
s->gid = DetectGidParse(rawstr);
if(s->gid > 0)
return 0;
return 0;
return -1;
}

13
src/detect-http-cookie.c
Unescape Escape View File

@ -1,6 +1,7 @@
/**Copyright (c) 2009 Open Information Security Foundation
*
* \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>
/* Copyright (c) 2009 Open Information Security Foundation */
/** \file
* \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>
*
*/
@ -33,7 +34,7 @@
int DetectHttpCookieMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx,
Flow *f, uint8_t flags, void *state, Signature *s,
SigMatch *m);
int DetectHttpCookieSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectHttpCookieSetup (DetectEngineCtx *, Signature *, char *);
void DetectHttpCookieRegisterTests(void);
/**
@ -144,15 +145,13 @@ int DetectHttpCookieMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx,
*
* \param de_ctx Pointer to the Detection Engine Context
* \param s Pointer to the Signature to which the current keyword belongs
* \param m Pointer to the SigMatch
* \param str Should hold an empty string always
*
* \retval 0 On success
* \retval -1 On failure
*/
int DetectHttpCookieSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *str)
static int DetectHttpCookieSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
{
DetectHttpCookieData *hd = NULL;
SigMatch *sm = NULL;

10
src/detect-http-method.c
Unescape Escape View File

@ -1,6 +1,6 @@
/* Copyright (c) 2009 Open Information Security Foundation */
/**
* Copyright (c) 2009 Open Information Security Foundation
*
* \file
* \author Brian Rectanus <brectanu@gmail.com>
*/
@ -33,7 +33,7 @@
int DetectHttpMethodMatch(ThreadVars *, DetectEngineThreadCtx *,
Flow *, uint8_t, void *, Signature *, SigMatch *);
int DetectHttpMethodSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectHttpMethodSetup(DetectEngineCtx *, Signature *, char *);
void DetectHttpMethodRegisterTests(void);
void DetectHttpMethodFree(void *);
@ -128,14 +128,12 @@ int DetectHttpMethodMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param str pointer to the user provided option string
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s,
SigMatch *notused, char *str)
static int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, char *str)
{
SCEnter();
DetectHttpMethodData *data = NULL;

11
src/detect-icmp-id.c
Unescape Escape View File

@ -1,7 +1,7 @@
/* Copyright (c) 2009 Open Information Security Foundation */
/**
* Copyright (c) 2009 Open Information Security Foundation
*
* \file detect-icmp-id.c
* \file
* \author Gerardo Iglesias Galvan <iglesiasg@gmail.com>
*
* "icmp_id" keyword support
@ -26,7 +26,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectIcmpIdMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectIcmpIdSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectIcmpIdSetup(DetectEngineCtx *, Signature *, char *);
void DetectIcmpIdRegisterTests(void);
void DetectIcmpIdFree(void *);
@ -183,13 +183,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param icmpidstr pointer to the user provided icmp_id option
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectIcmpIdSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *icmpidstr) {
static int DetectIcmpIdSetup (DetectEngineCtx *de_ctx, Signature *s, char *icmpidstr) {
DetectIcmpIdData *iid = NULL;
SigMatch *sm = NULL;

5
src/detect-icmp-seq.c
Unescape Escape View File

@ -23,7 +23,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectIcmpSeqMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectIcmpSeqSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectIcmpSeqSetup(DetectEngineCtx *, Signature *, char *);
void DetectIcmpSeqRegisterTests(void);
void DetectIcmpSeqFree(void *);
@ -183,13 +183,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param icmpseqstr pointer to the user provided icmp_seq option
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectIcmpSeqSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *icmpseqstr) {
static int DetectIcmpSeqSetup (DetectEngineCtx *de_ctx, Signature *s, char *icmpseqstr) {
DetectIcmpSeqData *iseq = NULL;
SigMatch *sm = NULL;

