aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/http_client_body: remove and update tests

Browse Source
pull/8732/head
Victor Julien 3 years ago
parent d4e998e0b8
commit a7e1eaaa2c
1 changed files with 104 additions and 171 deletions
Show Stats Download Patch File Download Diff File

275
src/tests/detect-http-client-body.c
Unescape Escape View File

@ -826,112 +826,65 @@ libhtp:\n\
*/ */
static int DetectHttpClientBodyTest01(void) static int DetectHttpClientBodyTest01(void)
{ {
DetectEngineCtx *de_ctx = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit();
int result = 0; FAIL_IF_NULL(de_ctx);
SigMatch *sm = NULL;
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"Testing http_client_body\"; "
"content:\"one\"; http_client_body; sid:1;)");
if (de_ctx->sig_list != NULL) {
result = 1;
} else {
goto end;
}
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_MATCH]; Signature *s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
if (sm != NULL) { "(msg:\"Testing http_client_body\"; "
result &= (sm->type == DETECT_CONTENT); "content:\"one\"; http_client_body; sid:1;)");
result &= (sm->next == NULL); FAIL_IF_NULL(s);
}
end: SigMatch *sm = de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_MATCH];
DetectEngineCtxFree(de_ctx); FAIL_IF_NOT_NULL(sm);
return result; DetectEngineCtxFree(de_ctx);
PASS;
} }
/** /**
* \test Test that a signature containing an valid http_client_body entry is * \test Test that a signature containing an valid http_client_body entry is
* parsed. * parsed.
* \todo error in sig 'http_client_body:;'
*/ */
static int DetectHttpClientBodyTest02(void) static int DetectHttpClientBodyTest02(void)
{ {
DetectEngineCtx *de_ctx = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit();
int result = 0; FAIL_IF_NULL(de_ctx);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"Testing http_client_body\"; "
"content:\"one\"; http_client_body:; sid:1;)");
if (de_ctx->sig_list != NULL)
result = 1;
end: Signature *s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
DetectEngineCtxFree(de_ctx); "(msg:\"Testing http_client_body\"; "
"content:\"one\"; http_client_body:; sid:1;)");
FAIL_IF_NULL(s);
return result; DetectEngineCtxFree(de_ctx);
PASS;
} }
/** /**
* \test Test that an invalid signature containing no content but a http_client_body * \test Test invalid signatures
* is invalidated.
*/ */
static int DetectHttpClientBodyTest03(void) static int DetectHttpClientBodyTest03(void)
{ {
DetectEngineCtx *de_ctx = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit();
int result = 0; FAIL_IF_NULL(de_ctx);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"Testing http_client_body\"; "
"http_client_body; sid:1;)");
if (de_ctx->sig_list == NULL)
result = 1;
end:
DetectEngineCtxFree(de_ctx);
return result;
}
/** const char *sigs[] = {
* \test Test that an invalid signature containing a rawbytes along with a "alert tcp any any -> any any (http_client_body; sid:1;)",
* http_client_body is invalidated. "alert tcp any any -> any any "
*/ "(msg:\"Testing http_client_body\"; "
static int DetectHttpClientBodyTest04(void) "content:\"one\"; rawbytes; http_client_body; sid:2;)",
{ NULL,
DetectEngineCtx *de_ctx = NULL; };
int result = 0;
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"Testing http_client_body\"; "
"content:\"one\"; rawbytes; http_client_body; sid:1;)");
if (de_ctx->sig_list == NULL)
result = 1;
end: for (uint32_t i = 0; sigs[i] != NULL; i++) {
Signature *s = DetectEngineAppendSig(de_ctx, sigs[i]);
FAIL_IF_NOT_NULL(s);
}
DetectEngineCtxFree(de_ctx); DetectEngineCtxFree(de_ctx);
PASS;
return result;
} }
/** /**
@ -940,24 +893,21 @@ static int DetectHttpClientBodyTest04(void)
*/ */
