mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
56 lines
734 B
Plaintext
56 lines
734 B
Plaintext
@init@
|
|
typedef Packet;
|
|
Packet *p;
|
|
expression E;
|
|
statement S;
|
|
@@
|
|
|
|
(
|
|
memset(p, ...);
|
|
p->pkt = E;
|
|
|
|
|
p = SCCalloc(...);
|
|
S
|
|
p->pkt = E;
|
|
)
|
|
|
|
@pktfield depends on !init@
|
|
identifier func !~ "^PacketCopyDataOffset$";
|
|
Packet *p;
|
|
position p1;
|
|
@@
|
|
|
|
func(...) {
|
|
<...
|
|
p->pkt@p1
|
|
...>
|
|
}
|
|
|
|
@ script:python @
|
|
p1 << pktfield.p1;
|
|
@@
|
|
|
|
print "Invalid Packet->pkt usage, GET_PKT_DATA macro must be used at %s:%s" % (p1[0].file, p1[0].line)
|
|
import sys
|
|
sys.exit(1)
|
|
|
|
@pktlenfield@
|
|
identifier func !~ "^PacketCopyDataOffset$";
|
|
Packet *p;
|
|
position p1;
|
|
@@
|
|
|
|
func(...) {
|
|
<...
|
|
p->pktlen@p1
|
|
...>
|
|
}
|
|
|
|
@ script:python @
|
|
p1 << pktlenfield.p1;
|
|
@@
|
|
|
|
print "Invalid Packet->pktlen usage, GET_PKT_LEN macro must be used at %s:%s" % (p1[0].file, p1[0].line)
|
|
import sys
|
|
sys.exit(1)
|