1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2 *
3 * You can copy, redistribute or modify this Program under the terms of
4 * the GNU General Public License version 2 as published by the Free
5 * Software Foundation.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * version 2 along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15 * 02110-1301, USA.
16 */
17
18 /**
19 * \file
20 *
21 * \author Anoop Saldanha <anoopsaldanha@gmail.com>
22 *
23 * Implements the fast_pattern keyword
24 */
25
26 #include "suricata-common.h"
27 #include "detect.h"
28 #include "flow.h"
29 #include "detect-content.h"
30 #include "detect-parse.h"
31 #include "detect-engine.h"
32 #include "detect-engine-mpm.h"
33 #include "detect-fast-pattern.h"
34
35 #include "util-error.h"
36 #include "util-byte.h"
37 #include "util-debug.h"
38 #include "util-unittest.h"
39 #include "util-unittest-helper.h"
40
41 #define PARSE_REGEX "^(\\s*only\\s*)|\\s*([0-9]+)\\s*,\\s*([0-9]+)\\s*$"
42
43 static DetectParseRegex parse_regex;
44
45 static int DetectFastPatternSetup(DetectEngineCtx *, Signature *, const char *);
46 #ifdef UNITTESTS
47 static void DetectFastPatternRegisterTests(void);
48 #endif
49
50 /* holds the list of sm match lists that need to be searched for a keyword
51 * that has fp support */
52 SCFPSupportSMList *sm_fp_support_smlist_list = NULL;
53
54 /**
55 * \brief Checks if a particular list(Signature->sm_lists[]) is in the list
56 * of lists that need to be searched for a keyword that has fp support.
57 *
58 * \param list_id The list id.
59 *
60 * \retval 1 If supported.
61 * \retval 0 If not.
62 */
FastPatternSupportEnabledForSigMatchList(const DetectEngineCtx * de_ctx,const int list_id)63 int FastPatternSupportEnabledForSigMatchList(const DetectEngineCtx *de_ctx,
64 const int list_id)
65 {
66 if (sm_fp_support_smlist_list == NULL)
67 return 0;
68
69 if (list_id == DETECT_SM_LIST_PMATCH)
70 return 1;
71
72 return DetectBufferTypeSupportsMpmGetById(de_ctx, list_id);
73
74 #if 0
75 SCFPSupportSMList *tmp_smlist_fp = sm_fp_support_smlist_list;
76 while (tmp_smlist_fp != NULL) {
77 if (tmp_smlist_fp->list_id == list_id)
78 return 1;
79
80 tmp_smlist_fp = tmp_smlist_fp->next;
81 }
82 #endif
83 return 0;
84 }
85
86 /**
87 * \brief Lets one add a sm list id to be searched for potential fp supported
88 * keywords later.
89 *
90 * \param list_id SM list id.
91 * \param priority Priority for this list.
92 */
SupportFastPatternForSigMatchList(int list_id,int priority)93 void SupportFastPatternForSigMatchList(int list_id, int priority)
94 {
95 SCFPSupportSMList *ip = NULL;
96 /* insertion point - ip */
97 for (SCFPSupportSMList *tmp = sm_fp_support_smlist_list; tmp != NULL; tmp = tmp->next) {
98 if (list_id == tmp->list_id) {
99 SCLogDebug("SM list already registered.");
100 return;
101 }
102
103 /* We need a strict check to be sure that the current list
104 * was not already registered
105 * and other lists with the same priority hide it.
106 */
107 if (priority < tmp->priority)
108 break;
109
110 ip = tmp;
111 }
112
113 if (sm_fp_support_smlist_list == NULL) {
114 SCFPSupportSMList *new = SCMalloc(sizeof(SCFPSupportSMList));
115 if (unlikely(new == NULL))
116 exit(EXIT_FAILURE);
117 memset(new, 0, sizeof(SCFPSupportSMList));
118 new->list_id = list_id;
119 new->priority = priority;
120
121 sm_fp_support_smlist_list = new;
122
123 return;
124 }
125
126 SCFPSupportSMList *new = SCMalloc(sizeof(SCFPSupportSMList));
127 if (unlikely(new == NULL))
128 exit(EXIT_FAILURE);
129 memset(new, 0, sizeof(SCFPSupportSMList));
130 new->list_id = list_id;
131 new->priority = priority;
132 if (ip == NULL) {
133 new->next = sm_fp_support_smlist_list;
134 sm_fp_support_smlist_list = new;
135 } else {
136 new->next = ip->next;
137 ip->next = new;
138 }
139
140 return;
141 }
142
143 /**
144 * \brief Registers the keywords(SMs) that should be given fp support.
145 */
SupportFastPatternForSigMatchTypes(void)146 void SupportFastPatternForSigMatchTypes(void)
147 {
148 SupportFastPatternForSigMatchList(DETECT_SM_LIST_PMATCH, 3);
149
150 /* other types are handled by DetectMpmAppLayerRegister() */
151
152 #if 0
153 SCFPSupportSMList *tmp = sm_fp_support_smlist_list;
154 while (tmp != NULL) {
155 printf("%d - %d\n", tmp->list_id, tmp->priority);
156
157 tmp = tmp->next;
158 }
159 #endif
160
161 return;
162 }
163
164 /**
165 * \brief Registration function for fast_pattern keyword
166 */
DetectFastPatternRegister(void)167 void DetectFastPatternRegister(void)
168 {
169 sigmatch_table[DETECT_FAST_PATTERN].name = "fast_pattern";
170 sigmatch_table[DETECT_FAST_PATTERN].desc = "force using preceding content in the multi pattern matcher";
171 sigmatch_table[DETECT_FAST_PATTERN].url = "/rules/prefilter-keywords.html#fast-pattern";
172 sigmatch_table[DETECT_FAST_PATTERN].Match = NULL;
173 sigmatch_table[DETECT_FAST_PATTERN].Setup = DetectFastPatternSetup;
174 sigmatch_table[DETECT_FAST_PATTERN].Free = NULL;
175 #ifdef UNITTESTS
176 sigmatch_table[DETECT_FAST_PATTERN].RegisterTests = DetectFastPatternRegisterTests;
177 #endif
178 sigmatch_table[DETECT_FAST_PATTERN].flags |= SIGMATCH_OPTIONAL_OPT;
179
180 DetectSetupParseRegexes(PARSE_REGEX, &parse_regex);
181 }
182
183 //static int DetectFastPatternParseArg(
184
185 /**
186 * \brief Configures the previous content context for a fast_pattern modifier
187 * keyword used in the rule.
188 *
189 * \param de_ctx Pointer to the Detection Engine Context.
190 * \param s Pointer to the Signature to which the current keyword belongs.
191 * \param arg May hold an argument
192 *
193 * \retval 0 On success.
194 * \retval -1 On failure.
195 */
DetectFastPatternSetup(DetectEngineCtx * de_ctx,Signature * s,const char * arg)196 static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
197 {
198 int ret = 0, res = 0;
199 int ov[MAX_SUBSTRINGS];
200 char arg_substr[128] = "";
201 DetectContentData *cd = NULL;
202
203 SigMatch *pm1 = DetectGetLastSMFromMpmLists(de_ctx, s);
204 SigMatch *pm2 = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
205 if (pm1 == NULL && pm2 == NULL) {
206 SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside "
207 "the rule, without a content context. Please use a "
208 "content based keyword before using fast_pattern");
209 return -1;
210 }
211
212 SigMatch *pm = NULL;
213 if (pm1 && pm2) {
214 if (pm1->idx > pm2->idx)
215 pm = pm1;
216 else
217 pm = pm2;
218 } else if (pm1 && !pm2) {
219 pm = pm1;
220 } else {
221 pm = pm2;
222 }
223
224 cd = (DetectContentData *)pm->ctx;
225 if ((cd->flags & DETECT_CONTENT_NEGATED) &&
226 ((cd->flags & DETECT_CONTENT_DISTANCE) ||
227 (cd->flags & DETECT_CONTENT_WITHIN) ||
228 (cd->flags & DETECT_CONTENT_OFFSET) ||
229 (cd->flags & DETECT_CONTENT_DEPTH))) {
230
231 /* we can't have any of these if we are having "only" */
232 SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern; cannot be "
233 "used with negated content, along with relative modifiers");
234 goto error;
235 }
236
237 if (arg == NULL|| strcmp(arg, "") == 0) {
238 if (cd->flags & DETECT_CONTENT_FAST_PATTERN) {
239 SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple fast_pattern "
240 "options for the same content");
241 goto error;
242 }
243 else { /*allow only one content to have fast_pattern modifier*/
244 uint32_t list_id = 0;
245 for (list_id = 0; list_id < s->init_data->smlists_array_size; list_id++) {
246 SigMatch *sm = NULL;
247 for (sm = s->init_data->smlists[list_id]; sm != NULL; sm = sm->next) {
248 if (sm->type == DETECT_CONTENT) {
249 DetectContentData *tmp_cd = (DetectContentData *)sm->ctx;
250 if (tmp_cd->flags & DETECT_CONTENT_FAST_PATTERN) {
251 SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern "
252 "can be used on only one content in a rule");
253 goto error;
254 }
255 }
256 } /* for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) */
257 }
258 }
259 cd->flags |= DETECT_CONTENT_FAST_PATTERN;
260 return 0;
261 }
262
263 /* Execute the regex and populate args with captures. */
264 ret = DetectParsePcreExec(&parse_regex, arg, 0, 0, ov, MAX_SUBSTRINGS);
265 /* fast pattern only */
266 if (ret == 2) {
267 if ((cd->flags & DETECT_CONTENT_NEGATED) ||
268 (cd->flags & DETECT_CONTENT_DISTANCE) ||
269 (cd->flags & DETECT_CONTENT_WITHIN) ||
270 (cd->flags & DETECT_CONTENT_OFFSET) ||
271 (cd->flags & DETECT_CONTENT_DEPTH)) {
272
273 /* we can't have any of these if we are having "only" */
274 SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern: only; cannot be "
275 "used with negated content or with any of the relative "
276 "modifiers like distance, within, offset, depth");
277 goto error;
278 }
279 cd->flags |= DETECT_CONTENT_FAST_PATTERN_ONLY;
280
281 /* fast pattern chop */
282 } else if (ret == 4) {
283 res = pcre_copy_substring((char *)arg, ov, MAX_SUBSTRINGS,
284 2, arg_substr, sizeof(arg_substr));
285 if (res < 0) {
286 SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed "
287 "for fast_pattern offset");
288 goto error;
289 }
290 uint16_t offset;
291 if (StringParseUint16(&offset, 10, 0,
292 (const char *)arg_substr) < 0) {
293 SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid fast pattern offset:"
294 " \"%s\"", arg_substr);
295 goto error;
296 }
297
298 res = pcre_copy_substring((char *)arg, ov, MAX_SUBSTRINGS,
299 3, arg_substr, sizeof(arg_substr));
300 if (res < 0) {
301 SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed "
302 "for fast_pattern offset");
303 goto error;
304 }
305 uint16_t length;
306 if (StringParseUint16(&length, 10, 0,
307 (const char *)arg_substr) < 0) {
308 SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid value for fast "
309 "pattern: \"%s\"", arg_substr);
310 goto error;
311 }
312
313 // Avoiding integer overflow
314 if (offset > (65535 - length)) {
315 SCLogError(SC_ERR_INVALID_SIGNATURE, "Fast pattern (length + offset) "
316 "exceeds limit pattern length limit");
317 goto error;
318 }
319
320 if (offset + length > cd->content_len) {
321 SCLogError(SC_ERR_INVALID_SIGNATURE, "Fast pattern (length + "
322 "offset (%u)) exceeds pattern length (%u)",
323 offset + length, cd->content_len);
324 goto error;
325 }
326
327 cd->fp_chop_offset = offset;
328 cd->fp_chop_len = length;
329 cd->flags |= DETECT_CONTENT_FAST_PATTERN_CHOP;
330
331 } else {
332 SCLogError(SC_ERR_PCRE_PARSE, "parse error, ret %" PRId32
333 ", string %s", ret, arg);
334 goto error;
335 }
336
337 //int args;
338 //args = 0;
339 //printf("ret-%d\n", ret);
340 //for (args = 0; args < ret; args++) {
341 // res = pcre_get_substring((char *)arg, ov, MAX_SUBSTRINGS,
342 // args, &arg_substr);
343 // if (res < 0) {
344 // SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed "
345 // "for arg 1");
346 // goto error;
347 // }
348 // printf("%d-%s\n", args, arg_substr);
349 //}
350
351 cd->flags |= DETECT_CONTENT_FAST_PATTERN;
352
353 return 0;
354
355 error:
356 return -1;
357 }
358
359 /*----------------------------------Unittests---------------------------------*/
360
361 #ifdef UNITTESTS
362 static int g_file_data_buffer_id = 0;
363 static int g_http_method_buffer_id = 0;
364 static int g_http_uri_buffer_id = 0;
365 static int g_http_ua_buffer_id = 0;
366 static int g_http_cookie_buffer_id = 0;
367 static int g_http_host_buffer_id = 0;
368 static int g_http_raw_host_buffer_id = 0;
369 static int g_http_stat_code_buffer_id = 0;
370 static int g_http_stat_msg_buffer_id = 0;
371 static int g_http_raw_header_buffer_id = 0;
372 static int g_http_header_buffer_id = 0;
373 static int g_http_client_body_buffer_id = 0;
374 static int g_http_raw_uri_buffer_id = 0;
375
376 /**
377 * \test Checks if a fast_pattern is registered in a Signature
378 */
DetectFastPatternTest01(void)379 static int DetectFastPatternTest01(void)
380 {
381 SigMatch *sm = NULL;
382 DetectEngineCtx *de_ctx = NULL;
383 int result = 0;
384
385 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
386 goto end;
387
388 de_ctx->flags |= DE_QUIET;
389 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
390 "(content:\"/one/\"; tcpv4-csum:valid; fast_pattern; "
391 "msg:\"Testing fast_pattern\"; sid:1;)");
392 if (de_ctx->sig_list == NULL)
393 goto end;
394
395 result = 0;
396 sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
397 while (sm != NULL) {
398 if (sm->type == DETECT_CONTENT) {
399 if ( ((DetectContentData *)sm->ctx)->flags &
400 DETECT_CONTENT_FAST_PATTERN) {
401 result = 1;
402 break;
403 } else {
404 result = 0;
405 break;
406 }
407 }
408 sm = sm->next;
409 }
410
411 end:
412 SigCleanSignatures(de_ctx);
413 DetectEngineCtxFree(de_ctx);
414 return result;
415 }
416
417 /**
418 * \test Checks if a fast_pattern is registered in a Signature
419 */
DetectFastPatternTest02(void)420 static int DetectFastPatternTest02(void)
421 {
422 DetectEngineCtx *de_ctx = NULL;
423 int result = 0;
424
425 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
426 goto end;
427
428 de_ctx->flags |= DE_QUIET;
429 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
430 "(content:\"/one/\"; fast_pattern; "
431 "content:\"boo\"; fast_pattern; "
432 "msg:\"Testing fast_pattern\"; sid:1;)");
433 if (de_ctx->sig_list != NULL)
434 goto end;
435
436 result = 1;
437
438 end:
439 SigCleanSignatures(de_ctx);
440 DetectEngineCtxFree(de_ctx);
441 return result;
442 }
443
444 /**
445 * \test Checks that we have no fast_pattern registerd for a Signature when the
446 * Signature doesn't contain a fast_pattern
447 */
DetectFastPatternTest03(void)448 static int DetectFastPatternTest03(void)
449 {
450 SigMatch *sm = NULL;
451 DetectEngineCtx *de_ctx = NULL;
452 int result = 0;
453
454 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
455 goto end;
456
457 de_ctx->flags |= DE_QUIET;
458 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
459 "(content:\"/one/\"; "
460 "msg:\"Testing fast_pattern\"; sid:1;)");
461 if (de_ctx->sig_list == NULL)
462 goto end;
463
464 result = 0;
465 sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
466 while (sm != NULL) {
467 if (sm->type == DETECT_CONTENT) {
468 if ( !(((DetectContentData *)sm->ctx)->flags &
469 DETECT_CONTENT_FAST_PATTERN)) {
470 result = 1;
471 } else {
472 result = 0;
473 break;
474 }
475 }
476 sm = sm->next;
477 }
478
479 end:
480 SigCleanSignatures(de_ctx);
481 DetectEngineCtxFree(de_ctx);
482 return result;
483 }
484
485 /**
486 * \test Checks that a fast_pattern is not registered in a Signature, when we
487 * supply a fast_pattern with an argument
488 */
DetectFastPatternTest04(void)489 static int DetectFastPatternTest04(void)
490 {
491 DetectEngineCtx *de_ctx = NULL;
492 int result = 0;
493
494 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
495 goto end;
496
497 de_ctx->flags |= DE_QUIET;
498 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
499 "(content:\"/one/\"; fast_pattern:boo; "
500 "msg:\"Testing fast_pattern\"; sid:1;)");
501 if (de_ctx->sig_list == NULL)
502 result = 1;
503
504 end:
505 SigCleanSignatures(de_ctx);
506 DetectEngineCtxFree(de_ctx);
507 return result;
508 }
509
510 /**
511 * \test Checks to make sure that other sigs work that should when fast_pattern is inspecting on the same payload
512 *
513 */
DetectFastPatternTest14(void)514 static int DetectFastPatternTest14(void)
515 {
516 uint8_t *buf = (uint8_t *) "Dummy is our name. Oh yes. From right here "
517 "right now, all the way to hangover. right. strings5_imp now here "
518 "comes our dark knight strings_string5. Yes here is our dark knight";
519 uint16_t buflen = strlen((char *)buf);
520 Packet *p = NULL;
521 ThreadVars th_v;
522 DetectEngineThreadCtx *det_ctx = NULL;
523 int alertcnt = 0;
524 int result = 0;
525
526 memset(&th_v, 0, sizeof(th_v));
527 p = UTHBuildPacket(buf,buflen,IPPROTO_TCP);
528
529 DetectEngineCtx *de_ctx = DetectEngineCtxInit();
530 if (de_ctx == NULL)
531 goto end;
532
533 FlowInitConfig(FLOW_QUIET);
534
535 de_ctx->flags |= DE_QUIET;
536
537 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
538 "(msg:\"fast_pattern test\"; content:\"strings_string5\"; content:\"knight\"; fast_pattern; sid:1;)");
539 if (de_ctx->sig_list == NULL)
540 goto end;
541
542 de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any "
543 "(msg:\"test different content\"; content:\"Dummy is our name\"; sid:2;)");
544 if (de_ctx->sig_list->next == NULL)
545 goto end;
546
547 SigGroupBuild(de_ctx);
548 DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
549
550 SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
551 if (PacketAlertCheck(p, 1)){
552 alertcnt++;
553 }else{
554 SCLogInfo("could not match on sig 1 with when fast_pattern is inspecting payload");
555 goto end;
556 }
557 if (PacketAlertCheck(p, 2)){
558 result = 1;
559 }else{
560 SCLogInfo("match on sig 1 fast_pattern no match sig 2 inspecting same payload");
561 }
562 end:
563 UTHFreePackets(&p, 1);
564 SigGroupCleanup(de_ctx);
565 SigCleanSignatures(de_ctx);
566
567 DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
568
569 DetectEngineCtxFree(de_ctx);
570 FlowShutdown();
571 return result;
572 }
573
574 /**
575 * \test Checks if a fast_pattern is registered in a Signature
576 */
DetectFastPatternTest15(void)577 static int DetectFastPatternTest15(void)
578 {
579 SigMatch *sm = NULL;
580 DetectEngineCtx *de_ctx = NULL;
581 int result = 0;
582
583 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
584 goto end;
585
586 de_ctx->flags |= DE_QUIET;
587 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
588 "(content:\"/one/\"; fast_pattern:only; "
589 "msg:\"Testing fast_pattern\"; sid:1;)");
590 if (de_ctx->sig_list == NULL)
591 goto end;
592
593 result = 0;
594 sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
595 while (sm != NULL) {
596 if (sm->type == DETECT_CONTENT) {
597 if ( ((DetectContentData *)sm->ctx)->flags &
598 DETECT_CONTENT_FAST_PATTERN) {
599 result = 1;
600 break;
601 } else {
602 result = 0;
603 break;
604 }
605 }
606 sm = sm->next;
607 }
608
609 end:
610 SigCleanSignatures(de_ctx);
611 DetectEngineCtxFree(de_ctx);
612 return result;
613 }
614
615 /**
616 * \test Checks if a fast_pattern is registered in a Signature
617 */
DetectFastPatternTest16(void)618 static int DetectFastPatternTest16(void)
619 {
620 SigMatch *sm = NULL;
621 DetectEngineCtx *de_ctx = NULL;
622 int result = 0;
623
624 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
625 goto end;
626
627 de_ctx->flags |= DE_QUIET;
628 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
629 "(content:\"oneoneone\"; fast_pattern:3,4; "
630 "msg:\"Testing fast_pattern\"; sid:1;)");
631 if (de_ctx->sig_list == NULL)
632 goto end;
633
634 result = 0;
635 sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
636 while (sm != NULL) {
637 if (sm->type == DETECT_CONTENT) {
638 if ( ((DetectContentData *)sm->ctx)->flags &
639 DETECT_CONTENT_FAST_PATTERN) {
640 result = 1;
641 break;
642 } else {
643 result = 0;
644 break;
645 }
646 }
647 sm = sm->next;
648 }
649
650 end:
651 SigCleanSignatures(de_ctx);
652 DetectEngineCtxFree(de_ctx);
653 return result;
654 }
655
DetectFastPatternTest17(void)656 static int DetectFastPatternTest17(void)
657 {
658 SigMatch *sm = NULL;
659 DetectEngineCtx *de_ctx = NULL;
660 int result = 0;
661
662 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
663 goto end;
664
665 de_ctx->flags |= DE_QUIET;
666 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
667 "(content:\"one\"; fast_pattern:only; sid:1;)");
668 if (de_ctx->sig_list == NULL)
669 goto end;
670
671 result = 0;
672 sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
673 DetectContentData *cd = (DetectContentData *)sm->ctx;
674 if (sm->type == DETECT_CONTENT) {
675 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
676 cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
677 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
678 cd->fp_chop_offset == 0 &&
679 cd->fp_chop_len == 0) {
680 result = 1;
681 } else {
682 result = 0;
683 }
684 }
685
686 end:
687 SigCleanSignatures(de_ctx);
688 DetectEngineCtxFree(de_ctx);
689 return result;
690 }
691
DetectFastPatternTest18(void)692 static int DetectFastPatternTest18(void)
693 {
694 SigMatch *sm = NULL;
695 DetectEngineCtx *de_ctx = NULL;
696 int result = 0;
697
698 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
699 goto end;
700
701 de_ctx->flags |= DE_QUIET;
702 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
703 "(content:\"oneoneone\"; fast_pattern:3,4; sid:1;)");
704 if (de_ctx->sig_list == NULL)
705 goto end;
706
707 result = 0;
708 sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
709 DetectContentData *cd = (DetectContentData *)sm->ctx;
710 if (sm->type == DETECT_CONTENT) {
711 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
712 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
713 cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
714 cd->fp_chop_offset == 3 &&
715 cd->fp_chop_len == 4) {
716 result = 1;
717 } else {
718 result = 0;
719 }
720 }
721
722 end:
723 SigCleanSignatures(de_ctx);
724 DetectEngineCtxFree(de_ctx);
725 return result;
726 }
727
DetectFastPatternTest19(void)728 static int DetectFastPatternTest19(void)
729 {
730 DetectEngineCtx *de_ctx = NULL;
731 int result = 0;
732
733 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
734 goto end;
735
736 de_ctx->flags |= DE_QUIET;
737 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
738 "(content:\"one\"; content:\"two\"; fast_pattern:only; distance:10; sid:1;)");
739 if (de_ctx->sig_list != NULL)
740 goto end;
741
742 result = 1;
743
744 end:
745 SigCleanSignatures(de_ctx);
746 DetectEngineCtxFree(de_ctx);
747 return result;
748 }
749
DetectFastPatternTest20(void)750 static int DetectFastPatternTest20(void)
751 {
752 DetectEngineCtx *de_ctx = NULL;
753 int result = 0;
754
755 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
756 goto end;
757
758 de_ctx->flags |= DE_QUIET;
759 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
760 "(content:\"one\"; content:\"two\"; distance:10; fast_pattern:only; sid:1;)");
761 if (de_ctx->sig_list != NULL)
762 goto end;
763
764 result = 1;
765
766 end:
767 SigCleanSignatures(de_ctx);
768 DetectEngineCtxFree(de_ctx);
769 return result;
770 }
771
DetectFastPatternTest21(void)772 static int DetectFastPatternTest21(void)
773 {
774 DetectEngineCtx *de_ctx = NULL;
775 int result = 0;
776
777 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
778 goto end;
779
780 de_ctx->flags |= DE_QUIET;
781 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
782 "(content:\"one\"; content:\"two\"; fast_pattern:only; within:10; sid:1;)");
783 if (de_ctx->sig_list != NULL)
784 goto end;
785
786 result = 1;
787
788 end:
789 SigCleanSignatures(de_ctx);
790 DetectEngineCtxFree(de_ctx);
791 return result;
792 }
793
DetectFastPatternTest22(void)794 static int DetectFastPatternTest22(void)
795 {
796 DetectEngineCtx *de_ctx = NULL;
797 int result = 0;
798
799 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
800 goto end;
801
802 de_ctx->flags |= DE_QUIET;
803 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
804 "(content:\"one\"; content:\"two\"; within:10; fast_pattern:only; sid:1;)");
805 if (de_ctx->sig_list != NULL)
806 goto end;
807
808 result = 1;
809
810 end:
811 SigCleanSignatures(de_ctx);
812 DetectEngineCtxFree(de_ctx);
813 return result;
814 }
815
DetectFastPatternTest23(void)816 static int DetectFastPatternTest23(void)
817 {
818 DetectEngineCtx *de_ctx = NULL;
819 int result = 0;
820
821 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
822 goto end;
823
824 de_ctx->flags |= DE_QUIET;
825 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
826 "(content:\"one\"; content:\"two\"; fast_pattern:only; offset:10; sid:1;)");
827 if (de_ctx->sig_list != NULL)
828 goto end;
829
830 result = 1;
831
832 end:
833 SigCleanSignatures(de_ctx);
834 DetectEngineCtxFree(de_ctx);
835 return result;
836 }
837
DetectFastPatternTest24(void)838 static int DetectFastPatternTest24(void)
839 {
840 DetectEngineCtx *de_ctx = NULL;
841 int result = 0;
842
843 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
844 goto end;
845
846 de_ctx->flags |= DE_QUIET;
847 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
848 "(content:\"one\"; content:\"two\"; offset:10; fast_pattern:only; sid:1;)");
849 if (de_ctx->sig_list != NULL)
850 goto end;
851
852 result = 1;
853
854 end:
855 SigCleanSignatures(de_ctx);
856 DetectEngineCtxFree(de_ctx);
857 return result;
858 }
859
DetectFastPatternTest25(void)860 static int DetectFastPatternTest25(void)
861 {
862 DetectEngineCtx *de_ctx = NULL;
863 int result = 0;
864
865 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
866 goto end;
867
868 de_ctx->flags |= DE_QUIET;
869 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
870 "(content:\"one\"; content:\"two\"; fast_pattern:only; depth:10; sid:1;)");
871 if (de_ctx->sig_list != NULL)
872 goto end;
873
874 result = 1;
875
876 end:
877 SigCleanSignatures(de_ctx);
878 DetectEngineCtxFree(de_ctx);
879 return result;
880 }
881
DetectFastPatternTest26(void)882 static int DetectFastPatternTest26(void)
883 {
884 DetectEngineCtx *de_ctx = NULL;
885 int result = 0;
886
887 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
888 goto end;
889
890 de_ctx->flags |= DE_QUIET;
891 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
892 "(content:\"one\"; content:\"two\"; depth:10; fast_pattern:only; sid:1;)");
893 if (de_ctx->sig_list != NULL)
894 goto end;
895
896 result = 1;
897
898 end:
899 SigCleanSignatures(de_ctx);
900 DetectEngineCtxFree(de_ctx);
901 return result;
902 }
903
DetectFastPatternTest27(void)904 static int DetectFastPatternTest27(void)
905 {
906 DetectEngineCtx *de_ctx = NULL;
907 int result = 0;
908
909 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
910 goto end;
911
912 de_ctx->flags |= DE_QUIET;
913 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
914 "(content:\"one\"; content:!\"two\"; fast_pattern:only; sid:1;)");
915 if (de_ctx->sig_list != NULL)
916 goto end;
917
918 result = 1;
919
920 end:
921 SigCleanSignatures(de_ctx);
922 DetectEngineCtxFree(de_ctx);
923 return result;
924 }
925
DetectFastPatternTest28(void)926 static int DetectFastPatternTest28(void)
927 {
928 DetectEngineCtx *de_ctx = NULL;
929 int result = 0;
930
931 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
932 goto end;
933
934 de_ctx->flags |= DE_QUIET;
935 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
936 "(content: \"one\"; content:\"two\"; distance:30; content:\"two\"; fast_pattern:only; sid:1;)");
937 if (de_ctx->sig_list == NULL)
938 goto end;
939
940 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
941 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
942 cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
943 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
944 cd->fp_chop_offset == 0 &&
945 cd->fp_chop_len == 0) {
946 result = 1;
947 } else {
948 result = 0;
949 }
950
951 end:
952 SigCleanSignatures(de_ctx);
953 DetectEngineCtxFree(de_ctx);
954 return result;
955 }
956
DetectFastPatternTest29(void)957 static int DetectFastPatternTest29(void)
958 {
959 DetectEngineCtx *de_ctx = NULL;
960 int result = 0;
961
962 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
963 goto end;
964
965 de_ctx->flags |= DE_QUIET;
966 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
967 "(content:\"one\"; content:\"two\"; within:30; content:\"two\"; fast_pattern:only; sid:1;)");
968 if (de_ctx->sig_list == NULL)
969 goto end;
970 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
971 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
972 cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
973 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
974 cd->fp_chop_offset == 0 &&
975 cd->fp_chop_len == 0) {
976 result = 1;
977 } else {
978 result = 0;
979 }
980
981 end:
982 SigCleanSignatures(de_ctx);
983 DetectEngineCtxFree(de_ctx);
984 return result;
985 }
986
DetectFastPatternTest30(void)987 static int DetectFastPatternTest30(void)
988 {
989 DetectEngineCtx *de_ctx = NULL;
990 int result = 0;
991
992 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
993 goto end;
994
995 de_ctx->flags |= DE_QUIET;
996 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
997 "(content:\"one\"; content:\"two\"; offset:30; content:\"two\"; fast_pattern:only; sid:1;)");
998 if (de_ctx->sig_list == NULL)
999 goto end;
1000 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
1001 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
1002 cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
1003 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
1004 cd->fp_chop_offset == 0 &&
1005 cd->fp_chop_len == 0) {
1006 result = 1;
1007 } else {
1008 result = 0;
1009 }
1010
1011 end:
1012 SigCleanSignatures(de_ctx);
1013 DetectEngineCtxFree(de_ctx);
1014 return result;
1015 }
1016
DetectFastPatternTest31(void)1017 static int DetectFastPatternTest31(void)
1018 {
1019 DetectEngineCtx *de_ctx = NULL;
1020 int result = 0;
1021
1022 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1023 goto end;
1024
1025 de_ctx->flags |= DE_QUIET;
1026 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1027 "(content:\"one\"; content:\"two\"; depth:30; content:\"two\"; fast_pattern:only; sid:1;)");
1028 if (de_ctx->sig_list == NULL)
1029 goto end;
1030 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
1031 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
1032 cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
1033 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
1034 cd->fp_chop_offset == 0 &&
1035 cd->fp_chop_len == 0) {
1036 result = 1;
1037 } else {
1038 result = 0;
1039 }
1040
1041 end:
1042 SigCleanSignatures(de_ctx);
1043 DetectEngineCtxFree(de_ctx);
1044 return result;
1045 }
1046
DetectFastPatternTest32(void)1047 static int DetectFastPatternTest32(void)
1048 {
1049 DetectEngineCtx *de_ctx = NULL;
1050 int result = 0;
1051
1052 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1053 goto end;
1054
1055 de_ctx->flags |= DE_QUIET;
1056 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1057 "(content:!\"one\"; fast_pattern; content:\"two\"; sid:1;)");
1058 if (de_ctx->sig_list == NULL)
1059 goto end;
1060 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
1061 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
1062 cd->flags & DETECT_CONTENT_NEGATED &&
1063 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
1064 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
1065 cd->fp_chop_offset == 0 &&
1066 cd->fp_chop_len == 0) {
1067 result = 1;
1068 } else {
1069 result = 0;
1070 }
1071
1072 end:
1073 SigCleanSignatures(de_ctx);
1074 DetectEngineCtxFree(de_ctx);
1075 return result;
1076 }
1077
DetectFastPatternTest33(void)1078 static int DetectFastPatternTest33(void)
1079 {
1080 DetectEngineCtx *de_ctx = NULL;
1081 int result = 0;
1082
1083 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1084 goto end;
1085
1086 de_ctx->flags |= DE_QUIET;
1087 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1088 "(content:\"two\"; content:!\"one\"; fast_pattern; distance:20; sid:1;)");
1089 if (de_ctx->sig_list != NULL)
1090 goto end;
1091
1092 result = 1;
1093
1094 end:
1095 SigCleanSignatures(de_ctx);
1096 DetectEngineCtxFree(de_ctx);
1097 return result;
1098 }
1099
DetectFastPatternTest34(void)1100 static int DetectFastPatternTest34(void)
1101 {
1102 DetectEngineCtx *de_ctx = NULL;
1103 int result = 0;
1104
1105 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1106 goto end;
1107
1108 de_ctx->flags |= DE_QUIET;
1109 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1110 "(content:\"two\"; content:!\"one\"; fast_pattern; within:20; sid:1;)");
1111 if (de_ctx->sig_list != NULL)
1112 goto end;
1113
1114 result = 1;
1115
1116 end:
1117 SigCleanSignatures(de_ctx);
1118 DetectEngineCtxFree(de_ctx);
1119 return result;
1120 }
1121
DetectFastPatternTest35(void)1122 static int DetectFastPatternTest35(void)
1123 {
1124 DetectEngineCtx *de_ctx = NULL;
1125 int result = 0;
1126
1127 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1128 goto end;
1129
1130 de_ctx->flags |= DE_QUIET;
1131 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1132 "(content:\"two\"; content:!\"one\"; fast_pattern; offset:20; sid:1;)");
1133 if (de_ctx->sig_list != NULL)
1134 goto end;
1135
1136 result = 1;
1137
1138 end:
1139 SigCleanSignatures(de_ctx);
1140 DetectEngineCtxFree(de_ctx);
1141 return result;
1142 }
1143
DetectFastPatternTest36(void)1144 static int DetectFastPatternTest36(void)
1145 {
1146 DetectEngineCtx *de_ctx = NULL;
1147 int result = 0;
1148
1149 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1150 goto end;
1151
1152 de_ctx->flags |= DE_QUIET;
1153 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1154 "(content:\"two\"; content:!\"one\"; fast_pattern; depth:20; sid:1;)");
1155 if (de_ctx->sig_list != NULL)
1156 goto end;
1157
1158 result = 1;
1159
1160 end:
1161 SigCleanSignatures(de_ctx);
1162 DetectEngineCtxFree(de_ctx);
1163 return result;
1164 }
1165
DetectFastPatternTest37(void)1166 static int DetectFastPatternTest37(void)
1167 {
1168 DetectEngineCtx *de_ctx = NULL;
1169 int result = 0;
1170
1171 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1172 goto end;
1173
1174 de_ctx->flags |= DE_QUIET;
1175 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1176 "(content:\"oneoneone\"; content:\"oneonetwo\"; fast_pattern:3,4; content:\"three\"; sid:1;)");
1177 if (de_ctx->sig_list == NULL)
1178 goto end;
1179 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
1180 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
1181 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
1182 cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
1183 cd->fp_chop_offset == 3 &&
1184 cd->fp_chop_len == 4) {
1185 result = 1;
1186 } else {
1187 result = 0;
1188 }
1189
1190 end:
1191 SigCleanSignatures(de_ctx);
1192 DetectEngineCtxFree(de_ctx);
1193 return result;
1194 }
1195
DetectFastPatternTest38(void)1196 static int DetectFastPatternTest38(void)
1197 {
1198 DetectEngineCtx *de_ctx = NULL;
1199 int result = 0;
1200
1201 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1202 goto end;
1203
1204 de_ctx->flags |= DE_QUIET;
1205 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1206 "(content:\"one\"; content:\"twotwotwo\"; fast_pattern:3,4; content:\"three\"; distance:30; sid:1;)");
1207 if (de_ctx->sig_list == NULL)
1208 goto end;
1209 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
1210 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
1211 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
1212 cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
1213 cd->fp_chop_offset == 3 &&
1214 cd->fp_chop_len == 4) {
1215 result = 1;
1216 } else {
1217 result = 0;
1218 }
1219
1220 end:
1221 SigCleanSignatures(de_ctx);
1222 DetectEngineCtxFree(de_ctx);
1223 return result;
1224 }
1225
DetectFastPatternTest39(void)1226 static int DetectFastPatternTest39(void)
1227 {
1228 DetectEngineCtx *de_ctx = NULL;
1229 int result = 0;
1230
1231 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1232 goto end;
1233
1234 de_ctx->flags |= DE_QUIET;
1235 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1236 "(content:\"one\"; content:\"twotwotwo\"; fast_pattern:3,4; content:\"three\"; within:30; sid:1;)");
1237 if (de_ctx->sig_list == NULL)
1238 goto end;
1239 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
1240 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
1241 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
1242 cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
1243 cd->fp_chop_offset == 3 &&
1244 cd->fp_chop_len == 4) {
1245 result = 1;
1246 } else {
1247 result = 0;
1248 }
1249
1250 end:
1251 SigCleanSignatures(de_ctx);
1252 DetectEngineCtxFree(de_ctx);
1253 return result;
1254 }
1255
DetectFastPatternTest40(void)1256 static int DetectFastPatternTest40(void)
1257 {
1258 DetectEngineCtx *de_ctx = NULL;
1259 int result = 0;
1260
1261 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1262 goto end;
1263
1264 de_ctx->flags |= DE_QUIET;
1265 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1266 "(content:\"one\"; content:\"twotwotwo\"; fast_pattern:3,4; content:\"three\"; offset:30; sid:1;)");
1267 if (de_ctx->sig_list == NULL)
1268 goto end;
1269 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
1270 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
1271 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
1272 cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
1273 cd->fp_chop_offset == 3 &&
1274 cd->fp_chop_len == 4) {
1275 result = 1;
1276 } else {
1277 result = 0;
1278 }
1279
1280 end:
1281 SigCleanSignatures(de_ctx);
1282 DetectEngineCtxFree(de_ctx);
1283 return result;
1284 }
1285
DetectFastPatternTest41(void)1286 static int DetectFastPatternTest41(void)
1287 {
1288 DetectEngineCtx *de_ctx = NULL;
1289 int result = 0;
1290
1291 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1292 goto end;
1293
1294 de_ctx->flags |= DE_QUIET;
1295 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1296 "(content:\"one\"; content:\"twotwotwo\"; fast_pattern:3,4; content:\"three\"; depth:30; sid:1;)");
1297 if (de_ctx->sig_list == NULL)
1298 goto end;
1299 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
1300 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
1301 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
1302 cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
1303 cd->fp_chop_offset == 3 &&
1304 cd->fp_chop_len == 4) {
1305 result = 1;
1306 } else {
1307 result = 0;
1308 }
1309
1310 end:
1311 SigCleanSignatures(de_ctx);
1312 DetectEngineCtxFree(de_ctx);
1313 return result;
1314 }
1315
DetectFastPatternTest42(void)1316 static int DetectFastPatternTest42(void)
1317 {
1318 DetectEngineCtx *de_ctx = NULL;
1319 int result = 0;
1320
1321 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1322 goto end;
1323
1324 de_ctx->flags |= DE_QUIET;
1325 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1326 "(content:\"one\"; content:\"two\"; distance:10; content:\"threethree\"; fast_pattern:3,4; sid:1;)");
1327 if (de_ctx->sig_list == NULL)
1328 goto end;
1329 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
1330 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
1331 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
1332 cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
1333 cd->fp_chop_offset == 3 &&
1334 cd->fp_chop_len == 4) {
1335 result = 1;
1336 } else {
1337 result = 0;
1338 }
1339
1340 end:
1341 SigCleanSignatures(de_ctx);
1342 DetectEngineCtxFree(de_ctx);
1343 return result;
1344 }
1345
DetectFastPatternTest43(void)1346 static int DetectFastPatternTest43(void)
1347 {
1348 DetectEngineCtx *de_ctx = NULL;
1349 int result = 0;
1350
1351 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1352 goto end;
1353
1354 de_ctx->flags |= DE_QUIET;
1355 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1356 "(content:\"one\"; content:\"two\"; within:10; content:\"threethree\"; fast_pattern:3,4; sid:1;)");
1357 if (de_ctx->sig_list == NULL)
1358 goto end;
1359 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
1360 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
1361 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
1362 cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
1363 cd->fp_chop_offset == 3 &&
1364 cd->fp_chop_len == 4) {
1365 result = 1;
1366 } else {
1367 result = 0;
1368 }
1369
1370 end:
1371 SigCleanSignatures(de_ctx);
1372 DetectEngineCtxFree(de_ctx);
1373 return result;
1374 }
1375
DetectFastPatternTest44(void)1376 static int DetectFastPatternTest44(void)
1377 {
1378 DetectEngineCtx *de_ctx = NULL;
1379 int result = 0;
1380
1381 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1382 goto end;
1383
1384 de_ctx->flags |= DE_QUIET;
1385 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1386 "(content:\"one\"; content:\"two\"; offset:10; content:\"threethree\"; fast_pattern:3,4; sid:1;)");
1387 if (de_ctx->sig_list == NULL)
1388 goto end;
1389 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
1390 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
1391 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
1392 cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
1393 cd->fp_chop_offset == 3 &&
1394 cd->fp_chop_len == 4) {
1395 result = 1;
1396 } else {
1397 result = 0;
1398 }
1399
1400 end:
1401 SigCleanSignatures(de_ctx);
1402 DetectEngineCtxFree(de_ctx);
1403 return result;
1404 }
1405
DetectFastPatternTest45(void)1406 static int DetectFastPatternTest45(void)
1407 {
1408 DetectEngineCtx *de_ctx = NULL;
1409 int result = 0;
1410
1411 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1412 goto end;
1413
1414 de_ctx->flags |= DE_QUIET;
1415 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1416 "(content:\"one\"; content:\"two\"; depth:10; content:\"threethree\"; fast_pattern:3,4; sid:1;)");
1417 if (de_ctx->sig_list == NULL)
1418 goto end;
1419 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
1420 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
1421 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
1422 cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
1423 cd->fp_chop_offset == 3 &&
1424 cd->fp_chop_len == 4) {
1425 result = 1;
1426 } else {
1427 result = 0;
1428 }
1429
1430 end:
1431 SigCleanSignatures(de_ctx);
1432 DetectEngineCtxFree(de_ctx);
1433 return result;
1434 }
1435
DetectFastPatternTest46(void)1436 static int DetectFastPatternTest46(void)
1437 {
1438 DetectEngineCtx *de_ctx = NULL;
1439 int result = 0;
1440
1441 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1442 goto end;
1443
1444 de_ctx->flags |= DE_QUIET;
1445 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1446 "(content:\"one\"; content:\"two\"; fast_pattern:65977,4; content:\"three\"; distance:10; sid:1;)");
1447 if (de_ctx->sig_list != NULL)
1448 goto end;
1449
1450 result = 1;
1451
1452 end:
1453 SigCleanSignatures(de_ctx);
1454 DetectEngineCtxFree(de_ctx);
1455 return result;
1456 }
1457
DetectFastPatternTest47(void)1458 static int DetectFastPatternTest47(void)
1459 {
1460 DetectEngineCtx *de_ctx = NULL;
1461 int result = 0;
1462
1463 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1464 goto end;
1465
1466 de_ctx->flags |= DE_QUIET;
1467 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1468 "(content:\"one\"; content:\"twooneone\"; fast_pattern:3,65977; content:\"three\"; distance:10; sid:1;)");
1469 if (de_ctx->sig_list != NULL)
1470 goto end;
1471
1472 result = 1;
1473
1474 end:
1475 SigCleanSignatures(de_ctx);
1476 DetectEngineCtxFree(de_ctx);
1477 return result;
1478 }
1479
DetectFastPatternTest48(void)1480 static int DetectFastPatternTest48(void)
1481 {
1482 DetectEngineCtx *de_ctx = NULL;
1483 int result = 0;
1484
1485 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1486 goto end;
1487
1488 de_ctx->flags |= DE_QUIET;
1489 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1490 "(content:\"one\"; content:\"two\"; fast_pattern:65534,4; content:\"three\"; distance:10; sid:1;)");
1491 if (de_ctx->sig_list != NULL)
1492 goto end;
1493
1494 result = 1;
1495
1496 end:
1497 SigCleanSignatures(de_ctx);
1498 DetectEngineCtxFree(de_ctx);
1499 return result;
1500 }
1501
DetectFastPatternTest49(void)1502 static int DetectFastPatternTest49(void)
1503 {
1504 DetectEngineCtx *de_ctx = NULL;
1505 int result = 0;
1506
1507 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1508 goto end;
1509
1510 de_ctx->flags |= DE_QUIET;
1511 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1512 "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; content:\"three\"; sid:1;)");
1513 if (de_ctx->sig_list == NULL)
1514 goto end;
1515 DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
1516 if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
1517 cd->flags & DETECT_CONTENT_NEGATED &&
1518 !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
1519 cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
1520 cd->fp_chop_offset == 3 &&
1521 cd->fp_chop_len == 4) {
1522 result = 1;
1523 } else {
1524 result = 0;
1525 }
1526
1527 end:
1528 SigCleanSignatures(de_ctx);
1529 DetectEngineCtxFree(de_ctx);
1530 return result;
1531 }
1532
DetectFastPatternTest50(void)1533 static int DetectFastPatternTest50(void)
1534 {
1535 DetectEngineCtx *de_ctx = NULL;
1536 int result = 0;
1537
1538 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1539 goto end;
1540
1541 de_ctx->flags |= DE_QUIET;
1542 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1543 "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; distance:10; content:\"three\"; sid:1;)");
1544 if (de_ctx->sig_list != NULL)
1545 goto end;
1546
1547 result = 1;
1548
1549 end:
1550 SigCleanSignatures(de_ctx);
1551 DetectEngineCtxFree(de_ctx);
1552 return result;
1553 }
1554
DetectFastPatternTest51(void)1555 static int DetectFastPatternTest51(void)
1556 {
1557 DetectEngineCtx *de_ctx = NULL;
1558 int result = 0;
1559
1560 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1561 goto end;
1562
1563 de_ctx->flags |= DE_QUIET;
1564 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1565 "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; within:10; content:\"three\"; sid:1;)");
1566 if (de_ctx->sig_list != NULL)
1567 goto end;
1568
1569 result = 1;
1570
1571 end:
1572 SigCleanSignatures(de_ctx);
1573 DetectEngineCtxFree(de_ctx);
1574 return result;
1575 }
1576
DetectFastPatternTest52(void)1577 static int DetectFastPatternTest52(void)
1578 {
1579 DetectEngineCtx *de_ctx = NULL;
1580 int result = 0;
1581
1582 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1583 goto end;
1584
1585 de_ctx->flags |= DE_QUIET;
1586 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1587 "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; offset:10; content:\"three\"; sid:1;)");
1588 if (de_ctx->sig_list != NULL)
1589 goto end;
1590
1591 result = 1;
1592
1593 end:
1594 SigCleanSignatures(de_ctx);
1595 DetectEngineCtxFree(de_ctx);
1596 return result;
1597 }
1598
DetectFastPatternTest53(void)1599 static int DetectFastPatternTest53(void)
1600 {
1601 DetectEngineCtx *de_ctx = NULL;
1602 int result = 0;
1603
1604 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1605 goto end;
1606
1607 de_ctx->flags |= DE_QUIET;
1608 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1609 "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; depth:10; content:\"three\"; sid:1;)");
1610 if (de_ctx->sig_list != NULL)
1611 goto end;
1612
1613 result = 1;
1614
1615 end:
1616 SigCleanSignatures(de_ctx);
1617 DetectEngineCtxFree(de_ctx);
1618 return result;
1619 }
1620
1621
1622 /* content fast_pattern tests ^ */
1623 /* uricontent fast_pattern tests v */
1624
1625
1626 /**
1627 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
1628 */
DetectFastPatternTest54(void)1629 static int DetectFastPatternTest54(void)
1630 {
1631 SigMatch *sm = NULL;
1632 DetectEngineCtx *de_ctx = NULL;
1633 int result = 0;
1634
1635 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1636 goto end;
1637
1638 de_ctx->flags |= DE_QUIET;
1639 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1640 "(uricontent:\"/one/\"; fast_pattern:only; "
1641 "msg:\"Testing fast_pattern\"; sid:1;)");
1642 if (de_ctx->sig_list == NULL)
1643 goto end;
1644
1645 result = 0;
1646 sm = de_ctx->sig_list->sm_lists[g_http_uri_buffer_id];
1647 while (sm != NULL) {
1648 if (sm->type == DETECT_CONTENT) {
1649 if ( ((DetectContentData *)sm->ctx)->flags &
1650 DETECT_CONTENT_FAST_PATTERN) {
1651 result = 1;
1652 break;
1653 } else {
1654 result = 0;
1655 break;
1656 }
1657 }
1658 sm = sm->next;
1659 }
1660
1661 end:
1662 SigCleanSignatures(de_ctx);
1663 DetectEngineCtxFree(de_ctx);
1664 return result;
1665 }
1666
1667 /**
1668 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
1669 */
DetectFastPatternTest55(void)1670 static int DetectFastPatternTest55(void)
1671 {
1672 SigMatch *sm = NULL;
1673 DetectEngineCtx *de_ctx = NULL;
1674 int result = 0;
1675
1676 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1677 goto end;
1678
1679 de_ctx->flags |= DE_QUIET;
1680 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1681 "(uricontent:\"oneoneone\"; fast_pattern:3,4; "
1682 "msg:\"Testing fast_pattern\"; sid:1;)");
1683 if (de_ctx->sig_list == NULL)
1684 goto end;
1685
1686 result = 0;
1687 sm = de_ctx->sig_list->sm_lists[g_http_uri_buffer_id];
1688 while (sm != NULL) {
1689 if (sm->type == DETECT_CONTENT) {
1690 if ( ((DetectContentData *)sm->ctx)->flags &
1691 DETECT_CONTENT_FAST_PATTERN) {
1692 result = 1;
1693 break;
1694 } else {
1695 result = 0;
1696 break;
1697 }
1698 }
1699 sm = sm->next;
1700 }
1701
1702 end:
1703 SigCleanSignatures(de_ctx);
1704 DetectEngineCtxFree(de_ctx);
1705 return result;
1706 }
1707
DetectFastPatternTest56(void)1708 static int DetectFastPatternTest56(void)
1709 {
1710 SigMatch *sm = NULL;
1711 DetectEngineCtx *de_ctx = NULL;
1712 int result = 0;
1713
1714 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1715 goto end;
1716
1717 de_ctx->flags |= DE_QUIET;
1718 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1719 "(uricontent:\"one\"; fast_pattern:only; sid:1;)");
1720 if (de_ctx->sig_list == NULL)
1721 goto end;
1722
1723 result = 0;
1724 sm = de_ctx->sig_list->sm_lists[g_http_uri_buffer_id];
1725 DetectContentData *ud = (DetectContentData *)sm->ctx;
1726 if (sm->type == DETECT_CONTENT) {
1727 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
1728 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
1729 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
1730 ud->fp_chop_offset == 0 &&
1731 ud->fp_chop_len == 0) {
1732 result = 1;
1733 } else {
1734 result = 0;
1735 }
1736 }
1737
1738 end:
1739 SigCleanSignatures(de_ctx);
1740 DetectEngineCtxFree(de_ctx);
1741 return result;
1742 }
1743
DetectFastPatternTest57(void)1744 static int DetectFastPatternTest57(void)
1745 {
1746 SigMatch *sm = NULL;
1747 DetectEngineCtx *de_ctx = NULL;
1748 int result = 0;
1749
1750 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1751 goto end;
1752
1753 de_ctx->flags |= DE_QUIET;
1754 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1755 "(uricontent:\"oneoneone\"; fast_pattern:3,4; sid:1;)");
1756 if (de_ctx->sig_list == NULL)
1757 goto end;
1758
1759 result = 0;
1760 sm = de_ctx->sig_list->sm_lists[g_http_uri_buffer_id];
1761 DetectContentData *ud = (DetectContentData *)sm->ctx;
1762 if (sm->type == DETECT_CONTENT) {
1763 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
1764 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
1765 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
1766 ud->fp_chop_offset == 3 &&
1767 ud->fp_chop_len == 4) {
1768 result = 1;
1769 } else {
1770 result = 0;
1771 }
1772 }
1773
1774 end:
1775 SigCleanSignatures(de_ctx);
1776 DetectEngineCtxFree(de_ctx);
1777 return result;
1778 }
1779
DetectFastPatternTest58(void)1780 static int DetectFastPatternTest58(void)
1781 {
1782 DetectEngineCtx *de_ctx = NULL;
1783 int result = 0;
1784
1785 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1786 goto end;
1787
1788 de_ctx->flags |= DE_QUIET;
1789 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1790 "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:only; distance:10; sid:1;)");
1791 if (de_ctx->sig_list != NULL)
1792 goto end;
1793
1794 result = 1;
1795
1796 end:
1797 SigCleanSignatures(de_ctx);
1798 DetectEngineCtxFree(de_ctx);
1799 return result;
1800 }
1801
DetectFastPatternTest59(void)1802 static int DetectFastPatternTest59(void)
1803 {
1804 DetectEngineCtx *de_ctx = NULL;
1805 int result = 0;
1806
1807 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1808 goto end;
1809
1810 de_ctx->flags |= DE_QUIET;
1811 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1812 "(uricontent:\"one\"; uricontent:\"two\"; distance:10; fast_pattern:only; sid:1;)");
1813 if (de_ctx->sig_list != NULL)
1814 goto end;
1815
1816 result = 1;
1817
1818 end:
1819 SigCleanSignatures(de_ctx);
1820 DetectEngineCtxFree(de_ctx);
1821 return result;
1822 }
1823
DetectFastPatternTest60(void)1824 static int DetectFastPatternTest60(void)
1825 {
1826 DetectEngineCtx *de_ctx = NULL;
1827 int result = 0;
1828
1829 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1830 goto end;
1831
1832 de_ctx->flags |= DE_QUIET;
1833 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1834 "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:only; within:10; sid:1;)");
1835 if (de_ctx->sig_list != NULL)
1836 goto end;
1837
1838 result = 1;
1839
1840 end:
1841 SigCleanSignatures(de_ctx);
1842 DetectEngineCtxFree(de_ctx);
1843 return result;
1844 }
1845
DetectFastPatternTest61(void)1846 static int DetectFastPatternTest61(void)
1847 {
1848 DetectEngineCtx *de_ctx = NULL;
1849 int result = 0;
1850
1851 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1852 goto end;
1853
1854 de_ctx->flags |= DE_QUIET;
1855 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1856 "(uricontent:\"one\"; uricontent:\"two\"; within:10; fast_pattern:only; sid:1;)");
1857 if (de_ctx->sig_list != NULL)
1858 goto end;
1859
1860 result = 1;
1861
1862 end:
1863 SigCleanSignatures(de_ctx);
1864 DetectEngineCtxFree(de_ctx);
1865 return result;
1866 }
1867
DetectFastPatternTest62(void)1868 static int DetectFastPatternTest62(void)
1869 {
1870 DetectEngineCtx *de_ctx = NULL;
1871 int result = 0;
1872
1873 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1874 goto end;
1875
1876 de_ctx->flags |= DE_QUIET;
1877 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1878 "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:only; offset:10; sid:1;)");
1879 if (de_ctx->sig_list != NULL)
1880 goto end;
1881
1882 result = 1;
1883
1884 end:
1885 SigCleanSignatures(de_ctx);
1886 DetectEngineCtxFree(de_ctx);
1887 return result;
1888 }
1889
DetectFastPatternTest63(void)1890 static int DetectFastPatternTest63(void)
1891 {
1892 DetectEngineCtx *de_ctx = NULL;
1893 int result = 0;
1894
1895 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1896 goto end;
1897
1898 de_ctx->flags |= DE_QUIET;
1899 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1900 "(uricontent:\"one\"; uricontent:\"two\"; offset:10; fast_pattern:only; sid:1;)");
1901 if (de_ctx->sig_list != NULL)
1902 goto end;
1903
1904 result = 1;
1905
1906 end:
1907 SigCleanSignatures(de_ctx);
1908 DetectEngineCtxFree(de_ctx);
1909 return result;
1910 }
1911
DetectFastPatternTest64(void)1912 static int DetectFastPatternTest64(void)
1913 {
1914 DetectEngineCtx *de_ctx = NULL;
1915 int result = 0;
1916
1917 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1918 goto end;
1919
1920 de_ctx->flags |= DE_QUIET;
1921 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1922 "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:only; depth:10; sid:1;)");
1923 if (de_ctx->sig_list != NULL)
1924 goto end;
1925
1926 result = 1;
1927
1928 end:
1929 SigCleanSignatures(de_ctx);
1930 DetectEngineCtxFree(de_ctx);
1931 return result;
1932 }
1933
DetectFastPatternTest65(void)1934 static int DetectFastPatternTest65(void)
1935 {
1936 DetectEngineCtx *de_ctx = NULL;
1937 int result = 0;
1938
1939 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1940 goto end;
1941
1942 de_ctx->flags |= DE_QUIET;
1943 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1944 "(uricontent:\"one\"; uricontent:\"two\"; depth:10; fast_pattern:only; sid:1;)");
1945 if (de_ctx->sig_list != NULL)
1946 goto end;
1947
1948 result = 1;
1949
1950 end:
1951 SigCleanSignatures(de_ctx);
1952 DetectEngineCtxFree(de_ctx);
1953 return result;
1954 }
1955
DetectFastPatternTest66(void)1956 static int DetectFastPatternTest66(void)
1957 {
1958 DetectEngineCtx *de_ctx = NULL;
1959 int result = 0;
1960
1961 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1962 goto end;
1963
1964 de_ctx->flags |= DE_QUIET;
1965 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1966 "(uricontent:\"one\"; uricontent:!\"two\"; fast_pattern:only; sid:1;)");
1967 if (de_ctx->sig_list != NULL)
1968 goto end;
1969
1970 result = 1;
1971
1972 end:
1973 SigCleanSignatures(de_ctx);
1974 DetectEngineCtxFree(de_ctx);
1975 return result;
1976 }
1977
DetectFastPatternTest67(void)1978 static int DetectFastPatternTest67(void)
1979 {
1980 DetectEngineCtx *de_ctx = NULL;
1981 int result = 0;
1982
1983 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
1984 goto end;
1985
1986 de_ctx->flags |= DE_QUIET;
1987 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1988 "(uricontent: \"one\"; uricontent:\"two\"; distance:30; uricontent:\"two\"; fast_pattern:only; sid:1;)");
1989 if (de_ctx->sig_list == NULL)
1990 goto end;
1991
1992 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
1993 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
1994 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
1995 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
1996 ud->fp_chop_offset == 0 &&
1997 ud->fp_chop_len == 0) {
1998 result = 1;
1999 } else {
2000 result = 0;
2001 }
2002
2003 end:
2004 SigCleanSignatures(de_ctx);
2005 DetectEngineCtxFree(de_ctx);
2006 return result;
2007 }
2008
DetectFastPatternTest68(void)2009 static int DetectFastPatternTest68(void)
2010 {
2011 DetectEngineCtx *de_ctx = NULL;
2012 int result = 0;
2013
2014 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2015 goto end;
2016
2017 de_ctx->flags |= DE_QUIET;
2018 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2019 "(uricontent:\"one\"; uricontent:\"two\"; within:30; uricontent:\"two\"; fast_pattern:only; sid:1;)");
2020 if (de_ctx->sig_list == NULL)
2021 goto end;
2022 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
2023 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2024 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
2025 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
2026 ud->fp_chop_offset == 0 &&
2027 ud->fp_chop_len == 0) {
2028 result = 1;
2029 } else {
2030 result = 0;
2031 }
2032
2033 end:
2034 SigCleanSignatures(de_ctx);
2035 DetectEngineCtxFree(de_ctx);
2036 return result;
2037 }
2038
DetectFastPatternTest69(void)2039 static int DetectFastPatternTest69(void)
2040 {
2041 DetectEngineCtx *de_ctx = NULL;
2042 int result = 0;
2043
2044 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2045 goto end;
2046
2047 de_ctx->flags |= DE_QUIET;
2048 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2049 "(uricontent:\"one\"; uricontent:\"two\"; offset:30; uricontent:\"two\"; fast_pattern:only; sid:1;)");
2050 if (de_ctx->sig_list == NULL)
2051 goto end;
2052 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
2053 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2054 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
2055 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
2056 ud->fp_chop_offset == 0 &&
2057 ud->fp_chop_len == 0) {
2058 result = 1;
2059 } else {
2060 result = 0;
2061 }
2062
2063 end:
2064 SigCleanSignatures(de_ctx);
2065 DetectEngineCtxFree(de_ctx);
2066 return result;
2067 }
2068
DetectFastPatternTest70(void)2069 static int DetectFastPatternTest70(void)
2070 {
2071 DetectEngineCtx *de_ctx = NULL;
2072 int result = 0;
2073
2074 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2075 goto end;
2076
2077 de_ctx->flags |= DE_QUIET;
2078 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2079 "(uricontent:\"one\"; uricontent:\"two\"; depth:30; uricontent:\"two\"; fast_pattern:only; sid:1;)");
2080 if (de_ctx->sig_list == NULL)
2081 goto end;
2082 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
2083 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2084 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
2085 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
2086 ud->fp_chop_offset == 0 &&
2087 ud->fp_chop_len == 0) {
2088 result = 1;
2089 } else {
2090 result = 0;
2091 }
2092
2093 end:
2094 SigCleanSignatures(de_ctx);
2095 DetectEngineCtxFree(de_ctx);
2096 return result;
2097 }
2098
DetectFastPatternTest71(void)2099 static int DetectFastPatternTest71(void)
2100 {
2101 DetectEngineCtx *de_ctx = NULL;
2102 int result = 0;
2103
2104 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2105 goto end;
2106
2107 de_ctx->flags |= DE_QUIET;
2108 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2109 "(uricontent:!\"one\"; fast_pattern; uricontent:\"two\"; sid:1;)");
2110 if (de_ctx->sig_list == NULL)
2111 goto end;
2112 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
2113 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2114 ud->flags & DETECT_CONTENT_NEGATED &&
2115 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
2116 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
2117 ud->fp_chop_offset == 0 &&
2118 ud->fp_chop_len == 0) {
2119 result = 1;
2120 } else {
2121 result = 0;
2122 }
2123
2124 end:
2125 SigCleanSignatures(de_ctx);
2126 DetectEngineCtxFree(de_ctx);
2127 return result;
2128 }
2129
DetectFastPatternTest72(void)2130 static int DetectFastPatternTest72(void)
2131 {
2132 DetectEngineCtx *de_ctx = NULL;
2133 int result = 0;
2134
2135 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2136 goto end;
2137
2138 de_ctx->flags |= DE_QUIET;
2139 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2140 "(uricontent:\"two\"; uricontent:!\"one\"; fast_pattern; distance:20; sid:1;)");
2141 if (de_ctx->sig_list != NULL)
2142 goto end;
2143
2144 result = 1;
2145
2146 end:
2147 SigCleanSignatures(de_ctx);
2148 DetectEngineCtxFree(de_ctx);
2149 return result;
2150 }
2151
DetectFastPatternTest73(void)2152 static int DetectFastPatternTest73(void)
2153 {
2154 DetectEngineCtx *de_ctx = NULL;
2155 int result = 0;
2156
2157 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2158 goto end;
2159
2160 de_ctx->flags |= DE_QUIET;
2161 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2162 "(uricontent:\"two\"; uricontent:!\"one\"; fast_pattern; within:20; sid:1;)");
2163 if (de_ctx->sig_list != NULL)
2164 goto end;
2165
2166 result = 1;
2167
2168 end:
2169 SigCleanSignatures(de_ctx);
2170 DetectEngineCtxFree(de_ctx);
2171 return result;
2172 }
2173
DetectFastPatternTest74(void)2174 static int DetectFastPatternTest74(void)
2175 {
2176 DetectEngineCtx *de_ctx = NULL;
2177 int result = 0;
2178
2179 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2180 goto end;
2181
2182 de_ctx->flags |= DE_QUIET;
2183 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2184 "(uricontent:\"two\"; uricontent:!\"one\"; fast_pattern; offset:20; sid:1;)");
2185 if (de_ctx->sig_list != NULL)
2186 goto end;
2187
2188 result = 1;
2189
2190 end:
2191 SigCleanSignatures(de_ctx);
2192 DetectEngineCtxFree(de_ctx);
2193 return result;
2194 }
2195
DetectFastPatternTest75(void)2196 static int DetectFastPatternTest75(void)
2197 {
2198 DetectEngineCtx *de_ctx = NULL;
2199 int result = 0;
2200
2201 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2202 goto end;
2203
2204 de_ctx->flags |= DE_QUIET;
2205 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2206 "(uricontent:\"two\"; uricontent:!\"one\"; fast_pattern; depth:20; sid:1;)");
2207 if (de_ctx->sig_list != NULL)
2208 goto end;
2209
2210 result = 1;
2211
2212 end:
2213 SigCleanSignatures(de_ctx);
2214 DetectEngineCtxFree(de_ctx);
2215 return result;
2216 }
2217
DetectFastPatternTest76(void)2218 static int DetectFastPatternTest76(void)
2219 {
2220 DetectEngineCtx *de_ctx = NULL;
2221 int result = 0;
2222
2223 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2224 goto end;
2225
2226 de_ctx->flags |= DE_QUIET;
2227 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2228 "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; sid:1;)");
2229 if (de_ctx->sig_list == NULL)
2230 goto end;
2231 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
2232 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2233 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
2234 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
2235 ud->fp_chop_offset == 3 &&
2236 ud->fp_chop_len == 4) {
2237 result = 1;
2238 } else {
2239 result = 0;
2240 }
2241
2242 end:
2243 SigCleanSignatures(de_ctx);
2244 DetectEngineCtxFree(de_ctx);
2245 return result;
2246 }
2247
DetectFastPatternTest77(void)2248 static int DetectFastPatternTest77(void)
2249 {
2250 DetectEngineCtx *de_ctx = NULL;
2251 int result = 0;
2252
2253 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2254 goto end;
2255
2256 de_ctx->flags |= DE_QUIET;
