aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: move sm_list to string funcs to parser code

Browse Source
pull/1980/head
Victor Julien 11 years ago
parent 722e2dbf7c
commit 92c571b26d
3 changed files with 82 additions and 79 deletions
Show Stats Download Patch File Download Diff File

79
src/detect-parse.c
Unescape Escape View File

@ -140,6 +140,85 @@ typedef struct SignatureParser_ {
char opts[DETECT_MAX_RULE_SIZE];
} SignatureParser;
const char *DetectListToHumanString(int list)
{
#define CASE_CODE_STRING(E, S) case E: return S; break
switch (list) {
CASE_CODE_STRING(DETECT_SM_LIST_MATCH, "packet");
CASE_CODE_STRING(DETECT_SM_LIST_PMATCH, "payload");
CASE_CODE_STRING(DETECT_SM_LIST_UMATCH, "http_uri");
CASE_CODE_STRING(DETECT_SM_LIST_HRUDMATCH, "http_raw_uri");
CASE_CODE_STRING(DETECT_SM_LIST_HCBDMATCH, "http_client_body");
CASE_CODE_STRING(DETECT_SM_LIST_FILEDATA, "file_data");
CASE_CODE_STRING(DETECT_SM_LIST_HHDMATCH, "http_header");
CASE_CODE_STRING(DETECT_SM_LIST_HRHDMATCH, "http_raw_header");
CASE_CODE_STRING(DETECT_SM_LIST_HSMDMATCH, "http_stat_msg");
CASE_CODE_STRING(DETECT_SM_LIST_HSCDMATCH, "http_stat_code");
CASE_CODE_STRING(DETECT_SM_LIST_HHHDMATCH, "http_host");
CASE_CODE_STRING(DETECT_SM_LIST_HRHHDMATCH, "http_raw_host");
CASE_CODE_STRING(DETECT_SM_LIST_HMDMATCH, "http_method");
CASE_CODE_STRING(DETECT_SM_LIST_HCDMATCH, "http_cookie");
CASE_CODE_STRING(DETECT_SM_LIST_HUADMATCH, "http_user_agent");
CASE_CODE_STRING(DETECT_SM_LIST_HRLMATCH, "http_request_line");
CASE_CODE_STRING(DETECT_SM_LIST_APP_EVENT, "app-layer-event");
CASE_CODE_STRING(DETECT_SM_LIST_AMATCH, "app-layer");
CASE_CODE_STRING(DETECT_SM_LIST_DMATCH, "dcerpc");
CASE_CODE_STRING(DETECT_SM_LIST_TMATCH, "tag");
CASE_CODE_STRING(DETECT_SM_LIST_FILEMATCH, "file");
CASE_CODE_STRING(DETECT_SM_LIST_DNSREQUEST_MATCH, "dns_request");
CASE_CODE_STRING(DETECT_SM_LIST_DNSRESPONSE_MATCH, "dns_response");
CASE_CODE_STRING(DETECT_SM_LIST_DNSQUERYNAME_MATCH, "dns_query");
CASE_CODE_STRING(DETECT_SM_LIST_MODBUS_MATCH, "modbus");
CASE_CODE_STRING(DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH, "template");
CASE_CODE_STRING(DETECT_SM_LIST_POSTMATCH, "postmatch");
CASE_CODE_STRING(DETECT_SM_LIST_SUPPRESS, "suppress");
CASE_CODE_STRING(DETECT_SM_LIST_THRESHOLD, "threshold");
CASE_CODE_STRING(DETECT_SM_LIST_MAX, "max (internal)");
CASE_CODE_STRING(DETECT_SM_LIST_NOTSET, "not set (internal)");
}
#undef CASE_CODE_STRING
return "unknown";
}
#define CASE_CODE(E) case E: return #E
const char *DetectListToString(int list)
{
switch (list) {
CASE_CODE(DETECT_SM_LIST_MATCH);
CASE_CODE(DETECT_SM_LIST_PMATCH);
CASE_CODE(DETECT_SM_LIST_UMATCH);
CASE_CODE(DETECT_SM_LIST_HRUDMATCH);
CASE_CODE(DETECT_SM_LIST_HCBDMATCH);
CASE_CODE(DETECT_SM_LIST_FILEDATA);
CASE_CODE(DETECT_SM_LIST_HHDMATCH);
CASE_CODE(DETECT_SM_LIST_HRHDMATCH);
CASE_CODE(DETECT_SM_LIST_HSMDMATCH);
CASE_CODE(DETECT_SM_LIST_HSCDMATCH);
CASE_CODE(DETECT_SM_LIST_HHHDMATCH);
CASE_CODE(DETECT_SM_LIST_HRHHDMATCH);
CASE_CODE(DETECT_SM_LIST_HMDMATCH);
CASE_CODE(DETECT_SM_LIST_HCDMATCH);
CASE_CODE(DETECT_SM_LIST_HUADMATCH);
CASE_CODE(DETECT_SM_LIST_HRLMATCH);
CASE_CODE(DETECT_SM_LIST_APP_EVENT);
CASE_CODE(DETECT_SM_LIST_AMATCH);
CASE_CODE(DETECT_SM_LIST_DMATCH);
CASE_CODE(DETECT_SM_LIST_TMATCH);
CASE_CODE(DETECT_SM_LIST_FILEMATCH);
CASE_CODE(DETECT_SM_LIST_DNSREQUEST_MATCH);
CASE_CODE(DETECT_SM_LIST_DNSRESPONSE_MATCH);
CASE_CODE(DETECT_SM_LIST_DNSQUERYNAME_MATCH);
CASE_CODE(DETECT_SM_LIST_MODBUS_MATCH);
CASE_CODE(DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH);
CASE_CODE(DETECT_SM_LIST_POSTMATCH);
CASE_CODE(DETECT_SM_LIST_SUPPRESS);
CASE_CODE(DETECT_SM_LIST_THRESHOLD);
CASE_CODE(DETECT_SM_LIST_MAX);
CASE_CODE(DETECT_SM_LIST_NOTSET);
}
return "unknown";
}
int DetectEngineContentModifierBufferSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg,
uint8_t sm_type, uint8_t sm_list,
AppProto alproto, void (*CustomCallback)(Signature *s))

