aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect-flow: use new unit test macros

Browse Source
pull/2364/head
Jason Ish 9 years ago committed by Victor Julien
parent 6948b2332a
commit dc762cd44d
1 changed files with 150 additions and 369 deletions
Show Stats Download Patch File Download Diff File

519
src/detect-flow.c
Unescape Escape View File

@ -408,15 +408,11 @@ static _Bool PrefilterFlowIsPrefilterable(const Signature *s)
*/
int DetectFlowTestParse01 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("established");
if (fd != NULL) {
DetectFlowFree(fd);
result = 1;
}
return result;
FAIL_IF_NULL(fd);
DetectFlowFree(fd);
PASS;
}
/**
@ -424,19 +420,12 @@ int DetectFlowTestParse01 (void)
*/
int DetectFlowTestParse02 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("established");
if (fd != NULL) {
if (fd->flags == DETECT_FLOW_FLAG_ESTABLISHED && fd->match_cnt == 1) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED, 1, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_ESTABLISHED &&
fd->match_cnt == 1);
PASS;
}
/**
@ -444,19 +433,12 @@ int DetectFlowTestParse02 (void)
*/
int DetectFlowTestParse03 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("stateless");
if (fd != NULL) {
if (fd->flags == DETECT_FLOW_FLAG_STATELESS && fd->match_cnt == 1) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS, 1, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_STATELESS && fd->match_cnt == 1);
DetectFlowFree(fd);
PASS;
}
/**
@ -464,19 +446,12 @@ int DetectFlowTestParse03 (void)
*/
int DetectFlowTestParse04 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("to_client");
if (fd != NULL) {
if (fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOCLIENT, 1, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1);
DetectFlowFree(fd);
PASS;
}
/**
@ -484,19 +459,12 @@ int DetectFlowTestParse04 (void)
*/
int DetectFlowTestParse05 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("to_server");
if (fd != NULL) {
if (fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOSERVER, 1, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1);
DetectFlowFree(fd);
PASS;
}
/**
@ -504,19 +472,12 @@ int DetectFlowTestParse05 (void)
*/
int DetectFlowTestParse06 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("from_server");
if (fd != NULL) {
if (fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOCLIENT, 1, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1);
DetectFlowFree(fd);
PASS;
}
/**
@ -524,19 +485,12 @@ int DetectFlowTestParse06 (void)
*/
int DetectFlowTestParse07 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("from_client");
if (fd != NULL) {
if (fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOSERVER, 1, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1);
DetectFlowFree(fd);
PASS;
}
/**
@ -544,19 +498,12 @@ int DetectFlowTestParse07 (void)
*/
int DetectFlowTestParse08 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("established,to_client");
if (fd != NULL) {
if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2) {
result = 1;
} else {
printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2);
DetectFlowFree(fd);
PASS;
}
/**
@ -564,19 +511,14 @@ int DetectFlowTestParse08 (void)
*/
int DetectFlowTestParse09 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("to_client,stateless");
if (fd != NULL) {
if (fd->flags & DETECT_FLOW_FLAG_STATELESS && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2) {
result = 1;
} else {
printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_STATELESS &&
fd->flags & DETECT_FLOW_FLAG_TOCLIENT &&
fd->match_cnt == 2);
DetectFlowFree(fd);
PASS;
}
/**
@ -584,19 +526,14 @@ int DetectFlowTestParse09 (void)
*/
int DetectFlowTestParse10 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("from_server,stateless");
if (fd != NULL) {
if (fd->flags & DETECT_FLOW_FLAG_STATELESS && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2){