9
src/detect-icode.c
Unescape Escape View File

@ -1,6 +1,6 @@
/* Copyright (c) 2009 Open Information Security Foundation */
/**
* Copyright (c) 2009 Open Information Security Foundation
*
* \file detect-icode.c
* \author Gerardo Iglesias <iglesiasg@gmail.com>
*
@ -29,7 +29,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectICodeMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectICodeSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectICodeSetup(DetectEngineCtx *, Signature *, char *);
void DetectICodeRegisterTests(void);
void DetectICodeFree(void *);
@ -199,13 +199,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param icodestr pointer to the user provided icode options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectICodeSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *icodestr) {
static int DetectICodeSetup(DetectEngineCtx *de_ctx, Signature *s, char *icodestr) {
DetectICodeData *icd = NULL;
SigMatch *sm = NULL;

14
src/detect-id.c
Unescape Escape View File

@ -1,7 +1,7 @@
/* Copyright (c) 2009 Open Information Security Foundation */
/**
* Copyright (c) 2009 Open Information Security Foundation
*
* \file detect-id.c
* \file
* \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
*
* "id" keyword, IPv4 Identifier keyword, part of the detection engine.
@ -34,7 +34,7 @@ static pcre_extra *parse_regex_study;
int DetectIdMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *,
Signature *, SigMatch *);
int DetectIdSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectIdSetup (DetectEngineCtx *, Signature *, char *);
void DetectIdRegisterTests(void);
void DetectIdFree(void *);
@ -96,7 +96,7 @@ int DetectIdMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p,
}
if (id_d->id == IPV4_GET_IPID(p)) {
SCLogDebug("detect-id: IPV4 Proto and matched with ip_id: %u.\n",
SCLogDebug("IPV4 Proto and matched with ip_id: %u.\n",
id_d->id);
return 1;
}
@ -191,14 +191,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param idstr pointer to the user provided "id" option
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectIdSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *idstr)
int DetectIdSetup (DetectEngineCtx *de_ctx, Signature *s, char *idstr)
{
DetectIdData *id_d = NULL;
SigMatch *sm = NULL;

5
src/detect-ipopts.c
Unescape Escape View File

@ -28,7 +28,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectIpOptsMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectIpOptsSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *str);
static int DetectIpOptsSetup (DetectEngineCtx *, Signature *, char *);
void IpOptsRegisterTests(void);
void DetectIpOptsFree(void *);
@ -162,13 +162,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param rawstr pointer to the user provided ipopts options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectIpOptsSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *rawstr)
static int DetectIpOptsSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
DetectIpOptsData *de = NULL;
SigMatch *sm = NULL;

7
src/detect-ipproto.c
Unescape Escape View File

@ -36,8 +36,7 @@
static pcre *parse_regex;
static pcre_extra *parse_regex_study;
static int DetectIPProtoSetup(DetectEngineCtx *de_ctx, Signature *s,
SigMatch *m, char *optstr);
static int DetectIPProtoSetup(DetectEngineCtx *, Signature *, char *);
static DetectIPProtoData *DetectIPProtoParse(const char *optstr);
static void DetectIPProtoRegisterTests(void);
@ -156,13 +155,11 @@ error:
*
* \param de_ctx Detection engine context
* \param s Signature
* \param m Signature match
* \param optstr Options string
*
* \return Non-zero on error
*/
static int DetectIPProtoSetup(DetectEngineCtx *de_ctx, Signature *s,
SigMatch *m, char *optstr)
static int DetectIPProtoSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
{
DetectIPProtoData *data = NULL;
int ret = 0;

5
src/detect-isdataat.c
Unescape Escape View File

@ -32,7 +32,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectIsdataatMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectIsdataatSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
int DetectIsdataatSetup (DetectEngineCtx *, Signature *, char *);
void DetectIsdataatRegisterTests(void);
void DetectIsdataatFree(void *);
@ -203,13 +203,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param isdataatstr pointer to the user provided isdataat options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *isdataatstr)
int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, char *isdataatstr)
{
DetectIsdataatData *idad = NULL;
SigMatch *sm = NULL;

