From: Victor Julien Date: Tue, 1 Mar 2016 16:42:40 +0000 (+0100) Subject: detect: move sm_list to string funcs to parser code X-Git-Tag: suricata-3.1RC1~328 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=92c571b26d4518ad630117a06990d80f92dfb4f6;p=thirdparty%2Fsuricata.git detect: move sm_list to string funcs to parser code --- diff --git a/src/detect-parse.c b/src/detect-parse.c index c392ba3fd1..4598258767 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -140,6 +140,85 @@ typedef struct SignatureParser_ { char opts[DETECT_MAX_RULE_SIZE]; } SignatureParser; +const char *DetectListToHumanString(int list) +{ +#define CASE_CODE_STRING(E, S) case E: return S; break + switch (list) { + CASE_CODE_STRING(DETECT_SM_LIST_MATCH, "packet"); + CASE_CODE_STRING(DETECT_SM_LIST_PMATCH, "payload"); + CASE_CODE_STRING(DETECT_SM_LIST_UMATCH, "http_uri"); + CASE_CODE_STRING(DETECT_SM_LIST_HRUDMATCH, "http_raw_uri"); + CASE_CODE_STRING(DETECT_SM_LIST_HCBDMATCH, "http_client_body"); + CASE_CODE_STRING(DETECT_SM_LIST_FILEDATA, "file_data"); + CASE_CODE_STRING(DETECT_SM_LIST_HHDMATCH, "http_header"); + CASE_CODE_STRING(DETECT_SM_LIST_HRHDMATCH, "http_raw_header"); + CASE_CODE_STRING(DETECT_SM_LIST_HSMDMATCH, "http_stat_msg"); + CASE_CODE_STRING(DETECT_SM_LIST_HSCDMATCH, "http_stat_code"); + CASE_CODE_STRING(DETECT_SM_LIST_HHHDMATCH, "http_host"); + CASE_CODE_STRING(DETECT_SM_LIST_HRHHDMATCH, "http_raw_host"); + CASE_CODE_STRING(DETECT_SM_LIST_HMDMATCH, "http_method"); + CASE_CODE_STRING(DETECT_SM_LIST_HCDMATCH, "http_cookie"); + CASE_CODE_STRING(DETECT_SM_LIST_HUADMATCH, "http_user_agent"); + CASE_CODE_STRING(DETECT_SM_LIST_HRLMATCH, "http_request_line"); + CASE_CODE_STRING(DETECT_SM_LIST_APP_EVENT, "app-layer-event"); + CASE_CODE_STRING(DETECT_SM_LIST_AMATCH, "app-layer"); + CASE_CODE_STRING(DETECT_SM_LIST_DMATCH, "dcerpc"); + CASE_CODE_STRING(DETECT_SM_LIST_TMATCH, "tag"); + CASE_CODE_STRING(DETECT_SM_LIST_FILEMATCH, "file"); + CASE_CODE_STRING(DETECT_SM_LIST_DNSREQUEST_MATCH, "dns_request"); + CASE_CODE_STRING(DETECT_SM_LIST_DNSRESPONSE_MATCH, "dns_response"); + CASE_CODE_STRING(DETECT_SM_LIST_DNSQUERYNAME_MATCH, "dns_query"); + CASE_CODE_STRING(DETECT_SM_LIST_MODBUS_MATCH, "modbus"); + CASE_CODE_STRING(DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH, "template"); + CASE_CODE_STRING(DETECT_SM_LIST_POSTMATCH, "postmatch"); + CASE_CODE_STRING(DETECT_SM_LIST_SUPPRESS, "suppress"); + CASE_CODE_STRING(DETECT_SM_LIST_THRESHOLD, "threshold"); + CASE_CODE_STRING(DETECT_SM_LIST_MAX, "max (internal)"); + CASE_CODE_STRING(DETECT_SM_LIST_NOTSET, "not set (internal)"); + } +#undef CASE_CODE_STRING + return "unknown"; +} + +#define CASE_CODE(E) case E: return #E +const char *DetectListToString(int list) +{ + switch (list) { + CASE_CODE(DETECT_SM_LIST_MATCH); + CASE_CODE(DETECT_SM_LIST_PMATCH); + CASE_CODE(DETECT_SM_LIST_UMATCH); + CASE_CODE(DETECT_SM_LIST_HRUDMATCH); + CASE_CODE(DETECT_SM_LIST_HCBDMATCH); + CASE_CODE(DETECT_SM_LIST_FILEDATA); + CASE_CODE(DETECT_SM_LIST_HHDMATCH); + CASE_CODE(DETECT_SM_LIST_HRHDMATCH); + CASE_CODE(DETECT_SM_LIST_HSMDMATCH); + CASE_CODE(DETECT_SM_LIST_HSCDMATCH); + CASE_CODE(DETECT_SM_LIST_HHHDMATCH); + CASE_CODE(DETECT_SM_LIST_HRHHDMATCH); + CASE_CODE(DETECT_SM_LIST_HMDMATCH); + CASE_CODE(DETECT_SM_LIST_HCDMATCH); + CASE_CODE(DETECT_SM_LIST_HUADMATCH); + CASE_CODE(DETECT_SM_LIST_HRLMATCH); + CASE_CODE(DETECT_SM_LIST_APP_EVENT); + CASE_CODE(DETECT_SM_LIST_AMATCH); + CASE_CODE(DETECT_SM_LIST_DMATCH); + CASE_CODE(DETECT_SM_LIST_TMATCH); + CASE_CODE(DETECT_SM_LIST_FILEMATCH); + CASE_CODE(DETECT_SM_LIST_DNSREQUEST_MATCH); + CASE_CODE(DETECT_SM_LIST_DNSRESPONSE_MATCH); + CASE_CODE(DETECT_SM_LIST_DNSQUERYNAME_MATCH); + CASE_CODE(DETECT_SM_LIST_MODBUS_MATCH); + CASE_CODE(DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH); + CASE_CODE(DETECT_SM_LIST_POSTMATCH); + CASE_CODE(DETECT_SM_LIST_SUPPRESS); + CASE_CODE(DETECT_SM_LIST_THRESHOLD); + CASE_CODE(DETECT_SM_LIST_MAX); + CASE_CODE(DETECT_SM_LIST_NOTSET); + } + return "unknown"; +} + int DetectEngineContentModifierBufferSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg, uint8_t sm_type, uint8_t sm_list, AppProto alproto, void (*CustomCallback)(Signature *s)) diff --git a/src/detect-parse.h b/src/detect-parse.h index 5c13e4c998..cb2ae0f3b3 100644 --- a/src/detect-parse.h +++ b/src/detect-parse.h @@ -64,5 +64,8 @@ int DetectEngineContentModifierBufferSetup(DetectEngineCtx *de_ctx, Signature *s uint8_t sm_type, uint8_t sm_list, AppProto alproto, void (*CustomCallback)(Signature *s)); +const char *DetectListToHumanString(int list); +const char *DetectListToString(int list); + #endif /* __DETECT_PARSE_H__ */ diff --git a/src/detect.c b/src/detect.c index 90699debd4..49bd118c37 100644 --- a/src/detect.c +++ b/src/detect.c @@ -2835,85 +2835,6 @@ static void SigParseApplyDsizeToContent(Signature *s) } } -const char *DetectListToHumanString(int list) -{ -#define CASE_CODE_STRING(E, S) case E: return S; break - switch (list) { - CASE_CODE_STRING(DETECT_SM_LIST_MATCH, "packet"); - CASE_CODE_STRING(DETECT_SM_LIST_PMATCH, "payload"); - CASE_CODE_STRING(DETECT_SM_LIST_UMATCH, "http_uri"); - CASE_CODE_STRING(DETECT_SM_LIST_HRUDMATCH, "http_raw_uri"); - CASE_CODE_STRING(DETECT_SM_LIST_HCBDMATCH, "http_client_body"); - CASE_CODE_STRING(DETECT_SM_LIST_FILEDATA, "file_data"); - CASE_CODE_STRING(DETECT_SM_LIST_HHDMATCH, "http_header"); - CASE_CODE_STRING(DETECT_SM_LIST_HRHDMATCH, "http_raw_header"); - CASE_CODE_STRING(DETECT_SM_LIST_HSMDMATCH, "http_stat_msg"); - CASE_CODE_STRING(DETECT_SM_LIST_HSCDMATCH, "http_stat_code"); - CASE_CODE_STRING(