-/* Copyright (C) 2007-2020 Open Information Security Foundation
+/* Copyright (C) 2007-2022 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
PASS;
}
-/**
- * \test FlowBitsTestSig09 is to test isset flowbits option with oring
- *
- * \retval 1 on success
- * \retval 0 on failure
- */
-
-static int FlowBitsTestSig09(void)
-{
- uint8_t *buf = (uint8_t *)
- "GET /one/ HTTP/1.1\r\n"
- "Host: one.example.org\r\n"
- "\r\n";
- uint16_t buflen = strlen((char *)buf);
- Packet *p = SCMalloc(SIZE_OF_PACKET);
- FAIL_IF_NULL(p);
- Signature *s = NULL;
- ThreadVars th_v;
- DetectEngineThreadCtx *det_ctx = NULL;
- DetectEngineCtx *de_ctx = NULL;
- Flow f;
-
- memset(p, 0, SIZE_OF_PACKET);
- memset(&th_v, 0, sizeof(th_v));
- memset(&f, 0, sizeof(Flow));
-
- FLOW_INITIALIZE(&f);
- p->flow = &f;
-
- p->src.family = AF_INET;
- p->dst.family = AF_INET;
- p->payload = buf;
- p->payload_len = buflen;
- p->proto = IPPROTO_TCP;
- p->flags |= PKT_HAS_FLOW;
- p->flowflags |= FLOW_PKT_TOSERVER;
-
- de_ctx = DetectEngineCtxInit();
- FAIL_IF_NULL(de_ctx);
-
- de_ctx->flags |= DE_QUIET;
-
- s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit set\"; flowbits:set,fb1; sid:1;)");
- FAIL_IF_NULL(s);
- s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit set\"; flowbits:set,fb2; sid:2;)");
- FAIL_IF_NULL(s);
- s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit isset ored flowbits\"; flowbits:isset,fb3|fb4; sid:3;)");
- FAIL_IF_NULL(s);
-
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
-
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
-
- FAIL_IF_NOT(PacketAlertCheck(p, 1));
- FAIL_IF_NOT(PacketAlertCheck(p, 2));
- FAIL_IF(PacketAlertCheck(p, 3));
-
- DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
- DetectEngineCtxFree(de_ctx);
-
- FLOW_DESTROY(&f);
-
- SCFree(p);
- PASS;
-}
-
-/**
- * \test FlowBitsTestSig10 is to test isset flowbits option with oring
- *
- * \retval 1 on success
- * \retval 0 on failure
- */
-
-static int FlowBitsTestSig10(void)
-{
- uint8_t *buf = (uint8_t *)
- "GET /one/ HTTP/1.1\r\n"
- "Host: one.example.org\r\n"
- "\r\n";
- uint16_t buflen = strlen((char *)buf);
- Packet *p = SCMalloc(SIZE_OF_PACKET);
- FAIL_IF_NULL(p);
- Signature *s = NULL;
- ThreadVars th_v;
- DetectEngineThreadCtx *det_ctx = NULL;
- DetectEngineCtx *de_ctx = NULL;
- Flow f;
-
- memset(p, 0, SIZE_OF_PACKET);
- memset(&th_v, 0, sizeof(th_v));
- memset(&f, 0, sizeof(Flow));
-
- FLOW_INITIALIZE(&f);
- p->flow = &f;
-
- p->src.family = AF_INET;
- p->dst.family = AF_INET;
- p->payload = buf;
- p->payload_len = buflen;
- p->proto = IPPROTO_TCP;
- p->flags |= PKT_HAS_FLOW;
- p->flowflags |= FLOW_PKT_TOSERVER;
-
- de_ctx = DetectEngineCtxInit();
- FAIL_IF_NULL(de_ctx);
-
- de_ctx->flags |= DE_QUIET;
-
- s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit set\"; flowbits:set,fb1; sid:1;)");
- FAIL_IF_NULL(s);
- s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit set\"; flowbits:set,fb2; sid:2;)");
