RuleMatcher.h File Reference

#include <limits.h>
#include "BroString.h"
#include "List.h"
#include "RE.h"
#include "Net.h"
#include "Sessions.h"
#include "IntSet.h"
#include "util.h"
#include "Rule.h"
#include "RuleAction.h"
#include "RuleCondition.h"

Include dependency graph for RuleMatcher.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes
struct	MaskedValue
struct	Range
class	RuleEndpointState
struct	RuleEndpointState::Matcher
class	RuleHdrTest
struct	RuleHdrTest::PatternSet
class	RuleMatcher
struct	RuleMatcher::Stats
Functions
void	rules_error (const char *msg)
void	rules_error (const char *msg, const char *addl)
void	rules_error (Rule *id, const char *msg)
int	rules_lex (void)
int	rules_parse (void)
int	rules_wrap (void)
	declare (PList, MaskedValue)
typedef	PList (MaskedValue) maskedvalue_list
typedef	PList (char) string_list
	declare (PList, BroString)
typedef	PList (BroString) bstr_list
void	id_to_maskedvallist (const char *id, maskedvalue_list *append_to)
char *	id_to_str (const char *id)
uint32	id_to_uint (const char *id)
	declare (PList, RuleHdrTest)
typedef	PList (RuleHdrTest) rule_hdr_test_list
Variables
int	rule_bench
FILE *	rules_in
int	rules_line_number
const char *	current_rule_file
RuleMatcher *	rule_matcher

---

Function Documentation

declare (  PList  , RuleHdrTest  )

declare (  PList  , BroString  )

declare (  PList  , MaskedValue  )

void id_to_maskedvallist (  const char *  id, maskedvalue_list *  append_to )

Definition at line 1069 of file RuleMatcher.cc. References get_bro_val(), id, loop_over_list, BroType::Tag(), Val::Type(), TYPE_TABLE, and val_to_maskedval(). Referenced by rules_parse(). { Val* v = get_bro_val(id); if ( ! v ) return; if ( v->Type()->Tag() == TYPE_TABLE ) { val_list* vals = v->AsTableVal()->ConvertToPureList()->Vals(); loop_over_list(*vals, i ) if ( ! val_to_maskedval((*vals)[i], append_to) ) return; } else val_to_maskedval(v, append_to); }

char* id_to_str (  const char *  id  )

Definition at line 1087 of file RuleMatcher.cc. References BroString::Bytes(), copy_string(), error(), get_bro_val(), id, BroString::Len(), rules_error(), BroType::Tag(), Val::Type(), and TYPE_STRING. Referenced by rules_parse(). { const BroString* src; char* dst; Val* v = get_bro_val(id); if ( ! v ) goto error; if ( v->Type()->Tag() != TYPE_STRING ) { rules_error("Identifier must refer to string"); goto error; } src = v->AsString(); dst = new char[src->Len()+1]; memcpy(dst, src->Bytes(), src->Len()); *(dst+src->Len()) = '\0'; return dst; error: char* dummy = copy_string("<error>"); return dummy; }

uint32 id_to_uint (  const char *  id  )

Definition at line 1113 of file RuleMatcher.cc. References Val::CoerceToUnsigned(), get_bro_val(), id, rules_error(), BroType::Tag(), Val::Type(), TYPE_BOOL, TYPE_COUNT, TYPE_ENUM, TYPE_INT, TYPE_PORT, TypeTag, and uint32. Referenced by rules_parse(). { Val* v = get_bro_val(id); if ( ! v ) return 0; TypeTag t = v->Type()->Tag(); if ( t == TYPE_BOOL || t == TYPE_COUNT || t == TYPE_ENUM || t == TYPE_INT || t == TYPE_PORT ) return v->CoerceToUnsigned(); rules_error("Identifier must refer to integer"); return 0; }

typedef PList (  RuleHdrTest   )

typedef PList (  BroString   )

typedef PList (  char   )

typedef PList (  MaskedValue   )

void rules_error (  Rule *  id, const char *  msg )