result = 1;
} else {
printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_STATELESS &&
fd->flags & DETECT_FLOW_FLAG_TOCLIENT &&
fd->match_cnt == 2);
DetectFlowFree(fd);
PASS;
}
/**
@ -604,19 +541,14 @@ int DetectFlowTestParse10 (void)
*/
int DetectFlowTestParse11 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse(" from_server , stateless ");
if (fd != NULL) {
if (fd->flags & DETECT_FLOW_FLAG_STATELESS && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2){
result = 1;
} else {
printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_STATELESS &&
fd->flags & DETECT_FLOW_FLAG_TOCLIENT &&
fd->match_cnt == 2);
DetectFlowFree(fd);
PASS;
}
/**
@ -625,15 +557,11 @@ int DetectFlowTestParse11 (void)
*/
int DetectFlowTestParseNocase01 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("ESTABLISHED");
if (fd != NULL) {
DetectFlowFree(fd);
result = 1;
}
return result;
FAIL_IF_NULL(fd);
DetectFlowFree(fd);
PASS;
}
/**
@ -641,19 +569,13 @@ int DetectFlowTestParseNocase01 (void)
*/
int DetectFlowTestParseNocase02 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("ESTABLISHED");
if (fd != NULL) {
if (fd->flags == DETECT_FLOW_FLAG_ESTABLISHED && fd->match_cnt == 1) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED, 1, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_ESTABLISHED &&
fd->match_cnt == 1);
DetectFlowFree(fd);
PASS;
}
/**
@ -661,19 +583,11 @@ int DetectFlowTestParseNocase02 (void)
*/
int DetectFlowTestParseNocase03 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("STATELESS");
if (fd != NULL) {
if (fd->flags == DETECT_FLOW_FLAG_STATELESS && fd->match_cnt == 1) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS, 1, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_STATELESS && fd->match_cnt == 1); DetectFlowFree(fd);
PASS;
}
/**
@ -681,19 +595,12 @@ int DetectFlowTestParseNocase03 (void)
*/
int DetectFlowTestParseNocase04 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("TO_CLIENT");
if (fd != NULL) {
if (fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOCLIENT, 1, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1);
DetectFlowFree(fd);
PASS;
}
/**
@ -701,19 +608,12 @@ int DetectFlowTestParseNocase04 (void)
*/
int DetectFlowTestParseNocase05 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("TO_SERVER");
if (fd != NULL) {
if (fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOSERVER, 1, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1);
DetectFlowFree(fd);
PASS;
}
/**
@ -721,19 +621,12 @@ int DetectFlowTestParseNocase05 (void)
*/
int DetectFlowTestParseNocase06 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("FROM_SERVER");
if (fd != NULL) {
if (fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOCLIENT, 1, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1);
DetectFlowFree(fd);
PASS;
}
/**
@ -741,19 +634,12 @@ int DetectFlowTestParseNocase06 (void)
*/
int DetectFlowTestParseNocase07 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("FROM_CLIENT");
if (fd != NULL) {
if (fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOSERVER, 1, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1);
DetectFlowFree(fd);
PASS;
}
/**
@ -761,19 +647,14 @@ int DetectFlowTestParseNocase07 (void)
*/
int DetectFlowTestParseNocase08 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("ESTABLISHED,TO_CLIENT");
if (fd != NULL) {
if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2) {
result = 1;
} else {
printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_ESTABLISHED &&
fd->flags & DETECT_FLOW_FLAG_TOCLIENT &&
fd->match_cnt == 2);
DetectFlowFree(fd);
PASS;
}
/**
@ -781,19 +662,14 @@ int DetectFlowTestParseNocase08 (void)
*/
int DetectFlowTestParseNocase09 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("TO_CLIENT,STATELESS");
if (fd != NULL) {
if (fd->flags & DETECT_FLOW_FLAG_STATELESS && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2) {
