return result;
}
-/**
- * \test Checks if a http_stat_code is registered in a Signature, if content is not
- * specified in the signature or rawbyes is specified or fast_pattern is
- * provided in the signature.
- */
-static int DetectHttpStatCodeTest01(void)
-{
- DetectEngineCtx *de_ctx = NULL;
- int result = 0;
-
- if ((de_ctx = DetectEngineCtxInit()) == NULL) {
- printf("DetectEngineCtxInit failed: ");
- goto end;
- }
-
- de_ctx->flags |= DE_QUIET;
- de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
- "(msg:\"Testing http_stat_code\"; http_stat_code; sid:1;)");
- if (de_ctx->sig_list != NULL) {
- printf("sid 1 parse failed to error out: ");
- goto end;
- }
-
- de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
- "(msg:\"Testing http_stat_code\"; content:\"|FF F1|\";"
- " rawbytes; http_stat_code; sid:2;)");
- if (de_ctx->sig_list != NULL) {
- printf("sid 2 parse failed to error out: ");
- goto end;
- }
-
- de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
- "(msg:\"Testing http_stat_code\"; content:\"100\";"
- "fast_pattern; http_stat_code; sid:3;)");
- if (de_ctx->sig_list == NULL) {
- printf("sid 3 parse failed: ");
- goto end;
- }
- if (!(((DetectContentData *)de_ctx->sig_list->sm_lists[g_http_stat_code_buffer_id]->ctx)->flags &
- DETECT_CONTENT_FAST_PATTERN))
- {
- goto end;
- }
-
- result = 1;
-end:
- if (de_ctx != NULL)
- DetectEngineCtxFree(de_ctx);
- return result;
-}
-
-/**
- * \test Checks if a http_stat_code is registered in a Signature and also checks
- * the nocase
- */
-static int DetectHttpStatCodeTest02(void)
-{
- SigMatch *sm = NULL;
- DetectEngineCtx *de_ctx = NULL;
- int result = 0;
-
- if ( (de_ctx = DetectEngineCtxInit()) == NULL)
- goto end;
-
- de_ctx->flags |= DE_QUIET;
- de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
- "(msg:\"Testing http_stat_code\"; content:\"one\"; "
- "http_stat_code; content:\"200\"; http_stat_code; "
- "content:\"two hundred\"; nocase; http_stat_code; "
- "sid:1;)");
- if (de_ctx->sig_list == NULL) {
- printf("sig parse failed: ");
- goto end;
- }
-
- result = 0;
- sm = de_ctx->sig_list->sm_lists[g_http_stat_code_buffer_id];
- if (sm == NULL) {
- printf("no sigmatch(es): ");
- goto end;
- }
-
- SigMatch *prev = NULL;
- while (sm != NULL) {
- if (sm->type == DETECT_CONTENT) {
- result = 1;
- } else {
- printf("expected DETECT_CONTENT for http_stat_code, got %d: ", sm->type);
- goto end;
- }
- prev = sm;
- sm = sm->next;
- }
-
- if (! (((DetectContentData *)prev->ctx)->flags &
- DETECT_CONTENT_NOCASE))
- {
- result = 0;
- }
-end:
- if (de_ctx != NULL)
- DetectEngineCtxFree(de_ctx);
- return result;
-}
-
/** \test Check the signature working to alert when http_stat_code is matched . */
static int DetectHttpStatCodeSigTest01(void)
{
UtRegisterTest("DetectEngineHttpStatCodeTest15",
DetectEngineHttpStatCodeTest15);
- UtRegisterTest("DetectHttpStatCodeTest01", DetectHttpStatCodeTest01);
- UtRegisterTest("DetectHttpStatCodeTest02", DetectHttpStatCodeTest02);
UtRegisterTest("DetectHttpStatCodeSigTest01", DetectHttpStatCodeSigTest01);
UtRegisterTest("DetectHttpStatCodeSigTest02", DetectHttpStatCodeSigTest02);
UtRegisterTest("DetectHttpStatCodeSigTest03", DetectHttpStatCodeSigTest03);