|
|
|
@ -390,16 +390,12 @@ int LogDropLogTest01()
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any any "
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any any "
|
|
|
|
"(msg:\"LogDropLog test\"; content:\"GET\"; Classtype:unknown; sid:1;)");
|
|
|
|
"(msg:\"LogDropLog test\"; content:\"GET\"; Classtype:unknown; sid:1;)");
|
|
|
|
|
|
|
|
|
|
|
|
result = (de_ctx->sig_list != NULL);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
|
|
|
|
|
|
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
if (p->alerts.cnt == 1 && (PACKET_TEST_ACTION(p, ACTION_DROP)))
|
|
|
|
if (p->alerts.cnt == 1 && (PACKET_TEST_ACTION(p, ACTION_DROP)))
|
|
|
|
result = (strcmp(p->alerts.alerts[0].s->class_msg, "Unknown are we") == 0);
|
|
|
|
result = (strcmp(p->alerts.alerts[0].s->class_msg, "Unknown are we") == 0);
|
|
|
|
else
|
|
|
|
|
|
|
|
result = 0;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (LogDropCondition(NULL, p) == TRUE)
|
|
|
|
if (LogDropCondition(NULL, p) == TRUE)
|
|
|
|
LogDropLogger(NULL, &dlt, p);
|
|
|
|
LogDropLogger(NULL, &dlt, p);
|
|
|
|
@ -458,16 +454,12 @@ int LogDropLogTest02()
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any "
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any "
|
|
|
|
"(msg:\"LogDropLog test\"; content:\"GET\"; Classtype:unknown; sid:1;)");
|
|
|
|
"(msg:\"LogDropLog test\"; content:\"GET\"; Classtype:unknown; sid:1;)");
|
|
|
|
|
|
|
|
|
|
|
|
result = (de_ctx->sig_list != NULL);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
|
|
|
|
|
|
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
if (p->alerts.cnt == 1 && p->alerts.alerts[0].action != ACTION_DROP)
|
|
|
|
if (p->alerts.cnt == 1 && p->alerts.alerts[0].action != ACTION_DROP)
|
|
|
|
result = (strcmp(p->alerts.alerts[0].s->class_msg, "Unknown are we") == 0);
|
|
|
|
result = (strcmp(p->alerts.alerts[0].s->class_msg, "Unknown are we") == 0);
|
|
|
|
else
|
|
|
|
|
|
|
|
result = 0;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (LogDropCondition(NULL, p) == TRUE)
|
|
|
|
if (LogDropCondition(NULL, p) == TRUE)
|
|
|
|
LogDropLogger(NULL, &dlt, p);
|
|
|
|
LogDropLogger(NULL, &dlt, p);
|
|
|
|
|