result = 1;
} else {
printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_STATELESS &&
fd->flags & DETECT_FLOW_FLAG_TOCLIENT &&
fd->match_cnt == 2);
DetectFlowFree(fd);
PASS;
}
/**
@ -801,19 +677,14 @@ int DetectFlowTestParseNocase09 (void)
*/
int DetectFlowTestParseNocase10 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("FROM_SERVER,STATELESS");
if (fd != NULL) {
if (fd->flags & DETECT_FLOW_FLAG_STATELESS && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2){
result = 1;
} else {
printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_STATELESS &&
fd->flags & DETECT_FLOW_FLAG_TOCLIENT &&
fd->match_cnt == 2);
DetectFlowFree(fd);
PASS;
}
/**
@ -821,37 +692,25 @@ int DetectFlowTestParseNocase10 (void)
*/
int DetectFlowTestParseNocase11 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse(" FROM_SERVER , STATELESS ");
if (fd != NULL) {
if (fd->flags & DETECT_FLOW_FLAG_STATELESS && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2){
result = 1;
} else {
printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_STATELESS &&
fd->flags & DETECT_FLOW_FLAG_TOCLIENT &&
fd->match_cnt == 2);
DetectFlowFree(fd);
PASS;
}
/**
* \test DetectFlowTestParse12 is a test for setting an invalid seperator :
*/
int DetectFlowTestParse12 (void)
{
int result = 1;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("from_server:stateless");
if (fd != NULL) {
printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
result = 0;
DetectFlowFree(fd);
}
return result;
FAIL_IF_NOT_NULL(fd);
PASS;
}
/**
@ -859,32 +718,21 @@ int DetectFlowTestParse12 (void)
*/
int DetectFlowTestParse13 (void)
{
int result = 1;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("invalidoptiontest");
if (fd != NULL) {
printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
result = 0;
DetectFlowFree(fd);
}
return result;
FAIL_IF_NOT_NULL(fd);
PASS;
}
/**
* \test DetectFlowTestParse14 is a test for a empty option
*/
int DetectFlowTestParse14 (void)
{
int result = 1;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("");
if (fd != NULL) {
printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
result = 0;
DetectFlowFree(fd);
}
return result;
FAIL_IF_NOT_NULL(fd);
PASS;
}
/**
@ -892,16 +740,10 @@ int DetectFlowTestParse14 (void)
*/
int DetectFlowTestParse15 (void)
{
int result = 1;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("established,stateless");
if (fd != NULL) {
printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
result = 0;
DetectFlowFree(fd);
}
return result;
FAIL_IF_NOT_NULL(fd);
PASS;
}
/**
@ -909,16 +751,10 @@ int DetectFlowTestParse15 (void)
*/
int DetectFlowTestParse16 (void)
{
int result = 1;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("to_client,to_server");
if (fd != NULL) {
printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
result = 0;
DetectFlowFree(fd);
}
return result;
FAIL_IF_NOT_NULL(fd);
PASS;
}
/**
@ -927,16 +763,10 @@ int DetectFlowTestParse16 (void)
*/
int DetectFlowTestParse17 (void)
{
int result = 1;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("to_client,from_server");
if (fd != NULL) {
printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
result = 0;
DetectFlowFree(fd);
}
return result;
FAIL_IF_NOT_NULL(fd);
PASS;
}
/**
@ -944,20 +774,15 @@ int DetectFlowTestParse17 (void)
*/
int DetectFlowTestParse18 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("from_server,established,only_stream");
if (fd != NULL) {
if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM && fd->match_cnt == 3) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED + DETECT_FLOW_FLAG_TOCLIENT + DETECT_FLOW_FLAG_ONLYSTREAM, 3,
fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_ESTABLISHED &&
fd->flags & DETECT_FLOW_FLAG_TOCLIENT &&
fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM &&
fd->match_cnt == 3);
DetectFlowFree(fd);
PASS;
}
/**
