diff --git a/src/detect-engine-threshold.c b/src/detect-engine-threshold.c index e0186824a9..afa3f8acbc 100644 --- a/src/detect-engine-threshold.c +++ b/src/detect-engine-threshold.c @@ -485,16 +485,26 @@ static void ThresholdCacheThreadFree(void *ptr) static void ThresholdCacheInit(void) { - /* Register thread storage. */ - thread_storage_id = ThreadStorageRegister( - "threshold_cache", sizeof(void *), NULL, ThresholdCacheThreadFree); - if (thread_storage_id.id < 0) { - FatalError("Failed to register threshold_cache thread storage"); +#ifdef UNITTESTS + /* many tests don't manage the thread storage correctly, so skip the cache in unittests */ + if (!(RunmodeIsUnittests())) { +#endif + /* Register thread storage. */ + thread_storage_id = ThreadStorageRegister( + "threshold_cache", sizeof(void *), NULL, ThresholdCacheThreadFree); + if (thread_storage_id.id < 0) { + FatalError("Failed to register threshold_cache thread storage"); + } +#ifdef UNITTESTS } +#endif } int ThresholdCacheThreadInit(DetectEngineThreadCtx *det_ctx) { + if (thread_storage_id.id < 0) + return 0; + struct ThresholdCacheThreadCtx *tctx = SCCalloc(1, sizeof(*tctx)); if (tctx == NULL) return -1; diff --git a/src/detect-threshold.c b/src/detect-threshold.c index f4b381bf2a..f24ba4bb8b 100644 --- a/src/detect-threshold.c +++ b/src/detect-threshold.c @@ -393,6 +393,7 @@ error: #include "util-hashlist.h" #include "packet.h" #include "action-globals.h" +#include "thread-storage.h" /** * \test ThresholdTestParse01 is a test for a valid threshold options @@ -564,96 +565,87 @@ static int ThresholdTestParse08(void) static int DetectThresholdTestSig1(void) { - Packet *p = NULL; - Signature *s = NULL; - ThreadVars th_v; DetectEngineThreadCtx *det_ctx; - int result = 0; int alerts = 0; + StorageCleanup(); + StorageInit(); ThresholdInit(); + StorageFinalize(); - memset(&th_v, 0, sizeof(th_v)); + ThreadVars *tv = ThreadVarsAlloc(); + FAIL_IF_NULL(tv); - p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + Packet *p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + FAIL_IF_NULL(p); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) { - goto end; - } - + FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; - s = de_ctx->sig_list = - SigInit(de_ctx, "alert tcp any any -> any 80 (msg:\"Threshold limit\"; content:\"A\"; " - "threshold: type limit, track by_dst, count 5, seconds 60; sid:1;)"); - if (s == NULL) { - goto end; - } + Signature *s = DetectEngineAppendSig(de_ctx, + "alert tcp any any -> any 80 (msg:\"Threshold limit\"; content:\"A\"; " + "threshold: type limit, track by_dst, count 5, seconds 60; sid:1;)"); + FAIL_IF_NULL(s); SigGroupBuild(de_ctx); - FAIL_IF(s->type == SIG_TYPE_IPONLY); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + DetectEngineThreadCtxInit(tv, (void *)de_ctx, (void *)&det_ctx); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 1); if (alerts != 1) { printf("alerts %" PRIi32 ", expected 1: ", alerts); } - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts != 2) { printf("alerts %" PRIi32 ", expected 2: ", alerts); } - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts != 3) { printf("alerts %" PRIi32 ", expected 3: ", alerts); } - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts != 4) { printf("alerts %" PRIi32 ", expected 4: ", alerts); } - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts != 5) { printf("alerts %" PRIi32 ", expected 5: ", alerts); } - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts != 5) { printf("alerts %" PRIi32 ", expected 5: ", alerts); } - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts != 5) { printf("alerts %" PRIi32 ", expected 5: ", alerts); } - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts != 5) { printf("alerts %" PRIi32 ", expected 5: ", alerts); } - if (alerts == 5) - result = 1; - else - printf("alerts %" PRIi32 ", expected 5: ", alerts); - - SigGroupCleanup(de_ctx); - SigCleanSignatures(de_ctx); + FAIL_IF_NOT(alerts == 5); - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineThreadCtxDeinit(tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); -end: + ThreadFreeStorage(tv); + StorageCleanup(); ThresholdDestroy(); - return