9
src/detect-itype.c
Unescape Escape View File

@ -1,6 +1,6 @@
/* Copyright (c) 2009 Open Information Security Foundation */
/**
* Copyright (c) 2009 Open Information Security Foundation
*
* \file detect-itype.c
* \author Gerardo Iglesias <iglesiasg@gmail.com>
*
@ -29,7 +29,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectITypeMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectITypeSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectITypeSetup(DetectEngineCtx *, Signature *, char *);
void DetectITypeRegisterTests(void);
void DetectITypeFree(void *);
@ -199,13 +199,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param itypestr pointer to the user provided itype options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectITypeSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *itypestr) {
static int DetectITypeSetup(DetectEngineCtx *de_ctx, Signature *s, char *itypestr) {
DetectITypeData *itd = NULL;
SigMatch *sm = NULL;

17
src/detect-metadata.c
Unescape Escape View File

@ -3,7 +3,7 @@
#include "suricata-common.h"
#include "detect.h"
int DetectMetadataSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *str);
static int DetectMetadataSetup (DetectEngineCtx *, Signature *, char *);
void DetectMetadataRegister (void) {
sigmatch_table[DETECT_METADATA].name = "metadata";
@ -13,21 +13,8 @@ void DetectMetadataRegister (void) {
sigmatch_table[DETECT_METADATA].RegisterTests = NULL;
}
int DetectMetadataSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *rawstr)
static int DetectMetadataSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
char *str = rawstr;
char dubbed = 0;
/* strip "'s */
if (rawstr[0] == '\"' && rawstr[strlen(rawstr)-1] == '\"') {
str = SCStrdup(rawstr+1);
str[strlen(rawstr)-2] = '\0';
dubbed = 1;
}
/* XXX */
if (dubbed) SCFree(str);
return 0;
}

5
src/detect-msg.c
Unescape Escape View File

@ -10,8 +10,7 @@
#include "detect-engine.h"
#include "detect-engine-mpm.h"
int DetectMsgSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *msgstr);
static int DetectMsgSetup (DetectEngineCtx *, Signature *, char *);
void DetectMsgRegisterTests(void);
void DetectMsgRegister (void) {
@ -22,7 +21,7 @@ void DetectMsgRegister (void) {
sigmatch_table[DETECT_MSG].RegisterTests = DetectMsgRegisterTests;
}
int DetectMsgSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *msgstr)
static int DetectMsgSetup (DetectEngineCtx *de_ctx, Signature *s, char *msgstr)
{
char *str = NULL;
uint16_t len;

4
src/detect-noalert.c
Unescape Escape View File

@ -4,7 +4,7 @@
#include "detect.h"
#include "util-debug.h"
int DetectNoalertSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectNoalertSetup (DetectEngineCtx *, Signature *, char *);
void DetectNoalertRegister (void) {
sigmatch_table[DETECT_NOALERT].name = "noalert";
@ -16,7 +16,7 @@ void DetectNoalertRegister (void) {
sigmatch_table[DETECT_NOALERT].flags |= SIGMATCH_NOOPT;
}
int DetectNoalertSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *nullstr)
static int DetectNoalertSetup (DetectEngineCtx *de_ctx, Signature *s, char *nullstr)
{
if (nullstr != NULL) {
SCLogError(SC_ERR_INVALID_VALUE, "nocase has no value");

5
src/detect-nocase.c
Unescape Escape View File

@ -11,7 +11,7 @@
#include "util-debug.h"
int DetectNocaseSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *depthstr);
static int DetectNocaseSetup (DetectEngineCtx *, Signature *, char *);
void DetectNocaseRegister (void) {
sigmatch_table[DETECT_NOCASE].name = "nocase";
@ -24,7 +24,8 @@ void DetectNocaseRegister (void) {
sigmatch_table[DETECT_NOCASE].flags |= SIGMATCH_PAYLOAD;
}
int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *nullstr)
/** \todo uricontent needs fixing */
static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nullstr)
{
int ret = 0;

