aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect-tls: tidy up unittests

Browse Source 
By doing the following:
- removing unnecessary locks
- moving variable declarations
- removing redundant function 'SigCleanSignatures'
pull/3868/head
Mats Klepsland 7 years ago committed by Victor Julien
parent 15012fc908
commit 12d37b8b2c
11 changed files with 43 additions and 127 deletions
Show Stats Download Patch File Download Diff File

10
src/detect-ssl-state.c
Unescape Escape View File

@ -731,12 +731,10 @@ static int DetectSslStateTest07(void)
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
STREAM_TOSERVER | STREAM_START, chello_buf,
chello_buf_len);
FAIL_IF(r != 0);
FLOWLOCK_UNLOCK(&f);
ssl_state = f.alstate;
FAIL_IF(ssl_state == NULL);
@ -751,11 +749,9 @@ static int DetectSslStateTest07(void)
FAIL_IF(PacketAlertCheck(p, 4));
FAIL_IF(PacketAlertCheck(p, 5));
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
shello_buf, shello_buf_len);
FAIL_IF(r != 0);
FLOWLOCK_UNLOCK(&f);
/* do detect */
p->alerts.cnt = 0;
@ -769,12 +765,10 @@ static int DetectSslStateTest07(void)
FAIL_IF(PacketAlertCheck(p, 4));
FAIL_IF(!PacketAlertCheck(p, 5));
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER,
client_change_cipher_spec_buf,
client_change_cipher_spec_buf_len);
FAIL_IF(r != 0);
FLOWLOCK_UNLOCK(&f);
/* do detect */
p->alerts.cnt = 0;
@ -785,12 +779,10 @@ static int DetectSslStateTest07(void)
FAIL_IF(!PacketAlertCheck(p, 3));
FAIL_IF(PacketAlertCheck(p, 4));
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
server_change_cipher_spec_buf,
server_change_cipher_spec_buf_len);
FAIL_IF(r != 0);
FLOWLOCK_UNLOCK(&f);
/* do detect */
p->alerts.cnt = 0;
@ -801,11 +793,9 @@ static int DetectSslStateTest07(void)
FAIL_IF(PacketAlertCheck(p, 3));
FAIL_IF(PacketAlertCheck(p, 4));
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER,
toserver_app_data_buf, toserver_app_data_buf_len);
FAIL_IF(r != 0);
FLOWLOCK_UNLOCK(&f);
/* do detect */
p->alerts.cnt = 0;

4
src/detect-ssl-version.c
Unescape Escape View File

@ -444,7 +444,6 @@ static int DetectSslVersionTestDetect01(void)
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
STREAM_TOSERVER, sslbuf1, ssllen1);
FAIL_IF(r != 0);
@ -460,7 +459,6 @@ static int DetectSslVersionTestDetect01(void)
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER,
sslbuf4, ssllen4);
FAIL_IF(r != 0);
FLOWLOCK_UNLOCK(&f);
SSLState *app_state = f.alstate;
FAIL_IF_NULL(app_state);
@ -535,7 +533,6 @@ static int DetectSslVersionTestDetect02(void)
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
STREAM_TOSERVER, sslbuf1, ssllen1);
FAIL_IF(r != 0);
@ -551,7 +548,6 @@ static int DetectSslVersionTestDetect02(void)
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER,
sslbuf4, ssllen4);
FAIL_IF(r != 0);
FLOWLOCK_UNLOCK(&f);
SSLState *app_state = f.alstate;
FAIL_IF_NULL(app_state);

