diff --git a/src/detect-content.c b/src/detect-content.c index 8162a92dff..ef81f38e21 100644 --- a/src/detect-content.c +++ b/src/detect-content.c @@ -40,6 +40,7 @@ #include "util-debug.h" #include "util-spm-bm.h" #include "threads.h" +#include "util-unittest-helper.h" int DetectContentMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *); static int DetectContentSetup (DetectEngineCtx *, Signature *, char *); @@ -1541,6 +1542,55 @@ static int SigTest75TestNegatedContent(void) return SigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"USER\"; content:\"!PASS\"; sid:1;)", (uint8_t *)"USER !PASS"); } +static int SigTest76TestBug134(void) +{ + uint8_t *buf = (uint8_t *)"test detect ${IFS} in traffic"; + uint16_t buflen = strlen((char *)buf); + Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); + int result = 0; + + p->dp = 515; + p->flowflags |= FLOW_PKT_ESTABLISHED; + p->flowflags |= FLOW_PKT_TOSERVER; + char sig[] = "alert tcp any any -> any 515 " + "(msg:\"detect IFS\"; flow:to_server,established; content:\"${IFS}\";" + " depth:50; offset:0; sid:900091; rev:1;)"; + if (UTHPacketMatchSigMpm(p, sig, MPM_B2G) == 0) { + result = 0; + goto end; + } + + result = 1; +end: + if (p != NULL) + UTHFreePacket(p); + return result; +} + +static int SigTest77TestBug139(void) +{ + uint8_t buf[] = { + 0x12, 0x23, 0x34, 0x35, 0x52, 0x52, 0x24, 0x42, 0x22, 0x24, + 0x52, 0x24, 0x82, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x34 }; + uint16_t buflen = sizeof(buf); + Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_UDP); + int result = 0; + + p->dp = 53; + char sig[] = "alert udp any any -> any 53 (msg:\"dns testing\";" + " content:\"|00 00|\"; depth:5; offset:13; sid:9436601;" + " rev:1;)"; + if (UTHPacketMatchSigMpm(p, sig, MPM_B2G) == 0) { + result = 0; + goto end; + } + + result = 1; +end: + if (p != NULL) + UTHFreePacket(p); + return result; +} #endif /* UNITTESTS */ /** @@ -1617,5 +1667,8 @@ void DetectContentRegisterTests(void) UtRegisterTest("SigTest74TestNegatedContent", SigTest74TestNegatedContent, 1); UtRegisterTest("SigTest75TestNegatedContent", SigTest75TestNegatedContent, 1); + UtRegisterTest("SigTest76TestBug134", SigTest76TestBug134, 1); + UtRegisterTest("SigTest77TestBug139", SigTest77TestBug139, 1); + #endif /* UNITTESTS */ } diff --git a/src/detect-parse.c b/src/detect-parse.c index 1f55ee6b1a..b7c5623177 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -555,9 +555,9 @@ static int SigParseActionRejectValidate(const char *action) { /** * \brief Parses the action that has been used by the Signature and allots it - * to its Signatue instance. + * to its Signature instance. * - * \param s Pointer to the Signatue instance to which the action belongs. + * \param s Pointer to the Signature instance to which the action belongs. * \param action Pointer to the action string used by the Signature. * * \retval 0 On successfully parsing the action string and adding it to the diff --git a/src/detect.c b/src/detect.c index 3601ea6ceb..04ec3ca5ef 100644 --- a/src/detect.c +++ b/src/detect.c @@ -787,7 +787,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh /* so now let's iterate the alerts and remove the ones after a pass rule * matched (if any) */ end: - SCLogDebug("(p->action & ation pass)) = %"PRIu8, (p->action & ACTION_PASS)); + SCLogDebug("(p->action & action pass)) = %"PRIu8, (p->action & ACTION_PASS)); for (i = 0; i < p->alerts.cnt; i++) { SCLogDebug("Sig->num: %"PRIu16, p->alerts.alerts[i].num); s = de_ctx->sig_array[p->alerts.alerts[i].num];