return result;
}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+int DetectFastPatternTest507(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:!\"oneonetwo\"; fast_pattern:3,4; "
+ "content:\"three\"; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ ud->flags & DETECT_CONTENT_NEGATED &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
+ ud->fp_chop_offset == 3 &&
+ ud->fp_chop_len == 4) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+/**
+ * \test Checks if a fast_pattern is registered in a Signature for uricontent.
+ */
+int DetectFastPatternTest508(void)
+{
+ SigMatch *sm = NULL;
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; fast_pattern:only; "
+ "msg:\"Testing fast_pattern\"; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+
+ result = 0;
+ sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
+ if (sm != NULL) {
+ if ( ((DetectContentData *)sm->ctx)->flags &
+ DETECT_CONTENT_FAST_PATTERN) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+ }
+
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+/**
+ * \test Checks if a fast_pattern is registered in a Signature for uricontent.
+ */
+int DetectFastPatternTest509(void)
+{
+ SigMatch *sm = NULL;
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"oneoneone\"; fast_pattern:3,4; "
+ "msg:\"Testing fast_pattern\"; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+
+ result = 0;
+ sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
+ if (sm != NULL) {
+ if ( ((DetectContentData *)sm->ctx)->flags &
+ DETECT_CONTENT_FAST_PATTERN) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest510(void)
+{
+ SigMatch *sm = NULL;
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; fast_pattern:only; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+
+ sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
+ if (sm == NULL) {
+ goto end;
+ }
+ DetectContentData *ud = sm->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
+ ud->fp_chop_offset == 0 &&
+ ud->fp_chop_len == 0) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest511(void)
+{
+ SigMatch *sm = NULL;
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"oneoneone\"; fast_pattern:3,4; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+
+ sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
+ if (sm == NULL) {
+ goto end;
+ }
+
+ DetectContentData *ud = sm->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
+ ud->fp_chop_offset == 3 &&
+ ud->fp_chop_len == 4) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest512(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; fast_pattern:only; distance:10; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest513(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; distance:10; fast_pattern:only; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest514(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; fast_pattern:only; within:10; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest515(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; within:10; fast_pattern:only; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest516(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; fast_pattern:only; offset:10; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest517(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; offset:10; fast_pattern:only; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest518(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; fast_pattern:only; depth:10; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest519(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; depth:10; fast_pattern:only; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest520(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:!\"two\"; fast_pattern:only; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest521(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\" one\"; "
+ "content:\"two\"; distance:30; "
+ "content:\"two\"; fast_pattern:only; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
+ ud->fp_chop_offset == 0 &&
+ ud->fp_chop_len == 0) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest522(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; within:30; "
+ "content:\"two\"; fast_pattern:only; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
+ ud->fp_chop_offset == 0 &&
+ ud->fp_chop_len == 0) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest523(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; offset:30; "
+ "content:\"two\"; fast_pattern:only; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
+ ud->fp_chop_offset == 0 &&
+ ud->fp_chop_len == 0) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest524(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; depth:30; "
+ "content:\"two\"; fast_pattern:only; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
