aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/http_client_body: use list util in tests

Browse Source 
Cleanups.
pull/8732/head
Victor Julien 2 years ago
parent 45d92a330c
commit 5cb2e6ad6a
1 changed files with 224 additions and 196 deletions
Show Stats Download Patch File Download Diff File

420
src/tests/detect-http-client-body.c
Unescape Escape View File

@ -2202,109 +2202,84 @@ end:
static int DetectHttpClientBodyTest22(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(content:\"one\"; content:\"two\"; http_client_body; "
"content:\"three\"; distance:10; http_client_body; content:\"four\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("de_ctx->sig_list == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
goto end;
}
DetectContentData *cd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
if (cd1->flags != 0 || memcmp(cd1->content, "one", cd1->content_len) != 0 ||
cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 ||
hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT ||
memcmp(hcbd1->content, "two", hcbd1->content_len) != 0 ||
hcbd2->flags != DETECT_CONTENT_DISTANCE ||
memcmp(hcbd2->content, "three", hcbd1->content_len) != 0) {
goto end;
}
if (!DETECT_CONTENT_IS_SINGLE(cd1) ||
!DETECT_CONTENT_IS_SINGLE(cd2) ||
DETECT_CONTENT_IS_SINGLE(hcbd1) ||
DETECT_CONTENT_IS_SINGLE(hcbd2)) {
goto end;
}
Signature *s = DetectEngineAppendSig(de_ctx,
"alert icmp any any -> any any "
"(content:\"one\"; content:\"two\"; http_client_body; "
"content:\"three\"; distance:10; http_client_body; content:\"four\"; sid:1;)");
FAIL_IF_NULL(s);
FAIL_IF_NULL(s->init_data->smlists[DETECT_SM_LIST_PMATCH]);
FAIL_IF(DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL);
SigMatch *sm = DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id);
FAIL_IF_NULL(sm);
result = 1;
DetectContentData *cd1 =
(DetectContentData *)s->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd2 =
(DetectContentData *)s->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectContentData *hcbd1 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
->prev->ctx;
DetectContentData *hcbd2 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
FAIL_IF(cd1->flags != 0);
FAIL_IF(memcmp(cd1->content, "one", cd1->content_len) != 0);
FAIL_IF(cd2->flags != 0);
FAIL_IF(memcmp(cd2->content, "four", cd2->content_len) != 0);
FAIL_IF(hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT);
FAIL_IF(memcmp(hcbd1->content, "two", hcbd1->content_len) != 0);
FAIL_IF(hcbd2->flags != DETECT_CONTENT_DISTANCE);
FAIL_IF(memcmp(hcbd2->content, "three", hcbd1->content_len) != 0);
FAIL_IF(!DETECT_CONTENT_IS_SINGLE(cd1));
FAIL_IF(!DETECT_CONTENT_IS_SINGLE(cd2));
FAIL_IF(DETECT_CONTENT_IS_SINGLE(hcbd1));
FAIL_IF(DETECT_CONTENT_IS_SINGLE(hcbd2));
end:
DetectEngineCtxFree(de_ctx);
return result;
PASS;
}
static int DetectHttpClientBodyTest23(void)
{
DetectEngineCtx *de_ctx = NULL;
int result = 0;
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
goto end;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(content:\"one\"; http_client_body; pcre:/two/; "
"content:\"three\"; distance:10; http_client_body; content:\"four\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("de_ctx->sig_list == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
goto end;
}
DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
if (pd1->flags != 0 ||
cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 ||
hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT ||
memcmp(hcbd1->content, "one", hcbd1->content_len) != 0 ||
hcbd2->flags != DETECT_CONTENT_DISTANCE ||
memcmp(hcbd2->content, "three", hcbd1->content_len) != 0) {
goto end;
}
if (!DETECT_CONTENT_IS_SINGLE(cd2) ||
DETECT_CONTENT_IS_SINGLE(hcbd1) ||
DETECT_CONTENT_IS_SINGLE(hcbd2)) {
goto end;
}
result = 1;
Signature *s = DetectEngineAppendSig(de_ctx,
"alert icmp any any -> any any "
"(content:\"one\"; http_client_body; pcre:/two/; "
"content:\"three\"; distance:10; http_client_body; content:\"four\"; sid:1;)");
FAIL_IF_NULL(s);
FAIL_IF_NULL(s->init_data->smlists[DETECT_SM_LIST_PMATCH]);
FAIL_IF_NULL(DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id));
DetectPcreData *pd1 =
(DetectPcreData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
->prev->ctx;
DetectContentData *cd2 =
(DetectContentData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
->ctx;
DetectContentData *hcbd1 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
->prev->ctx;
DetectContentData *hcbd2 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
FAIL_IF(pd1->flags != 0);
FAIL_IF(cd2->flags != 0);
FAIL_IF(memcmp(cd2->content, "four", cd2->content_len) != 0);
FAIL_IF(hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT);
FAIL_IF(memcmp(hcbd1->content, "one", hcbd1->content_len) != 0);
FAIL_IF(hcbd2->flags != DETECT_CONTENT_DISTANCE);
FAIL_IF(memcmp(hcbd2->content, "three", hcbd1->content_len) != 0);
FAIL_IF(!DETECT_CONTENT_IS_SINGLE(cd2));
FAIL_IF(DETECT_CONTENT_IS_SINGLE(hcbd1));
FAIL_IF(DETECT_CONTENT_IS_SINGLE(hcbd2));
end:
DetectEngineCtxFree(de_ctx);
return result;
PASS;
}
static int DetectHttpClientBodyTest24(void)
@ -2316,28 +2291,36 @@ static int DetectHttpClientBodyTest24(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(content:\"one\"; http_client_body; pcre:/two/; "
"content:\"three\"; distance:10; within:15; http_client_body; content:\"four\"; sid:1;)");
Signature *s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
"(content:\"one\"; http_client_body; pcre:/two/; "
"content:\"three\"; distance:10; within:15; "
