|
|
|
@ -304,16 +304,14 @@ static int AlertFastLogTest01()
|
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
|
|
|
"(msg:\"FastLog test\"; content:\"GET\"; "
|
|
|
|
|
"Classtype:unknown; sid:1;)");
|
|
|
|
|
result = (de_ctx->sig_list != NULL);
|
|
|
|
|
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
|
|
|
|
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
|
if (p->alerts.cnt == 1)
|
|
|
|
|
if (p->alerts.cnt == 1) {
|
|
|
|
|
result = (strcmp(p->alerts.alerts[0].s->class_msg, "Unknown are we") == 0);
|
|
|
|
|
else
|
|
|
|
|
result = 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
SigGroupCleanup(de_ctx);
|
|
|
|
|
SigCleanSignatures(de_ctx);
|
|
|
|
@ -351,25 +349,16 @@ static int AlertFastLogTest02()
|
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
|
|
|
"(msg:\"FastLog test\"; content:\"GET\"; "
|
|
|
|
|
"Classtype:unknown; sid:1;)");
|
|
|
|
|
result = (de_ctx->sig_list != NULL);
|
|
|
|
|
if (result == 0)
|
|
|
|
|
printf("sig parse failed: ");
|
|
|
|
|
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
|
|
|
|
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
|
if (p->alerts.cnt == 1) {
|
|
|
|
|
result = (strcmp(p->alerts.alerts[0].s->class_msg, "Unknown Traffic") != 0);
|
|
|
|
|
if (result == 0)
|
|
|
|
|
printf("p->alerts.alerts[0].class_msg %s: ", p->alerts.alerts[0].s->class_msg);
|
|
|
|
|
|
|
|
|
|
result = (strcmp(p->alerts.alerts[0].s->class_msg,
|
|
|
|
|
"Unknown are we") == 0);
|
|
|
|
|
if (result == 0)
|
|
|
|
|
printf("p->alerts.alerts[0].class_msg %s: ", p->alerts.alerts[0].s->class_msg);
|
|
|
|
|
} else {
|
|
|
|
|
result = 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
SigGroupCleanup(de_ctx);
|
|
|
|
|