static int DetectHttpClientBodyTest05(void) static int DetectHttpClientBodyTest05(void)
{ {
DetectEngineCtx *de_ctx = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit();
int result = 0; FAIL_IF_NULL(de_ctx);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"Testing http_client_body\"; "
"content:\"one\"; http_client_body; nocase; sid:1;)");
if (de_ctx->sig_list != NULL)
result = 1;
end: const char *sigs[] = {
DetectEngineCtxFree(de_ctx); "alert tcp any any -> any any (content:\"one\"; http_client_body; nocase; sid:1;)",
NULL,
};
return result; for (uint32_t i = 0; sigs[i] != NULL; i++) {
Signature *s = DetectEngineAppendSig(de_ctx, sigs[i]);
FAIL_IF_NULL(s);
}
DetectEngineCtxFree(de_ctx);
PASS;
} }
/** /**
@ -1010,12 +960,11 @@ static int DetectHttpClientBodyTest06(void)
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
"(msg:\"http client body test\"; " "(msg:\"http client body test\"; "
"content:\"message\"; http_client_body; " "content:\"message\"; http_client_body; "
"sid:1;)"); "sid:1;)");
if (de_ctx->sig_list == NULL) FAIL_IF_NULL(s);
goto end;
SigGroupBuild(de_ctx); SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
@ -1115,12 +1064,11 @@ static int DetectHttpClientBodyTest07(void)
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
"(msg:\"http client body test\"; " "(msg:\"http client body test\"; "
"content:\"message\"; http_client_body; " "content:\"message\"; http_client_body; "
"sid:1;)"); "sid:1;)");
if (de_ctx->sig_list == NULL) FAIL_IF_NULL(s);
goto end;
SigGroupBuild(de_ctx); SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
@ -1234,12 +1182,11 @@ static int DetectHttpClientBodyTest08(void)
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
"(msg:\"http client body test\"; " "(msg:\"http client body test\"; "
"content:\"message\"; http_client_body; " "content:\"message\"; http_client_body; "
"sid:1;)"); "sid:1;)");
if (de_ctx->sig_list == NULL) FAIL_IF_NULL(s);
goto end;
SigGroupBuild(de_ctx); SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
@ -1356,12 +1303,11 @@ static int DetectHttpClientBodyTest09(void)
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
"(msg:\"http client body test\"; " "(msg:\"http client body test\"; "
"content:\"body1This\"; http_client_body; " "content:\"body1This\"; http_client_body; "
"sid:1;)"); "sid:1;)");
if (de_ctx->sig_list == NULL) FAIL_IF_NULL(s);
goto end;
SigGroupBuild(de_ctx); SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
@ -1478,12 +1424,11 @@ static int DetectHttpClientBodyTest10(void)
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
"(msg:\"http client body test\"; " "(msg:\"http client body test\"; "
"content:\"body1This\"; http_client_body; nocase;" "content:\"body1This\"; http_client_body; nocase;"
"sid:1;)"); "sid:1;)");
if (de_ctx->sig_list == NULL) FAIL_IF_NULL(s);
goto end;
SigGroupBuild(de_ctx); SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
@ -1591,12 +1536,11 @@ static int DetectHttpClientBodyTest11(void)
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
"(msg:\"http client body test\"; " "(msg:\"http client body test\"; "
"content:!\"message1\"; http_client_body; " "content:!\"message1\"; http_client_body; "
"sid:1;)"); "sid:1;)");
if (de_ctx->sig_list == NULL) FAIL_IF_NULL(s);
goto end;
SigGroupBuild(de_ctx); SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
@ -1687,12 +1631,11 @@ static int DetectHttpClientBodyTest12(void)
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
"(msg:\"http client body test\"; " "(msg:\"http client body test\"; "
"content:!\"message\"; http_client_body; " "content:!\"message\"; http_client_body; "
"sid:1;)"); "sid:1;)");
if (de_ctx->sig_list == NULL) FAIL_IF_NULL(s);
goto end;
