Project

General

Profile

Feature #471 » 0002-bug-471-file_data-fast-pattern-unittests-added.patch

Anoop Saldanha, 06/06/2012 09:32 AM

View differences:

src/detect-fast-pattern.c
return result;
}
int DetectFastPatternTest507(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:!\"oneonetwo\"; fast_pattern:3,4; "
"content:\"three\"; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_NEGATED &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
/**
* \test Checks if a fast_pattern is registered in a Signature for uricontent.
*/
int DetectFastPatternTest508(void)
{
SigMatch *sm = NULL;
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; fast_pattern:only; "
"msg:\"Testing fast_pattern\"; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
result = 0;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
if (sm != NULL) {
if ( ((DetectContentData *)sm->ctx)->flags &
DETECT_CONTENT_FAST_PATTERN) {
result = 1;
} else {
result = 0;
}
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
/**
* \test Checks if a fast_pattern is registered in a Signature for uricontent.
*/
int DetectFastPatternTest509(void)
{
SigMatch *sm = NULL;
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"oneoneone\"; fast_pattern:3,4; "
"msg:\"Testing fast_pattern\"; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
result = 0;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
if (sm != NULL) {
if ( ((DetectContentData *)sm->ctx)->flags &
DETECT_CONTENT_FAST_PATTERN) {
result = 1;
} else {
result = 0;
}
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest510(void)
{
SigMatch *sm = NULL;
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
if (sm == NULL) {
goto end;
}
DetectContentData *ud = sm->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest511(void)
{
SigMatch *sm = NULL;
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"oneoneone\"; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
if (sm == NULL) {
goto end;
}
DetectContentData *ud = sm->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest512(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; fast_pattern:only; distance:10; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest513(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; distance:10; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest514(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; fast_pattern:only; within:10; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest515(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; within:10; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest516(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; fast_pattern:only; offset:10; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest517(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; offset:10; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest518(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; fast_pattern:only; depth:10; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest519(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; depth:10; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest520(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:!\"two\"; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest521(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\" one\"; "
"content:\"two\"; distance:30; "
"content:\"two\"; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest522(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; within:30; "
"content:\"two\"; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest523(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; offset:30; "
"content:\"two\"; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest524(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; depth:30; "
"content:\"two\"; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest525(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:!\"one\"; fast_pattern; "
"content:\"two\"; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_NEGATED &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest526(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"two\"; "
"content:!\"one\"; fast_pattern; distance:20; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest527(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"two\"; "
"content:!\"one\"; fast_pattern; within:20; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest528(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"two\"; "
"content:!\"one\"; fast_pattern; offset:20; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest529(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"two\"; "
"content:!\"one\"; fast_pattern; depth:20; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest530(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"oneonetwo\"; fast_pattern:3,4; "
"content:\"three\"; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest531(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"oneonetwo\"; fast_pattern:3,4; "
"content:\"three\"; distance:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest532(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"oneonetwo\"; fast_pattern:3,4; "
"content:\"three\"; within:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest533(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"oneonetwo\"; fast_pattern:3,4; "
"content:\"three\"; offset:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest534(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"oneonetwo\"; fast_pattern:3,4; "
"content:\"three\"; depth:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest535(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; distance:10; "
"content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest536(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; within:10; "
