aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: fix file_data / http_server_body tests

Browse Source
pull/2559/head
Victor Julien 9 years ago
parent faadec0d7f
commit 99580487e5
2 changed files with 653 additions and 702 deletions
Show Stats Download Patch File Download Diff File

1275
src/detect-fast-pattern.c
View File

File diff suppressed because it is too large Load Diff

80
src/detect-http-server-body.c
Unescape Escape View File

@ -1802,7 +1802,7 @@ int DetectHttpServerBodyTest22(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(content:\"one\"; content:\"two\"; http_server_body; "
"content:\"three\"; distance:10; http_server_body; content:\"four\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
@ -1857,7 +1857,7 @@ int DetectHttpServerBodyTest23(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(content:\"one\"; http_server_body; pcre:/two/; "
"content:\"three\"; distance:10; http_server_body; content:\"four\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
@ -1911,7 +1911,7 @@ int DetectHttpServerBodyTest24(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(content:\"one\"; http_server_body; pcre:/two/; "
"content:\"three\"; distance:10; within:15; http_server_body; content:\"four\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
@ -1965,7 +1965,7 @@ int DetectHttpServerBodyTest25(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(content:\"one\"; http_server_body; pcre:/two/; "
"content:\"three\"; distance:10; http_server_body; "
"content:\"four\"; distance:10; sid:1;)");
@ -2021,7 +2021,7 @@ int DetectHttpServerBodyTest26(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(content:\"one\"; offset:10; http_server_body; pcre:/two/; "
"content:\"three\"; distance:10; http_server_body; within:10; "
"content:\"four\"; distance:10; sid:1;)");
@ -2078,7 +2078,7 @@ int DetectHttpServerBodyTest27(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(content:\"one\"; offset:10; http_server_body; pcre:/two/; distance:10; "
"content:\"three\"; distance:10; http_server_body; depth:10; "
"content:\"four\"; distance:10; sid:1;)");
@ -2104,7 +2104,7 @@ int DetectHttpServerBodyTest28(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(content:\"one\"; http_server_body; pcre:/two/; "
"content:\"three\"; http_server_body; depth:10; "
"content:\"four\"; distance:10; sid:1;)");
@ -2160,7 +2160,7 @@ int DetectHttpServerBodyTest29(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(content:\"one\"; http_server_body; "
"content:\"two\"; distance:0; http_server_body; sid:1;)");
if (de_ctx->sig_list == NULL) {
@ -2204,7 +2204,7 @@ int DetectHttpServerBodyTest30(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(content:\"one\"; http_server_body; "
"content:\"two\"; within:5; http_server_body; sid:1;)");
if (de_ctx->sig_list == NULL) {
@ -2248,7 +2248,7 @@ int DetectHttpServerBodyTest31(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(content:\"one\"; within:5; http_server_body; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("de_ctx->sig_list == NULL\n");
@ -2272,7 +2272,7 @@ int DetectHttpServerBodyTest32(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(content:\"one\"; http_server_body; within:5; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("de_ctx->sig_list == NULL\n");
@ -2296,7 +2296,7 @@ int DetectHttpServerBodyTest33(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(content:\"one\"; within:5; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("de_ctx->sig_list == NULL\n");
@ -2320,7 +2320,7 @@ int DetectHttpServerBodyTest34(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(pcre:/one/Q; "
"content:\"two\"; within:5; http_server_body; sid:1;)");
if (de_ctx->sig_list == NULL) {
@ -2371,7 +2371,7 @@ int DetectHttpServerBodyTest35(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(content:\"two\"; http_server_body; "
"pcre:/one/QR; sid:1;)");
if (de_ctx->sig_list == NULL) {
@ -2422,7 +2422,7 @@ int DetectHttpServerBodyTest36(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(pcre:/one/Q; "
"content:\"two\"; distance:5; http_server_body; sid:1;)");
if (de_ctx->sig_list == NULL) {
@ -2490,7 +2490,6 @@ static int DetectHttpServerBodyFileDataTest01(void)
"\r\n"
"message";
uint32_t http_len2 = sizeof(http_buf2) - 1;
int result = 0;
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
memset(&th_v, 0, sizeof(th_v));
@ -2513,74 +2512,43 @@ static int DetectHttpServerBodyFileDataTest01(void)
StreamTcpInitConfig(TRUE);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
"(msg:\"http server body test\"; "
"file_data; content:\"message\"; "
"sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
FAIL_IF_NULL(de_ctx->sig_list);
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
STREAM_TOSERVER | STREAM_START | STREAM_EOF,
http_buf,
http_len);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FAIL_IF(r != 0);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
STREAM_TOCLIENT | STREAM_START | STREAM_EOF,
http_buf2,
http_len2);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);
http_state = f.alstate;
if (http_state == NULL) {
printf("no http state: \n");
result = 0;
goto end;
}
FAIL_IF_NULL(http_state);
/* do detect */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (!(PacketAlertCheck(p, 1))) {
printf("sid 1 didn't match but should have: ");
goto end;
}
FAIL_IF(!(PacketAlertCheck(p, 1)));
result = 1;
end:
if (alp_tctx != NULL)
AppLayerParserThreadCtxFree(alp_tctx);
if (de_ctx != NULL)
SigGroupCleanup(de_ctx);
if (de_ctx != NULL)
SigCleanSignatures(de_ctx);
if (de_ctx != NULL)
DetectEngineCtxFree(de_ctx);
AppLayerParserThreadCtxFree(alp_tctx);
DetectEngineCtxFree(de_ctx);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
UTHFreePackets(&p, 1);
return result;
PASS;
}
/**

Write Preview
Loading…
Cancel
Save