Exemplo n.º 1
0
/**
 * \brief this function is used to add the parsed fragoffset data into the current signature
 *
 * \param de_ctx pointer to the Detection Engine Context
 * \param s pointer to the Current Signature
 * \param fragoffsetstr pointer to the user provided fragoffset option
 *
 * \retval 0 on Success
 * \retval -1 on Failure
 */
static int DetectFragOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *fragoffsetstr)
{
    DetectFragOffsetData *fragoff = NULL;
    SigMatch *sm = NULL;

    fragoff = DetectFragOffsetParse(fragoffsetstr);
    if (fragoff == NULL) goto error;

    sm = SigMatchAlloc();
    if (sm == NULL) goto error;

    sm->type = DETECT_FRAGOFFSET;
    sm->ctx = (SigMatchCtx *)fragoff;

    SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH);
    s->flags |= SIG_FLAG_REQUIRE_PACKET;

    return 0;

error:
    if (fragoff != NULL) DetectFragOffsetFree(fragoff);
    if (sm != NULL) SCFree(sm);
    return -1;

}
Exemplo n.º 2
0
/**
 * \test DetectFragOffsetParseTest02 is a test for setting a valid fragoffset value
 *       with spaces all around
 */
int DetectFragOffsetParseTest02 (void) {
    DetectFragOffsetData *fragoff = NULL;
    fragoff = DetectFragOffsetParse(">300");
    if (fragoff != NULL && fragoff->frag_off == 300 && fragoff->mode == FRAG_MORE) {
        DetectFragOffsetFree(fragoff);
        return 1;
    }
    return 0;
}
Exemplo n.º 3
0
/**
 * \test DetectFragOffsetParseTest03 is a test for setting an invalid fragoffset value
 */
int DetectFragOffsetParseTest03 (void) {
    DetectFragOffsetData *fragoff = NULL;
    fragoff = DetectFragOffsetParse("badc");
    if (fragoff != NULL) {
        DetectFragOffsetFree(fragoff);
        return 1;
    }
    return 0;
}
Exemplo n.º 4
0
/**
 * \test DetectFragOffsetParseTest01 is a test for setting a valid fragoffset value
 */
int DetectFragOffsetParseTest01 (void) {
    DetectFragOffsetData *fragoff = NULL;
    fragoff = DetectFragOffsetParse("300");
    if (fragoff != NULL && fragoff->frag_off == 300) {
        DetectFragOffsetFree(fragoff);
        return 1;
    }
    return 0;
}