aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix decode event compiler warning.

Browse Source
remotes/origin/master-1.0.x
Victor Julien 16 years ago
parent b6d55f84ac
commit 63d32f723f
2 changed files with 29 additions and 57 deletions
Show Stats Download Patch File Download Diff File

30
src/detect-decode-event.c
Unescape Escape View File

@ -3,7 +3,6 @@
* \author Breno Silva <breno.silva@gmail.com>
*/
#include "decode.h"
#include "detect.h"
#include "flow-var.h"
@ -18,7 +17,6 @@
#include <pcre.h>
#include <ctype.h>
/* XXX VJ stricter regex */
#define PARSE_REGEX "\\S[0-9A-z_]+[.][A-z+]+$"
static pcre *parse_regex;
@ -32,7 +30,6 @@ void DecodeEventRegisterTests(void);
/**
* \brief Registration function for decode-event: keyword
*/
void DetectDecodeEventRegister (void) {
sigmatch_table[DETECT_DECODE_EVENT].name = "decode-event";
sigmatch_table[DETECT_DECODE_EVENT].Match = DetectDecodeEventMatch;
@ -76,12 +73,9 @@ error:
* \retval 0 no match
* \retval 1 match
*/
int DetectDecodeEventMatch (ThreadVars *t, PatternMatcherThread *pmt, Packet *p, Signature *s, SigMatch *m)
{
int ret = 0;
DetectDecodeEventData *de = (DetectDecodeEventData *)m->ctx;
if(de && DECODER_ISSET_EVENT(p, de->event))
@ -98,46 +92,37 @@ int DetectDecodeEventMatch (ThreadVars *t, PatternMatcherThread *pmt, Packet *p,
* \retval de pointer to DetectFlowData on success
* \retval NULL on failure
*/
DetectDecodeEventData *DetectDecodeEventParse (char *rawstr)
{
int i;
DetectDecodeEventData *de = NULL;
#define MAX_SUBSTRINGS 30
int ret = 0, res = 0, found = 0;
int ov[MAX_SUBSTRINGS];
ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS);
if (ret < 1) {
goto error;
}
const char *str_ptr;
res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 0, &str_ptr);
if (res < 0) {
goto error;
}
for(i=0; DEvents[i].event_name != NULL; i++) {
for(i = 0; DEvents[i].event_name != NULL; i++) {
if((strncasecmp(DEvents[i].event_name,str_ptr,strlen(DEvents[i].event_name))) == 0) {
found = 1;
break;
}
}
if(found == 0)
goto error;
de = malloc(sizeof(DetectDecodeEventData));
if (de == NULL) {
printf("DetectDecodeEventSetup malloc failed\n");
goto error;
@ -162,8 +147,6 @@ error:
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectDecodeEventSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *rawstr)
{
DetectDecodeEventData *de = NULL;
@ -187,8 +170,6 @@ error:
if (de) free(de);
if (sm) free(sm);
return -1;
return 0;
}
/**
@ -196,8 +177,6 @@ error:
*
* \param de pointer to DetectDecodeEventData
*/
void DetectDecodeEventFree(DetectDecodeEventData *de) {
if(de) free(de);
}
@ -209,7 +188,6 @@ void DetectDecodeEventFree(DetectDecodeEventData *de) {
/**
* \test DecodeEventTestParse01 is a test for a valid decode-event value
*/
int DecodeEventTestParse01 (void) {
DetectDecodeEventData *de = NULL;
de = DetectDecodeEventParse("ipv4.pkt_too_small");
@ -225,7 +203,6 @@ int DecodeEventTestParse01 (void) {
/**
* \test DecodeEventTestParse02 is a test for a valid upper + lower case decode-event value
*/
int DecodeEventTestParse02 (void) {
DetectDecodeEventData *de = NULL;
de = DetectDecodeEventParse("PPP.pkt_too_small");
@ -240,7 +217,6 @@ int DecodeEventTestParse02 (void) {
/**
* \test DecodeEventTestParse03 is a test for a valid upper case decode-event value
*/
int DecodeEventTestParse03 (void) {
DetectDecodeEventData *de = NULL;
de = DetectDecodeEventParse("IPV6.PKT_TOO_SMALL");
@ -255,7 +231,6 @@ int DecodeEventTestParse03 (void) {
/**
* \test DecodeEventTestParse04 is a test for an invalid upper case decode-event value
*/
int DecodeEventTestParse04 (void) {
DetectDecodeEventData *de = NULL;
de = DetectDecodeEventParse("IPV6.INVALID_EVENT");
@ -270,7 +245,6 @@ int DecodeEventTestParse04 (void) {
/**
* \test DecodeEventTestParse05 is a test for an invalid char into the decode-event value
*/
int DecodeEventTestParse05 (void) {
DetectDecodeEventData *de = NULL;
de = DetectDecodeEventParse("IPV-6,INVALID_CHAR");
@ -285,7 +259,6 @@ int DecodeEventTestParse05 (void) {
/**
* \test DecodeEventTestParse06 is a test for match function with valid decode-event value
*/
int DecodeEventTestParse06 (void) {
Packet p;
ThreadVars tv;
@ -326,7 +299,6 @@ error:
/**
* \brief this function registers unit tests for DecodeEvent
*/
void DecodeEventRegisterTests(void) {
UtRegisterTest("DecodeEventTestParse01", DecodeEventTestParse01, 1);
UtRegisterTest("DecodeEventTestParse02", DecodeEventTestParse02, 1);