+ ud->fp_chop_offset == 0 &&
+ ud->fp_chop_len == 0) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest525(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:!\"one\"; fast_pattern; "
+ "content:\"two\"; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ ud->flags & DETECT_CONTENT_NEGATED &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
+ ud->fp_chop_offset == 0 &&
+ ud->fp_chop_len == 0) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest526(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"two\"; "
+ "content:!\"one\"; fast_pattern; distance:20; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest527(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"two\"; "
+ "content:!\"one\"; fast_pattern; within:20; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest528(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"two\"; "
+ "content:!\"one\"; fast_pattern; offset:20; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest529(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"two\"; "
+ "content:!\"one\"; fast_pattern; depth:20; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest530(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"oneonetwo\"; fast_pattern:3,4; "
+ "content:\"three\"; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
+ ud->fp_chop_offset == 3 &&
+ ud->fp_chop_len == 4) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest531(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"oneonetwo\"; fast_pattern:3,4; "
+ "content:\"three\"; distance:30; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
+ ud->fp_chop_offset == 3 &&
+ ud->fp_chop_len == 4) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest532(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"oneonetwo\"; fast_pattern:3,4; "
+ "content:\"three\"; within:30; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
+ ud->fp_chop_offset == 3 &&
+ ud->fp_chop_len == 4) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest533(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"oneonetwo\"; fast_pattern:3,4; "
+ "content:\"three\"; offset:30; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
+ ud->fp_chop_offset == 3 &&
+ ud->fp_chop_len == 4) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest534(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"oneonetwo\"; fast_pattern:3,4; "
+ "content:\"three\"; depth:30; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
+ ud->fp_chop_offset == 3 &&
+ ud->fp_chop_len == 4) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest535(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; distance:10; "
+ "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
+ ud->fp_chop_offset == 3 &&
+ ud->fp_chop_len == 4) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest536(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; within:10; "
+ "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
+ ud->fp_chop_offset == 3 &&
+ ud->fp_chop_len == 4) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest537(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; offset:10; "
+ "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
+ ud->fp_chop_offset == 3 &&
+ ud->fp_chop_len == 4) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest538(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; depth:10; "
+ "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
+ ud->fp_chop_offset == 3 &&
+ ud->fp_chop_len == 4) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest539(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; fast_pattern:65977,4; "
+ "content:\"three\"; distance:10; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest540(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"oneonetwo\"; fast_pattern:3,65977; "
+ "content:\"three\"; distance:10; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest541(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:\"two\"; fast_pattern:65534,4; "
+ "content:\"three\"; distance:10; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest542(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:!\"oneonetwo\"; fast_pattern:3,4; "
+ "content:\"three\"; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ ud->flags & DETECT_CONTENT_NEGATED &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
+ ud->fp_chop_offset == 3 &&
+ ud->fp_chop_len == 4) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest543(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:!\"oneonetwo\"; fast_pattern:3,4; distance:10; "
+ "content:\"three\"; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest544(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:!\"oneonetwo\"; fast_pattern:3,4; within:10; "