result; + ThreadVarsFree(tv); + PASS; } /** @@ -667,70 +659,63 @@ end: static int DetectThresholdTestSig2(void) { - Packet *p = NULL; - Signature *s = NULL; - ThreadVars th_v; DetectEngineThreadCtx *det_ctx; - int result = 0; int alerts = 0; + StorageCleanup(); + StorageInit(); ThresholdInit(); + StorageFinalize(); - memset(&th_v, 0, sizeof(th_v)); + ThreadVars *tv = ThreadVarsAlloc(); + FAIL_IF_NULL(tv); - p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + Packet *p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + FAIL_IF_NULL(p); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) { - goto end; - } - + FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; - s = de_ctx->sig_list = - SigInit(de_ctx, "alert tcp any any -> any 80 (msg:\"Threshold\"; threshold: type " - "threshold, track by_dst, count 5, seconds 60; sid:1;)"); - if (s == NULL) { - goto end; - } + Signature *s = DetectEngineAppendSig(de_ctx, + "alert tcp any any -> any 80 (msg:\"Threshold\"; threshold: type " + "threshold, track by_dst, count 5, seconds 60; sid:1;)"); + FAIL_IF_NULL(s); SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + DetectEngineThreadCtxInit(tv, (void *)de_ctx, (void *)&det_ctx); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - if (alerts == 2) - result = 1; - else - goto cleanup; + FAIL_IF_NOT(alerts == 2); -cleanup: - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineThreadCtxDeinit(tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); - -end: UTHFreePackets(&p, 1); + ThreadFreeStorage(tv); + StorageCleanup(); ThresholdDestroy(); - return result; + ThreadVarsFree(tv); + PASS; } /** @@ -744,11 +729,16 @@ end: static int DetectThresholdTestSig3(void) { - ThreadVars th_v; - memset(&th_v, 0, sizeof(th_v)); - + StorageCleanup(); + StorageInit(); ThresholdInit(); + StorageFinalize(); + + ThreadVars *tv = ThreadVarsAlloc(); + FAIL_IF_NULL(tv); + Packet *p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + FAIL_IF_NULL(p); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); @@ -761,30 +751,33 @@ static int DetectThresholdTestSig3(void) SigGroupBuild(de_ctx); DetectEngineThreadCtx *det_ctx; - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + DetectEngineThreadCtxInit(tv, (void *)de_ctx, (void *)&det_ctx); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 10) == 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 10) == 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 10) == 1); TimeSetIncrementTime(200); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 10) == 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 10) == 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 10) == 1); - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineThreadCtxDeinit(tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); + ThreadFreeStorage(tv); + ThreadVarsFree(tv); + StorageCleanup(); ThresholdDestroy(); PASS; } @@ -800,66 +793,61 @@ static int DetectThresholdTestSig3(void) static int DetectThresholdTestSig4(void) { - Packet *p = NULL; - Signature *s = NULL; - ThreadVars th_v; DetectEngineThreadCtx *det_ctx; - int result = 0; int alerts = 0; + StorageCleanup(); + StorageInit(); ThresholdInit(); + StorageFinalize(); - memset(&th_v, 0, sizeof(th_v)); + ThreadVars *tv = ThreadVarsAlloc(); + FAIL_IF_NULL(tv); - p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + Packet *p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + FAIL_IF_NULL(p); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) { - goto end; - } - + FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; - s = de_ctx->sig_list = - SigInit(de_ctx, "alert tcp any any -> any 80 (msg:\"Threshold both\"; threshold: type " - "both, track by_dst, count 2, seconds 60; sid:10;)"); - if (s == NULL) { - goto end; - } + Signature *s = DetectEngineAppendSig(de_ctx, + "alert tcp any any -> any 80 (msg:\"Threshold both\"; threshold: type " + "both, track by_dst, count 2, seconds 60; sid:10;)"); + FAIL_IF_NULL(s); SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + DetectEngineThreadCtxInit(tv, (void *)de_ctx, (void *)&det_ctx); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); TimeSetIncrementTime(200); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); - if (alerts == 2) - result = 1; - else - goto cleanup; + FAIL_IF_NOT(alerts == 2); -cleanup: - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineThreadCtxDeinit(tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); -end: + UTHFreePackets(&p, 1); + ThreadFreeStorage(tv); + StorageCleanup(); ThresholdDestroy(); - return result; + ThreadVarsFree(tv); + PASS; } /** @@ -873,166 +861,148 @@ end: static int DetectThresholdTestSig5(void) { - Packet *p = NULL; - Signature *s = NULL; - ThreadVars th_v; DetectEngineThreadCtx *det_ctx; - int result = 0; int alerts = 0; + StorageCleanup(); + StorageInit(); ThresholdInit(); + StorageFinalize(); - memset(&th_v, 0, sizeof(th_v)); - p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + ThreadVars *tv = ThreadVarsAlloc(); + FAIL_IF_NULL(tv); + Packet *p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + FAIL_IF_NULL(p); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) { - goto end; - } - + FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; - s = de_ctx->sig_list = - SigInit(de_ctx, "alert tcp any any -> any 80 (msg:\"Threshold limit sid 1\"; " - "threshold: type limit, track by_dst, count 5, seconds 60; sid:1;)"); - if (s == NULL) { - goto end; - } + Signature *s = DetectEngineAppendSig(de_ctx, + "alert tcp any any -> any 80 (msg:\"Threshold limit sid 1\"; " + "threshold: type limit, track by_dst, count 5, seconds 60; sid:1;)"); + FAIL_IF_NULL(s); - s = s->next = - SigInit(de_ctx, "alert tcp any any -> any 80 (msg:\"Threshold limit sid 1000\"; " - "threshold: type limit, track by_dst, count 5, seconds 60; sid:1000;)"); - if (s == NULL) { - goto end; - } + s = DetectEngineAppendSig(de_ctx, + "alert tcp any any -> any 80 (msg:\"Threshold limit sid 1000\"; " + "threshold: type limit, track by_dst, count 5, seconds 60; sid:1000;)"); + FAIL_IF_NULL(s); SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + DetectEngineThreadCtxInit(tv, (void *)de_ctx, (void *)&det_ctx); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - if (alerts == 10) - result = 1; - else { - printf("alerts %d != 10: ", alerts); - goto cleanup; - } + FAIL_IF_NOT(alerts == 10); -cleanup: - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineThreadCtxDeinit(tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); - -end: UTHFreePackets(&p, 1); + ThreadFreeStorage(tv); + StorageCleanup(); ThresholdDestroy(); - return result; + ThreadVarsFree(tv); + PASS; } static int DetectThresholdTestSig6Ticks(void) { - Packet *p = NULL; - Signature *s = NULL; - ThreadVars th_v; DetectEngineThreadCtx *det_ctx; - int result = 0; int alerts = 0; + StorageCleanup(); + StorageInit(); ThresholdInit(); + StorageFinalize(); - memset(&th_v, 0, sizeof(th_v)); - p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + ThreadVars *tv = ThreadVarsAlloc(); + FAIL_IF_NULL(tv); - DetectEngineCtx *de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) { - goto end; - } + Packet *p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + FAIL_IF_NULL(p); + DetectEngineCtx *de_ctx = DetectEngineCtxInit(); + FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; - s = de_ctx->sig_list = - SigInit(de_ctx, "alert tcp any any -> any 80 (msg:\"Threshold limit sid 1\"; " - "threshold: type limit, track by_dst, count 5, seconds 60; sid:1;)"); - if (s == NULL) { - goto end; - } + Signature *s = DetectEngineAppendSig(de_ctx, + "alert tcp any any -> any 80 (msg:\"Threshold limit sid 1\"; " + "threshold: type limit, track by_dst, count 5, seconds 60; sid:1;)"); + FAIL_IF_NULL(s); - s = s->next = - SigInit(de_ctx, "alert tcp any any -> any 80 (msg:\"Threshold limit sid 1000\"; " - "threshold: type limit, track by_dst, count 5, seconds 60; sid:1000;)"); - if (s == NULL) { - goto end; - } + s = DetectEngineAppendSig(de_ctx, + "alert tcp any any -> any 80 (msg:\"Threshold limit sid 1000\"; " + "threshold: type limit, track by_dst, count 5, seconds 60; sid:1000;)"); + FAIL_IF_NULL(s); SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + DetectEngineThreadCtxInit(tv, (void *)de_ctx, (void *)&det_ctx); uint64_t ticks_start = 0; uint64_t ticks_end = 0; ticks_start = UtilCpuGetTicks(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); ticks_end = UtilCpuGetTicks(); printf("test run %" PRIu64 "\n", (ticks_end - ticks_start)); - if (alerts == 10) - result = 1; - else - goto cleanup; + FAIL_IF_NOT(alerts == 10); -cleanup: - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineThreadCtxDeinit(tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); -end: UTHFreePackets(&p, 1); + ThreadFreeStorage(tv); + StorageCleanup(); ThresholdDestroy(); - return result; + ThreadVarsFree(tv); + PASS; } /** @@ -1040,48 +1010,45 @@ end: */ static int DetectThresholdTestSig7(void) { - Packet *p = NULL; - Signature *s = NULL; - ThreadVars th_v; DetectEngineThreadCtx *det_ctx; - int result = 0; int alerts = 0; int drops = 0; + StorageCleanup(); + StorageInit(); ThresholdInit(); + StorageFinalize(); - memset(&th_v, 0, sizeof(th_v)); + ThreadVars *tv = ThreadVarsAlloc(); + FAIL_IF_NULL(tv); - p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + Packet *p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + FAIL_IF_NULL(p); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) { - goto end; - } - + FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; - s = de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any 80 (threshold: type limit, " - "track by_src, count 1, seconds 300; sid:10;)"); - if (s == NULL) { - goto end; - } + Signature *s = + DetectEngineAppendSig(de_ctx, "drop tcp any any -> any 80 (threshold: type limit, " + "track by_src, count 1, seconds 300; sid:10;)"); + FAIL_IF_NULL(s); SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + DetectEngineThreadCtxInit(tv, (void *)de_ctx, (void *)&det_ctx); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; @@ -1089,38 +1056,31 @@ static int DetectThresholdTestSig7(void) TimeSetIncrementTime(200); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - if (alerts == 1 && drops == 6) - result = 1; - else { - if (alerts != 1) - printf("alerts: %d != 1: ", alerts); - if (drops != 6) - printf("drops: %d != 6: ", drops); - goto cleanup; - } + FAIL_IF_NOT(alerts == 1 && drops == 6); -cleanup: - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineThreadCtxDeinit(tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); -end: UTHFreePackets(&p, 1); + ThreadFreeStorage(tv); + StorageCleanup(); ThresholdDestroy(); - return result; + ThreadVarsFree(tv); + PASS; } /** @@ -1128,48 +1088,45 @@ end: */ static int DetectThresholdTestSig8(void) { - Packet *p = NULL; - Signature *s = NULL; - ThreadVars th_v; DetectEngineThreadCtx *det_ctx; - int result = 0; int alerts = 0; int drops = 0; + StorageCleanup(); + StorageInit(); ThresholdInit(); + StorageFinalize(); - memset(&th_v, 0, sizeof(th_v)); + ThreadVars *tv = ThreadVarsAlloc(); + FAIL_IF_NULL(tv); - p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + Packet *p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + FAIL_IF_NULL(p); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) { - goto end; - } - + FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; - s = de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any 80 (threshold: type limit, " - "track by_src, count 2, seconds 300; sid:10;)"); - if (s == NULL) { - goto end; - } + Signature *s = + DetectEngineAppendSig(de_ctx, "drop tcp any any -> any 80 (threshold: type limit, " + "track by_src, count 2, seconds 300; sid:10;)"); + FAIL_IF_NULL(s); SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + DetectEngineThreadCtxInit(tv, (void *)de_ctx, (void *)&det_ctx); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; @@ -1177,38 +1134,31 @@ static int DetectThresholdTestSig8(void) TimeSetIncrementTime(200); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - if (alerts == 2 && drops == 6) - result = 1; - else { - if (alerts != 1) - printf("alerts: %d != 1: ", alerts); - if (drops != 6) - printf("drops: %d != 6: ", drops); - goto cleanup; - } + FAIL_IF_NOT(alerts == 2 && drops == 6); -cleanup: - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineThreadCtxDeinit(tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); -end: UTHFreePackets(&p, 1); + ThreadFreeStorage(tv); + StorageCleanup(); ThresholdDestroy(); - return result; + ThreadVarsFree(tv); + PASS; } /** @@ -1216,48 +1166,45 @@ end: */ static int DetectThresholdTestSig9(void) { - Packet *p = NULL; - Signature *s = NULL; - ThreadVars th_v; DetectEngineThreadCtx *det_ctx; - int result = 0; int alerts = 0; int drops = 0; + StorageCleanup(); + StorageInit(); ThresholdInit(); + StorageFinalize(); - memset(&th_v, 0, sizeof(th_v)); + ThreadVars *tv = ThreadVarsAlloc(); + FAIL_IF_NULL(tv); - p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + Packet *p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + FAIL_IF_NULL(p); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) { - goto end; - } - + FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; - s = de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any 80 (threshold: type threshold, " - "track by_src, count 3, seconds 100; sid:10;)"); - if (s == NULL) { - goto end; - } + Signature *s = + DetectEngineAppendSig(de_ctx, "drop tcp any any -> any 80 (threshold: type threshold, " + "track by_src, count 3, seconds 100; sid:10;)"); + FAIL_IF_NULL(s); SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + DetectEngineThreadCtxInit(tv, (void *)de_ctx, (void *)&det_ctx); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; @@ -1265,38 +1212,31 @@ static int DetectThresholdTestSig9(void) TimeSetIncrementTime(200); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - if (alerts == 2 && drops == 2) - result = 1; - else { - if (alerts != 2) - printf("alerts: %d != 2: ", alerts); - if (drops != 2) - printf("drops: %d != 2: ", drops); - goto cleanup; - } + FAIL_IF_NOT(alerts == 2 && drops == 2); -cleanup: - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineThreadCtxDeinit(tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); -end: UTHFreePackets(&p, 1); + ThreadFreeStorage(tv); + StorageCleanup(); ThresholdDestroy(); - return result; + ThreadVarsFree(tv); + PASS; } /** @@ -1304,48 +1244,45 @@ end: */ static int DetectThresholdTestSig10(void) { - Packet *p = NULL; - Signature *s = NULL; - ThreadVars th_v; DetectEngineThreadCtx *det_ctx; - int result = 0; int alerts = 0; int drops = 0; + StorageCleanup(); + StorageInit(); ThresholdInit(); + StorageFinalize(); - memset(&th_v, 0, sizeof(th_v)); + ThreadVars *tv = ThreadVarsAlloc(); + FAIL_IF_NULL(tv); - p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + Packet *p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + FAIL_IF_NULL(p); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) { - goto end; - } - + FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; - s = de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any 80 (threshold: type threshold, " - "track by_src, count 5, seconds 300; sid:10;)"); - if (s == NULL) { - goto end; - } + Signature *s = + DetectEngineAppendSig(de_ctx, "drop tcp any any -> any 80 (threshold: type threshold, " + "track by_src, count 5, seconds 300; sid:10;)"); + FAIL_IF_NULL(s); SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + DetectEngineThreadCtxInit(tv, (void *)de_ctx, (void *)&det_ctx); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; @@ -1353,38 +1290,31 @@ static int DetectThresholdTestSig10(void) TimeSetIncrementTime(200); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - if (alerts == 1 && drops == 1) - result = 1; - else { - if (alerts != 1) - printf("alerts: %d != 1: ", alerts); - if (drops != 1) - printf("drops: %d != 1: ", drops); - goto cleanup; - } + FAIL_IF_NOT(alerts == 1 && drops == 1); -cleanup: - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineThreadCtxDeinit(tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); -end: UTHFreePackets(&p, 1); + ThreadFreeStorage(tv); + StorageCleanup(); ThresholdDestroy(); - return result; + ThreadVarsFree(tv); + PASS; } /** @@ -1392,48 +1322,45 @@ end: */ static int DetectThresholdTestSig11(void) { - Packet *p = NULL; - Signature *s = NULL; - ThreadVars th_v; DetectEngineThreadCtx *det_ctx; - int result = 0; int alerts = 0; int drops = 0; + StorageCleanup(); + StorageInit(); ThresholdInit(); + StorageFinalize(); - memset(&th_v, 