Definition at line 1672 of file rule-parse.cc. References Location::filename, Location::first_line, Rule::GetLocation(), Rule::ID(), rule_matcher, and RuleMatcher::SetParseError(). Referenced by RuleMatcher::AddRule(), get_bro_val(), id_to_str(), id_to_uint(), RuleMatcher::InsertRuleIntoTree(), RuleConditionEval::RuleConditionEval(), rules_parse(), and val_to_maskedval(). { const Location& l = r->GetLocation(); fprintf(stderr, "Error in signature %s (%s:%d): %s\n", r->ID(), l.filename, l.first_line, msg); rule_matcher->SetParseError(); }

void rules_error (  const char *  msg, const char *  addl )

Definition at line 1665 of file rule-parse.cc. References current_rule_file, rule_matcher, rules_line_number, and RuleMatcher::SetParseError(). { fprintf(stderr, "Error in signature (%s:%d): %s (%s)\n", current_rule_file, rules_line_number+1, msg, addl); rule_matcher->SetParseError(); }

void rules_error (  const char *  msg  )

Definition at line 1658 of file rule-parse.cc. References current_rule_file, rule_matcher, rules_line_number, and RuleMatcher::SetParseError(). { fprintf(stderr, "Error in signature (%s:%d): %s\n", current_rule_file, rules_line_number+1, msg); rule_matcher->SetParseError(); }

int rules_lex (  void   )

int rules_parse (  void   )