17
src/detect-tls-cert-fingerprint.c
Unescape Escape View File

@ -230,10 +230,7 @@ static void DetectTlsFingerprintSetupCallback(const DetectEngineCtx *de_ctx,
*/
static int DetectTlsFingerprintTest01(void)
{
DetectEngineCtx *de_ctx = NULL;
SigMatch *sm = NULL;
de_ctx = DetectEngineCtxInit();
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET;
@ -245,7 +242,7 @@ static int DetectTlsFingerprintTest01(void)
FAIL_IF_NULL(de_ctx->sig_list);
/* sm should not be in the MATCH list */
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_MATCH];
SigMatch *sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_MATCH];
FAIL_IF_NOT_NULL(sm);
sm = de_ctx->sig_list->sm_lists[g_tls_cert_fingerprint_buffer_id];
@ -255,7 +252,6 @@ static int DetectTlsFingerprintTest01(void)
FAIL_IF_NOT_NULL(sm->next);
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
PASS;
@ -467,7 +463,6 @@ static int DetectTlsFingerprintTest02(void)
Packet *p1 = NULL;
Packet *p2 = NULL;
Packet *p3 = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
@ -515,7 +510,7 @@ static int DetectTlsFingerprintTest02(void)
de_ctx->mpm_matcher = mpm_default_matcher;
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test tls.cert_fingerprint\"; "
"tls.cert_fingerprint; "
"content:\"4a:a3:66:76:82:cb:6b:23:bb:c3:58:47:23:a4:63:a7:78:a4:a1:18\"; "
@ -525,11 +520,9 @@ static int DetectTlsFingerprintTest02(void)
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
STREAM_TOSERVER, client_hello,
sizeof(client_hello));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);
@ -540,10 +533,8 @@ static int DetectTlsFingerprintTest02(void)
FAIL_IF(PacketAlertCheck(p1, 1));
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
server_hello, sizeof(server_hello));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);
@ -551,10 +542,8 @@ static int DetectTlsFingerprintTest02(void)
FAIL_IF(PacketAlertCheck(p2, 1));
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
certificate, sizeof(certificate));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);

17
src/detect-tls-cert-issuer.c
Unescape Escape View File

@ -143,10 +143,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
*/
static int DetectTlsIssuerTest01(void)
{
DetectEngineCtx *de_ctx = NULL;
SigMatch *sm = NULL;
de_ctx = DetectEngineCtxInit();
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET;
@ -156,7 +153,7 @@ static int DetectTlsIssuerTest01(void)
FAIL_IF_NULL(de_ctx->sig_list);
/* sm should not be in the MATCH list */
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_MATCH];
SigMatch *sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_MATCH];
FAIL_IF_NOT_NULL(sm);
sm = de_ctx->sig_list->sm_lists[g_tls_cert_issuer_buffer_id];
@ -166,7 +163,6 @@ static int DetectTlsIssuerTest01(void)
FAIL_IF_NOT_NULL(sm->next);
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
PASS;
@ -379,7 +375,6 @@ static int DetectTlsIssuerTest02(void)
Packet *p1 = NULL;
Packet *p2 = NULL;
Packet *p3 = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
@ -427,7 +422,7 @@ static int DetectTlsIssuerTest02(void)
de_ctx->mpm_matcher = mpm_default_matcher;
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test tls.cert_issuer\"; "
"tls.cert_issuer; content:\"google\"; nocase; "
"sid:1;)");
@ -436,11 +431,9 @@ static int DetectTlsIssuerTest02(void)
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
STREAM_TOSERVER, client_hello,
sizeof(client_hello));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);
@ -451,10 +444,8 @@ static int DetectTlsIssuerTest02(void)
FAIL_IF(PacketAlertCheck(p1, 1));
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
server_hello, sizeof(server_hello));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);
@ -462,10 +453,8 @@ static int DetectTlsIssuerTest02(void)
FAIL_IF(PacketAlertCheck(p2, 1));
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
certificate, sizeof(certificate));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);