"http_client_body; content:\"four\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("de_ctx->sig_list == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
goto end;
}
DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
DetectPcreData *pd1 =
(DetectPcreData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
->prev->ctx;
DetectContentData *cd2 =
(DetectContentData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
->ctx;
DetectContentData *hcbd1 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
->prev->ctx;
DetectContentData *hcbd2 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
if (pd1->flags != 0 ||
cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 ||
hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT ||
@ -2369,29 +2352,37 @@ static int DetectHttpClientBodyTest25(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(content:\"one\"; http_client_body; pcre:/two/; "
"content:\"three\"; distance:10; http_client_body; "
"content:\"four\"; distance:10; sid:1;)");
Signature *s =
DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
"(content:\"one\"; http_client_body; pcre:/two/; "
"content:\"three\"; distance:10; http_client_body; "
"content:\"four\"; distance:10; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("de_ctx->sig_list == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
goto end;
}
DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
DetectPcreData *pd1 =
(DetectPcreData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
->prev->ctx;
DetectContentData *cd2 =
(DetectContentData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
->ctx;
DetectContentData *hcbd1 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
->prev->ctx;
DetectContentData *hcbd2 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
if (pd1->flags != DETECT_PCRE_RELATIVE_NEXT ||
cd2->flags != DETECT_CONTENT_DISTANCE ||
memcmp(cd2->content, "four", cd2->content_len) != 0 ||
@ -2424,29 +2415,37 @@ static int DetectHttpClientBodyTest26(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(content:\"one\"; offset:10; http_client_body; pcre:/two/; "
"content:\"three\"; distance:10; http_client_body; within:10; "
"content:\"four\"; distance:10; sid:1;)");
Signature *s = DetectEngineAppendSig(de_ctx,
"alert icmp any any -> any any "
"(content:\"one\"; offset:10; http_client_body; pcre:/two/; "
"content:\"three\"; distance:10; http_client_body; within:10; "
"content:\"four\"; distance:10; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("de_ctx->sig_list == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
goto end;
}
DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
DetectPcreData *pd1 =
(DetectPcreData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
->prev->ctx;
DetectContentData *cd2 =
(DetectContentData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
->ctx;
DetectContentData *hcbd1 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
->prev->ctx;
DetectContentData *hcbd2 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) ||
cd2->flags != DETECT_CONTENT_DISTANCE ||
memcmp(cd2->content, "four", cd2->content_len) != 0 ||
@ -2503,29 +2502,36 @@ static int DetectHttpClientBodyTest28(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(content:\"one\"; http_client_body; pcre:/two/; "
"content:\"three\"; http_client_body; depth:10; "
"content:\"four\"; distance:10; sid:1;)");
Signature *s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
"(content:\"one\"; http_client_body; pcre:/two/; "
"content:\"three\"; http_client_body; depth:10; "
"content:\"four\"; distance:10; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("de_ctx->sig_list == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
goto end;
}
DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
DetectPcreData *pd1 =
(DetectPcreData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
->prev->ctx;
DetectContentData *cd2 =
(DetectContentData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
->ctx;
DetectContentData *hcbd1 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
->prev->ctx;
DetectContentData *hcbd2 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) ||
cd2->flags != DETECT_CONTENT_DISTANCE ||
memcmp(cd2->content, "four", cd2->content_len) != 0 ||
@ -2558,26 +2564,30 @@ static int DetectHttpClientBodyTest29(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(content:\"one\"; http_client_body; "
"content:\"two\"; distance:0; http_client_body; sid:1;)");
Signature *s =
DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
"(content:\"one\"; http_client_body; "
"content:\"two\"; distance:0; http_client_body; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("de_ctx->sig_list == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL) {
printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
goto end;
}
DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
DetectContentData *hcbd1 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
->prev->ctx;
DetectContentData *hcbd2 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
if (hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT ||
memcmp(hcbd1->content, "one", hcbd1->content_len) != 0 ||
hcbd2->flags != DETECT_CONTENT_DISTANCE ||
@ -2601,26 +2611,30 @@ static int DetectHttpClientBodyTest30(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(content:\"one\"; http_client_body; "
"content:\"two\"; within:5; http_client_body; sid:1;)");
Signature *s =
DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
