|
|
|
@ -322,6 +322,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
|
|
|
|
|
|
|
|
|
|
#ifdef UNITTESTS
|
|
|
|
|
static int g_file_data_buffer_id = 0;
|
|
|
|
|
static int g_http_method_buffer_id = 0;
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \test Checks if a fast_pattern is registered in a Signature
|
|
|
|
@ -7168,7 +7169,7 @@ int DetectFastPatternTest261(void)
|
|
|
|
|
"content:\"three\"; http_method; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_NEGATED &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
|
|
|
@ -7206,7 +7207,7 @@ int DetectFastPatternTest262(void)
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
|
|
result = 0;
|
|
|
|
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HMDMATCH];
|
|
|
|
|
sm = de_ctx->sig_list->sm_lists[g_http_method_buffer_id];
|
|
|
|
|
if (sm != NULL) {
|
|
|
|
|
if ( ((DetectContentData *)sm->ctx)->flags &
|
|
|
|
|
DETECT_CONTENT_FAST_PATTERN) {
|
|
|
|
@ -7243,7 +7244,7 @@ int DetectFastPatternTest263(void)
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
|
|
result = 0;
|
|
|
|
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HMDMATCH];
|
|
|
|
|
sm = de_ctx->sig_list->sm_lists[g_http_method_buffer_id];
|
|
|
|
|
if (sm != NULL) {
|
|
|
|
|
if ( ((DetectContentData *)sm->ctx)->flags &
|
|
|
|
|
DETECT_CONTENT_FAST_PATTERN) {
|
|
|
|
@ -7275,7 +7276,7 @@ int DetectFastPatternTest264(void)
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
|
|
result = 0;
|
|
|
|
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HMDMATCH];
|
|
|
|
|
sm = de_ctx->sig_list->sm_lists[g_http_method_buffer_id];
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)sm->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
|
|
|
|
@ -7309,7 +7310,7 @@ int DetectFastPatternTest265(void)
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
|
|
result = 0;
|
|
|
|
|
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HMDMATCH];
|
|
|
|
|
sm = de_ctx->sig_list->sm_lists[g_http_method_buffer_id];
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)sm->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
|
|
|
@ -7539,7 +7540,7 @@ int DetectFastPatternTest275(void)
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
|
|
|
|
@ -7569,7 +7570,7 @@ int DetectFastPatternTest276(void)
|
|
|
|
|
"(content:\"one\"; http_method; content:\"two\"; http_method; within:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
|
|
|
|
@ -7599,7 +7600,7 @@ int DetectFastPatternTest277(void)
|
|
|
|
|
"(content:\"one\"; http_method; content:\"two\"; http_method; offset:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
|
|
|
|
@ -7629,7 +7630,7 @@ int DetectFastPatternTest278(void)
|
|
|
|
|
"(content:\"one\"; http_method; content:\"two\"; http_method; depth:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
|
|
|
|
@ -7659,7 +7660,7 @@ int DetectFastPatternTest279(void)
|
|
|
|
|
"(content:!\"one\"; fast_pattern; http_method; content:\"two\"; http_method; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_NEGATED &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
|
|
|
@ -7778,7 +7779,7 @@ int DetectFastPatternTest284(void)
|
|
|
|
|
"(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
|
|
|
@ -7808,7 +7809,7 @@ int DetectFastPatternTest285(void)
|
|
|
|
|
"(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; distance:30; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
|
|
|
@ -7838,7 +7839,7 @@ int DetectFastPatternTest286(void)
|
|
|
|
|
"(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; within:30; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
|
|
|
@ -7868,7 +7869,7 @@ int DetectFastPatternTest287(void)
|
|
|
|
|
"(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; offset:30; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
|
|
|
@ -7898,7 +7899,7 @@ int DetectFastPatternTest288(void)
|
|
|
|
|
"(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; depth:30; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
|
|
|
@ -7928,7 +7929,7 @@ int DetectFastPatternTest289(void)
|
|
|
|
|
"(content:\"one\"; http_method; content:\"two\"; http_method; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
|
|
|
@ -7958,7 +7959,7 @@ int DetectFastPatternTest290(void)
|
|
|
|
|
"(content:\"one\"; http_method; content:\"two\"; http_method; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
|
|
|
@ -7988,7 +7989,7 @@ int DetectFastPatternTest291(void)
|
|
|
|
|
"(content:\"one\"; http_method; content:\"two\"; http_method; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
|
|
|
@ -8018,7 +8019,7 @@ int DetectFastPatternTest292(void)
|
|
|
|
|
"(content:\"one\"; http_method; content:\"two\"; http_method; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
|
|
|
|
@ -8117,7 +8118,7 @@ int DetectFastPatternTest296(void)
|
|
|
|
|
"(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_NEGATED &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
|
|
|
@ -8236,7 +8237,7 @@ int DetectFastPatternTest301(void)
|
|
|
|
|
"(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
|
|
|
|
|
DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
|
|
|
|
|
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
|
|
|
|
|
ud->flags & DETECT_CONTENT_NEGATED &&
|
|
|
|
|
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
|
|
|
|
@ -18823,6 +18824,7 @@ void DetectFastPatternRegisterTests(void)
|
|
|
|
|
{
|
|
|
|
|
#ifdef UNITTESTS
|
|
|
|
|
g_file_data_buffer_id = DetectBufferTypeGetByName("file_data");
|
|
|
|
|
g_http_method_buffer_id = DetectBufferTypeGetByName("http_method");
|
|
|
|
|
|
|
|
|
|
UtRegisterTest("DetectFastPatternTest01", DetectFastPatternTest01);
|
|
|
|
|
UtRegisterTest("DetectFastPatternTest02", DetectFastPatternTest02);
|
|
|
|
|