6
src/detect-offset.c
Unescape Escape View File

@ -11,7 +11,7 @@
#include "util-debug.h"
int DetectOffsetSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *offsetstr);
static int DetectOffsetSetup (DetectEngineCtx *, Signature *, char *);
void DetectOffsetRegister (void) {
sigmatch_table[DETECT_OFFSET].name = "offset";
@ -23,13 +23,11 @@ void DetectOffsetRegister (void) {
sigmatch_table[DETECT_OFFSET].flags |= SIGMATCH_PAYLOAD;
}
int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *offsetstr)
int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
{
char *str = offsetstr;
char dubbed = 0;
//printf("DetectOffsetSetup: s->match:%p,m:%p,offsetstr:\'%s\'\n", s->match, m, offsetstr);
/* strip "'s */
if (offsetstr[0] == '\"' && offsetstr[strlen(offsetstr)-1] == '\"') {
str = SCStrdup(offsetstr+1);

19
src/detect-parse.c
Unescape Escape View File

@ -276,7 +276,7 @@ void SigParsePrepare(void) {
}
}
int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *optstr) {
static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr) {
#define MAX_SUBSTRINGS 30
int ov[MAX_SUBSTRINGS];
int ret = 0, i = 0;
@ -326,22 +326,11 @@ int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *op
}
/* setup may or may not add a new SigMatch to the list */
if (st->Setup(de_ctx, s, m, optvalue) < 0) {
if (st->Setup(de_ctx, s, optvalue) < 0) {
SCLogDebug("\"%s\" failed to setup", st->name);
goto error;
}
/* thats why we check for that here
* (it may install more than one SigMatch!) */
if (m != NULL && m->next != NULL)
while (m != NULL && m->next != NULL)
m = m->next;
else if (m == NULL && s->match != NULL)
m = s->match;
while (m != NULL && m->next != NULL)
m = m->next;
if (ret == 4 && optmore != NULL) {
//printf("SigParseOptions: recursive call for more options... (s:%p,m:%p)\n", s, m);
@ -350,7 +339,7 @@ int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *op
if (optstr) SCFree(optstr);
//if (optmore) pcre_free_substring(optmore);
if (arr != NULL) SCFree(arr);
return SigParseOptions(de_ctx, s, m, optmore);
return SigParseOptions(de_ctx, s, optmore);
}
if (optname) pcre_free_substring(optname);
@ -592,7 +581,7 @@ int SigParse(DetectEngineCtx *de_ctx, Signature *s, char *sigstr, uint8_t addrs_
/* we can have no options, so make sure we have them */
if (basics[CONFIG_OPTS] != NULL) {
ret = SigParseOptions(de_ctx, s, NULL, SCStrdup(basics[CONFIG_OPTS]));
ret = SigParseOptions(de_ctx, s, SCStrdup(basics[CONFIG_OPTS]));
SCLogDebug("ret from SigParseOptions %d", ret);
}

4
src/detect-pcre.c
Unescape Escape View File

@ -55,7 +55,7 @@ uint8_t pcre_need_htp_request_body = 0;
int DetectPcreMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectPcreALMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m);
int DetectPcreSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectPcreSetup (DetectEngineCtx *, Signature *, char *);
void DetectPcreFree(void *);
void DetectPcreRegisterTests(void);
@ -555,7 +555,7 @@ error:
}
int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *regexstr)
static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexstr)
{
DetectPcreData *pd = NULL;
SigMatch *sm = NULL;

4
src/detect-pktvar.c
Unescape Escape View File

@ -19,7 +19,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectPktvarMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectPktvarSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectPktvarSetup (DetectEngineCtx *, Signature *, char *);
void DetectPktvarRegister (void) {
sigmatch_table[DETECT_PKTVAR].name = "pktvar";
@ -75,7 +75,7 @@ int DetectPktvarMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p,
return ret;
}
int DetectPktvarSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *rawstr)
static int DetectPktvarSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
DetectPktvarData *cd = NULL;
SigMatch *sm = NULL;