DETECT_SM_LIST_HHHDMATCH, "http_host"); - CASE_CODE_STRING(DETECT_SM_LIST_HRHHDMATCH, "http_raw_host"); - CASE_CODE_STRING(DETECT_SM_LIST_HMDMATCH, "http_method"); - CASE_CODE_STRING(DETECT_SM_LIST_HCDMATCH, "http_cookie"); - CASE_CODE_STRING(DETECT_SM_LIST_HUADMATCH, "http_user_agent"); - CASE_CODE_STRING(DETECT_SM_LIST_HRLMATCH, "http_request_line"); - CASE_CODE_STRING(DETECT_SM_LIST_APP_EVENT, "app-layer-event"); - CASE_CODE_STRING(DETECT_SM_LIST_AMATCH, "app-layer"); - CASE_CODE_STRING(DETECT_SM_LIST_DMATCH, "dcerpc"); - CASE_CODE_STRING(DETECT_SM_LIST_TMATCH, "tag"); - CASE_CODE_STRING(DETECT_SM_LIST_FILEMATCH, "file"); - CASE_CODE_STRING(DETECT_SM_LIST_DNSREQUEST_MATCH, "dns_request"); - CASE_CODE_STRING(DETECT_SM_LIST_DNSRESPONSE_MATCH, "dns_response"); - CASE_CODE_STRING(DETECT_SM_LIST_DNSQUERYNAME_MATCH, "dns_query"); - CASE_CODE_STRING(DETECT_SM_LIST_MODBUS_MATCH, "modbus"); - CASE_CODE_STRING(DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH, "template"); - CASE_CODE_STRING(DETECT_SM_LIST_POSTMATCH, "postmatch"); - CASE_CODE_STRING(DETECT_SM_LIST_SUPPRESS, "suppress"); - CASE_CODE_STRING(DETECT_SM_LIST_THRESHOLD, "threshold"); - CASE_CODE_STRING(DETECT_SM_LIST_MAX, "max (internal)"); - CASE_CODE_STRING(DETECT_SM_LIST_NOTSET, "not set (internal)"); - } -#undef CASE_CODE_STRING - return "unknown"; -} - -#define CASE_CODE(E) case E: return #E -const char *DetectListToString(int list) -{ - switch (list) { - CASE_CODE(DETECT_SM_LIST_MATCH); - CASE_CODE(DETECT_SM_LIST_PMATCH); - CASE_CODE(DETECT_SM_LIST_UMATCH); - CASE_CODE(DETECT_SM_LIST_HRUDMATCH); - CASE_CODE(DETECT_SM_LIST_HCBDMATCH); - CASE_CODE(DETECT_SM_LIST_FILEDATA); - CASE_CODE(DETECT_SM_LIST_HHDMATCH); - CASE_CODE(DETECT_SM_LIST_HRHDMATCH); - CASE_CODE(DETECT_SM_LIST_HSMDMATCH); - CASE_CODE(DETECT_SM_LIST_HSCDMATCH); - CASE_CODE(DETECT_SM_LIST_HHHDMATCH); - CASE_CODE(DETECT_SM_LIST_HRHHDMATCH); - CASE_CODE(DETECT_SM_LIST_HMDMATCH); - CASE_CODE(DETECT_SM_LIST_HCDMATCH); - CASE_CODE(DETECT_SM_LIST_HUADMATCH); - CASE_CODE(DETECT_SM_LIST_HRLMATCH); - CASE_CODE(DETECT_SM_LIST_APP_EVENT); - CASE_CODE(DETECT_SM_LIST_AMATCH); - CASE_CODE(DETECT_SM_LIST_DMATCH); - CASE_CODE(DETECT_SM_LIST_TMATCH); - CASE_CODE(DETECT_SM_LIST_FILEMATCH); - CASE_CODE(DETECT_SM_LIST_DNSREQUEST_MATCH); - CASE_CODE(DETECT_SM_LIST_DNSRESPONSE_MATCH); - CASE_CODE(DETECT_SM_LIST_DNSQUERYNAME_MATCH); - CASE_CODE(DETECT_SM_LIST_MODBUS_MATCH); - CASE_CODE(DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH); - CASE_CODE(DETECT_SM_LIST_POSTMATCH); - CASE_CODE(DETECT_SM_LIST_SUPPRESS); - CASE_CODE(DETECT_SM_LIST_THRESHOLD); - CASE_CODE(DETECT_SM_LIST_MAX); - CASE_CODE(DETECT_SM_LIST_NOTSET); - } - return "unknown"; -} - /** \brief Pure-PCRE or bytetest rule */ int RuleInspectsPayloadHasNoMpm(const Signature *s) {