Feature #471 » 0002-bug-471-file_data-fast-pattern-unittests-added.patch
| src/detect-fast-pattern.c | ||
|---|---|---|
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest507(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; "
|
||
|
"content:\"three\"; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_NEGATED &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
|
ud->fp_chop_offset == 3 &&
|
||
|
ud->fp_chop_len == 4) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
/**
|
||
|
* \test Checks if a fast_pattern is registered in a Signature for uricontent.
|
||
|
*/
|
||
|
int DetectFastPatternTest508(void)
|
||
|
{
|
||
|
SigMatch *sm = NULL;
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; fast_pattern:only; "
|
||
|
"msg:\"Testing fast_pattern\"; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
result = 0;
|
||
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
|
||
|
if (sm != NULL) {
|
||
|
if ( ((DetectContentData *)sm->ctx)->flags &
|
||
|
DETECT_CONTENT_FAST_PATTERN) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
/**
|
||
|
* \test Checks if a fast_pattern is registered in a Signature for uricontent.
|
||
|
*/
|
||
|
int DetectFastPatternTest509(void)
|
||
|
{
|
||
|
SigMatch *sm = NULL;
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"oneoneone\"; fast_pattern:3,4; "
|
||
|
"msg:\"Testing fast_pattern\"; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
result = 0;
|
||
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
|
||
|
if (sm != NULL) {
|
||
|
if ( ((DetectContentData *)sm->ctx)->flags &
|
||
|
DETECT_CONTENT_FAST_PATTERN) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest510(void)
|
||
|
{
|
||
|
SigMatch *sm = NULL;
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; fast_pattern:only; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
|
||
|
if (sm == NULL) {
|
||
|
goto end;
|
||
|
}
|
||
|
DetectContentData *ud = sm->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
|
||
|
ud->fp_chop_offset == 0 &&
|
||
|
ud->fp_chop_len == 0) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest511(void)
|
||
|
{
|
||
|
SigMatch *sm = NULL;
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"oneoneone\"; fast_pattern:3,4; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
|
||
|
if (sm == NULL) {
|
||
|
goto end;
|
||
|
}
|
||
|
DetectContentData *ud = sm->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
|
ud->fp_chop_offset == 3 &&
|
||
|
ud->fp_chop_len == 4) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest512(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; fast_pattern:only; distance:10; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest513(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; distance:10; fast_pattern:only; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest514(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; fast_pattern:only; within:10; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest515(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; within:10; fast_pattern:only; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest516(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; fast_pattern:only; offset:10; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest517(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; offset:10; fast_pattern:only; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest518(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; fast_pattern:only; depth:10; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest519(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; depth:10; fast_pattern:only; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest520(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:!\"two\"; fast_pattern:only; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest521(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\" one\"; "
|
||
|
"content:\"two\"; distance:30; "
|
||
|
"content:\"two\"; fast_pattern:only; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
|
||
|
ud->fp_chop_offset == 0 &&
|
||
|
ud->fp_chop_len == 0) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest522(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; within:30; "
|
||
|
"content:\"two\"; fast_pattern:only; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
|
||
|
ud->fp_chop_offset == 0 &&
|
||
|
ud->fp_chop_len == 0) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest523(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; offset:30; "
|
||
|
"content:\"two\"; fast_pattern:only; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
|
||
|
ud->fp_chop_offset == 0 &&
|
||
|
ud->fp_chop_len == 0) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest524(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; depth:30; "
|
||
|
"content:\"two\"; fast_pattern:only; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
|
||
|
ud->fp_chop_offset == 0 &&
|
||
|
ud->fp_chop_len == 0) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest525(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:!\"one\"; fast_pattern; "
|
||
|
"content:\"two\"; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_NEGATED &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
|
||
|
ud->fp_chop_offset == 0 &&
|
||
|
ud->fp_chop_len == 0) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest526(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"two\"; "
|
||
|
"content:!\"one\"; fast_pattern; distance:20; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest527(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"two\"; "
|
||
|
"content:!\"one\"; fast_pattern; within:20; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest528(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"two\"; "
|
||
|
"content:!\"one\"; fast_pattern; offset:20; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest529(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"two\"; "
|
||
|
"content:!\"one\"; fast_pattern; depth:20; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest530(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; "
|
||
|
"content:\"three\"; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
|
ud->fp_chop_offset == 3 &&
|
||
|
ud->fp_chop_len == 4) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest531(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; "
|
||
|
"content:\"three\"; distance:30; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
|
ud->fp_chop_offset == 3 &&
|
||
|
ud->fp_chop_len == 4) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest532(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; "
|
||
|
"content:\"three\"; within:30; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
|
ud->fp_chop_offset == 3 &&
|
||
|
ud->fp_chop_len == 4) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest533(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; "
|
||
|
"content:\"three\"; offset:30; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
|
ud->fp_chop_offset == 3 &&
|
||
|
ud->fp_chop_len == 4) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest534(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; "
|
||
|
"content:\"three\"; depth:30; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
|