8
src/detect-priority.c
Unescape Escape View File

@ -1,4 +1,6 @@
/** Copyright (c) 2009 Open Information Security Foundation.
/* Copyright (c) 2009 Open Information Security Foundation. */
/** \file
* \author Victor Julien <victor@inliniac.net>
* \author Anoop Saldanha <poonaatsoc@gmail.com>
*/
@ -17,7 +19,7 @@
static pcre *regex = NULL;
static pcre_extra *regex_study = NULL;
int DetectPrioritySetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *sidstr);
static int DetectPrioritySetup (DetectEngineCtx *, Signature *, char *);
void SCPriorityRegisterTests(void);
/**
@ -52,7 +54,7 @@ void DetectPriorityRegister (void)
return;
}
int DetectPrioritySetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *rawstr)
static int DetectPrioritySetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
const char *prio_str = NULL;

4
src/detect-rawbytes.c
Unescape Escape View File

@ -11,7 +11,7 @@
#include "util-debug.h"
int DetectRawbytesSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectRawbytesSetup (DetectEngineCtx *, Signature *, char *);
void DetectRawbytesRegister (void) {
sigmatch_table[DETECT_RAWBYTES].name = "rawbytes";
@ -24,7 +24,7 @@ void DetectRawbytesRegister (void) {
sigmatch_table[DETECT_RAWBYTES].flags |= SIGMATCH_PAYLOAD;
}
int DetectRawbytesSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *nullstr)
int DetectRawbytesSetup (DetectEngineCtx *de_ctx, Signature *s, char *nullstr)
{
if (nullstr != NULL) {
SCLogError(SC_ERR_INVALID_VALUE, "nocase has no value");

9
src/detect-recursive.c
Unescape Escape View File

@ -1,7 +1,7 @@
/* RECURSIVE part of the detection engine.
*
* Used to capture variables recursively in a payload,
* used for example to extract http_uri for uricontent.
* used for example to extract http_uri for uricontent.
*
* Note: non Snort compatible. */
@ -10,7 +10,7 @@
#include "detect.h"
#include "flow-var.h"
int DetectRecursiveSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectRecursiveSetup (DetectEngineCtx *, Signature *, char *);
void DetectRecursiveRegister (void) {
sigmatch_table[DETECT_RECURSIVE].name = "recursive";
@ -22,17 +22,14 @@ void DetectRecursiveRegister (void) {
sigmatch_table[DETECT_RECURSIVE].flags |= SIGMATCH_NOOPT;
}
int DetectRecursiveSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *nullstr)
static int DetectRecursiveSetup (DetectEngineCtx *de_ctx, Signature *s, char *nullstr)
{
//printf("DetectRecursiveSetup: s->match:%p,m:%p\n", s->match, m);
if (nullstr != NULL) {
printf("DetectRecursiveSetup: recursive has no value\n");
return -1;
}
s->flags |= SIG_FLAG_RECURSIVE;
return 0;
}

4
src/detect-reference.c
Unescape Escape View File

@ -3,7 +3,7 @@
#include "suricata-common.h"
#include "detect.h"
int DetectReferenceSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *str);
static int DetectReferenceSetup (DetectEngineCtx *, Signature *, char *);
void DetectReferenceRegister (void) {
sigmatch_table[DETECT_REFERENCE].name = "reference";
@ -13,7 +13,7 @@ void DetectReferenceRegister (void) {
sigmatch_table[DETECT_REFERENCE].RegisterTests = NULL;
}
int DetectReferenceSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *rawstr)
int DetectReferenceSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
char *str = rawstr;
char dubbed = 0;

4
src/detect-rev.c
Unescape Escape View File

@ -5,7 +5,7 @@
#include "util-debug.h"
#include "util-error.h"
int DetectRevSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *str);
static int DetectRevSetup (DetectEngineCtx *, Signature *, char *);
void DetectRevRegister (void) {
sigmatch_table[DETECT_REV].name = "rev";
@ -15,7 +15,7 @@ void DetectRevRegister (void) {
sigmatch_table[DETECT_REV].RegisterTests = NULL;
}
int DetectRevSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *rawstr)
static int DetectRevSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
char *str = rawstr;
char dubbed = 0;