"(content:\"one\"; http_client_body; "
"content:\"two\"; within:5; http_client_body; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("de_ctx->sig_list == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL) {
printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
goto end;
}
DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
DetectContentData *hcbd1 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
->prev->ctx;
DetectContentData *hcbd2 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
if (hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT ||
memcmp(hcbd1->content, "one", hcbd1->content_len) != 0 ||
hcbd2->flags != DETECT_CONTENT_WITHIN ||
@ -2706,34 +2720,39 @@ static int DetectHttpClientBodyTest34(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(pcre:/one/P; "
"content:\"two\"; within:5; http_client_body; sid:1;)");
Signature *s =
DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
"(pcre:/one/P; "
"content:\"two\"; within:5; http_client_body; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("de_ctx->sig_list == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL) {
printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id] == NULL ||
de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->type != DETECT_CONTENT ||
de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev == NULL ||
de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->type != DETECT_PCRE) {
if (DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id) == NULL ||
DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->type != DETECT_CONTENT ||
DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->prev == NULL ||
DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->prev->type !=
DETECT_PCRE) {
goto end;
}
DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
DetectPcreData *pd1 =
(DetectPcreData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
->prev->ctx;
DetectContentData *hcbd2 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) ||
hcbd2->flags != DETECT_CONTENT_WITHIN ||
memcmp(hcbd2->content, "two", hcbd2->content_len) != 0) {
@ -2756,34 +2775,38 @@ static int DetectHttpClientBodyTest35(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(content:\"two\"; http_client_body; "
"pcre:/one/PR; sid:1;)");
Signature *s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
"(content:\"two\"; http_client_body; "
"pcre:/one/PR; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("de_ctx->sig_list == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL) {
printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id] == NULL ||
de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->type != DETECT_PCRE ||
de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev == NULL ||
de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->type != DETECT_CONTENT) {
if (DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id) == NULL ||
DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->type != DETECT_PCRE ||
DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->prev == NULL ||
DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->prev->type !=
DETECT_CONTENT) {
goto end;
}
DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
DetectPcreData *pd2 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
DetectContentData *hcbd1 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
->prev->ctx;
DetectPcreData *pd2 =
(DetectPcreData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
if (pd2->flags != (DETECT_PCRE_RELATIVE) ||
hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT ||
memcmp(hcbd1->content, "two", hcbd1->content_len) != 0) {
@ -2806,34 +2829,39 @@ static int DetectHttpClientBodyTest36(void)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
"(pcre:/one/P; "
"content:\"two\"; distance:5; http_client_body; sid:1;)");
Signature *s =
DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
"(pcre:/one/P; "
"content:\"two\"; distance:5; http_client_body; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("de_ctx->sig_list == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL) {
printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
goto end;
}
if (de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id] == NULL ||
de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->type != DETECT_CONTENT ||
de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev == NULL ||
de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->type != DETECT_PCRE) {
if (DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id) == NULL ||
DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->type != DETECT_CONTENT ||
DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->prev == NULL ||
DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->prev->type !=
DETECT_PCRE) {
goto end;
}
DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
DetectPcreData *pd1 =
(DetectPcreData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
->prev->ctx;
DetectContentData *hcbd2 =
(DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) ||
hcbd2->flags != DETECT_CONTENT_DISTANCE ||
memcmp(hcbd2->content, "two", hcbd2->content_len) != 0) {
@ -2859,7 +2887,7 @@ static int DetectHttpClientBodyIsdataatParseTest(void)
"isdataat:!4,relative; sid:1;)");
FAIL_IF_NULL(s);
SigMatch *sm = s->init_data->smlists_tail[g_http_client_body_buffer_id];
SigMatch *sm = DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id);
FAIL_IF_NULL(sm);
FAIL_IF_NOT(sm->type == DETECT_ISDATAAT);

Write Preview
Loading…
Cancel
Save