const DetectEngineTransforms *transforms,
Flow *_f, const uint8_t flow_flags,
void *txv, const int list_id);
+#ifdef UNITTESTS
static void DetectTemplateBufferRegisterTests(void);
+#endif
static int g_template_buffer_id = 0;
void DetectTemplateBufferRegister(void)
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].desc =
"Template content modififier to match on the template buffers";
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].Setup = DetectTemplateBufferSetup;
+#ifdef UNITTESTS
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].RegisterTests =
DetectTemplateBufferRegisterTests;
+#endif
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].flags |= SIGMATCH_NOOPT;
}
#ifdef UNITTESTS
-
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "app-layer-parser.h"
-#include "detect-engine.h"
-#include "detect-parse.h"
-#include "flow-util.h"
-#include "stream-tcp.h"
-
-static int DetectTemplateBufferTest(void)
-{
- AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
- FAIL_IF_NULL(alp_tctx);
-
- Flow f;
- Packet *p;
- TcpSession tcp;
- ThreadVars tv;
- Signature *s;
-
- uint8_t request[] = "Hello World!";
-
- /* Setup flow. */
- memset(&f, 0, sizeof(Flow));
- memset(&tcp, 0, sizeof(TcpSession));
- memset(&tv, 0, sizeof(ThreadVars));
- p = UTHBuildPacket(request, sizeof(request), IPPROTO_TCP);
- FLOW_INITIALIZE(&f);
- f.alproto = ALPROTO_TEMPLATE;
- f.protoctx = (void *)&tcp;
- f.proto = IPPROTO_TCP;
- f.flags |= FLOW_IPV4;
- p->flow = &f;
- p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
- p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED;
- StreamTcpInitConfig(TRUE);
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- FAIL_IF_NULL(de_ctx);
-
- /* This rule should match. */
- s = DetectEngineAppendSig(de_ctx,
- "alert tcp any any -> any any ("
- "msg:\"TEMPLATE Test Rule\"; "
- "template_buffer; content:\"World!\"; "
- "sid:1; rev:1;)");
- FAIL_IF_NULL(s);
-
- /* This rule should not match. */
- s = DetectEngineAppendSig(de_ctx,
- "alert tcp any any -> any any ("
- "msg:\"TEMPLATE Test Rule\"; "
- "template_buffer; content:\"W0rld!\"; "
- "sid:2; rev:1;)");
- FAIL_IF_NULL(s);
-
- SigGroupBuild(de_ctx);
-
- DetectEngineThreadCtx *det_ctx = NULL;
- DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
- FAIL_IF_NULL(det_ctx);
-
- FLOWLOCK_WRLOCK(&f);
- AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TEMPLATE,
- STREAM_TOSERVER, request, sizeof(request));
- FLOWLOCK_UNLOCK(&f);
-
- /* Check that we have app-layer state. */
- FAIL_IF_NULL(f.alstate);
-
- SigMatchSignatures(&tv, de_ctx, det_ctx, p);
- FAIL_IF(!PacketAlertCheck(p, 1));
- FAIL_IF(PacketAlertCheck(p, 2));
-
- /* Cleanup. */
- AppLayerParserThreadCtxFree(alp_tctx);
- DetectEngineThreadCtxDeinit(&tv, det_ctx);
- DetectEngineCtxFree(de_ctx);
- StreamTcpFreeConfig(TRUE);
- FLOW_DESTROY(&f);
- UTHFreePacket(p);
-
- PASS;
-}
-
+#include "tests/detect-template-buffer.c"
#endif
-
-static void DetectTemplateBufferRegisterTests(void)
-{
-#ifdef UNITTESTS
- UtRegisterTest("DetectTemplateBufferTest", DetectTemplateBufferTest);
-#endif /* UNITTESTS */
-}
--- /dev/null
+/* Copyright (C) 2015-2018 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+#include "../util-unittest.h"
+#include "../util-unittest-helper.h"
+#include "../app-layer-parser.h"
+#include "../detect-engine.h"
+#include "../detect-parse.h"
+#include "../flow-util.h"
+#include "../stream-tcp.h"
+
+static int DetectTemplateBufferTest(void)
+{
+ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
+ FAIL_IF_NULL(alp_tctx);
+
+ Flow f;
+ Packet *p;
+ TcpSession tcp;
+ ThreadVars tv;
+ Signature *s;
+
+ uint8_t request[] = "Hello World!";
+
+ /* Setup flow. */
+ memset(&f, 0, sizeof(Flow));
+ memset(&tcp, 0, sizeof(TcpSession));
+ memset(&tv, 0, sizeof(ThreadVars));
+ p = UTHBuildPacket(request, sizeof(request), IPPROTO_TCP);
+ FLOW_INITIALIZE(&f);
+ f.alproto = ALPROTO_TEMPLATE;
+ f.protoctx = (void *)&tcp;
+ f.proto = IPPROTO_TCP;
+ f.flags |= FLOW_IPV4;
+ p->flow = &f;
+ p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
+ p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED;
+ StreamTcpInitConfig(TRUE);
+
+ DetectEngineCtx *de_ctx = DetectEngineCtxInit();
+ FAIL_IF_NULL(de_ctx);
+
+ /* This rule should match. */
+ s = DetectEngineAppendSig(de_ctx,
+ "alert tcp any any -> any any ("
+ "msg:\"TEMPLATE Test Rule\"; "
+ "template_buffer; content:\"World!\"; "
+ "sid:1; rev:1;)");
+ FAIL_IF_NULL(s);
+
+ /* This rule should not match. */
+ s = DetectEngineAppendSig(de_ctx,
+ "alert tcp any any -> any any ("
+ "msg:\"TEMPLATE Test Rule\"; "
+ "template_buffer; content:\"W0rld!\"; "
+ "sid:2; rev:1;)");
+ FAIL_IF_NULL(s);
+
+ SigGroupBuild(de_ctx);
+
+ DetectEngineThreadCtx *det_ctx = NULL;
+ DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
+ FAIL_IF_NULL(det_ctx);
+
+ AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TEMPLATE,
+ STREAM_TOSERVER, request, sizeof(request));
+
+ /* Check that we have app-layer state. */
+ FAIL_IF_NULL(f.alstate);
+
+ SigMatchSignatures(&tv, de_ctx, det_ctx, p);
+ FAIL_IF(!PacketAlertCheck(p, 1));
+ FAIL_IF(PacketAlertCheck(p, 2));
+
+ /* Cleanup. */
+ AppLayerParserThreadCtxFree(alp_tctx);
+ DetectEngineThreadCtxDeinit(&tv, det_ctx);
+ DetectEngineCtxFree(de_ctx);
+ StreamTcpFreeConfig(TRUE);
+ FLOW_DESTROY(&f);
+ UTHFreePacket(p);
+
+ PASS;
+}
+
+static void DetectTemplateBufferRegisterTests(void)
+{
+ UtRegisterTest("DetectTemplateBufferTest", DetectTemplateBufferTest);
+}