SigGroupBuild(de_ctx); SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
@ -1783,12 +1726,12 @@ static int DetectHttpClientBodyTest13(void)
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " Signature *s = DetectEngineAppendSig(de_ctx,
"(msg:\"http client body test\"; " "alert http any any -> any any "
"content:\"abcdefghijklmnopqrstuvwxyz0123456789\"; http_client_body; " "(msg:\"http client body test\"; "
"sid:1;)"); "content:\"abcdefghijklmnopqrstuvwxyz0123456789\"; http_client_body; "
if (de_ctx->sig_list == NULL) "sid:1;)");
goto end; FAIL_IF_NULL(s);
SigGroupBuild(de_ctx); SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
@ -2537,14 +2480,12 @@ static int DetectHttpClientBodyTest27(void)
goto end; goto end;
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " Signature *s = DetectEngineAppendSig(de_ctx,
"(content:\"one\"; offset:10; http_client_body; pcre:/two/; " "alert icmp any any -> any any "
"content:\"three\"; distance:10; http_client_body; within:10; " "(content:\"one\"; offset:10; http_client_body; pcre:/two/; "
"content:\"four\"; distance:10; sid:1;)"); "content:\"three\"; distance:10; http_client_body; within:10; "
if (de_ctx->sig_list == NULL) { "content:\"four\"; distance:10; sid:1;)");
printf("de_ctx->sig_list == NULL\n"); FAIL_IF_NULL(s);
goto end;
}
result = 1; result = 1;
@ -2703,12 +2644,10 @@ static int DetectHttpClientBodyTest31(void)
goto end; goto end;
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " Signature *s =
"(content:\"one\"; within:5; http_client_body; sid:1;)"); DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
if (de_ctx->sig_list == NULL) { "(content:\"one\"; within:5; http_client_body; sid:1;)");
printf("de_ctx->sig_list == NULL\n"); FAIL_IF_NULL(s);
goto end;
}
result = 1; result = 1;
@ -2726,12 +2665,10 @@ static int DetectHttpClientBodyTest32(void)
goto end; goto end;
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " Signature *s =
"(content:\"one\"; http_client_body; within:5; sid:1;)"); DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
if (de_ctx->sig_list == NULL) { "(content:\"one\"; http_client_body; within:5; sid:1;)");
printf("de_ctx->sig_list != NULL\n"); FAIL_IF_NULL(s);
goto end;
}
result = 1; result = 1;
@ -2749,12 +2686,9 @@ static int DetectHttpClientBodyTest33(void)
goto end; goto end;
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " Signature *s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
"(content:\"one\"; within:5; sid:1;)"); "(content:\"one\"; within:5; sid:1;)");
if (de_ctx->sig_list == NULL) { FAIL_IF_NULL(s);
printf("de_ctx->sig_list == NULL\n");
goto end;
}
result = 1; result = 1;
@ -2945,7 +2879,6 @@ void DetectHttpClientBodyRegisterTests(void)
UtRegisterTest("DetectHttpClientBodyTest01", DetectHttpClientBodyTest01); UtRegisterTest("DetectHttpClientBodyTest01", DetectHttpClientBodyTest01);
UtRegisterTest("DetectHttpClientBodyTest02", DetectHttpClientBodyTest02); UtRegisterTest("DetectHttpClientBodyTest02", DetectHttpClientBodyTest02);
UtRegisterTest("DetectHttpClientBodyTest03", DetectHttpClientBodyTest03); UtRegisterTest("DetectHttpClientBodyTest03", DetectHttpClientBodyTest03);
UtRegisterTest("DetectHttpClientBodyTest04", DetectHttpClientBodyTest04);
UtRegisterTest("DetectHttpClientBodyTest05", DetectHttpClientBodyTest05); UtRegisterTest("DetectHttpClientBodyTest05", DetectHttpClientBodyTest05);
UtRegisterTest("DetectHttpClientBodyTest06", DetectHttpClientBodyTest06); UtRegisterTest("DetectHttpClientBodyTest06", DetectHttpClientBodyTest06);
UtRegisterTest("DetectHttpClientBodyTest07", DetectHttpClientBodyTest07); UtRegisterTest("DetectHttpClientBodyTest07", DetectHttpClientBodyTest07);

Write Preview
Loading…
Cancel
Save