示例#1
0
/**
 * \brief this function is used to add the parsed icmp_id data into the current signature
 *
 * \param de_ctx pointer to the Detection Engine Context
 * \param s pointer to the Current Signature
 * \param icmpidstr pointer to the user provided icmp_id option
 *
 * \retval 0 on Success
 * \retval -1 on Failure
 */
static int DetectIcmpIdSetup (DetectEngineCtx *de_ctx, Signature *s, char *icmpidstr)
{
    DetectIcmpIdData *iid = NULL;
    SigMatch *sm = NULL;

    iid = DetectIcmpIdParse(icmpidstr);
    if (iid == NULL) goto error;

    sm = SigMatchAlloc();
    if (sm == NULL) goto error;

    sm->type = DETECT_ICMP_ID;
    sm->ctx = (void *)iid;

    SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH);
    s->flags |= SIG_FLAG_REQUIRE_PACKET;

    return 0;

error:
    if (iid != NULL) DetectIcmpIdFree(iid);
    if (sm != NULL) SCFree(sm);
    return -1;

}
示例#2
0
/**
 * \test DetectIcmpIdParseTest04 is a test for setting a valid icmp_id value
 *       with quotation marks and spaces all around
 */
int DetectIcmpIdParseTest04 (void) {
    DetectIcmpIdData *iid = NULL;
    iid = DetectIcmpIdParse("   \"   300 \"");
    if (iid != NULL && iid->id == htons(300)) {
        DetectIcmpIdFree(iid);
        return 1;
    }
    return 0;
}
示例#3
0
/**
 * \test DetectIcmpIdParseTest05 is a test for setting an invalid icmp_id
 *       value with missing quotation marks
 */
int DetectIcmpIdParseTest05 (void) {
    DetectIcmpIdData *iid = NULL;
    iid = DetectIcmpIdParse("\"300");
    if (iid == NULL) {
        DetectIcmpIdFree(iid);
        return 1;
    }
    return 0;
}
示例#4
0
/**
 * \brief this function is used to add the parsed icmp_id data into the current signature
 *
 * \param de_ctx pointer to the Detection Engine Context
 * \param s pointer to the Current Signature
 * \param icmpidstr pointer to the user provided icmp_id option
 *
 * \retval 0 on Success
 * \retval -1 on Failure
 */
static int DetectIcmpIdSetup (DetectEngineCtx *de_ctx, Signature *s, char *icmpidstr) {
    DetectIcmpIdData *iid = NULL;
    SigMatch *sm = NULL;

    iid = DetectIcmpIdParse(icmpidstr);
    if (iid == NULL) goto error;

    sm = SigMatchAlloc();
    if (sm == NULL) goto error;

    sm->type = DETECT_ICMP_ID;
    sm->ctx = (void *)iid;

    SigMatchAppendPacket(s, sm);

    return 0;

error:
    if (iid != NULL) DetectIcmpIdFree(iid);
    if (sm != NULL) SCFree(sm);
    return -1;

}