There is nothing Address specific going on in the preparations.
Stage 1: Preprocessing happens. Sigs classified as IP Only, Masks
applied, content specific limits applied, etc and sig array built.
Stage 2: Sigs grouped by IPOnly, ports and protocols.
Stage 3: Decoder Events SGH built.
Stage 4: File flags set, sig grouping done per prefilter, etc.
snprintf(rule, sizeof(rule), "alert tcp any any -> any any (%s sid:1; rev:1;)", (sig)); \
Signature *s = DetectEngineAppendSig(de_ctx, rule); \
FAIL_IF_NULL(s); \
- SigAddressPrepareStage1(de_ctx); \
+ SigPrepareStage1(de_ctx); \
bool res = TestLastContent(s, (o), (d)); \
FAIL_IF(res == false); \
DetectEngineCtxFree(de_ctx); \
* \retval 0 on success
* \retval -1 on failure
*/
-int SigAddressPrepareStage1(DetectEngineCtx *de_ctx)
+int SigPrepareStage1(DetectEngineCtx *de_ctx)
{
uint32_t cnt_iponly = 0;
uint32_t cnt_payload = 0;
* \retval 0 On success
* \retval -1 On failure
*/
-int SigAddressPrepareStage2(DetectEngineCtx *de_ctx)
+int SigPrepareStage2(DetectEngineCtx *de_ctx)
{
SCLogDebug("building signature grouping structure, stage 2: "
"building source address lists...");
SigGroupHeadBuildMatchArray(de_ctx, de_ctx->decoder_event_sgh, max_idx);
}
-int SigAddressPrepareStage3(DetectEngineCtx *de_ctx)
+int SigPrepareStage3(DetectEngineCtx *de_ctx)
{
/* prepare the decoder event sgh */
DetectEngineBuildDecoderEventSgh(de_ctx);
#endif
/** \brief finalize preparing sgh's */
-int SigAddressPrepareStage4(DetectEngineCtx *de_ctx)
+int SigPrepareStage4(DetectEngineCtx *de_ctx)
{
SCEnter();
SigInitStandardMpmFactoryContexts(de_ctx);
- if (SigAddressPrepareStage1(de_ctx) != 0) {
+ if (SigPrepareStage1(de_ctx) != 0) {
FatalError("initializing the detection engine failed");
}
- if (SigAddressPrepareStage2(de_ctx) != 0) {
+ if (SigPrepareStage2(de_ctx) != 0) {
FatalError("initializing the detection engine failed");
}
- if (SigAddressPrepareStage3(de_ctx) != 0) {
+ if (SigPrepareStage3(de_ctx) != 0) {
FatalError("initializing the detection engine failed");
}
- if (SigAddressPrepareStage4(de_ctx) != 0) {
+ if (SigPrepareStage4(de_ctx) != 0) {
FatalError("initializing the detection engine failed");
}
int SignatureIsFilesizeInspecting(const Signature *);
void SignatureSetType(DetectEngineCtx *de_ctx, Signature *s);
-int SigAddressPrepareStage1(DetectEngineCtx *de_ctx);
-int SigAddressPrepareStage2(DetectEngineCtx *de_ctx);
-int SigAddressPrepareStage3(DetectEngineCtx *de_ctx);
-int SigAddressPrepareStage4(DetectEngineCtx *de_ctx);
+int SigPrepareStage1(DetectEngineCtx *de_ctx);
+int SigPrepareStage2(DetectEngineCtx *de_ctx);
+int SigPrepareStage3(DetectEngineCtx *de_ctx);
+int SigPrepareStage4(DetectEngineCtx *de_ctx);
int SigAddressCleanupStage1(DetectEngineCtx *de_ctx);
void SigCleanSignatures(DetectEngineCtx *);
#ifdef UNITTESTS
-int SigAddressPrepareStage1(DetectEngineCtx *);
+int SigPrepareStage1(DetectEngineCtx *);
/**
* \test Check if a SigGroupHead hash table is properly allocated and
"content:\"test2\"; content:\"test3\"; sid:5;)");
FAIL_IF_NULL(s);
- SigAddressPrepareStage1(de_ctx);
+ SigPrepareStage1(de_ctx);
SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list);
SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list->next->next);
"content:\"test2\"; content:\"test3\"; sid:5;)");
FAIL_IF_NULL(s);
- SigAddressPrepareStage1(de_ctx);
+ SigPrepareStage1(de_ctx);
SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list);
SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list->next->next);
"content:\"test2\"; content:\"test3\"; sid:5;)");
FAIL_IF_NULL(s);
- SigAddressPrepareStage1(de_ctx);
+ SigPrepareStage1(de_ctx);
SigGroupHeadAppendSig(de_ctx, &src_sh, de_ctx->sig_list);
SigGroupHeadAppendSig(de_ctx, &src_sh, de_ctx->sig_list->next->next);
"content:\"test2\"; content:\"test3\"; sid:5;)");
FAIL_IF_NULL(s);
- SigAddressPrepareStage1(de_ctx);
+ SigPrepareStage1(de_ctx);
SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list);
SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list->next->next);