@ -965,20 +790,15 @@ int DetectFlowTestParse18 (void)
*/
int DetectFlowTestParseNocase18 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("FROM_SERVER,ESTABLISHED,ONLY_STREAM");
if (fd != NULL) {
if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM && fd->match_cnt == 3) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED + DETECT_FLOW_FLAG_TOCLIENT + DETECT_FLOW_FLAG_ONLYSTREAM, 3,
fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_ESTABLISHED &&
fd->flags & DETECT_FLOW_FLAG_TOCLIENT &&
fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM &&
fd->match_cnt == 3);
DetectFlowFree(fd);
PASS;
}
@ -987,16 +807,10 @@ int DetectFlowTestParseNocase18 (void)
*/
int DetectFlowTestParse19 (void)
{
int result = 1;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("from_server,established,only_stream,a");
if (fd != NULL) {
printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
result = 0;
DetectFlowFree(fd);
}
return result;
FAIL_IF_NOT_NULL(fd);
PASS;
}
/**
@ -1004,21 +818,15 @@ int DetectFlowTestParse19 (void)
*/
int DetectFlowTestParse20 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("from_server,established,no_stream");
if (fd != NULL) {
if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->flags & DETECT_FLOW_FLAG_NOSTREAM && fd->match_cnt == 3) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED + DETECT_FLOW_FLAG_TOCLIENT + DETECT_FLOW_FLAG_NOSTREAM, 3,
fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_ESTABLISHED &&
fd->flags & DETECT_FLOW_FLAG_TOCLIENT &&
fd->flags & DETECT_FLOW_FLAG_NOSTREAM &&
fd->match_cnt == 3);
DetectFlowFree(fd);
PASS;
}
/**
@ -1026,21 +834,15 @@ int DetectFlowTestParse20 (void)
*/
int DetectFlowTestParseNocase20 (void)
{
int result = 0;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("FROM_SERVER,ESTABLISHED,NO_STREAM");
if (fd != NULL) {
if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->flags & DETECT_FLOW_FLAG_NOSTREAM && fd->match_cnt == 3) {
result = 1;
} else {
printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED + DETECT_FLOW_FLAG_TOCLIENT + DETECT_FLOW_FLAG_NOSTREAM, 3,
fd->flags, fd->match_cnt);
}
DetectFlowFree(fd);
}
return result;
FAIL_IF_NULL(fd);
FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_ESTABLISHED &&
fd->flags & DETECT_FLOW_FLAG_TOCLIENT &&
fd->flags & DETECT_FLOW_FLAG_NOSTREAM &&
fd->match_cnt == 3);
DetectFlowFree(fd);
PASS;
}
/**
@ -1048,21 +850,14 @@ int DetectFlowTestParseNocase20 (void)
*/
int DetectFlowTestParse21 (void)
{
int result = 1;
DetectFlowData *fd = NULL;
fd = DetectFlowParse("from_server,a,no_stream");
if (fd != NULL) {
printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
result = 0;
DetectFlowFree(fd);
}
return result;
FAIL_IF_NOT_NULL(fd);
PASS;
}
static int DetectFlowSigTest01(void)
{
int result = 0;
ThreadVars th_v;
DecodeThreadVars dtv;
DetectEngineCtx *de_ctx = NULL;
@ -1071,10 +866,7 @@ static int DetectFlowSigTest01(void)
uint16_t buflen = strlen((char *)buf);
Packet *p = UTHBuildPacket(buf, buflen, IPPROTO_TCP);
if (p->flow != NULL) {
printf("packet has flow set\n");
goto end;
}
FAIL_IF_NULL(p);
char *sig1 = "alert tcp any any -> any any (msg:\"dummy\"; "
"content:\"nova\"; flow:no_stream; sid:1;)";
@ -1083,29 +875,18 @@ static int DetectFlowSigTest01(void)
memset(&th_v, 0, sizeof(th_v));
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
printf("de_ctx == NULL: ");
goto end;
}
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, sig1);
if (de_ctx->sig_list == NULL) {
printf("signature == NULL: ");
goto end;
}
FAIL_IF_NULL(de_ctx->sig_list);
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1) != 1) {
goto end;
}
result = 1;
FAIL_IF(PacketAlertCheck(p, 1) != 1);
end:
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
@ -1118,7 +899,7 @@ static int DetectFlowSigTest01(void)
if (p != NULL)
UTHFreePacket(p);
return result;
PASS;
}
#endif /* UNITTESTS */

Write Preview
Loading…
Cancel
Save