17
src/detect-tls-cert-serial.c
Unescape Escape View File

@ -220,10 +220,7 @@ static void DetectTlsSerialSetupCallback(const DetectEngineCtx *de_ctx,
*/
static int DetectTlsSerialTest01(void)
{
DetectEngineCtx *de_ctx = NULL;
SigMatch *sm = NULL;
de_ctx = DetectEngineCtxInit();
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET;
@ -233,7 +230,7 @@ static int DetectTlsSerialTest01(void)
FAIL_IF_NULL(de_ctx->sig_list);
/* sm should not be in the MATCH list */
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_MATCH];
SigMatch *sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_MATCH];
FAIL_IF_NOT_NULL(sm);
sm = de_ctx->sig_list->sm_lists[g_tls_cert_serial_buffer_id];
@ -243,7 +240,6 @@ static int DetectTlsSerialTest01(void)
FAIL_IF_NOT_NULL(sm->next);
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
PASS;
@ -455,7 +451,6 @@ static int DetectTlsSerialTest02(void)
Packet *p1 = NULL;
Packet *p2 = NULL;
Packet *p3 = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
@ -503,7 +498,7 @@ static int DetectTlsSerialTest02(void)
de_ctx->mpm_matcher = mpm_default_matcher;
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test tls.cert_serial\"; "
"tls.cert_serial; "
"content:\"5C:19:B7:B1:32:3B:1C:A1\"; "
@ -513,11 +508,9 @@ static int DetectTlsSerialTest02(void)
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
STREAM_TOSERVER, client_hello,
sizeof(client_hello));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);
@ -528,10 +521,8 @@ static int DetectTlsSerialTest02(void)
FAIL_IF(PacketAlertCheck(p1, 1));
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
server_hello, sizeof(server_hello));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);
@ -539,10 +530,8 @@ static int DetectTlsSerialTest02(void)
FAIL_IF(PacketAlertCheck(p2, 1));
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
certificate, sizeof(certificate));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);

17
src/detect-tls-cert-subject.c
Unescape Escape View File

@ -142,10 +142,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
*/
static int DetectTlsSubjectTest01(void)
{
DetectEngineCtx *de_ctx = NULL;
SigMatch *sm = NULL;
de_ctx = DetectEngineCtxInit();
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET;
@ -155,7 +152,7 @@ static int DetectTlsSubjectTest01(void)
FAIL_IF_NULL(de_ctx->sig_list);
/* sm should not be in the MATCH list */
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_MATCH];
SigMatch *sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_MATCH];
FAIL_IF_NOT_NULL(sm);
sm = de_ctx->sig_list->sm_lists[g_tls_cert_subject_buffer_id];
@ -165,7 +162,6 @@ static int DetectTlsSubjectTest01(void)
FAIL_IF_NOT_NULL(sm->next);
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
PASS;
@ -378,7 +374,6 @@ static int DetectTlsSubjectTest02(void)
Packet *p1 = NULL;
Packet *p2 = NULL;
Packet *p3 = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
@ -426,7 +421,7 @@ static int DetectTlsSubjectTest02(void)
de_ctx->mpm_matcher = mpm_default_matcher;
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test tls.cert_subject\"; "
"tls.cert_subject; content:\"google\"; nocase; "
"sid:1;)");
@ -435,11 +430,9 @@ static int DetectTlsSubjectTest02(void)
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
STREAM_TOSERVER, client_hello,
sizeof(client_hello));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);
@ -450,10 +443,8 @@ static int DetectTlsSubjectTest02(void)
FAIL_IF(PacketAlertCheck(p1, 1));
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
server_hello, sizeof(server_hello));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);
@ -461,10 +452,8 @@ static int DetectTlsSubjectTest02(void)
FAIL_IF(PacketAlertCheck(p2, 1));
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
certificate, sizeof(certificate));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);

