|
|
|
@ -129,6 +129,7 @@ int DetectProtoContainsProto(const DetectProto *dp, int proto)
|
|
|
|
#include "detect-engine.h"
|
|
|
|
#include "detect-engine.h"
|
|
|
|
#include "detect-parse.h"
|
|
|
|
#include "detect-parse.h"
|
|
|
|
#include "detect-engine-mpm.h"
|
|
|
|
#include "detect-engine-mpm.h"
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
/**
|
|
|
|
* \brief this function is used to initialize the detection engine context and
|
|
|
|
* \brief this function is used to initialize the detection engine context and
|
|
|
|
* setup the signature with passed values.
|
|
|
|
* setup the signature with passed values.
|
|
|
|
@ -138,32 +139,31 @@ static int DetectProtoInitTest(DetectEngineCtx **de_ctx, Signature **sig,
|
|
|
|
{
|
|
|
|
{
|
|
|
|
char fullstr[1024];
|
|
|
|
char fullstr[1024];
|
|
|
|
int result = 0;
|
|
|
|
int result = 0;
|
|
|
|
|
|
|
|
static uint32_t test_sid = 1;
|
|
|
|
|
|
|
|
|
|
|
|
*de_ctx = NULL;
|
|
|
|
|
|
|
|
*sig = NULL;
|
|
|
|
*sig = NULL;
|
|
|
|
|
|
|
|
|
|
|
|
if (snprintf(fullstr, 1024, "alert %s any any -> any any (msg:\"DetectProto"
|
|
|
|
if (snprintf(fullstr, 1024,
|
|
|
|
" test\"; sid:1;)", str) >= 1024)
|
|
|
|
"alert %s any any -> any any (msg:\"DetectProto"
|
|
|
|
{
|
|
|
|
" test\"; sid:%u;)",
|
|
|
|
|
|
|
|
str, test_sid++) >= 1024) {
|
|
|
|
goto end;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
*de_ctx = DetectEngineCtxInit();
|
|
|
|
|
|
|
|
if (*de_ctx == NULL) {
|
|
|
|
if (*de_ctx == NULL) {
|
|
|
|
goto end;
|
|
|
|
*de_ctx = DetectEngineCtxInit();
|
|
|
|
}
|
|
|
|
if (*de_ctx == NULL) {
|
|
|
|
|
|
|
|
goto end;
|
|
|
|
(*de_ctx)->flags |= DE_QUIET;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
(*de_ctx)->sig_list = SigInit(*de_ctx, fullstr);
|
|
|
|
(*de_ctx)->flags |= DE_QUIET;
|
|
|
|
if ((*de_ctx)->sig_list == NULL) {
|
|
|
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
*sig = (*de_ctx)->sig_list;
|
|
|
|
Signature *s = DetectEngineAppendSig(*de_ctx, fullstr);
|
|
|
|
|
|
|
|
if (s == NULL) {
|
|
|
|
if (DetectProtoParse(dp, str) < 0)
|
|
|
|
|
|
|
|
goto end;
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
*sig = s;
|
|
|
|
|
|
|
|
|
|
|
|
result = 1;
|
|
|
|
result = 1;
|
|
|
|
|
|
|
|
|
|
|
|
|