"content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest537(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; offset:10; "
"content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest538(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; depth:10; "
"content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
} else {
result = 0;
}
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest539(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; fast_pattern:65977,4; "
"content:\"three\"; distance:10; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest540(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"oneonetwo\"; fast_pattern:3,65977; "
"content:\"three\"; distance:10; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest541(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:\"two\"; fast_pattern:65534,4; "
"content:\"three\"; distance:10; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest542(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:!\"oneonetwo\"; fast_pattern:3,4; "
"content:\"three\"; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_NEGATED &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest543(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:!\"oneonetwo\"; fast_pattern:3,4; distance:10; "
"content:\"three\"; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest544(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:!\"oneonetwo\"; fast_pattern:3,4; within:10; "
"content:\"three\"; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest545(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:!\"oneonetwo\"; fast_pattern:3,4; offset:10; "
"content:\"three\"; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest546(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:!\"oneonetwo\"; fast_pattern:3,4; depth:10; "
"content:\"three\"; sid:1;)");
if (de_ctx->sig_list != NULL)
goto end;
result = 1;
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
int DetectFastPatternTest547(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(file_data; content:\"one\"; "
"content:!\"oneonetwo\"; fast_pattern:3,4; "
"content:\"three\"; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_NEGATED &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
} else {
result = 0;
}
end:
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
#endif
void DetectFastPatternRegisterTests(void)
......
UtRegisterTest("DetectFastPatternTest504", DetectFastPatternTest504, 1);
UtRegisterTest("DetectFastPatternTest505", DetectFastPatternTest505, 1);
UtRegisterTest("DetectFastPatternTest506", DetectFastPatternTest506, 1);
/* http_server_body fast_pattern tests ^ */
/* file_data fast_pattern tests v */
UtRegisterTest("DetectFastPatternTest507", DetectFastPatternTest507, 1);
UtRegisterTest("DetectFastPatternTest508", DetectFastPatternTest508, 1);
UtRegisterTest("DetectFastPatternTest509", DetectFastPatternTest509, 1);
UtRegisterTest("DetectFastPatternTest510", DetectFastPatternTest510, 1);
UtRegisterTest("DetectFastPatternTest511", DetectFastPatternTest511, 1);
UtRegisterTest("DetectFastPatternTest512", DetectFastPatternTest512, 1);
UtRegisterTest("DetectFastPatternTest513", DetectFastPatternTest513, 1);
UtRegisterTest("DetectFastPatternTest514", DetectFastPatternTest514, 1);
UtRegisterTest("DetectFastPatternTest515", DetectFastPatternTest515, 1);
UtRegisterTest("DetectFastPatternTest516", DetectFastPatternTest516, 1);
UtRegisterTest("DetectFastPatternTest517", DetectFastPatternTest517, 1);
UtRegisterTest("DetectFastPatternTest518", DetectFastPatternTest518, 1);
UtRegisterTest("DetectFastPatternTest519", DetectFastPatternTest519, 1);
UtRegisterTest("DetectFastPatternTest520", DetectFastPatternTest520, 1);
UtRegisterTest("DetectFastPatternTest521", DetectFastPatternTest521, 1);
UtRegisterTest("DetectFastPatternTest522", DetectFastPatternTest522, 1);
UtRegisterTest("DetectFastPatternTest523", DetectFastPatternTest523, 1);
UtRegisterTest("DetectFastPatternTest524", DetectFastPatternTest524, 1);
UtRegisterTest("DetectFastPatternTest525", DetectFastPatternTest525, 1);
UtRegisterTest("DetectFastPatternTest526", DetectFastPatternTest526, 1);
UtRegisterTest("DetectFastPatternTest527", DetectFastPatternTest527, 1);
UtRegisterTest("DetectFastPatternTest528", DetectFastPatternTest528, 1);
UtRegisterTest("DetectFastPatternTest529", DetectFastPatternTest529, 1);
UtRegisterTest("DetectFastPatternTest530", DetectFastPatternTest530, 1);
UtRegisterTest("DetectFastPatternTest531", DetectFastPatternTest531, 1);
UtRegisterTest("DetectFastPatternTest532", DetectFastPatternTest532, 1);
UtRegisterTest("DetectFastPatternTest533", DetectFastPatternTest533, 1);
UtRegisterTest("DetectFastPatternTest534", DetectFastPatternTest534, 1);
UtRegisterTest("DetectFastPatternTest535", DetectFastPatternTest535, 1);
UtRegisterTest("DetectFastPatternTest536", DetectFastPatternTest536, 1);
UtRegisterTest("DetectFastPatternTest537", DetectFastPatternTest537, 1);
UtRegisterTest("DetectFastPatternTest538", DetectFastPatternTest538, 1);
UtRegisterTest("DetectFastPatternTest539", DetectFastPatternTest539, 1);
UtRegisterTest("DetectFastPatternTest540", DetectFastPatternTest540, 1);
UtRegisterTest("DetectFastPatternTest541", DetectFastPatternTest541, 1);
UtRegisterTest("DetectFastPatternTest542", DetectFastPatternTest542, 1);
UtRegisterTest("DetectFastPatternTest543", DetectFastPatternTest543, 1);
UtRegisterTest("DetectFastPatternTest544", DetectFastPatternTest544, 1);
UtRegisterTest("DetectFastPatternTest545", DetectFastPatternTest545, 1);
UtRegisterTest("DetectFastPatternTest546", DetectFastPatternTest546, 1);
UtRegisterTest("DetectFastPatternTest547", DetectFastPatternTest547, 1);
#endif
return;
(2-2/2)