ud->fp_chop_offset == 3 &&
|
||
|
ud->fp_chop_len == 4) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest535(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; distance:10; "
|
||
|
"content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
|
ud->fp_chop_offset == 3 &&
|
||
|
ud->fp_chop_len == 4) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest536(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; within:10; "
|
||
|
"content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
|
ud->fp_chop_offset == 3 &&
|
||
|
ud->fp_chop_len == 4) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest537(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; offset:10; "
|
||
|
"content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
|
ud->fp_chop_offset == 3 &&
|
||
|
ud->fp_chop_len == 4) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest538(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; depth:10; "
|
||
|
"content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
|
ud->fp_chop_offset == 3 &&
|
||
|
ud->fp_chop_len == 4) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest539(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; fast_pattern:65977,4; "
|
||
|
"content:\"three\"; distance:10; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest540(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,65977; "
|
||
|
"content:\"three\"; distance:10; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest541(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:\"two\"; fast_pattern:65534,4; "
|
||
|
"content:\"three\"; distance:10; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest542(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; "
|
||
|
"content:\"three\"; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_NEGATED &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
|
ud->fp_chop_offset == 3 &&
|
||
|
ud->fp_chop_len == 4) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest543(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; distance:10; "
|
||
|
"content:\"three\"; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest544(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; within:10; "
|
||
|
"content:\"three\"; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest545(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; offset:10; "
|
||
|
"content:\"three\"; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest546(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; depth:10; "
|
||
|
"content:\"three\"; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
int DetectFastPatternTest547(void)
|
||
|
{
|
||
|
DetectEngineCtx *de_ctx = NULL;
|
||
|
int result = 0;
|
||
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
||
|
goto end;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(file_data; content:\"one\"; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; "
|
||
|
"content:\"three\"; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_NEGATED &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
|
ud->fp_chop_offset == 3 &&
|
||
|
ud->fp_chop_len == 4) {
|
||
|
result = 1;
|
||
|
} else {
|
||
|
result = 0;
|
||
|
}
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
#endif
|
||
|
void DetectFastPatternRegisterTests(void)
|
||
| ... | ... | |
|
UtRegisterTest("DetectFastPatternTest504", DetectFastPatternTest504, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest505", DetectFastPatternTest505, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest506", DetectFastPatternTest506, 1);
|
||
|
/* http_server_body fast_pattern tests ^ */
|
||
|
/* file_data fast_pattern tests v */
|
||
|
UtRegisterTest("DetectFastPatternTest507", DetectFastPatternTest507, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest508", DetectFastPatternTest508, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest509", DetectFastPatternTest509, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest510", DetectFastPatternTest510, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest511", DetectFastPatternTest511, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest512", DetectFastPatternTest512, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest513", DetectFastPatternTest513, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest514", DetectFastPatternTest514, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest515", DetectFastPatternTest515, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest516", DetectFastPatternTest516, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest517", DetectFastPatternTest517, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest518", DetectFastPatternTest518, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest519", DetectFastPatternTest519, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest520", DetectFastPatternTest520, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest521", DetectFastPatternTest521, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest522", DetectFastPatternTest522, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest523", DetectFastPatternTest523, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest524", DetectFastPatternTest524, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest525", DetectFastPatternTest525, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest526", DetectFastPatternTest526, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest527", DetectFastPatternTest527, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest528", DetectFastPatternTest528, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest529", DetectFastPatternTest529, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest530", DetectFastPatternTest530, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest531", DetectFastPatternTest531, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest532", DetectFastPatternTest532, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest533", DetectFastPatternTest533, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest534", DetectFastPatternTest534, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest535", DetectFastPatternTest535, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest536", DetectFastPatternTest536, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest537", DetectFastPatternTest537, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest538", DetectFastPatternTest538, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest539", DetectFastPatternTest539, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest540", DetectFastPatternTest540, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest541", DetectFastPatternTest541, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest542", DetectFastPatternTest542, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest543", DetectFastPatternTest543, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest544", DetectFastPatternTest544, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest545", DetectFastPatternTest545, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest546", DetectFastPatternTest546, 1);
|
||
|
UtRegisterTest("DetectFastPatternTest547", DetectFastPatternTest547, 1);
|
||
|
#endif
|
||
|
return;
|
||
- « Previous
- 1
- 2
- Next »