Definition at line 874 of file rule-parse.cc. References Rule::AddAction(), Rule::AddCondition(), Rule::AddHdrTest(), Rule::AddPattern(), Rule::AddRequires(), RuleMatcher::AddRule(), current_rule, current_rule_file, YYSTYPE::hdr_test, id_to_maskedvallist(), id_to_str(), id_to_uint(), Range::len, MaskedValue::mask, YYSTYPE::mval, Range::offset, YYSTYPE::range, YYSTYPE::rule, rule_matcher, rules_char, rules_check, rules_defact, rules_defgoto, rules_error(), rules_line_number, rules_lval, rules_nerrs, rules_pact, rules_pgoto, rules_r1, rules_r2, rules_stos, rules_table, rules_tname, rules_type, Rule::SetActiveStatus(), YYSTYPE::str, YYSTYPE::val, MaskedValue::val, val, YYSTYPE::vallist, warn(), YY_REDUCE_PRINT, YY_STACK_PRINT, YYABORT, YYACCEPT, YYDPRINTF, YYDSYMPRINTF, YYEMPTY, YYEOF, YYFINAL, YYINITDEPTH, YYLAST, YYLEX, YYMAXDEPTH, YYNTOKENS, YYPACT_NINF, YYPOPSTACK, YYSIZE_T, YYSTACK_ALLOC, YYSTACK_BYTES, YYSTACK_FREE, YYSTACK_RELOCATE, YYTABLE_NINF, YYTERROR, and YYTRANSLATE. Referenced by RuleMatcher::ReadFiles(). { register int rules_state; register int rules_n; int rules_result; /* Number of tokens to shift before error messages enabled. */ int rules_errstatus; /* Lookahead token as an internal (translated) token number. */ int rules_token = 0; /* Three stacks and their tools: `rules_ss': related to states, `rules_vs': related to semantic values, `rules_ls': related to locations. Refer to the stacks thru separate pointers, to allow rules_overflow to reallocate them elsewhere. */ /* The state stack. */ short rules_ssa[YYINITDEPTH]; short *rules_ss = rules_ssa; register short *rules_ssp; /* The semantic value stack. */ YYSTYPE rules_vsa[YYINITDEPTH]; YYSTYPE *rules_vs = rules_vsa; register YYSTYPE *rules_vsp; #define YYPOPSTACK (rules_vsp--, rules_ssp--) YYSIZE_T rules_stacksize = YYINITDEPTH; /* The variables used to return semantic value and location from the action routines. */ YYSTYPE rules_val; /* When reducing, the number of symbols on the RHS of the reduced rule. */ int rules_len; YYDPRINTF ((stderr, "Starting parse\n")); rules_state = 0; rules_errstatus = 0; rules_nerrs = 0; rules_char = YYEMPTY; /* Cause a token to be read. */ /* Initialize stack pointers. Waste one element of value and location stack so that they stay on the same level as the state stack. The wasted elements are never initialized. */ rules_ssp = rules_ss; rules_vsp = rules_vs; goto rules_setstate; /*------------------------------------------------------------. | rules_newstate -- Push a new state, which is found in rules_state. | `------------------------------------------------------------*/ rules_newstate: /* In all cases, when you get here, the value and location stacks have just been pushed. so pushing a state here evens the stacks. */ rules_ssp++; rules_setstate: *rules_ssp = rules_state; if (rules_ss + rules_stacksize - 1 <= rules_ssp) { /* Get the current used size of the three stacks, in elements. */ YYSIZE_T rules_size = rules_ssp - rules_ss + 1; #ifdef rules_overflow { /* Give user a chance to reallocate the stack. Use copies of these so that the &'s don't force the real ones into memory. */ YYSTYPE *rules_vs1 = rules_vs; short *rules_ss1 = rules_ss; /* Each stack pointer address is followed by the size of the data in use in that stack, in bytes. This used to be a conditional around just the two extra args, but that might be undefined if rules_overflow is a macro. */ rules_overflow ("parser stack overflow", &rules_ss1, rules_size * sizeof (*rules_ssp), &rules_vs1, rules_size * sizeof (*rules_vsp), &rules_stacksize); rules_ss = rules_ss1; rules_vs = rules_vs1; } #else /* no rules_overflow */ # ifndef YYSTACK_RELOCATE goto rules_overflowlab; # else /* Extend the stack our own way. */ if (YYMAXDEPTH <= rules_stacksize) goto rules_overflowlab; rules_stacksize *= 2; if (YYMAXDEPTH < rules_stacksize) rules_stacksize = YYMAXDEPTH; { short *rules_ss1 = rules_ss; union rules_alloc *rules_ptr = (union rules_alloc *) YYSTACK_ALLOC (YYSTACK_BYTES (rules_stacksize)); if (! rules_ptr) goto rules_overflowlab; YYSTACK_RELOCATE (rules_ss); YYSTACK_RELOCATE (rules_vs); # undef YYSTACK_RELOCATE if (rules_ss1 != rules_ssa) YYSTACK_FREE (rules_ss1); } # endif #endif /* no rules_overflow */ rules_ssp = rules_ss + rules_size - 1; rules_vsp = rules_vs + rules_size - 1; YYDPRINTF ((stderr, "Stack size increased to %lu\n", (unsigned long int) rules_stacksize)); if (rules_ss + rules_stacksize - 1 <= rules_ssp) YYABORT; } YYDPRINTF ((stderr, "Entering state %d\n", rules_state)); goto rules_backup; /*-----------. | rules_backup. | `-----------*/ rules_backup: /* Do appropriate processing given the current state. */ /* Read a lookahead token if we need one and don't already have one. */ /* rules_resume: */ /* First try to decide what to do without reference to lookahead token. */ rules_n = rules_pact[rules_state]; if (rules_n == YYPACT_NINF) goto rules_default; /* Not known => get a lookahead token if don't already have one. */ /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol. */ if (rules_char == YYEMPTY) { YYDPRINTF ((stderr, "Reading a token: ")); rules_char = YYLEX; } if (rules_char <= YYEOF) { rules_char = rules_token = YYEOF; YYDPRINTF ((stderr, "Now at end of input.