aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/content: use list util in tests; cleanups

Browse Source
pull/8732/head
Victor Julien 2 years ago
parent b4c7a76194
commit 9e098020c9
1 changed files with 77 additions and 134 deletions
Show Stats Download Patch File Download Diff File

187
src/detect-content.c
Unescape Escape View File

@ -1453,34 +1453,26 @@ end:
*/ */
static int DetectContentParseTest18(void) static int DetectContentParseTest18(void)
{ {
Signature *s = SigAlloc();
int result = 1;
DetectEngineCtx *de_ctx = DetectEngineCtxInit(); DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) { FAIL_IF_NULL(de_ctx);
result = 0;
goto end;
}
if (DetectSignatureSetAppProto(s, ALPROTO_DCERPC) < 0)
goto end;
result &= (DetectContentSetup(de_ctx, s, "one") == 0);
result &= (s->sm_lists[g_dce_stub_data_buffer_id] == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL);
Signature *s = SigAlloc();
FAIL_IF_NULL(s);
FAIL_IF(DetectSignatureSetAppProto(s, ALPROTO_DCERPC) < 0);
FAIL_IF_NOT(DetectContentSetup(de_ctx, s, "one") == 0);
FAIL_IF(DetectBufferIsPresent(s, g_dce_stub_data_buffer_id));
FAIL_IF_NOT(s->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL);
SigFree(de_ctx, s); SigFree(de_ctx, s);
s = SigAlloc(); s = SigAlloc();
if (s == NULL) FAIL_IF_NULL(s);
return 0; FAIL_IF_NOT(DetectContentSetup(de_ctx, s, "one") == 0);
FAIL_IF(DetectBufferIsPresent(s, g_dce_stub_data_buffer_id));
result &= (DetectContentSetup(de_ctx, s, "one") == 0); FAIL_IF_NOT(s->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL);
result &= (s->sm_lists[g_dce_stub_data_buffer_id] == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL);
end:
SigFree(de_ctx, s); SigFree(de_ctx, s);
DetectEngineCtxFree(de_ctx);
return result; DetectEngineCtxFree(de_ctx);
PASS;
} }
/** /**
@ -1489,124 +1481,75 @@ static int DetectContentParseTest18(void)
static int DetectContentParseTest19(void) static int DetectContentParseTest19(void)
{ {
DetectEngineCtx *de_ctx = NULL;
int result = 1;
Signature *s = NULL;
DetectContentData *data = NULL;
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
Signature *s =
DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
"(msg:\"Testing dce iface, stub_data with content\"; " "(msg:\"Testing dce iface, stub_data with content\"; "
"dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; "
"dce_stub_data; " "dce_stub_data; "
"content:\"one\"; distance:0; sid:1;)"); "content:\"one\"; distance:0; sid:1;)");
if (de_ctx->sig_list == NULL) { FAIL_IF_NULL(s);
printf ("failed dce iface, stub_data with content ");
result = 0; SigMatch *sm = DetectBufferGetFirstSigMatch(s, g_dce_stub_data_buffer_id);
goto end; FAIL_IF_NULL(sm);
} FAIL_IF_NOT(sm->type == DETECT_CONTENT);
s = de_ctx->sig_list; FAIL_IF_NOT(s->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL);
if (s->sm_lists_tail[g_dce_stub_data_buffer_id] == NULL) {
result = 0;
goto end;
}
result &= (s->sm_lists_tail[g_dce_stub_data_buffer_id]->type == DETECT_CONTENT);
result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL);
data = (DetectContentData *)s->sm_lists_tail[g_dce_stub_data_buffer_id]->ctx;
if (data->flags & DETECT_CONTENT_RAWBYTES ||
data->flags & DETECT_CONTENT_NOCASE ||
data->flags & DETECT_CONTENT_WITHIN ||
!(data->flags & DETECT_CONTENT_DISTANCE) ||
data->flags & DETECT_CONTENT_FAST_PATTERN ||
data->flags & DETECT_CONTENT_NEGATED ||
result == 0) {
result = 0;
goto end;
}
s->next = SigInit(de_ctx, "alert tcp any any -> any any " DetectContentData *data = (DetectContentData *)sm->ctx;
FAIL_IF_NOT(data->flags == DETECT_CONTENT_DISTANCE);
s = DetectEngineAppendSig(de_ctx,
"alert tcp any any -> any any "
"(msg:\"Testing dce iface, stub_data with contents & distance, within\"; " "(msg:\"Testing dce iface, stub_data with contents & distance, within\"; "
"dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; "
