23338889526

Committed 20 Mar 2026 10:29AM UTC coverage: 76.331% (-3.0%) from 79.315%

Build # 23338889526

Build Type

Pull #15053

github

Committed by

web-flow

Commit Message

Merge 00ac1dd14 into 6587e363a

Pull Request Pull Request #15053: Flow queue/v3

Coverage Stats

106 of 127 new or added lines in 8 files covered. (83.46%)

9913 existing lines in 468 files now uncovered.

255689 of 334972 relevant lines covered (76.33%)

4170649.82 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

70.73

/src/detect-rawbytes.c

/* Copyright (C) 2007-2018 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

/**
 * \file
 *
 * \author Victor Julien <victor@inliniac.net>
 *
 * Implements rawbytes keyword support
 *
 * \todo Provide un-normalized telnet dce/rpc buffers to match on
 */

#include "suricata-common.h"

#include "decode.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-rawbytes.h"
#include "detect-engine.h"

#include "detect-content.h"
#include "detect-pcre.h"

#include "util-debug.h"

static int DetectRawbytesSetup(DetectEngineCtx *, Signature *, const char *);

void DetectRawbytesRegister(void)
{
    sigmatch_table[DETECT_RAWBYTES].name = "rawbytes";
    sigmatch_table[DETECT_RAWBYTES].desc =
            "dummy keyword to be compatible with snort signatures without effect";
    sigmatch_table[DETECT_RAWBYTES].url = "/rules/payload-keywords.html#rawbytes";
    sigmatch_table[DETECT_RAWBYTES].Setup = DetectRawbytesSetup;
    sigmatch_table[DETECT_RAWBYTES].flags |= SIGMATCH_NOOPT;
}

static int DetectRawbytesSetup(DetectEngineCtx *de_ctx, Signature *s, const char *nullstr)
{
    SCEnter();

    if (nullstr != NULL) {
        SCLogError("rawbytes has no value");
        SCReturnInt(-1);
    }

    if (s->init_data->list != DETECT_SM_LIST_NOTSET) {
        SCLogError("\"rawbytes\" cannot be combined "
                   "with the \"%s\" sticky buffer",
                DetectEngineBufferTypeGetNameById(de_ctx, s->init_data->list));
        SCReturnInt(-1);
    }

    SigMatch *pm = DetectGetLastSMByListId(s, DETECT_SM_LIST_PMATCH, DETECT_CONTENT, -1);
    if (pm == NULL) {
        SCLogError("\"rawbytes\" needs a preceding content option");
        SCReturnInt(-1);
    }

    switch (pm->type) {
        case DETECT_CONTENT: {
            DetectContentData *cd = (DetectContentData *)pm->ctx;
            if (cd->flags & DETECT_CONTENT_RAWBYTES) {
                SCLogError("can't use multiple rawbytes modifiers for the same content. ");
                SCReturnInt(-1);
            }
            cd->flags |= DETECT_CONTENT_RAWBYTES;
            break;
        }
        default:
            SCLogError("\"rawbytes\" needs a preceding content option");
            SCReturnInt(-1);
    }

    SCReturnInt(0);
}

1	/* Copyright (C) 2007-2018 Open Information Security Foundation
2	*
3	* You can copy, redistribute or modify this Program under the terms of
4	* the GNU General Public License version 2 as published by the Free
5	* Software Foundation.
6	*
7	* This program is distributed in the hope that it will be useful,
8	* but WITHOUT ANY WARRANTY; without even the implied warranty of
9	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10	* GNU General Public License for more details.
11	*
12	* You should have received a copy of the GNU General Public License
13	* version 2 along with this program; if not, write to the Free Software
14	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15	* 02110-1301, USA.
16	*/
17
18	/**
19	* \file
20	*
21	* \author Victor Julien <victor@inliniac.net>
22	*
23	* Implements rawbytes keyword support
24	*
25	* \todo Provide un-normalized telnet dce/rpc buffers to match on
26	*/
27
28	#include "suricata-common.h"
29
30	#include "decode.h"
31	#include "detect.h"
32	#include "detect-parse.h"
33	#include "detect-rawbytes.h"
34	#include "detect-engine.h"
35
36	#include "detect-content.h"
37	#include "detect-pcre.h"
38
39	#include "util-debug.h"
40
41	static int DetectRawbytesSetup(DetectEngineCtx , Signature , const char *);
42
43	void DetectRawbytesRegister(void)
44	{	2,216✔
45	sigmatch_table[DETECT_RAWBYTES].name = "rawbytes";	2,216✔
46	sigmatch_table[DETECT_RAWBYTES].desc =	2,216✔
47	"dummy keyword to be compatible with snort signatures without effect";	2,216✔
48	sigmatch_table[DETECT_RAWBYTES].url = "/rules/payload-keywords.html#rawbytes";	2,216✔
49	sigmatch_table[DETECT_RAWBYTES].Setup = DetectRawbytesSetup;	2,216✔
50	sigmatch_table[DETECT_RAWBYTES].flags \|= SIGMATCH_NOOPT;	2,216✔
51	}	2,216✔
52
53	static int DetectRawbytesSetup(DetectEngineCtx de_ctx, Signature s, const char *nullstr)
54	{	20✔
55	SCEnter();	20✔
56
57	if (nullstr != NULL) {	20✔
58	SCLogError("rawbytes has no value");	×
59	SCReturnInt(-1);	×
60	}	×
61
62	if (s->init_data->list != DETECT_SM_LIST_NOTSET) {	20✔
63	SCLogError("\"rawbytes\" cannot be combined "	6✔
64	"with the \"%s\" sticky buffer",	6✔
65	DetectEngineBufferTypeGetNameById(de_ctx, s->init_data->list));	6✔
66	SCReturnInt(-1);	6✔
67	}	6✔
68
69	SigMatch *pm = DetectGetLastSMByListId(s, DETECT_SM_LIST_PMATCH, DETECT_CONTENT, -1);	14✔
70	if (pm == NULL) {	14✔
UNCOV 71	SCLogError("\"rawbytes\" needs a preceding content option");	×
UNCOV 72	SCReturnInt(-1);	×
UNCOV 73	}	×
74
75	switch (pm->type) {	14✔
76	case DETECT_CONTENT: {	14✔
77	DetectContentData cd = (DetectContentData )pm->ctx;	14✔
78	if (cd->flags & DETECT_CONTENT_RAWBYTES) {	14✔
UNCOV 79	SCLogError("can't use multiple rawbytes modifiers for the same content. ");	×
UNCOV 80	SCReturnInt(-1);	×
UNCOV 81	}	×
82	cd->flags \|= DETECT_CONTENT_RAWBYTES;	14✔
83	break;	14✔
84	}	14✔
85	default:	×
86	SCLogError("\"rawbytes\" needs a preceding content option");	×
87	SCReturnInt(-1);	×
88	}	14✔
89
90	SCReturnInt(0);	14✔
91	}	14✔

OISF / suricata / 23338889526

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous