Feature #471 » 0001-bug-471-http-server-body-fast-pattern-unittests-adde.patch
| src/detect-fast-pattern.c | ||
|---|---|---|
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
|
||
|
"content:\"three\"; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
|
||
|
"content:\"three\"; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_NEGATED &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; fast_pattern:only; http_stat_code; "
|
||
|
"(content:\"one\"; fast_pattern:only; http_server_body; "
|
||
|
"msg:\"Testing fast_pattern\"; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
result = 0;
|
||
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSCDMATCH];
|
||
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
|
||
|
if (sm != NULL) {
|
||
|
if ( ((DetectContentData *)sm->ctx)->flags &
|
||
|
DETECT_CONTENT_FAST_PATTERN) {
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"oneoneone\"; fast_pattern:3,4; http_stat_code; "
|
||
|
"(content:\"oneoneone\"; fast_pattern:3,4; http_server_body; "
|
||
|
"msg:\"Testing fast_pattern\"; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
result = 0;
|
||
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSCDMATCH];
|
||
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
|
||
|
if (sm != NULL) {
|
||
|
if ( ((DetectContentData *)sm->ctx)->flags &
|
||
|
DETECT_CONTENT_FAST_PATTERN) {
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; fast_pattern:only; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; fast_pattern:only; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSCDMATCH];
|
||
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
|
||
|
if (sm == NULL) {
|
||
|
goto end;
|
||
|
}
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"oneoneone\"; fast_pattern:3,4; http_stat_code; sid:1;)");
|
||
|
"(content:\"oneoneone\"; fast_pattern:3,4; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSCDMATCH];
|
||
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
|
||
|
if (sm == NULL) {
|
||
|
goto end;
|
||
|
}
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; fast_pattern:only; http_stat_code; distance:10; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; fast_pattern:only; http_server_body; distance:10; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; distance:10; fast_pattern:only; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; distance:10; fast_pattern:only; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; fast_pattern:only; http_stat_code; within:10; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; fast_pattern:only; http_server_body; within:10; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; within:10; fast_pattern:only; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; within:10; fast_pattern:only; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; fast_pattern:only; http_stat_code; offset:10; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; fast_pattern:only; http_server_body; offset:10; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; offset:10; fast_pattern:only; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; offset:10; fast_pattern:only; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; fast_pattern:only; http_stat_code; depth:10; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; fast_pattern:only; http_server_body; depth:10; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; depth:10; fast_pattern:only; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; depth:10; fast_pattern:only; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:!\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:!\"two\"; fast_pattern:only; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\" one\"; http_stat_code; "
|
||
|
"content:\"two\"; http_stat_code; distance:30; "
|
||
|
"content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
|
||
|
"(content:\" one\"; http_server_body; "
|
||
|
"content:\"two\"; http_server_body; distance:30; "
|
||
|
"content:\"two\"; fast_pattern:only; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; http_stat_code; within:30; "
|
||
|
"content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; http_server_body; within:30; "
|
||
|
"content:\"two\"; fast_pattern:only; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; http_stat_code; offset:30; "
|
||
|
"content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; http_server_body; offset:30; "
|
||
|
"content:\"two\"; fast_pattern:only; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; http_stat_code; depth:30; "
|
||
|
"content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; http_server_body; depth:30; "
|
||
|
"content:\"two\"; fast_pattern:only; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:!\"one\"; fast_pattern; http_stat_code; "
|
||
|
"content:\"two\"; http_stat_code; sid:1;)");
|
||
|
"(content:!\"one\"; fast_pattern; http_server_body; "
|
||
|
"content:\"two\"; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_NEGATED &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"two\"; http_stat_code; "
|
||
|
"content:!\"one\"; fast_pattern; http_stat_code; distance:20; sid:1;)");
|
||
|
"(content:\"two\"; http_server_body; "
|
||
|
"content:!\"one\"; fast_pattern; http_server_body; distance:20; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"two\"; http_stat_code; "
|
||
|
"content:!\"one\"; fast_pattern; http_stat_code; within:20; sid:1;)");
|
||
|
"(content:\"two\"; http_server_body; "
|
||
|
"content:!\"one\"; fast_pattern; http_server_body; within:20; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"two\"; http_stat_code; "
|
||
|
"content:!\"one\"; fast_pattern; http_stat_code; offset:20; sid:1;)");
|
||
|
"(content:\"two\"; http_server_body; "
|
||
|
"content:!\"one\"; fast_pattern; http_server_body; offset:20; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"two\"; http_stat_code; "
|
||
|
"content:!\"one\"; fast_pattern; http_stat_code; depth:20; sid:1;)");
|
||
|
"(content:\"two\"; http_server_body; "
|
||
|
"content:!\"one\"; fast_pattern; http_server_body; depth:20; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
|
||
|
"content:\"three\"; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
|
||
|
"content:\"three\"; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
|
||
|
"content:\"three\"; http_stat_code; distance:30; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
|
||
|
"content:\"three\"; http_server_body; distance:30; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
|
||
|
"content:\"three\"; http_stat_code; within:30; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
|
||
|
"content:\"three\"; http_server_body; within:30; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
|
||
|
"content:\"three\"; http_stat_code; offset:30; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
|
||
|
"content:\"three\"; http_server_body; offset:30; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
|
||
|
"content:\"three\"; http_stat_code; depth:30; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
|
||
|
"content:\"three\"; http_server_body; depth:30; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; http_stat_code; distance:10; "
|
||
|
"content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; http_server_body; distance:10; "
|
||
|
"content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; http_stat_code; within:10; "
|
||
|
"content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; http_server_body; within:10; "
|
||
|
"content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; http_stat_code; offset:10; "
|
||
|
"content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; http_server_body; offset:10; "
|
||
|
"content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; http_stat_code; depth:10; "
|
||
|
"content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; http_server_body; depth:10; "
|
||
|
"content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; fast_pattern:65977,4; http_stat_code; "
|
||
|
"content:\"three\"; http_stat_code; distance:10; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; fast_pattern:65977,4; http_server_body; "
|
||
|
"content:\"three\"; http_server_body; distance:10; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,65977; http_stat_code; "
|
||
|
"content:\"three\"; distance:10; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"oneonetwo\"; fast_pattern:3,65977; http_server_body; "
|
||
|
"content:\"three\"; distance:10; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:\"two\"; fast_pattern:65534,4; http_stat_code; "
|
||
|
"content:\"three\"; http_stat_code; distance:10; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:\"two\"; fast_pattern:65534,4; http_server_body; "
|
||
|
"content:\"three\"; http_server_body; distance:10; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
|
||
|
"content:\"three\"; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
|
||
|
"content:\"three\"; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_NEGATED &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; distance:10; "
|
||
|
"content:\"three\"; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; distance:10; "
|
||
|
"content:\"three\"; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; within:10; "
|
||
|
"content:\"three\"; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; within:10; "
|
||
|
"content:\"three\"; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; offset:10; "
|
||
|
"content:\"three\"; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; offset:10; "
|
||
|
"content:\"three\"; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; depth:10; "
|
||
|
"content:\"three\"; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; depth:10; "
|
||
|
"content:\"three\"; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
| ... | ... | |
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
|
||
|
"(content:\"one\"; http_stat_code; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
|
||
|
"content:\"three\"; http_stat_code; sid:1;)");
|
||
|
"(content:\"one\"; http_server_body; "
|
||
|
"content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
|
||
|
"content:\"three\"; http_server_body; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL)
|
||
|
goto end;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
|
||
|
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
|
||
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
||
|
ud->flags & DETECT_CONTENT_NEGATED &&
|
||
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
||