- FAIL_IF_NULL(s);
- s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit set\"; flowbits:set,fb3; sid:3;)");
- FAIL_IF_NULL(s);
- s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit isset ored flowbits\"; flowbits:isset,fb3|fb4; sid:4;)");
- FAIL_IF_NULL(s);
-
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
-
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
-
- FAIL_IF_NOT(PacketAlertCheck(p, 1));
- FAIL_IF_NOT(PacketAlertCheck(p, 2));
- FAIL_IF_NOT(PacketAlertCheck(p, 3));
- FAIL_IF_NOT(PacketAlertCheck(p, 4));
-
- DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
- DetectEngineCtxFree(de_ctx);
-
- FLOW_DESTROY(&f);
-
- SCFree(p);
- PASS;
-}
-
-/**
- * \test FlowBitsTestSig11 is to test isnotset flowbits option with oring
- *
- * \retval 1 on success
- * \retval 0 on failure
- */
-
-static int FlowBitsTestSig11(void)
-{
- uint8_t *buf = (uint8_t *)
- "GET /one/ HTTP/1.1\r\n"
- "Host: one.example.org\r\n"
- "\r\n";
- uint16_t buflen = strlen((char *)buf);
- Packet *p = SCMalloc(SIZE_OF_PACKET);
- FAIL_IF_NULL(p);
- Signature *s = NULL;
- ThreadVars th_v;
- DetectEngineThreadCtx *det_ctx = NULL;
- DetectEngineCtx *de_ctx = NULL;
- Flow f;
-
- memset(p, 0, SIZE_OF_PACKET);
- memset(&th_v, 0, sizeof(th_v));
- memset(&f, 0, sizeof(Flow));
-
- FLOW_INITIALIZE(&f);
- p->flow = &f;
-
- p->src.family = AF_INET;
- p->dst.family = AF_INET;
- p->payload = buf;
- p->payload_len = buflen;
- p->proto = IPPROTO_TCP;
- p->flags |= PKT_HAS_FLOW;
- p->flowflags |= FLOW_PKT_TOSERVER;
-
- de_ctx = DetectEngineCtxInit();
- FAIL_IF_NULL(de_ctx);
-
- de_ctx->flags |= DE_QUIET;
-
- s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit set\"; flowbits:set,fb1; sid:1;)");
- FAIL_IF_NULL(s);
- s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit set\"; flowbits:set,fb2; sid:2;)");
- FAIL_IF_NULL(s);
- s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit set\"; flowbits:set,fb3; sid:3;)");
- FAIL_IF_NULL(s);
- s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit isnotset ored flowbits\"; flowbits:isnotset, fb1 | fb2 ; sid:4;)");
- FAIL_IF_NULL(s);
-
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
-
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
-
- FAIL_IF_NOT(PacketAlertCheck(p, 1));
- FAIL_IF_NOT(PacketAlertCheck(p, 2));
- FAIL_IF_NOT(PacketAlertCheck(p, 3));
- FAIL_IF(PacketAlertCheck(p, 4));
-
- DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
- DetectEngineCtxFree(de_ctx);
-
- FLOW_DESTROY(&f);
-
- SCFree(p);
- PASS;
-}
-
/**
* \brief this function registers unit tests for FlowBits
*/
UtRegisterTest("FlowBitsTestSig06", FlowBitsTestSig06);
UtRegisterTest("FlowBitsTestSig07", FlowBitsTestSig07);
UtRegisterTest("FlowBitsTestSig08", FlowBitsTestSig08);
- UtRegisterTest("FlowBitsTestSig09", FlowBitsTestSig09);
- UtRegisterTest("FlowBitsTestSig10", FlowBitsTestSig10);
- UtRegisterTest("FlowBitsTestSig11", FlowBitsTestSig11);
}
#endif /* UNITTESTS */