+ "content:\"three\"; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest545(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:!\"oneonetwo\"; fast_pattern:3,4; offset:10; "
+ "content:\"three\"; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest546(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:!\"oneonetwo\"; fast_pattern:3,4; depth:10; "
+ "content:\"three\"; sid:1;)");
+ if (de_ctx->sig_list != NULL)
+ goto end;
+
+ result = 1;
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
+int DetectFastPatternTest547(void)
+{
+ DetectEngineCtx *de_ctx = NULL;
+ int result = 0;
+
+ if ( (de_ctx = DetectEngineCtxInit()) == NULL)
+ goto end;
+
+ de_ctx->flags |= DE_QUIET;
+ de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
+ "(file_data; content:\"one\"; "
+ "content:!\"oneonetwo\"; fast_pattern:3,4; "
+ "content:\"three\"; sid:1;)");
+ if (de_ctx->sig_list == NULL)
+ goto end;
+ DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
+ if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
+ ud->flags & DETECT_CONTENT_NEGATED &&
+ !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
+ ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
+ ud->fp_chop_offset == 3 &&
+ ud->fp_chop_len == 4) {
+ result = 1;
+ } else {
+ result = 0;
+ }
+
+ end:
+ SigCleanSignatures(de_ctx);
+ DetectEngineCtxFree(de_ctx);
+ return result;
+}
+
#endif
void DetectFastPatternRegisterTests(void)
UtRegisterTest("DetectFastPatternTest504", DetectFastPatternTest504, 1);
UtRegisterTest("DetectFastPatternTest505", DetectFastPatternTest505, 1);
UtRegisterTest("DetectFastPatternTest506", DetectFastPatternTest506, 1);
+ /* http_server_body fast_pattern tests ^ */
+ /* file_data fast_pattern tests v */
+ UtRegisterTest("DetectFastPatternTest507", DetectFastPatternTest507, 1);
+ UtRegisterTest("DetectFastPatternTest508", DetectFastPatternTest508, 1);
+ UtRegisterTest("DetectFastPatternTest509", DetectFastPatternTest509, 1);
+ UtRegisterTest("DetectFastPatternTest510", DetectFastPatternTest510, 1);
+ UtRegisterTest("DetectFastPatternTest511", DetectFastPatternTest511, 1);
+ UtRegisterTest("DetectFastPatternTest512", DetectFastPatternTest512, 1);
+ UtRegisterTest("DetectFastPatternTest513", DetectFastPatternTest513, 1);
+ UtRegisterTest("DetectFastPatternTest514", DetectFastPatternTest514, 1);
+ UtRegisterTest("DetectFastPatternTest515", DetectFastPatternTest515, 1);
+ UtRegisterTest("DetectFastPatternTest516", DetectFastPatternTest516, 1);
+ UtRegisterTest("DetectFastPatternTest517", DetectFastPatternTest517, 1);
+ UtRegisterTest("DetectFastPatternTest518", DetectFastPatternTest518, 1);
+ UtRegisterTest("DetectFastPatternTest519", DetectFastPatternTest519, 1);
+ UtRegisterTest("DetectFastPatternTest520", DetectFastPatternTest520, 1);
+ UtRegisterTest("DetectFastPatternTest521", DetectFastPatternTest521, 1);
+ UtRegisterTest("DetectFastPatternTest522", DetectFastPatternTest522, 1);
+ UtRegisterTest("DetectFastPatternTest523", DetectFastPatternTest523, 1);
+ UtRegisterTest("DetectFastPatternTest524", DetectFastPatternTest524, 1);
+ UtRegisterTest("DetectFastPatternTest525", DetectFastPatternTest525, 1);
+ UtRegisterTest("DetectFastPatternTest526", DetectFastPatternTest526, 1);
+ UtRegisterTest("DetectFastPatternTest527", DetectFastPatternTest527, 1);
+ UtRegisterTest("DetectFastPatternTest528", DetectFastPatternTest528, 1);
+ UtRegisterTest("DetectFastPatternTest529", DetectFastPatternTest529, 1);
+ UtRegisterTest("DetectFastPatternTest530", DetectFastPatternTest530, 1);
+ UtRegisterTest("DetectFastPatternTest531", DetectFastPatternTest531, 1);
+ UtRegisterTest("DetectFastPatternTest532", DetectFastPatternTest532, 1);
+ UtRegisterTest("DetectFastPatternTest533", DetectFastPatternTest533, 1);
+ UtRegisterTest("DetectFastPatternTest534", DetectFastPatternTest534, 1);
+ UtRegisterTest("DetectFastPatternTest535", DetectFastPatternTest535, 1);
+ UtRegisterTest("DetectFastPatternTest536", DetectFastPatternTest536, 1);
+ UtRegisterTest("DetectFastPatternTest537", DetectFastPatternTest537, 1);
+ UtRegisterTest("DetectFastPatternTest538", DetectFastPatternTest538, 1);
+ UtRegisterTest("DetectFastPatternTest539", DetectFastPatternTest539, 1);
+ UtRegisterTest("DetectFastPatternTest540", DetectFastPatternTest540, 1);
+ UtRegisterTest("DetectFastPatternTest541", DetectFastPatternTest541, 1);
+ UtRegisterTest("DetectFastPatternTest542", DetectFastPatternTest542, 1);
+ UtRegisterTest("DetectFastPatternTest543", DetectFastPatternTest543, 1);
+ UtRegisterTest("DetectFastPatternTest544", DetectFastPatternTest544, 1);
+ UtRegisterTest("DetectFastPatternTest545", DetectFastPatternTest545, 1);
+ UtRegisterTest("DetectFastPatternTest546", DetectFastPatternTest546, 1);
+ UtRegisterTest("DetectFastPatternTest547", DetectFastPatternTest547, 1);
#endif
return;
projects / thirdparty / suricata.git / commitdiff