3
src/detect-parse.h
Unescape Escape View File

@ -64,5 +64,8 @@ int DetectEngineContentModifierBufferSetup(DetectEngineCtx *de_ctx, Signature *s
uint8_t sm_type, uint8_t sm_list,
AppProto alproto, void (*CustomCallback)(Signature *s));
const char *DetectListToHumanString(int list);
const char *DetectListToString(int list);
#endif /* __DETECT_PARSE_H__ */

79
src/detect.c
Unescape Escape View File

@ -2835,85 +2835,6 @@ static void SigParseApplyDsizeToContent(Signature *s)
}
}
const char *DetectListToHumanString(int list)
{
#define CASE_CODE_STRING(E, S) case E: return S; break
switch (list) {
CASE_CODE_STRING(DETECT_SM_LIST_MATCH, "packet");
CASE_CODE_STRING(DETECT_SM_LIST_PMATCH, "payload");
CASE_CODE_STRING(DETECT_SM_LIST_UMATCH, "http_uri");
CASE_CODE_STRING(DETECT_SM_LIST_HRUDMATCH, "http_raw_uri");
CASE_CODE_STRING(DETECT_SM_LIST_HCBDMATCH, "http_client_body");
CASE_CODE_STRING(DETECT_SM_LIST_FILEDATA, "file_data");
CASE_CODE_STRING(DETECT_SM_LIST_HHDMATCH, "http_header");
CASE_CODE_STRING(DETECT_SM_LIST_HRHDMATCH, "http_raw_header");
CASE_CODE_STRING(DETECT_SM_LIST_HSMDMATCH, "http_stat_msg");
CASE_CODE_STRING(DETECT_SM_LIST_HSCDMATCH, "http_stat_code");
CASE_CODE_STRING(DETECT_SM_LIST_HHHDMATCH, "http_host");
CASE_CODE_STRING(DETECT_SM_LIST_HRHHDMATCH, "http_raw_host");
CASE_CODE_STRING(DETECT_SM_LIST_HMDMATCH, "http_method");
CASE_CODE_STRING(DETECT_SM_LIST_HCDMATCH, "http_cookie");
CASE_CODE_STRING(DETECT_SM_LIST_HUADMATCH, "http_user_agent");
CASE_CODE_STRING(DETECT_SM_LIST_HRLMATCH, "http_request_line");
CASE_CODE_STRING(DETECT_SM_LIST_APP_EVENT, "app-layer-event");
CASE_CODE_STRING(DETECT_SM_LIST_AMATCH, "app-layer");
CASE_CODE_STRING(DETECT_SM_LIST_DMATCH, "dcerpc");
CASE_CODE_STRING(DETECT_SM_LIST_TMATCH, "tag");
CASE_CODE_STRING(DETECT_SM_LIST_FILEMATCH, "file");
CASE_CODE_STRING(DETECT_SM_LIST_DNSREQUEST_MATCH, "dns_request");
CASE_CODE_STRING(DETECT_SM_LIST_DNSRESPONSE_MATCH, "dns_response");