0, sizeof(th_v)); + ThreadVars *tv = ThreadVarsAlloc(); + FAIL_IF_NULL(tv); - p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + Packet *p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + FAIL_IF_NULL(p); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) { - goto end; - } - + FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; - s = de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any 80 (threshold: type both, " - "track by_src, count 3, seconds 300; sid:10;)"); - if (s == NULL) { - goto end; - } + Signature *s = + DetectEngineAppendSig(de_ctx, "drop tcp any any -> any 80 (threshold: type both, " + "track by_src, count 3, seconds 300; sid:10;)"); + FAIL_IF_NULL(s); SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + DetectEngineThreadCtxInit(tv, (void *)de_ctx, (void *)&det_ctx); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; @@ -1441,38 +1368,31 @@ static int DetectThresholdTestSig11(void) TimeSetIncrementTime(200); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - if (alerts == 1 && drops == 4) - result = 1; - else { - if (alerts != 1) - printf("alerts: %d != 1: ", alerts); - if (drops != 4) - printf("drops: %d != 4: ", drops); - goto cleanup; - } + FAIL_IF_NOT(alerts == 1 && drops == 4); -cleanup: - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineThreadCtxDeinit(tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); -end: UTHFreePackets(&p, 1); + ThreadFreeStorage(tv); + StorageCleanup(); ThresholdDestroy(); - return result; + ThreadVarsFree(tv); + PASS; } /** @@ -1480,48 +1400,45 @@ end: */ static int DetectThresholdTestSig12(void) { - Packet *p = NULL; - Signature *s = NULL; - ThreadVars th_v; DetectEngineThreadCtx *det_ctx; - int result = 0; int alerts = 0; int drops = 0; + StorageCleanup(); + StorageInit(); ThresholdInit(); + StorageFinalize(); - memset(&th_v, 0, sizeof(th_v)); + ThreadVars *tv = ThreadVarsAlloc(); + FAIL_IF_NULL(tv); - p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + Packet *p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + FAIL_IF_NULL(p); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) { - goto end; - } - + FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; - s = de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any 80 (threshold: type both, " - "track by_src, count 5, seconds 300; sid:10;)"); - if (s == NULL) { - goto end; - } + Signature *s = + DetectEngineAppendSig(de_ctx, "drop tcp any any -> any 80 (threshold: type both, " + "track by_src, count 5, seconds 300; sid:10;)"); + FAIL_IF_NULL(s); SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + DetectEngineThreadCtxInit(tv, (void *)de_ctx, (void *)&det_ctx); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; @@ -1529,39 +1446,32 @@ static int DetectThresholdTestSig12(void) TimeSetIncrementTime(200); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0); p->action = 0; - if (alerts == 1 && drops == 2) - result = 1; - else { - if (alerts != 1) - printf("alerts: %d != 1: ", alerts); - if (drops != 2) - printf("drops: %d != 2: ", drops); - goto cleanup; - } + FAIL_IF_NOT(alerts == 1 && drops == 2); -cleanup: - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineThreadCtxDeinit(tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); -end: UTHFreePackets(&p, 1); HostShutdown(); + ThreadFreeStorage(tv); + StorageCleanup(); ThresholdDestroy(); - return result; + ThreadVarsFree(tv); + PASS; } /** @@ -1575,39 +1485,40 @@ end: static int DetectThresholdTestSig13(void) { - Packet *p = NULL; - Signature *s = NULL; - ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int alerts = 0; + StorageCleanup(); + StorageInit(); ThresholdInit(); + StorageFinalize(); + + ThreadVars *tv = ThreadVarsAlloc(); + FAIL_IF_NULL(tv); - memset(&th_v, 0, sizeof(th_v)); - p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); + Packet *p = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); FAIL_IF_NULL(p); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); - de_ctx->flags |= DE_QUIET; - s = de_ctx->sig_list = - SigInit(de_ctx, "alert tcp any any -> any 80 (msg:\"Threshold limit sid 1\"; " - "threshold: type limit, track by_rule, count 2, seconds 60; sid:1;)"); + Signature *s = DetectEngineAppendSig(de_ctx, + "alert tcp any any -> any 80 (msg:\"Threshold limit sid 1\"; " + "threshold: type limit, track by_rule, count 2, seconds 60; sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + DetectEngineThreadCtxInit(tv, (void *)de_ctx, (void *)&det_ctx); /* should alert twice */ - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); FAIL_IF(alerts != 2); @@ -1615,21 +1526,24 @@ static int DetectThresholdTestSig13(void) TimeSetIncrementTime(70); p->ts = TimeGet(); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + SigMatchSignatures(tv, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); FAIL_IF(alerts != 4); - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineThreadCtxDeinit(tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); + ThreadFreeStorage(tv); + StorageCleanup(); ThresholdDestroy(); + ThreadVarsFree(tv); PASS; } @@ -1644,52 +1558,51 @@ static int DetectThresholdTestSig13(void) static int DetectThresholdTestSig14(void) { - Packet *p1 = NULL; - Packet *p2 = NULL; - Signature *s = NULL; - ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int alerts1 = 0; int alerts2 = 0; + StorageCleanup(); + StorageInit(); ThresholdInit(); + StorageFinalize(); - memset(&th_v, 0, sizeof(th_v)); - p1 = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); - p2 = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "3.3.3.3", 1024, 80); + ThreadVars *tv = ThreadVarsAlloc(); + FAIL_IF_NULL(tv); + Packet *p1 = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); FAIL_IF_NULL(p1); + Packet *p2 = UTHBuildPacketReal((uint8_t *)"A", 1, IPPROTO_TCP, "1.1.1.1", "3.3.3.3", 1024, 80); FAIL_IF_NULL(p2); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); - de_ctx->flags |= DE_QUIET; - s = de_ctx->sig_list = - SigInit(de_ctx, "alert tcp any any -> any 80 (msg:\"Threshold limit sid 1\"; " - "threshold: type limit, track by_both, count 2, seconds 60; sid:1;)"); + Signature *s = DetectEngineAppendSig(de_ctx, + "alert tcp any any -> any 80 (msg:\"Threshold limit sid 1\"; " + "threshold: type limit, track by_both, count 2, seconds 60; sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + DetectEngineThreadCtxInit(tv, (void *)de_ctx, (void *)&det_ctx); /* Both p1 and p2 should alert twice */ - SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); + SigMatchSignatures(tv, de_ctx, det_ctx, p1); alerts1 += PacketAlertCheck(p1, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); + SigMatchSignatures(tv, de_ctx, det_ctx, p1); alerts1 += PacketAlertCheck(p1, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); + SigMatchSignatures(tv, de_ctx, det_ctx, p1); alerts1 += PacketAlertCheck(p1, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); + SigMatchSignatures(tv, de_ctx, det_ctx, p1); alerts1 += PacketAlertCheck(p1, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); + SigMatchSignatures(tv, de_ctx, det_ctx, p2); alerts2 += PacketAlertCheck(p2, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); + SigMatchSignatures(tv, de_ctx, det_ctx, p2); alerts2 += PacketAlertCheck(p2, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); + SigMatchSignatures(tv, de_ctx, det_ctx, p2); alerts2 += PacketAlertCheck(p2, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); + SigMatchSignatures(tv, de_ctx, det_ctx, p2); alerts2 += PacketAlertCheck(p2, 1); FAIL_IF(alerts1 != 2); @@ -1700,19 +1613,22 @@ static int DetectThresholdTestSig14(void) p2->ts = TimeGet(); /* Now they should both alert again after previous alerts expire */ - SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); + SigMatchSignatures(tv, de_ctx, det_ctx, p1); alerts1 += PacketAlertCheck(p1, 1); - SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); + SigMatchSignatures(tv, de_ctx, det_ctx, p2); alerts2 += PacketAlertCheck(p2, 1); FAIL_IF(alerts1 != 3); FAIL_IF(alerts2 != 3); - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineThreadCtxDeinit(tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); + ThreadFreeStorage(tv); + StorageCleanup(); ThresholdDestroy(); + ThreadVarsFree(tv); PASS; }