@ -2011,7 +2010,6 @@ static int UriTestSig16(void)
f.protoctx=(void*)&ssn;
f.proto=IPPROTO_TCP;
f.flags|=FLOW_IPV4;
p->flow=&f;
p->flags|=PKT_HAS_FLOW|PKT_STREAM_EST;
p->flowflags|=FLOW_PKT_TOSERVER;
@ -2021,87 +2019,49 @@ static int UriTestSig16(void)
StreamTcpInitConfig(TRUE);
DetectEngineCtx*de_ctx=DetectEngineCtxInit();
if(de_ctx==NULL){
gotoend;
}
FAIL_IF_NULL(de_ctx);
de_ctx->flags|=DE_QUIET;
s=de_ctx->sig_list=SigInit(de_ctx,"drop tcp any any -> any any (msg:\"ET TROJAN Downadup/Conficker A or B Worm reporting\"; flow:to_server,established; uricontent:\"/search?q=\"; pcre:\"/^\\/search\\?q=[0-9]{1,3}(&aq=7(\\?[0-9a-f]{8})?)?/U\"; pcre:\"/\\x0d\\x0aHost\\: \\d+\\.\\d+\\.\\d+\\.\\d+\\x0d\\x0a/\"; sid:2009024; rev:9;)");