diff --git a/src/util-threshold-config.c b/src/util-threshold-config.c index ca4f81df79..0a67d286ac 100644 --- a/src/util-threshold-config.c +++ b/src/util-threshold-config.c @@ -2377,6 +2377,156 @@ end: return result; } +/** + * \brief Creates a dummy threshold file, with all valid options, for testing purposes. + * + * \retval fd Pointer to file descriptor. + */ +static FILE *SCThresholdConfGenerateInvalidDummyFD12() +{ + FILE *fd = NULL; + const char *buffer = + "suppress gen_id 1, sig_id 2200029, track by_dst, ip fe80::/16\n" + "suppress gen_id 1, sig_id 2200029, track by_stc, ip fe80::/16\n"; + + fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); + if (fd == NULL) + SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); + + return fd; +} + +/** + * \test Check if the suppress rule parsing handles errors correctly + * + * \retval 1 on succces + * \retval 0 on failure + */ +static int SCThresholdConfTest18(void) +{ + Signature *s = NULL; + int result = 0; + FILE *fd = NULL; + SigMatch *sm = NULL; + DetectThresholdData *de = NULL; + + HostInitConfig(HOST_QUIET); + DetectEngineCtx *de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) + return result; + de_ctx->flags |= DE_QUIET; + + s = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.0.10 any -> 192.168.0.100 any (msg:\"suppress test\"; gid:1; sid:2200029;)"); + if (s == NULL) { + goto end; + } + + fd = SCThresholdConfGenerateInvalidDummyFD12(); + SCThresholdConfInitContext(de_ctx,fd); + SigGroupBuild(de_ctx); + + if (s->sm_lists[DETECT_SM_LIST_THRESHOLD] == NULL) { + printf("no thresholds: "); + goto end; + } + sm = s->sm_lists[DETECT_SM_LIST_THRESHOLD]; + if (sm == NULL) { + printf("no sm: "); + goto end; + } + + de = (DetectThresholdData *)sm->ctx; + if (de == NULL) { + printf("no de: "); + goto end; + } + if (!(de->type == TYPE_SUPPRESS && de->track == TRACK_DST)) { + printf("de state wrong: "); + goto end; + } + + result = 1; +end: + DetectEngineCtxFree(de_ctx); + HostShutdown(); + return result; +} + +/** + * \brief Creates a dummy threshold file, with all valid options, for testing purposes. + * + * \retval fd Pointer to file descriptor. + */ +static FILE *SCThresholdConfGenerateInvalidDummyFD13() +{ + FILE *fd = NULL; + const char *buffer = + "suppress gen_id 1, sig_id 2200029, track by_stc, ip fe80::/16\n" + "suppress gen_id 1, sig_id 2200029, track by_dst, ip fe80::/16\n"; + + fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); + if (fd == NULL) + SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); + + return fd; +} + +/** + * \test Check if the suppress rule parsing handles errors correctly + * + * \retval 1 on succces + * \retval 0 on failure + */ +static int SCThresholdConfTest19(void) +{ + Signature *s = NULL; + int result = 0; + FILE *fd = NULL; + SigMatch *sm = NULL; + DetectThresholdData *de = NULL; + + HostInitConfig(HOST_QUIET); + DetectEngineCtx *de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) + return result; + de_ctx->flags |= DE_QUIET; + + s = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.0.10 any -> 192.168.0.100 any (msg:\"suppress test\"; gid:1; sid:2200029;)"); + if (s == NULL) { + goto end; + } + + fd = SCThresholdConfGenerateInvalidDummyFD13(); + SCThresholdConfInitContext(de_ctx,fd); + SigGroupBuild(de_ctx); + + if (s->sm_lists[DETECT_SM_LIST_THRESHOLD] == NULL) { + printf("no thresholds: "); + goto end; + } + sm = s->sm_lists[DETECT_SM_LIST_THRESHOLD]; + if (sm == NULL) { + printf("no sm: "); + goto end; + } + + de = (DetectThresholdData *)sm->ctx; + if (de == NULL) { + printf("no de: "); + goto end; + } + if (!(de->type == TYPE_SUPPRESS && de->track == TRACK_DST)) { + printf("de state wrong: "); + goto end; + } + + result = 1; +end: + DetectEngineCtxFree(de_ctx); + HostShutdown(); + return result; +} + #endif /* UNITTESTS */ /** @@ -2402,6 +2552,9 @@ void SCThresholdConfRegisterTests(void) UtRegisterTest("SCThresholdConfTest15 - suppress drop", SCThresholdConfTest15, 1); UtRegisterTest("SCThresholdConfTest16 - suppress drop", SCThresholdConfTest16, 1); UtRegisterTest("SCThresholdConfTest17 - suppress drop", SCThresholdConfTest17, 1); + + UtRegisterTest("SCThresholdConfTest18 - suppress parsing", SCThresholdConfTest18, 1); + UtRegisterTest("SCThresholdConfTest19 - suppress parsing", SCThresholdConfTest19, 1); #endif /* UNITTESTS */ }