CASE_CODE_STRING(DETECT_SM_LIST_DNSQUERYNAME_MATCH, "dns_query");
CASE_CODE_STRING(DETECT_SM_LIST_MODBUS_MATCH, "modbus");
CASE_CODE_STRING(DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH, "template");
CASE_CODE_STRING(DETECT_SM_LIST_POSTMATCH, "postmatch");
CASE_CODE_STRING(DETECT_SM_LIST_SUPPRESS, "suppress");
CASE_CODE_STRING(DETECT_SM_LIST_THRESHOLD, "threshold");
CASE_CODE_STRING(DETECT_SM_LIST_MAX, "max (internal)");
CASE_CODE_STRING(DETECT_SM_LIST_NOTSET, "not set (internal)");
}
#undef CASE_CODE_STRING
return "unknown";
}
#define CASE_CODE(E) case E: return #E
const char *DetectListToString(int list)
{
switch (list) {
CASE_CODE(DETECT_SM_LIST_MATCH);
CASE_CODE(DETECT_SM_LIST_PMATCH);
CASE_CODE(DETECT_SM_LIST_UMATCH);
CASE_CODE(DETECT_SM_LIST_HRUDMATCH);
CASE_CODE(DETECT_SM_LIST_HCBDMATCH);
CASE_CODE(DETECT_SM_LIST_FILEDATA);
CASE_CODE(DETECT_SM_LIST_HHDMATCH);
CASE_CODE(DETECT_SM_LIST_HRHDMATCH);
CASE_CODE(DETECT_SM_LIST_HSMDMATCH);
CASE_CODE(DETECT_SM_LIST_HSCDMATCH);
CASE_CODE(DETECT_SM_LIST_HHHDMATCH);
CASE_CODE(DETECT_SM_LIST_HRHHDMATCH);
CASE_CODE(DETECT_SM_LIST_HMDMATCH);
CASE_CODE(DETECT_SM_LIST_HCDMATCH);
CASE_CODE(DETECT_SM_LIST_HUADMATCH);
CASE_CODE(DETECT_SM_LIST_HRLMATCH);
CASE_CODE(DETECT_SM_LIST_APP_EVENT);
CASE_CODE(DETECT_SM_LIST_AMATCH);
CASE_CODE(DETECT_SM_LIST_DMATCH);
CASE_CODE(DETECT_SM_LIST_TMATCH);
CASE_CODE(DETECT_SM_LIST_FILEMATCH);
CASE_CODE(DETECT_SM_LIST_DNSREQUEST_MATCH);
CASE_CODE(DETECT_SM_LIST_DNSRESPONSE_MATCH);
CASE_CODE(DETECT_SM_LIST_DNSQUERYNAME_MATCH);
CASE_CODE(DETECT_SM_LIST_MODBUS_MATCH);
CASE_CODE(DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH);
CASE_CODE(DETECT_SM_LIST_POSTMATCH);
CASE_CODE(DETECT_SM_LIST_SUPPRESS);
CASE_CODE(DETECT_SM_LIST_THRESHOLD);
CASE_CODE(DETECT_SM_LIST_MAX);
CASE_CODE(DETECT_SM_LIST_NOTSET);
}
return "unknown";
}
/** \brief Pure-PCRE or bytetest rule */
int RuleInspectsPayloadHasNoMpm(const Signature *s)
{

Write Preview
Loading…
Cancel
Save