From: Victor Julien <victor@inliniac.net>
Date: Sat, 20 Feb 2021 14:51:50 +0000 (+0100)
Subject: detect/fast_pattern: add prefilter test
X-Git-Tag: suricata-7.0.0-beta1~1786
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e374d5ac15382685e53bf2398788251924fa4333;p=thirdparty%2Fsuricata.git

detect/fast_pattern: add prefilter test
---

diff --git a/src/detect-fast-pattern.c b/src/detect-fast-pattern.c
index dae3fe0190..880ab19e56 100644
--- a/src/detect-fast-pattern.c
+++ b/src/detect-fast-pattern.c
@@ -1069,6 +1069,24 @@ static int DetectFastPatternTest671(void)
     PASS;
 }
 
+static int DetectFastPatternPrefilter(void)
+{
+    DetectEngineCtx *de_ctx = DetectEngineCtxInit();
+    FAIL_IF_NULL(de_ctx);
+    const char *string = "alert tcp any any -> any any "
+                         "(content:\"one\"; prefilter; sid:1;)";
+    Signature *s = DetectEngineAppendSig(de_ctx, string);
+    FAIL_IF_NULL(s);
+    SigMatch *sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
+    FAIL_IF_NULL(sm);
+    FAIL_IF_NOT(sm->type == DETECT_CONTENT);
+    DetectContentData *cd = (DetectContentData *)sm->ctx;
+    FAIL_IF_NOT(DETECT_CONTENT_IS_SINGLE(cd));
+    FAIL_IF_NOT((cd->flags & DETECT_CONTENT_FAST_PATTERN) == DETECT_CONTENT_FAST_PATTERN);
+    DetectEngineCtxFree(de_ctx);
+    PASS;
+}
+
 static void DetectFastPatternRegisterTests(void)
 {
     UtRegisterTest("DetectFastPatternTest01", DetectFastPatternTest01);
@@ -1080,5 +1098,7 @@ static void DetectFastPatternRegisterTests(void)
      * - if 2 duplicate patterns, with no chop set get unique ids.
      */
     UtRegisterTest("DetectFastPatternTest671", DetectFastPatternTest671);
+
+    UtRegisterTest("DetectFastPatternPrefilter", DetectFastPatternPrefilter);
 }
 #endif