56
src/detect-decode-event.h
Unescape Escape View File

@ -20,34 +20,34 @@ struct DetectDecodeEvents_ {
char *event_name;
u_int8_t code;
} DEvents[] = {
"ipv4.pkt_too_small", IPV4_PKT_TOO_SMALL,
"ipv4.hlen_too_small", IPV4_HLEN_TOO_SMALL,
"ipv4.iplen_smaller_than_hlen", IPV4_IPLEN_SMALLER_THAN_HLEN,
"ipv6.pkt_too_small", IPV6_PKT_TOO_SMALL,
"ipv6.trunc_exthdr", IPV6_TRUNC_EXTHDR,
"ipv6.exthdr_dupl_fh", IPV6_EXTHDR_DUPL_FH,
"ipv6.exthdr_dupl_rh", IPV6_EXTHDR_DUPL_RH,
"ipv6.exthdr_dupl_hh", IPV6_EXTHDR_DUPL_HH,
"ipv6.exthdr_dupl_dh", IPV6_EXTHDR_DUPL_DH,
"ipv6.exthdr_dupl_ah", IPV6_EXTHDR_DUPL_AH,
"ipv6.exthdr_dupl_eh", IPV6_EXTHDR_DUPL_EH,
"ipv6.exthdr_invalid_optlen", IPV6_EXTHDR_INVALID_OPTLEN,
"tcp.pkt_too_small", TCP_PKT_TOO_SMALL,
"tcp.hlen_too_small", TCP_HLEN_TOO_SMALL,
"tcp.invalid_optlen", TCP_INVALID_OPTLEN,
"tcp.opt_invalid_len", TCP_OPT_INVALID_LEN,
"tcp.opt_duplicate", TCP_OPT_DUPLICATE,
"udp.pkt_too_small", UDP_PKT_TOO_SMALL,
"udp.hlen_too_small", UDP_HLEN_TOO_SMALL,
"udp.hlen_invalid", UDP_HLEN_INVALID,
"sll.pkt_too_small", SLL_PKT_TOO_SMALL,
"ethernet.pkt_too_small", ETHERNET_PKT_TOO_SMALL,
"ppp.pkt_too_small", PPP_PKT_TOO_SMALL,
"ppp.ju_pkt_too_small", PPPVJU_PKT_TOO_SMALL,
"ppp.ip4_pkt_too_small", PPPIPV4_PKT_TOO_SMALL,
"ppp.ip6_pkt_too_small", PPPIPV6_PKT_TOO_SMALL,
"ppp.wrong_type", PPP_WRONG_TYPE,
NULL, 0
{ "ipv4.pkt_too_small", IPV4_PKT_TOO_SMALL, },
{ "ipv4.hlen_too_small", IPV4_HLEN_TOO_SMALL, },
{ "ipv4.iplen_smaller_than_hlen", IPV4_IPLEN_SMALLER_THAN_HLEN, },
{ "ipv6.pkt_too_small", IPV6_PKT_TOO_SMALL, },
{ "ipv6.trunc_exthdr", IPV6_TRUNC_EXTHDR, },
{ "ipv6.exthdr_dupl_fh", IPV6_EXTHDR_DUPL_FH, },
{ "ipv6.exthdr_dupl_rh", IPV6_EXTHDR_DUPL_RH, },
{ "ipv6.exthdr_dupl_hh", IPV6_EXTHDR_DUPL_HH, },
{ "ipv6.exthdr_dupl_dh", IPV6_EXTHDR_DUPL_DH, },
{ "ipv6.exthdr_dupl_ah", IPV6_EXTHDR_DUPL_AH, },
{ "ipv6.exthdr_dupl_eh", IPV6_EXTHDR_DUPL_EH, },
{ "ipv6.exthdr_invalid_optlen", IPV6_EXTHDR_INVALID_OPTLEN, },
{ "tcp.pkt_too_small", TCP_PKT_TOO_SMALL, },
{ "tcp.hlen_too_small", TCP_HLEN_TOO_SMALL, },
{ "tcp.invalid_optlen", TCP_INVALID_OPTLEN, },
{ "tcp.opt_invalid_len", TCP_OPT_INVALID_LEN, },
{ "tcp.opt_duplicate", TCP_OPT_DUPLICATE, },
{ "udp.pkt_too_small", UDP_PKT_TOO_SMALL, },
{ "udp.hlen_too_small", UDP_HLEN_TOO_SMALL, },
{ "udp.hlen_invalid", UDP_HLEN_INVALID, },
{ "sll.pkt_too_small", SLL_PKT_TOO_SMALL, },
{ "ethernet.pkt_too_small", ETHERNET_PKT_TOO_SMALL, },
{ "ppp.pkt_too_small", PPP_PKT_TOO_SMALL, },
{ "ppp.ju_pkt_too_small", PPPVJU_PKT_TOO_SMALL, },
{ "ppp.ip4_pkt_too_small", PPPIPV4_PKT_TOO_SMALL, },
{ "ppp.ip6_pkt_too_small", PPPIPV6_PKT_TOO_SMALL, },
{ "ppp.wrong_type", PPP_WRONG_TYPE, },
{ NULL, 0 },
};

Write Preview
Loading…
Cancel
Save