4
src/detect-rpc.c
Unescape Escape View File

@ -31,7 +31,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectRpcMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectRpcSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
int DetectRpcSetup (DetectEngineCtx *, Signature *, char *);
void DetectRpcRegisterTests(void);
void DetectRpcFree(void *);
@ -250,7 +250,7 @@ error:
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectRpcSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *rpcstr)
int DetectRpcSetup (DetectEngineCtx *de_ctx, Signature *s, char *rpcstr)
{
DetectRpcData *rd = NULL;
SigMatch *sm = NULL;

7
src/detect-sameip.c
Unescape Escape View File

@ -22,8 +22,7 @@
static int DetectSameipMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *,
Signature *, SigMatch *);
static int DetectSameipSetup(DetectEngineCtx *, Signature *, SigMatch *,
char *);
static int DetectSameipSetup(DetectEngineCtx *, Signature *, char *);
static void DetectSameipRegisterTests(void);
/**
@ -63,14 +62,12 @@ static int DetectSameipMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param optstr pointer to the user provided options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
static int DetectSameipSetup(DetectEngineCtx *de_ctx, Signature *s,
SigMatch *notused, char *optstr)
static int DetectSameipSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
{
SigMatch *sm = NULL;

15
src/detect-seq.c
Unescape Escape View File

@ -23,12 +23,11 @@
#include "util-unittest-helper.h"
#include "util-debug.h"
static int DetectSeqSetup(DetectEngineCtx *, Signature *s, SigMatch *m,
char *sidstr);
static int DetectSeqMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
Packet *p, Signature *s, SigMatch *m);
static int DetectSeqSetup(DetectEngineCtx *, Signature *, char *);
static int DetectSeqMatch(ThreadVars *, DetectEngineThreadCtx *,
Packet *, Signature *, SigMatch *);
static void DetectSeqRegisterTests(void);
static void DetectSeqFree(void *ptr);
static void DetectSeqFree(void *);
void DetectSeqRegister(void) {
@ -70,20 +69,16 @@ static int DetectSeqMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param optstr pointer to the user provided options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
static int DetectSeqSetup (DetectEngineCtx *de_ctx, Signature *s,
SigMatch *notused, char *optstr)
static int DetectSeqSetup (DetectEngineCtx *de_ctx, Signature *s, char *optstr)
{
DetectSeqData *data;
SigMatch *sm = NULL;
//printf("DetectSeqSetup: \'%s\'\n", optstr);
data = SCMalloc(sizeof(DetectSeqData));
if (data == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "malloc failed");

4
src/detect-sid.c
Unescape Escape View File

@ -5,7 +5,7 @@
#include "util-debug.h"
#include "util-error.h"
int DetectSidSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *sidstr);
static int DetectSidSetup (DetectEngineCtx *, Signature *, char *);
void DetectSidRegister (void) {
sigmatch_table[DETECT_SID].name = "sid";
@ -15,7 +15,7 @@ void DetectSidRegister (void) {
sigmatch_table[DETECT_SID].RegisterTests = NULL;
}
int DetectSidSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *sidstr)
static int DetectSidSetup (DetectEngineCtx *de_ctx, Signature *s, char *sidstr)
{
char *str = sidstr;
char dubbed = 0;