\n")); } else { rules_token = YYTRANSLATE (rules_char); YYDSYMPRINTF ("Next token is", rules_token, &rules_lval, &rules_lloc); } /* If the proper action on seeing token YYTOKEN is to reduce or to detect an error, take that action. */ rules_n += rules_token; if (rules_n < 0 || YYLAST < rules_n || rules_check[rules_n] != rules_token) goto rules_default; rules_n = rules_table[rules_n]; if (rules_n <= 0) { if (rules_n == 0 || rules_n == YYTABLE_NINF) goto rules_errlab; rules_n = -rules_n; goto rules_reduce; } if (rules_n == YYFINAL) YYACCEPT; /* Shift the lookahead token. */ YYDPRINTF ((stderr, "Shifting token %s, ", rules_tname[rules_token])); /* Discard the token being shifted unless it is eof. */ if (rules_char != YYEOF) rules_char = YYEMPTY; *++rules_vsp = rules_lval; /* Count tokens shifted since error; after three, turn off error status. */ if (rules_errstatus) rules_errstatus--; rules_state = rules_n; goto rules_newstate; /*-----------------------------------------------------------. | rules_default -- do the default action for the current state. | `-----------------------------------------------------------*/ rules_default: rules_n = rules_defact[rules_state]; if (rules_n == 0) goto rules_errlab; goto rules_reduce; /*-----------------------------. | rules_reduce -- Do a reduction. | `-----------------------------*/ rules_reduce: /* rules_n is the number of a rule to reduce with. */ rules_len = rules_r2[rules_n]; /* If YYLEN is nonzero, implement the default value of the action: `$$ = $1'. Otherwise, the following line sets YYVAL to garbage. This behavior is undocumented and Bison users should not rely upon it. Assigning to YYVAL unconditionally makes the parser a bit smaller, and it avoids a GCC warning that YYVAL may be used uninitialized. */ rules_val = rules_vsp[1-rules_len]; YY_REDUCE_PRINT (rules_n); switch (rules_n) { case 2: #line 69 "rule-parse.y" { rule_matcher->AddRule(rules_vsp[0].rule); } break; case 4: #line 75 "rule-parse.y" { Location l(current_rule_file, rules_line_number+1, 0, 0, 0); current_rule = new Rule(rules_lval.str, l); } break; case 5: #line 80 "rule-parse.y" { rules_val.rule = current_rule; } break; case 8: #line 90 "rule-parse.y" { current_rule->AddHdrTest(new RuleHdrTest( RuleHdrTest::IP, 16, 4, (RuleHdrTest::Comp) rules_vsp[-1].val, rules_vsp[0].vallist)); } break; case 9: #line 97 "rule-parse.y" { // Works for both TCP and UDP current_rule->AddHdrTest(new RuleHdrTest( RuleHdrTest::TCP, 2, 2, (RuleHdrTest::Comp) rules_vsp[-1].val, rules_vsp[0].vallist)); } break; case 10: #line 104 "rule-parse.y" { current_rule->AddCondition(new RuleConditionEval(rules_vsp[0].str)); } break; case 11: #line 109 "rule-parse.y" { current_rule->AddHdrTest(rules_vsp[0].hdr_test); } break; case 12: #line 112 "rule-parse.y" { current_rule->AddCondition( new RuleConditionIPOptions(rules_vsp[0].val)); } break; case 13: #line 118 "rule-parse.y" { int proto = 0; switch ( rules_vsp[0].prot ) { case RuleHdrTest::ICMP: proto = 1; break; case RuleHdrTest::IP: proto = 0; break; case RuleHdrTest::TCP: proto = 6; break; case RuleHdrTest::UDP: proto = 17; break; default: rules_error("internal_error: unknown protocol"); } if ( proto ) { maskedvalue_list* vallist = new maskedvalue_list; MaskedValue* val = new MaskedValue(); val->val = proto; val->mask = 0xffffffff; vallist->append(val); current_rule->AddHdrTest(new RuleHdrTest( RuleHdrTest::IP, 9, 1, (RuleHdrTest::Comp) rules_vsp[-1].val, vallist)); } } break; case 14: #line 145 "rule-parse.y" { current_rule->AddHdrTest(new RuleHdrTest( RuleHdrTest::IP, 9, 1, (RuleHdrTest::Comp) rules_vsp[-1].val, rules_vsp[0].vallist)); } break; case 15: #line 152 "rule-parse.y" { current_rule->AddAction(new RuleActionEvent( rules_vsp[0].str )); } break; case 16: #line 155 "rule-parse.y" { current_rule->AddPattern(rules_vsp[0].str, rules_vsp[-1].ptype); } break; case 17: #line 158 "rule-parse.y" { if ( rules_vsp[-2].range.offset > 0 ) warn("Offsets are currently ignored for patterns"); current_rule->AddPattern(rules_vsp[0].str, rules_vsp[-4].ptype, 0, rules_vsp[-2].range.len); } break; case 18: #line 165 "rule-parse.y" { current_rule->AddCondition( new RuleConditionPayloadSize(rules_vsp[0].val, (RuleConditionPayloadSize::Comp) (rules_vsp[-1].val))); } break; case 19: #line 171 "rule-parse.y" { current_rule->AddRequires(rules_vsp[0].str, 0, 0); } break; case 20: #line 174 "rule-parse.y" { current_rule->AddRequires(rules_vsp[0].str, 0, 1); } break; case 21: #line 177 "rule-parse.y" { current_rule->AddRequires(rules_vsp[0].str, 1, 0); } break; case 22: #line 180 "rule-parse.y" { current_rule->AddRequires(rules_vsp[0].str, 1, 1); } break; case 23: #line 183 "rule-parse.y" { current_rule->AddCondition(new RuleConditionSameIP()); } break; case 24: #line 186 "rule-parse.y" { current_rule->AddHdrTest(new RuleHdrTest( RuleHdrTest::IP, 12, 4, (RuleHdrTest::Comp) rules_vsp[-1].val, rules_vsp[0].vallist)); } break; case 25: #line 193 "rule-parse.y" { // Works for both TCP and UDP current_rule->AddHdrTest(new RuleHdrTest( RuleHdrTest::TCP, 0, 2, (RuleHdrTest::Comp) rules_vsp[-1].val, rules_vsp[0].vallist)); } break; case 26: #line 200 "rule-parse.y" { current_rule->AddCondition(new RuleConditionTCPState(rules_vsp[0].val)); } break; case 27: #line 205 "rule-parse.y" { current_rule->SetActiveStatus(rules_vsp[0].bl); } break; case 28: #line 210 "rule-parse.y" { maskedvalue_list* vallist = new maskedvalue_list; MaskedValue* val = new MaskedValue(); val->val = rules_vsp[0].mval.val; val->mask = rules_vsp[-2].val; vallist->append(val); rules_val.hdr_test = new RuleHdrTest(rules_vsp[-7].prot, rules_vsp[-5].range.offset, rules_vsp[-5].range.len, (RuleHdrTest::Comp) rules_vsp[-1].val, vallist); } break; case 29: #line 223 "rule-parse.y" { rules_val.hdr_test = new RuleHdrTest(rules_vsp[-5].prot, rules_vsp[-3].range.offset, rules_vsp[-3].range.len, (RuleHdrTest::Comp) rules_vsp[-1].val, rules_vsp[0].vallist); } break; case 30: #line 231 "rule-parse.y" { rules_vsp[-2].vallist->append(new MaskedValue(rules_vsp[0].mval)); rules_val.vallist = rules_vsp[-2].vallist; } break; case 31: #line 233 "rule-parse.y" { id_to_maskedvallist(rules_vsp[0].str, rules_vsp[-2].vallist); rules_val.vallist = rules_vsp[-2].vallist; } break; case 32: #line 235 "rule-parse.y" { rules_val.vallist = new maskedvalue_list(); rules_val.vallist->append(new MaskedValue(rules_vsp[0].mval)); } break; case 33: #line 240 "rule-parse.y" { rules_val.vallist = new maskedvalue_list(); id_to_maskedvallist(rules_vsp[0].str, rules_val.vallist); } break; case 34: #line 248 "rule-parse.y" { rules_val.mval.val = rules_vsp[0].val; rules_val.mval.mask = 0xffffffff; } break; case 36: #line 254 "rule-parse.y" { rules_val.range = rules_vsp[0].range; } break; case 37: #line 256 "rule-parse.y" { rules_val.range.offset = 0; rules_val.range.len = rules_vsp[0].val; } break; case 38: #line 258 "rule-parse.y" { rules_val.range.offset = rules_vsp[-1].val; rules_val.range.len = UINT_MAX; } break; case 39: #line 263 "rule-parse.y" { rules_val.range.offset = rules_vsp[0].val; rules_val.range.len = 1; } break; case 40: #line 265 "rule-parse.y" { rules_val.range.offset = rules_vsp[-2].val; rules_val.range.len = rules_vsp[0].val; } break; case 41: #line 270 "rule-parse.y" { rules_val.val = rules_vsp[-2].val | rules_vsp[0].val; } break; case 42: #line 272 "rule-parse.y" { rules_val.val = rules_vsp[0].val; } break; case 43: #line 277 "rule-parse.y" { rules_val.val = rules_vsp[-2].val | rules_vsp[0].val; } break; case 44: #line 279 "rule-parse.y" { rules_val.val = rules_vsp[0].val; } break; case 45: #line 284 "rule-parse.y" { rules_val.val = rules_vsp[0].val; } break; case 46: #line 286 "rule-parse.y" { rules_val.val = id_to_uint(rules_vsp[0].str); } break; case 47: #line 291 "rule-parse.y" { rules_val.str = rules_vsp[0].str; } break; case 48: #line 293 "rule-parse.y" { rules_val.str = id_to_str(rules_vsp[0].str); } break; case 49: #line 298 "rule-parse.y" { rules_val.str = rules_vsp[0].str; } break; case 50: #line 300 "rule-parse.y" { rules_val.str = id_to_str(rules_vsp[0].str); } break; } /* Line 993 of yacc.c. */ #line 1431 "y.tab.c"  rules_vsp -= rules_len; rules_ssp -= rules_len; YY_STACK_PRINT (rules_ss, rules_ssp); *++rules_vsp = rules_val; /* Now `shift' the result of the reduction. Determine what state that goes to, based on the state we popped back to and the rule number reduced by. */ rules_n = rules_r1[rules_n]; rules_state = rules_pgoto[rules_n - YYNTOKENS] + *rules_ssp; if (0 <= rules_state && rules_state <= YYLAST && rules_check[rules_state] == *rules_ssp) rules_state = rules_table[rules_state]; else rules_state = rules_defgoto[rules_n - YYNTOKENS]; goto rules_newstate; /*------------------------------------. | rules_errlab -- here on detecting error | `------------------------------------*/ rules_errlab: /* If not already recovering from an error, report this error. */ if (!rules_errstatus) { ++rules_nerrs; #if YYERROR_VERBOSE rules_n = rules_pact[rules_state]; if (YYPACT_NINF < rules_n && rules_n < YYLAST) { YYSIZE_T rules_size = 0; int rules_type = YYTRANSLATE (rules_char); const char* rules_prefix; char *rules_msg; int rules_x; /* Start YYX at -YYN if negative to avoid negative indexes in YYCHECK. */ int rules_xbegin = rules_n < 0 ? -rules_n : 0; /* Stay within bounds of both rules_check and rules_tname. */ int rules_checklim = YYLAST - rules_n; int rules_xend = rules_checklim < YYNTOKENS ? rules_checklim : YYNTOKENS; int rules_count = 0; rules_prefix = ", expecting "; for (rules_x = rules_xbegin; rules_x < rules_xend; ++rules_x) if (rules_check[rules_x + rules_n] == rules_x && rules_x != YYTERROR) { rules_size += rules_strlen (rules_prefix) + rules_strlen (rules_tname [rules_x]); rules_count += 1; if (rules_count == 5) { rules_size = 0; break; } } rules_size += (sizeof ("syntax error, unexpected ") + rules_strlen (rules_tname[rules_type])); rules_msg = (char *) YYSTACK_ALLOC (rules_size); if (rules_msg != 0) { char *rules_p = rules_stpcpy (rules_msg, "syntax error, unexpected "); rules_p = rules_stpcpy (rules_p, rules_tname[rules_type]); if (rules_count < 5) { rules_prefix = ", expecting "; for (rules_x = rules_xbegin; rules_x < rules_xend; ++rules_x) if (rules_check[rules_x + rules_n] == rules_x && rules_x != YYTERROR) { rules_p = rules_stpcpy (rules_p, rules_prefix); rules_p = rules_stpcpy (rules_p, rules_tname[rules_x]); rules_prefix = " or "; } } rules_error (rules_msg); YYSTACK_FREE (rules_msg); } else rules_error ("syntax error; also virtual memory exhausted"); } else #endif /* YYERROR_VERBOSE */ rules_error ("syntax error"); } if (rules_errstatus == 3) { /* If just tried and failed to reuse lookahead token after an error, discard it. */ if (rules_char <= YYEOF) { /* If at end of input, pop the error token, then the rest of the stack, then return failure. */ if (rules_char == YYEOF) for (;;) { YYPOPSTACK; if (rules_ssp == rules_ss) YYABORT; YYDSYMPRINTF ("Error: popping", rules_stos[*rules_ssp], rules_vsp, rules_lsp); rules_destruct (rules_stos[*rules_ssp], rules_vsp); } } else { YYDSYMPRINTF ("Error: discarding", rules_token, &rules_lval, &rules_lloc); rules_destruct (rules_token, &rules_lval); rules_char = YYEMPTY; } } /* Else will try to reuse lookahead token after shifting the error token. */ goto rules_errlab1; /*---------------------------------------------------. | rules_errorlab -- error raised explicitly by YYERROR. | `---------------------------------------------------*/ rules_errorlab: #ifdef __GNUC__ /* Pacify GCC when the user code never invokes YYERROR and the label rules_errorlab therefore never appears in user code. */ if (0) goto rules_errorlab; #endif rules_vsp -= rules_len; rules_ssp -= rules_len; rules_state = *rules_ssp; goto rules_errlab1; /*-------------------------------------------------------------. | rules_errlab1 -- common code for both syntax error and YYERROR. | `-------------------------------------------------------------*/ rules_errlab1: rules_errstatus = 3; /* Each real token shifted decrements this. */ for (;;) { rules_n = rules_pact[rules_state]; if (rules_n != YYPACT_NINF) { rules_n += YYTERROR; if (0 <= rules_n && rules_n <= YYLAST && rules_check[rules_n] == YYTERROR) { rules_n = rules_table[rules_n]; if (0 < rules_n) break; } } /* Pop the current state because it cannot handle the error token. */ if (rules_ssp == rules_ss) YYABORT; YYDSYMPRINTF ("Error: popping", rules_stos[*rules_ssp], rules_vsp, rules_lsp); rules_destruct (rules_stos[rules_state], rules_vsp); YYPOPSTACK; rules_state = *rules_ssp; YY_STACK_PRINT (rules_ss, rules_ssp); } if (rules_n == YYFINAL) YYACCEPT; YYDPRINTF ((stderr, "Shifting error token, ")); *++rules_vsp = rules_lval; rules_state = rules_n; goto rules_newstate; /*-------------------------------------. | rules_acceptlab -- YYACCEPT comes here. | `-------------------------------------*/ rules_acceptlab: rules_result = 0; goto rules_return; /*-----------------------------------. | rules_abortlab -- YYABORT comes here. | `-----------------------------------*/ rules_abortlab: rules_result = 1; goto rules_return; #ifndef rules_overflow /*----------------------------------------------. | rules_overflowlab -- parser overflow comes here. | `----------------------------------------------*/ rules_overflowlab: rules_error ("parser stack overflow"); rules_result = 2; /* Fall through. */ #endif rules_return: #ifndef rules_overflow if (rules_ss != rules_ssa) YYSTACK_FREE (rules_ss); #endif return rules_result; }

