Project

General

Profile

Bug #8 » 0001-failing-unit-test-where-fast_pattern-rule-and-non-fa.patch

unit test patch against 746d12071e68dd0bbd2f5f4e0823b9f401e61e16 - Will Metcalf, 11/12/2009 11:14 AM

View differences:

src/detect-fast-pattern.c
#include "eidps-common.h"
#include "detect.h"
#include "flow.h"
#include "detect-content.h"
#include "detect-parse.h"
#include "detect-engine.h"
......
return result;
}
/**
* \test Checks to make sure that other sigs work that should when fast_pattern is inspecting on the same payload
*
*/
int DetectFastPatternTest14(void)
{
uint8_t *buf = (uint8_t *) "Dummy is our name. Oh yes. From right here "
"right now, all the way to hangover. right. strings5_imp now here "
"comes our dark knight strings_string5. Yes here is our dark knight";
uint16_t buflen = strlen((char *)buf);
Packet p;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int alertcnt = 0;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(&p, 0, sizeof(p));
p.src.family = AF_INET;
p.dst.family = AF_INET;
p.payload = buf;
p.payload_len = buflen;
p.proto = IPPROTO_TCP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
FlowInitConfig(FLOW_QUIET);
de_ctx->mpm_matcher = MPM_B3G;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"fast_pattern test\"; content:\"strings_string5\"; content:\"knight\"; fast_pattern; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"test different content\"; content:\"Dummy is our name\"; sid:2;)");
if (de_ctx->sig_list->next == NULL)
goto end;
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, &p);
if (PacketAlertCheck(&p, 1)){
alertcnt++;
}else{
SCLogInfo("could not match on sig 1 with when fast_pattern is inspecting payload");
goto end;
}
if (PacketAlertCheck(&p, 2)){
result = 1;
}else{
SCLogInfo("match on sig 1 fast_pattern no match sig 2 inspecting same payload");
}
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
end:
DetectEngineCtxFree(de_ctx);
return result;
}
#endif
void DetectFastPatternRegisterTests(void)
......
UtRegisterTest("DetectFastPatternTest11", DetectFastPatternTest11, 1);
UtRegisterTest("DetectFastPatternTest12", DetectFastPatternTest12, 1);
UtRegisterTest("DetectFastPatternTest13", DetectFastPatternTest13, 1);
UtRegisterTest("DetectFastPatternTest14", DetectFastPatternTest14, 1);
#endif
(1-1/2)