21
src/detect-tls-cert-validity.c
Unescape Escape View File

@ -1191,7 +1191,6 @@ static int ValidityTestDetect01(void)
Packet *p1 = NULL;
Packet *p2 = NULL;
Packet *p3 = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
@ -1238,9 +1237,9 @@ static int ValidityTestDetect01(void)
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test tls_cert_notbefore\"; "
"tls_cert_notbefore:<2016-07-20; sid:1;)");
Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test tls_cert_notbefore\"; "
"tls_cert_notbefore:<2016-07-20; sid:1;)");
FAIL_IF_NULL(s);
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
@ -1522,7 +1521,6 @@ static int ExpiredTestDetect01(void)
Packet *p1 = NULL;
Packet *p2 = NULL;
Packet *p3 = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
@ -1571,9 +1569,9 @@ static int ExpiredTestDetect01(void)
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test tls_cert_expired\"; "
"tls_cert_expired; sid:1;)");
Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test tls_cert_expired\"; "
"tls_cert_expired; sid:1;)");
FAIL_IF_NULL(s);
SigGroupBuild(de_ctx);
@ -1831,7 +1829,6 @@ static int ValidTestDetect01(void)
Packet *p1 = NULL;
Packet *p2 = NULL;
Packet *p3 = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
@ -1880,9 +1877,9 @@ static int ValidTestDetect01(void)
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test tls_cert_valid\"; "
"tls_cert_valid; sid:1;)");
Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test tls_cert_valid\"; "
"tls_cert_valid; sid:1;)");
FAIL_IF_NULL(s);
SigGroupBuild(de_ctx);

17
src/detect-tls-ja3-hash.c
Unescape Escape View File

@ -248,7 +248,6 @@ static int DetectTlsJa3HashTest01(void)
Flow f;
SSLState *ssl_state = NULL;
Packet *p = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
TcpSession ssn;
@ -281,7 +280,7 @@ static int DetectTlsJa3HashTest01(void)
de_ctx->mpm_matcher = mpm_default_matcher;
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test ja3.hash\"; ja3.hash; "
"content:\"e7eca2baf4458d095b7f45da28c16c34\"; "
"sid:1;)");
@ -290,10 +289,8 @@ static int DetectTlsJa3HashTest01(void)
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
STREAM_TOSERVER, buf, sizeof(buf));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);
ssl_state = f.alstate;
@ -347,8 +344,6 @@ static int DetectTlsJa3HashTest02(void)
Flow f;
SSLState *ssl_state = NULL;
Packet *p = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
TcpSession ssn;
@ -358,9 +353,9 @@ static int DetectTlsJa3HashTest02(void)
memset(&f, 0, sizeof(Flow));
memset(&ssn, 0, sizeof(TcpSession));
p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP,
"192.168.1.5", "192.168.1.1",
41424, 443);
Packet *p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP,
"192.168.1.5", "192.168.1.1",
41424, 443);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
@ -381,7 +376,7 @@ static int DetectTlsJa3HashTest02(void)
de_ctx->mpm_matcher = mpm_default_matcher;
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test ja3.hash\"; ja3.hash; "
"content:\"bc6c386f480ee97b9d9e52d472b772d8\"; "
"sid:1;)");
@ -390,10 +385,8 @@ static int DetectTlsJa3HashTest02(void)
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
STREAM_TOSERVER, buf, sizeof(buf));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);
ssl_state = f.alstate;

12
src/detect-tls-ja3-string.c
Unescape Escape View File

@ -177,8 +177,6 @@ static int DetectTlsJa3StringTest01(void)
Flow f;
SSLState *ssl_state = NULL;
Packet *p = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
TcpSession ssn;
@ -188,9 +186,9 @@ static int DetectTlsJa3StringTest01(void)
memset(&f, 0, sizeof(Flow));
memset(&ssn, 0, sizeof(TcpSession));
p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP,
"192.168.1.5", "192.168.1.1",
41424, 443);
Packet *p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP,
"192.168.1.5", "192.168.1.1",
41424, 443);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
@ -211,7 +209,7 @@ static int DetectTlsJa3StringTest01(void)
de_ctx->mpm_matcher = mpm_default_matcher;
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test ja3.string\"; ja3.string; "
"content:\"-65-68-69-102-103-104-105-106-107-132-135-255,0,,\"; "
"sid:1;)");
@ -220,10 +218,8 @@ static int DetectTlsJa3StringTest01(void)
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
STREAM_TOSERVER, buf, sizeof(buf));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);
ssl_state = f.alstate;

