From f1f5574fa7e6fb66cd2639101512ce66a08fadb4 Mon Sep 17 00:00:00 2001 From: Anoop Saldanha Date: Fri, 3 Feb 2012 18:55:34 +0530 Subject: [PATCH 1/2] Use SigInitReal() instead of SigInit() in raw uri tests. This should show that we have unittests failing, thus highlighting bug 411. The next commit is the fix for this bug --- src/detect-engine-hrud.c | 60 +++++++++++++++++++++++----------------------- 1 files changed, 30 insertions(+), 30 deletions(-) diff --git a/src/detect-engine-hrud.c b/src/detect-engine-hrud.c index 58d3e8b..d9e5bc1 100644 --- a/src/detect-engine-hrud.c +++ b/src/detect-engine-hrud.c @@ -518,7 +518,7 @@ static int DetectEngineHttpRawUriTest01(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"../c/./d\"; http_raw_uri; " "sid:1;)"); @@ -632,7 +632,7 @@ static int DetectEngineHttpRawUriTest02(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"/c/./d\"; http_raw_uri; offset:5; " "sid:1;)"); @@ -735,7 +735,7 @@ static int DetectEngineHttpRawUriTest03(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"/a/b\"; http_raw_uri; offset:10; " "sid:1;)"); @@ -853,7 +853,7 @@ static int DetectEngineHttpRawUriTest04(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:!\"/a/b\"; http_raw_uri; offset:10; " "sid:1;)"); @@ -970,7 +970,7 @@ static int DetectEngineHttpRawUriTest05(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"a/b\"; http_raw_uri; depth:10; " "sid:1;)"); @@ -1087,7 +1087,7 @@ static int DetectEngineHttpRawUriTest06(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:!\"/a/b\"; http_raw_uri; depth:25; " "sid:1;)"); @@ -1204,7 +1204,7 @@ static int DetectEngineHttpRawUriTest07(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:!\"/c/./d\"; http_raw_uri; depth:12; " "sid:1;)"); @@ -1321,7 +1321,7 @@ static int DetectEngineHttpRawUriTest08(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:!\"/c/./d\"; http_raw_uri; depth:18; " "sid:1;)"); @@ -1438,7 +1438,7 @@ static int DetectEngineHttpRawUriTest09(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"/a\"; http_raw_uri; " "content:\"./c/.\"; http_raw_uri; within:9; " @@ -1556,7 +1556,7 @@ static int DetectEngineHttpRawUriTest10(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"/a\"; http_raw_uri; " "content:!\"boom\"; http_raw_uri; within:5; " @@ -1674,7 +1674,7 @@ static int DetectEngineHttpRawUriTest11(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"./a\"; http_raw_uri; " "content:\"boom\"; http_raw_uri; within:5; " @@ -1792,7 +1792,7 @@ static int DetectEngineHttpRawUriTest12(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"./a\"; http_raw_uri; " "content:!\"/b/..\"; http_raw_uri; within:5; " @@ -1910,7 +1910,7 @@ static int DetectEngineHttpRawUriTest13(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"./a\"; http_raw_uri; " "content:\"/c/.\"; http_raw_uri; distance:5; " @@ -2028,7 +2028,7 @@ static int DetectEngineHttpRawUriTest14(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"./a\"; http_raw_uri; " "content:!\"b/..\"; http_raw_uri; distance:5; " @@ -2146,7 +2146,7 @@ static int DetectEngineHttpRawUriTest15(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"./a\"; http_raw_uri; " "content:\"/c/\"; http_raw_uri; distance:7; " @@ -2264,7 +2264,7 @@ static int DetectEngineHttpRawUriTest16(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"./a\"; http_raw_uri; " "content:!\"/c/\"; http_raw_uri; distance:4; " @@ -2365,7 +2365,7 @@ static int DetectEngineHttpRawUriTest17(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"body1\"; http_raw_uri; " "content:\"bambu\"; http_raw_uri; " @@ -2436,7 +2436,7 @@ static int DetectEngineHttpRawUriTest18(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"body1\"; http_raw_uri; " "content:\"bambu\"; http_raw_uri; fast_pattern; " @@ -2507,7 +2507,7 @@ static int DetectEngineHttpRawUriTest19(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"bambu\"; http_raw_uri; " "content:\"is\"; http_raw_uri; " @@ -2578,7 +2578,7 @@ static int DetectEngineHttpRawUriTest20(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"bambu\"; http_raw_uri; " "content:\"is\"; http_raw_uri; fast_pattern; " @@ -2666,7 +2666,7 @@ static int DetectEngineHttpRawUriTest21(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:!\"/c/\"; http_raw_uri; within:5; " @@ -2784,7 +2784,7 @@ static int DetectEngineHttpRawUriTest22(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:!\"/c/\"; within:5; http_raw_uri; " @@ -2902,7 +2902,7 @@ static int DetectEngineHttpRawUriTest23(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:!\"/c/\"; distance:3; http_raw_uri; " @@ -3020,7 +3020,7 @@ static int DetectEngineHttpRawUriTest24(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:!\"/c/\"; distance:10; http_raw_uri; " @@ -3138,7 +3138,7 @@ static int DetectEngineHttpRawUriTest25(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:\"/c/\"; within:10; http_raw_uri; " @@ -3256,7 +3256,7 @@ static int DetectEngineHttpRawUriTest26(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:\"/c/\"; within:5; http_raw_uri; " @@ -3374,7 +3374,7 @@ static int DetectEngineHttpRawUriTest27(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:\"/c/\"; distance:5; http_raw_uri; " @@ -3492,7 +3492,7 @@ static int DetectEngineHttpRawUriTest28(void) de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:\"/c/\"; distance:10; http_raw_uri; " @@ -3598,7 +3598,7 @@ static int DetectEngineHttpRawUriTest29(void) de_ctx->mpm_matcher = MPM_B2G; de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative raw uri contents\"; " "content:\"/c/\"; http_raw_uri; " "isdataat:4,relative; sid:1;)"); @@ -3686,7 +3686,7 @@ static int DetectEngineHttpRawUriTest30(void) de_ctx->mpm_matcher = MPM_B2G; de_ctx->flags |= DE_QUIET; - de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " + de_ctx->sig_list = SigInitReal(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative raw uri contents\"; " "uricontent:\"/c/\"; isdataat:!10,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { -- 1.7.1