11
src/detect-stream_size.c
Unescape Escape View File

@ -1,5 +1,7 @@
/**Copyright (c) 2009 Open Information Security Foundation
*
/* Copyright (c) 2009 Open Information Security Foundation */
/**
* \file
* \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>
*
* Stream size for the engine.
@ -27,7 +29,7 @@ static pcre_extra *parse_regex_study;
/*prototypes*/
int DetectStreamSizeMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectStreamSizeSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectStreamSizeSetup (DetectEngineCtx *, Signature *, char *);
void DetectStreamSizeFree(void *);
void DetectStreamSizeRegisterTests(void);
@ -291,13 +293,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param streamstr pointer to the user provided stream size options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectStreamSizeSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *streamstr) {
static int DetectStreamSizeSetup (DetectEngineCtx *de_ctx, Signature *s, char *streamstr) {
DetectStreamSizeData *sd = NULL;
SigMatch *sm = NULL;

4
src/detect-tag.c
Unescape Escape View File

@ -3,7 +3,7 @@
#include "suricata-common.h"
#include "detect.h"
int DetectTagSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *str);
static int DetectTagSetup(DetectEngineCtx *, Signature *, char *);
void DetectTagRegister (void) {
sigmatch_table[DETECT_TAG].name = "tag";
@ -13,7 +13,7 @@ void DetectTagRegister (void) {
sigmatch_table[DETECT_TAG].RegisterTests = NULL;
}
int DetectTagSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *rawstr)
static int DetectTagSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
return 0;
}

5
src/detect-threshold.c
Unescape Escape View File

@ -27,7 +27,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
static int DetectThresholdMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
static int DetectThresholdSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *str);
static int DetectThresholdSetup (DetectEngineCtx *, Signature *, char *);
static void DetectThresholdFree(void *);
/**
@ -182,13 +182,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param rawstr pointer to the user provided threshold options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
static int DetectThresholdSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *rawstr)
static int DetectThresholdSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
DetectThresholdData *de = NULL;
SigMatch *sm = NULL;

9
src/detect-tls-version.c
Unescape Escape View File

@ -1,6 +1,6 @@
/* Copyright (c) 2009 Open Information Security Foundation */
/**
* Copyright (c) 2009 Open Information Security Foundation
*
* \file
* \author Victor Julien <victor@inliniac.net>
*/
@ -38,7 +38,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectTlsVersionMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *);
int DetectTlsVersionSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectTlsVersionSetup (DetectEngineCtx *, Signature *, char *);
void DetectTlsVersionRegisterTests(void);
void DetectTlsVersionFree(void *);
@ -201,13 +201,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param idstr pointer to the user provided "id" option
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectTlsVersionSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *str)
static int DetectTlsVersionSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
{
DetectTlsVersionData *tls = NULL;
SigMatch *sm = NULL;

5
src/detect-ttl.c
Unescape Escape View File

@ -25,7 +25,7 @@ static pcre_extra *parse_regex_study;
/*prototypes*/
int DetectTtlMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectTtlSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectTtlSetup (DetectEngineCtx *, Signature *, char *);
void DetectTtlFree (void *);
void DetectTtlRegisterTests (void);
@ -220,13 +220,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param ttlstr pointer to the user provided ttl options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectTtlSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *ttlstr) {
static int DetectTtlSetup (DetectEngineCtx *de_ctx, Signature *s, char *ttlstr) {
DetectTtlData *ttld = NULL;
SigMatch *sm = NULL;

8
src/detect-uricontent.c
Unescape Escape View File

@ -38,7 +38,7 @@
/* prototypes */
int DetectUricontentMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *,
Signature *, SigMatch *);
int DetectUricontentSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectUricontentSetup (DetectEngineCtx *, Signature *, char *);
void HttpUriRegisterTests(void);
int DetectAppLayerUricontentMatch (ThreadVars *, DetectEngineThreadCtx *,
@ -52,7 +52,6 @@ void DetectUricontentRegister (void)
{
sigmatch_table[DETECT_URICONTENT].name = "uricontent";
sigmatch_table[DETECT_URICONTENT].AppLayerMatch = DetectAppLayerUricontentMatch;
//sigmatch_table[DETECT_URICONTENT].Match = DetectUricontentMatch;
sigmatch_table[DETECT_URICONTENT].Match = NULL;
sigmatch_table[DETECT_URICONTENT].Setup = DetectUricontentSetup;
sigmatch_table[DETECT_URICONTENT].Free = NULL;
@ -406,14 +405,11 @@ error:
* \param de_ctx Pointer to the detection engine context
* \param s Pointer to signature for the current Signature being parsed
* from the rules
* \param m Pointer to the head of the SigMatchs for the current rule
* being parsed
* \param contentstr Pointer to the string holding the keyword value
*
* \retval 0 on success, -1 on failure
*/
int DetectUricontentSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *contentstr)
int DetectUricontentSetup (DetectEngineCtx *de_ctx, Signature *s, char *contentstr)
{
SCEnter();