"dce_stub_data; " "dce_stub_data; "
"content:\"one\"; distance:0; content:\"two\"; within:10; sid:1;)"); "content:\"one\"; distance:0; content:\"two\"; within:10; sid:2;)");
if (s->next == NULL) { FAIL_IF_NULL(s);
printf("failed dce iface, stub_data with content & distance, within"); sm = DetectBufferGetFirstSigMatch(s, g_dce_stub_data_buffer_id);
result = 0; FAIL_IF_NULL(sm);
goto end; FAIL_IF_NOT(sm->type == DETECT_CONTENT);
} FAIL_IF_NULL(sm->next);
s = s->next; sm = sm->next;
if (s->sm_lists_tail[g_dce_stub_data_buffer_id] == NULL) { FAIL_IF_NOT(sm->type == DETECT_CONTENT);
result = 0; FAIL_IF_NOT(s->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL);
goto end;
} data = (DetectContentData *)sm->ctx;
result &= (s->sm_lists_tail[g_dce_stub_data_buffer_id]->type == DETECT_CONTENT); FAIL_IF_NOT(data->flags == DETECT_CONTENT_WITHIN);
result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); FAIL_IF_NOT(data->within == 10);
data = (DetectContentData *)s->sm_lists_tail[g_dce_stub_data_buffer_id]->ctx;
if (data->flags & DETECT_CONTENT_RAWBYTES || s = DetectEngineAppendSig(de_ctx,
data->flags & DETECT_CONTENT_NOCASE || "alert tcp any any -> any any "
!(data->flags & DETECT_CONTENT_WITHIN) ||
data->flags & DETECT_CONTENT_DISTANCE ||
data->flags & DETECT_CONTENT_FAST_PATTERN ||
data->flags & DETECT_CONTENT_NEGATED ||
result == 0) {
result = 0;
goto end;
}
result &= (data->within == 10);
s->next = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"Testing dce iface, stub with contents, distance, within\"; " "(msg:\"Testing dce iface, stub with contents, distance, within\"; "
"dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; "
"dce_stub_data; " "dce_stub_data; "
"content:\"one\"; distance:0; " "content:\"one\"; distance:0; "
"content:\"two\"; within:10; distance:2; sid:1;)"); "content:\"two\"; within:10; distance:2; sid:3;)");
if (s->next == NULL) { FAIL_IF_NULL(s);
result = 0; sm = DetectBufferGetFirstSigMatch(s, g_dce_stub_data_buffer_id);
goto end; FAIL_IF_NULL(sm);
} FAIL_IF_NOT(sm->type == DETECT_CONTENT);
s = s->next; FAIL_IF_NULL(sm->next);
if (s->sm_lists_tail[g_dce_stub_data_buffer_id] == NULL) { sm = sm->next;
result = 0; FAIL_IF_NOT(sm->type == DETECT_CONTENT);
goto end; data = (DetectContentData *)sm->ctx;
} FAIL_IF_NOT(data->flags == (DETECT_CONTENT_WITHIN | DETECT_CONTENT_DISTANCE));
result &= (s->sm_lists_tail[g_dce_stub_data_buffer_id]->type == DETECT_CONTENT); FAIL_IF_NOT(data->within == 10);
result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); FAIL_IF_NOT(data->distance == 2);
data = (DetectContentData *)s->sm_lists_tail[g_dce_stub_data_buffer_id]->ctx; FAIL_IF_NOT(s->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL);
if (data->flags & DETECT_CONTENT_RAWBYTES ||
data->flags & DETECT_CONTENT_NOCASE || s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
!(data->flags & DETECT_CONTENT_WITHIN) ||
!(data->flags & DETECT_CONTENT_DISTANCE) ||
data->flags & DETECT_CONTENT_FAST_PATTERN ||
data->flags & DETECT_CONTENT_NEGATED ||
result == 0) {
result = 0;
goto end;
}
result &= (data->within == 10 && data->distance == 2);
s->next = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"Testing content\"; " "(msg:\"Testing content\"; "
"content:\"one\"; sid:1;)"); "content:\"one\"; sid:4;)");
if (s->next == NULL) { FAIL_IF_NULL(s);
printf ("failed testing content"); FAIL_IF(DetectBufferIsPresent(s, g_dce_stub_data_buffer_id));
result = 0; FAIL_IF(s->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL);
goto end;
}
s = s->next;
if (s->sm_lists_tail[g_dce_stub_data_buffer_id] != NULL) {
result = 0;
goto end;
}
result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL);
end:
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx); DetectEngineCtxFree(de_ctx);
PASS;
return result;
} }
/** /**

Write Preview
Loading…
Cancel
Save