]> git.ipfire.org Git - thirdparty/suricata.git/commit
detect-parse: improve common parser 2683/head
authorVictor Julien <victor@inliniac.net>
Mon, 1 May 2017 18:34:07 +0000 (20:34 +0200)
committerVictor Julien <victor@inliniac.net>
Tue, 2 May 2017 09:23:35 +0000 (11:23 +0200)
commit342059835fe7ec0079ac91a152a0abab516b184f
tree8bb13390ef2a57f2fa0f14d97c1205a4b8faa7ff
parent842dfbc3f86cee39d19ae394d39f87be2e1eea94
detect-parse: improve common parser

In preparation of turning input to keyword parsers to const add
options to the common rule parser to enforce and strip double
quotes and parse negation support.

At registration, the keyword can register 3 extra flags:

    SIGMATCH_QUOTES_MANDATORY: value to keyword must be quoted

    SIGMATCH_QUOTES_OPTIONAL: value to keyword may be quoted

    SIGMATCH_HANDLE_NEGATION: leading ! is parsed

In all cases leading spaces are removed. If the 'quote' flags are
set, the quotes are removed from the input as well.
15 files changed:
src/detect-content.c
src/detect-content.h
src/detect-fileext.c
src/detect-filemagic.c
src/detect-filename.c
src/detect-flowvar.c
src/detect-msg.c
src/detect-parse.c
src/detect-pcre.c
src/detect-replace.c
src/detect-ssh-proto-version.c
src/detect-ssh-software-version.c
src/detect-tls.c
src/detect-uricontent.c
src/detect.h