Exemplo n.º 1
0
/**
 * \test this is a test for a invalid dsize value 2<>1
 *
 *  \retval 1 on succces
 *  \retval 0 on failure
 */
int DsizeTestParse16 (void) {
    DetectDsizeData *dd = NULL;
    dd = DetectDsizeParse("2<>1");
    if (dd) {
        DetectDsizeFree(dd);
        return 0;
    }

    return 1;
}
Exemplo n.º 2
0
/**
 * \test this is a test for a valid dsize value 1<>2
 *
 *  \retval 1 on succces
 *  \retval 0 on failure
 */
int DsizeTestParse04 (void) {
    DetectDsizeData *dd = NULL;
    dd = DetectDsizeParse("1<>2");
    if (dd) {
        DetectDsizeFree(dd);
        return 1;
    }

    return 0;
}
Exemplo n.º 3
0
/**
 * \test test for a valid dsize value    12
 *
 *  \retval 1 on succces
 *  \retval 0 on failure
 */
int DsizeTestParse20 (void) {
    int result = 0;
    DetectDsizeData *dd = NULL;
    dd = DetectDsizeParse("   12 ");
    if (dd) {
        if (dd->dsize == 12 && dd->mode == DETECTDSIZE_EQ)
            result = 1;

        DetectDsizeFree(dd);
    }

    return result;
}
Exemplo n.º 4
0
/**
 * \test this is a test for a valid dsize value 1 <> 2
 *
 *  \retval 1 on succces
 *  \retval 0 on failure
 */
int DsizeTestParse17 (void) {
    int result = 0;
    DetectDsizeData *dd = NULL;
    dd = DetectDsizeParse(" 1 <> 2 ");
    if (dd) {
        if (dd->dsize == 1 && dd->dsize2 == 2 && dd->mode == DETECTDSIZE_RA)
            result = 1;

        DetectDsizeFree(dd);
    }

    return result;
}
Exemplo n.º 5
0
/**
 * \test this is a test for a valid dsize value 1
 *
 *  \retval 1 on succces
 *  \retval 0 on failure
 */
int DsizeTestParse13 (void) {
    int result = 0;
    DetectDsizeData *dd = NULL;
    dd = DetectDsizeParse("1");
    if (dd) {
        if (dd->dsize2 == 0)
            result = 1;

        DetectDsizeFree(dd);
    }

    return result;
}
Exemplo n.º 6
0
/**
 * \test this is a test for a valid dsize value <100
 *
 *  \retval 1 on succces
 *  \retval 0 on failure
 */
int DsizeTestParse07 (void) {
    int result = 0;
    DetectDsizeData *dd = NULL;
    dd = DetectDsizeParse("<100");
    if (dd) {
        if (dd->dsize == 100 && dd->mode == DETECTDSIZE_LT)
            result = 1;

        DetectDsizeFree(dd);
    }

    return result;
}
Exemplo n.º 7
0
/**
 * \internal
 * \brief this function is used to add the parsed dsize into the current signature
 *
 * \param de_ctx pointer to the Detection Engine Context
 * \param s pointer to the Current Signature
 * \param rawstr pointer to the user provided flags options
 *
 * \retval 0 on Success
 * \retval -1 on Failure
 */
static int DetectDsizeSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
    DetectDsizeData *dd = NULL;
    SigMatch *sm = NULL;

    if (SigMatchGetLastSMFromLists(s, 2,
                                   DETECT_DSIZE,
                                   s->sm_lists_tail[DETECT_SM_LIST_MATCH]) != NULL) {
        SCLogError(SC_ERR_INVALID_SIGNATURE, "Can't use 2 or more dsizes in "
                   "the same sig.  Invalidating signature.");
        goto error;
    }

    SCLogDebug("\'%s\'", rawstr);

    dd = DetectDsizeParse(rawstr);
    if (dd == NULL) {
        SCLogError(SC_ERR_INVALID_ARGUMENT,"Parsing \'%s\' failed", rawstr);
        goto error;
    }

    /* Okay so far so good, lets get this into a SigMatch
     * and put it in the Signature. */
    sm = SigMatchAlloc();
    if (sm == NULL){
        SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory for SigMatch");
        SCFree(dd);
        goto error;
    }

    sm->type = DETECT_DSIZE;
    sm->ctx = (void *)dd;

    SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH);

    SCLogDebug("dd->dsize %"PRIu16", dd->dsize2 %"PRIu16", dd->mode %"PRIu8"",
            dd->dsize, dd->dsize2, dd->mode);
    /* tell the sig it has a dsize to speed up engine init */
    s->flags |= SIG_FLAG_REQUIRE_PACKET;
    s->flags |= SIG_FLAG_DSIZE;

    if (s->dsize_sm == NULL) {
        s->dsize_sm = sm;
    }

    return 0;

error:
    return -1;
}