return result;
}
-/**
- * \test Checks if a http_stat_msg is registered in a Signature, if content is not
- * specified in the signature or rawbyes is specified or fast_pattern is
- * provided in the signature.
- */
-static int DetectHttpStatMsgTest01(void)
-{
- DetectEngineCtx *de_ctx = NULL;
- int result = 0;
-
- if ( (de_ctx = DetectEngineCtxInit()) == NULL)
- goto end;
-
- de_ctx->flags |= DE_QUIET;
- de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
- "(msg:\"Testing http_stat_msg\"; http_stat_msg;sid:1;)");
- if (de_ctx->sig_list != NULL)
- goto end;
-
- de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
- "(msg:\"Testing http_stat_msg\"; content:\"|FF F1|\";"
- " rawbytes; http_stat_msg;sid:1;)");
- if (de_ctx->sig_list != NULL)
- goto end;
-
- de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
- "(msg:\"Testing http_stat_msg\"; content:\"one\";"
- "fast_pattern; http_stat_msg; sid:1;)");
- if (de_ctx->sig_list == NULL)
- goto end;
- if (!(((DetectContentData *)de_ctx->sig_list->sm_lists[g_http_stat_msg_buffer_id]->ctx)->flags &
- DETECT_CONTENT_FAST_PATTERN))
- {
- goto end;
- }
-
- result = 1;
-end:
- if (de_ctx != NULL)
- DetectEngineCtxFree(de_ctx);
- return result;
-}
-
-/**
- * \test Checks if a http_stat_msg is registered in a Signature and also checks
- * the nocase
- */
-static int DetectHttpStatMsgTest02(void)
-{
- SigMatch *sm = NULL;
- DetectEngineCtx *de_ctx = NULL;
- int result = 0;
-
- if ( (de_ctx = DetectEngineCtxInit()) == NULL)
- goto end;
-
- de_ctx->flags |= DE_QUIET;
- de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
- "(msg:\"Testing http_stat_msg\"; content:\"one\"; "
- "http_stat_msg; content:\"two\"; http_stat_msg; "
- "content:\"two\"; nocase; http_stat_msg; "
- "sid:1;)");
- if (de_ctx->sig_list == NULL) {
- printf("sig parse failed: ");
- goto end;
- }
-
- result = 0;
- sm = de_ctx->sig_list->sm_lists[g_http_stat_msg_buffer_id];
- if (sm == NULL) {
- printf("no sigmatch(es): ");
- goto end;
- }
-
- SigMatch *prev = NULL;
- while (sm != NULL) {
- if (sm->type == DETECT_CONTENT) {
- result = 1;
- } else {
- printf("expected DETECT_CONTENT for http_stat_msg, got %d: ", sm->type);
- goto end;
- }
- prev = sm;
- sm = sm->next;
- }
-
- if (! (((DetectContentData *)prev->ctx)->flags &
- DETECT_CONTENT_NOCASE))
- {
- result = 0;
- }
-end:
- if (de_ctx != NULL)
- DetectEngineCtxFree(de_ctx);
- return result;
-}
-
/** \test Check the signature working to alert when http_stat_msg is matched . */
static int DetectHttpStatMsgSigTest01(void)
{
*/
void DetectHttpStatMsgRegisterTests (void)
{
- UtRegisterTest("DetectHttpStatMsgTest01", DetectHttpStatMsgTest01);
- UtRegisterTest("DetectHttpStatMsgTest02", DetectHttpStatMsgTest02);
UtRegisterTest("DetectHttpStatMsgSigTest01", DetectHttpStatMsgSigTest01);
UtRegisterTest("DetectHttpStatMsgSigTest02", DetectHttpStatMsgSigTest02);
UtRegisterTest("DetectHttpStatMsgSigTest03", DetectHttpStatMsgSigTest03);