int rules_wrap (  void   )

Definition at line 1680 of file rule-parse.cc. { return 1; }

---

Variable Documentation

const char* current_rule_file

Definition at line 34 of file RuleMatcher.h. Referenced by RuleMatcher::ReadFiles(), rules_error(), and rules_parse().

int rule_bench

Definition at line 22 of file RuleMatcher.h. Referenced by RuleMatcher::ClearEndpointState(), RuleMatcher::FinishEndpoint(), RuleMatcher::InitEndpoint(), main(), RE_Match_State::Match(), and RuleMatcher::Match().

RuleMatcher* rule_matcher

Definition at line 37 of file RuleMatcher.h. Referenced by TCP_Reassembler::BlockInserted(), Connection::ClearMatchState(), TCP_Endpoint::DataSent(), RuleActionEvent::DoAction(), RuleConditionEval::DoMatch(), Connection::FinishEndpointMatcher(), HTTP_Conn::HTTP_RequestLine(), Connection::InitEndpointMatcher(), ProfileLogger::Log(), main(), Connection::Match(), TCP_Reassembler::MatchUndelivered(), NetSessions::NewConn(), FingerConn::NewLine(), FTP_Conn::NewLine(), ICMP_Connection::NextPacket(), TCP_Connection::NextPacket(), UDP_Connection::NextPacket(), rules_error(), rules_parse(), and termination_signal().

FILE* rules_in

Definition at line 32 of file RuleMatcher.h. Referenced by RuleMatcher::ReadFiles().

int rules_line_number

Definition at line 33 of file RuleMatcher.h. Referenced by RuleMatcher::ReadFiles(), rules_error(), and rules_parse().

---