6
src/detect-urilen.c
Unescape Escape View File

@ -29,7 +29,7 @@ static pcre_extra *parse_regex_study;
/*prototypes*/
int DetectUrilenMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f,
uint8_t flags, void *state, Signature *s, SigMatch *m);
int DetectUrilenSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
static int DetectUrilenSetup (DetectEngineCtx *, Signature *, char *);
void DetectUrilenFree (void *);
void DetectUrilenRegisterTests (void);
@ -261,14 +261,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param urilenstr pointer to the user provided urilen options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectUrilenSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
char *urilenstr)
static int DetectUrilenSetup (DetectEngineCtx *de_ctx, Signature *s, char *urilenstr)
{
SCEnter();
DetectUrilenData *urilend = NULL;

5
src/detect-window.c
Unescape Escape View File

@ -30,7 +30,7 @@ static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectWindowMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
int DetectWindowSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
int DetectWindowSetup(DetectEngineCtx *, Signature *, char *);
void DetectWindowRegisterTests(void);
void DetectWindowFree(void *);
@ -175,13 +175,12 @@ error:
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param windowstr pointer to the user provided window options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectWindowSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *windowstr)
int DetectWindowSetup (DetectEngineCtx *de_ctx, Signature *s, char *windowstr)
{
DetectWindowData *wd = NULL;
SigMatch *sm = NULL;

7
src/detect-within.c
Unescape Escape View File

@ -13,7 +13,7 @@
#include "detect-pcre.h"
#include "util-debug.h"
int DetectWithinSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *withinstr);
static int DetectWithinSetup (DetectEngineCtx *, Signature *, char *);
void DetectWithinRegister (void) {
sigmatch_table[DETECT_WITHIN].name = "within";
@ -25,7 +25,7 @@ void DetectWithinRegister (void) {
sigmatch_table[DETECT_WITHIN].flags |= SIGMATCH_PAYLOAD;
}
int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused, char *withinstr)
static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withinstr)
{
char *str = withinstr;
char dubbed = 0;
@ -70,9 +70,6 @@ int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *notused,
if (cd->flags & DETECT_CONTENT_IS_CHUNK)
DetectContentPropagateWithin(pm);
//DetectContentPrint(cd);
//printf("DetectWithinSetup: set within %" PRId32 " for previous content\n", cd->within);
pm = DetectContentFindPrevApplicableSM(s->pmatch_tail->prev);
if (pm == NULL) {
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two preceeding content options");

13
src/detect.h
Unescape Escape View File

@ -425,14 +425,17 @@ typedef struct SigMatch_ {
/** \brief element in sigmatch type table. */
typedef struct SigTableElmt_ {
/** Packet match function */
/** Packet match function pointer */
int (*Match)(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
/** AppLayer match function */
/** AppLayer match function pointer */
int (*AppLayerMatch)(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t flags, void *alstate, Signature *, SigMatch *);
uint16_t alproto; /**< app layer proto from app-layer-protos.h this match
applies to */
/** app layer proto from app-layer-protos.h this match applies to */
uint16_t alproto;
/** keyword setup function pointer */
int (*Setup)(DetectEngineCtx *, Signature *, char *);
int (*Setup)(DetectEngineCtx *, Signature *, SigMatch *, char *);
void (*Free)(void *);
void (*RegisterTests)(void);

Write Preview
Loading…
Cancel
Save