34
src/detect-tls-sni.c
Unescape Escape View File

@ -160,8 +160,6 @@ static int DetectTlsSniTest01(void)
Flow f;
SSLState *ssl_state = NULL;
Packet *p = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
TcpSession ssn;
@ -171,9 +169,9 @@ static int DetectTlsSniTest01(void)
memset(&f, 0, sizeof(Flow));
memset(&ssn, 0, sizeof(TcpSession));
p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP,
"192.168.1.5", "192.168.1.1",
41424, 443);
Packet *p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP,
"192.168.1.5", "192.168.1.1",
41424, 443);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
@ -194,18 +192,16 @@ static int DetectTlsSniTest01(void)
de_ctx->mpm_matcher = mpm_default_matcher;
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test tls.sni option\"; "
"tls.sni; content:\"google.com\"; sid:1;)");
Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test tls.sni option\"; "
"tls.sni; content:\"google.com\"; sid:1;)");
FAIL_IF_NULL(s);
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
STREAM_TOSERVER, buf, sizeof(buf));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);
ssl_state = f.alstate;
@ -252,8 +248,6 @@ static int DetectTlsSniTest02(void)
Flow f;
SSLState *ssl_state = NULL;
Packet *p = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
TcpSession ssn;
@ -263,9 +257,9 @@ static int DetectTlsSniTest02(void)
memset(&f, 0, sizeof(Flow));
memset(&ssn, 0, sizeof(TcpSession));
p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP,
"192.168.1.5", "192.168.1.1",
41424, 443);
Packet *p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP,
"192.168.1.5", "192.168.1.1",
41424, 443);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
@ -286,10 +280,10 @@ static int DetectTlsSniTest02(void)
de_ctx->mpm_matcher = mpm_default_matcher;
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test tls.sni option\"; "
"tls.sni; content:\"google\"; nocase; "
"pcre:\"/google\\.com$/i\"; sid:1;)");
Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
"(msg:\"Test tls.sni option\"; "
"tls.sni; content:\"google\"; nocase; "
"pcre:\"/google\\.com$/i\"; sid:1;)");
FAIL_IF_NULL(s);
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
@ -301,10 +295,8 @@ static int DetectTlsSniTest02(void)
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
STREAM_TOSERVER, buf, sizeof(buf));
FLOWLOCK_UNLOCK(&f);
FAIL_IF(r != 0);
ssl_state = f.alstate;

4
src/detect-tls-version.c
Unescape Escape View File

@ -355,7 +355,6 @@ static int DetectTlsVersionTestDetect01(void)
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
STREAM_TOSERVER, tlsbuf1, tlslen1);
FAIL_IF(r != 0);
@ -371,7 +370,6 @@ static int DetectTlsVersionTestDetect01(void)
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER,
tlsbuf4, tlslen4);
FAIL_IF(r != 0);
FLOWLOCK_UNLOCK(&f);
SSLState *ssl_state = f.alstate;
FAIL_IF_NULL(ssl_state);
@ -451,7 +449,6 @@ static int DetectTlsVersionTestDetect02(void)
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
STREAM_TOSERVER, tlsbuf1, tlslen1);
FAIL_IF(r != 0);
@ -467,7 +464,6 @@ static int DetectTlsVersionTestDetect02(void)
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER,
tlsbuf4, tlslen4);
FAIL_IF(r != 0);
FLOWLOCK_UNLOCK(&f);
SSLState *ssl_state = f.alstate;
FAIL_IF_NULL(ssl_state);

Write Preview
Loading…
Cancel
Save