2257 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2258 "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; distance:30; sid:1;)");
2259 if (de_ctx->sig_list == NULL)
2260 goto end;
2261 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
2262 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2263 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
2264 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
2265 ud->fp_chop_offset == 3 &&
2266 ud->fp_chop_len == 4) {
2267 result = 1;
2268 } else {
2269 result = 0;
2270 }
2271
2272 end:
2273 SigCleanSignatures(de_ctx);
2274 DetectEngineCtxFree(de_ctx);
2275 return result;
2276 }
2277
DetectFastPatternTest78(void)2278 static int DetectFastPatternTest78(void)
2279 {
2280 DetectEngineCtx *de_ctx = NULL;
2281 int result = 0;
2282
2283 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2284 goto end;
2285
2286 de_ctx->flags |= DE_QUIET;
2287 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2288 "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; within:30; sid:1;)");
2289 if (de_ctx->sig_list == NULL)
2290 goto end;
2291 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
2292 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2293 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
2294 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
2295 ud->fp_chop_offset == 3 &&
2296 ud->fp_chop_len == 4) {
2297 result = 1;
2298 } else {
2299 result = 0;
2300 }
2301
2302 end:
2303 SigCleanSignatures(de_ctx);
2304 DetectEngineCtxFree(de_ctx);
2305 return result;
2306 }
2307
DetectFastPatternTest79(void)2308 static int DetectFastPatternTest79(void)
2309 {
2310 DetectEngineCtx *de_ctx = NULL;
2311 int result = 0;
2312
2313 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2314 goto end;
2315
2316 de_ctx->flags |= DE_QUIET;
2317 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2318 "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; offset:30; sid:1;)");
2319 if (de_ctx->sig_list == NULL)
2320 goto end;
2321 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
2322 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2323 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
2324 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
2325 ud->fp_chop_offset == 3 &&
2326 ud->fp_chop_len == 4) {
2327 result = 1;
2328 } else {
2329 result = 0;
2330 }
2331
2332 end:
2333 SigCleanSignatures(de_ctx);
2334 DetectEngineCtxFree(de_ctx);
2335 return result;
2336 }
2337
DetectFastPatternTest80(void)2338 static int DetectFastPatternTest80(void)
2339 {
2340 DetectEngineCtx *de_ctx = NULL;
2341 int result = 0;
2342
2343 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2344 goto end;
2345
2346 de_ctx->flags |= DE_QUIET;
2347 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2348 "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; depth:30; sid:1;)");
2349 if (de_ctx->sig_list == NULL)
2350 goto end;
2351 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
2352 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2353 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
2354 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
2355 ud->fp_chop_offset == 3 &&
2356 ud->fp_chop_len == 4) {
2357 result = 1;
2358 } else {
2359 result = 0;
2360 }
2361
2362 end:
2363 SigCleanSignatures(de_ctx);
2364 DetectEngineCtxFree(de_ctx);
2365 return result;
2366 }
2367
DetectFastPatternTest81(void)2368 static int DetectFastPatternTest81(void)
2369 {
2370 DetectEngineCtx *de_ctx = NULL;
2371 int result = 0;
2372
2373 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2374 goto end;
2375
2376 de_ctx->flags |= DE_QUIET;
2377 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2378 "(uricontent:\"one\"; uricontent:\"two\"; distance:10; uricontent:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
2379 if (de_ctx->sig_list == NULL)
2380 goto end;
2381 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
2382 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2383 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
2384 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
2385 ud->fp_chop_offset == 3 &&
2386 ud->fp_chop_len == 4) {
2387 result = 1;
2388 } else {
2389 result = 0;
2390 }
2391
2392 end:
2393 SigCleanSignatures(de_ctx);
2394 DetectEngineCtxFree(de_ctx);
2395 return result;
2396 }
2397
DetectFastPatternTest82(void)2398 static int DetectFastPatternTest82(void)
2399 {
2400 DetectEngineCtx *de_ctx = NULL;
2401 int result = 0;
2402
2403 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2404 goto end;
2405
2406 de_ctx->flags |= DE_QUIET;
2407 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2408 "(uricontent:\"one\"; uricontent:\"two\"; within:10; uricontent:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
2409 if (de_ctx->sig_list == NULL)
2410 goto end;
2411 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
2412 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2413 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
2414 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
2415 ud->fp_chop_offset == 3 &&
2416 ud->fp_chop_len == 4) {
2417 result = 1;
2418 } else {
2419 result = 0;
2420 }
2421
2422 end:
2423 SigCleanSignatures(de_ctx);
2424 DetectEngineCtxFree(de_ctx);
2425 return result;
2426 }
2427
DetectFastPatternTest83(void)2428 static int DetectFastPatternTest83(void)
2429 {
2430 DetectEngineCtx *de_ctx = NULL;
2431 int result = 0;
2432
2433 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2434 goto end;
2435
2436 de_ctx->flags |= DE_QUIET;
2437 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2438 "(uricontent:\"one\"; uricontent:\"two\"; offset:10; uricontent:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
2439 if (de_ctx->sig_list == NULL)
2440 goto end;
2441 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
2442 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2443 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
2444 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
2445 ud->fp_chop_offset == 3 &&
2446 ud->fp_chop_len == 4) {
2447 result = 1;
2448 } else {
2449 result = 0;
2450 }
2451
2452 end:
2453 SigCleanSignatures(de_ctx);
2454 DetectEngineCtxFree(de_ctx);
2455 return result;
2456 }
2457
DetectFastPatternTest84(void)2458 static int DetectFastPatternTest84(void)
2459 {
2460 DetectEngineCtx *de_ctx = NULL;
2461 int result = 0;
2462
2463 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2464 goto end;
2465
2466 de_ctx->flags |= DE_QUIET;
2467 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2468 "(uricontent:\"one\"; uricontent:\"two\"; depth:10; uricontent:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
2469 if (de_ctx->sig_list == NULL)
2470 goto end;
2471 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
2472 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2473 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
2474 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
2475 ud->fp_chop_offset == 3 &&
2476 ud->fp_chop_len == 4) {
2477 result = 1;
2478 } else {
2479 result = 0;
2480 }
2481
2482
2483 result = 1;
2484
2485 end:
2486 SigCleanSignatures(de_ctx);
2487 DetectEngineCtxFree(de_ctx);
2488 return result;
2489 }
2490
DetectFastPatternTest85(void)2491 static int DetectFastPatternTest85(void)
2492 {
2493 DetectEngineCtx *de_ctx = NULL;
2494 int result = 0;
2495
2496 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2497 goto end;
2498
2499 de_ctx->flags |= DE_QUIET;
2500 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2501 "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:65977,4; uricontent:\"three\"; distance:10; sid:1;)");
2502 if (de_ctx->sig_list != NULL)
2503 goto end;
2504
2505 result = 1;
2506
2507 end:
2508 SigCleanSignatures(de_ctx);
2509 DetectEngineCtxFree(de_ctx);
2510 return result;
2511 }
2512
DetectFastPatternTest86(void)2513 static int DetectFastPatternTest86(void)
2514 {
2515 DetectEngineCtx *de_ctx = NULL;
2516 int result = 0;
2517
2518 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2519 goto end;
2520
2521 de_ctx->flags |= DE_QUIET;
2522 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2523 "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,65977; uricontent:\"three\"; distance:10; sid:1;)");
2524 if (de_ctx->sig_list != NULL)
2525 goto end;
2526
2527 result = 1;
2528
2529 end:
2530 SigCleanSignatures(de_ctx);
2531 DetectEngineCtxFree(de_ctx);
2532 return result;
2533 }
2534
DetectFastPatternTest87(void)2535 static int DetectFastPatternTest87(void)
2536 {
2537 DetectEngineCtx *de_ctx = NULL;
2538 int result = 0;
2539
2540 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2541 goto end;
2542
2543 de_ctx->flags |= DE_QUIET;
2544 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2545 "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:65534,4; uricontent:\"three\"; distance:10; sid:1;)");
2546 if (de_ctx->sig_list != NULL)
2547 goto end;
2548
2549 result = 1;
2550
2551 end:
2552 SigCleanSignatures(de_ctx);
2553 DetectEngineCtxFree(de_ctx);
2554 return result;
2555 }
2556
DetectFastPatternTest88(void)2557 static int DetectFastPatternTest88(void)
2558 {
2559 DetectEngineCtx *de_ctx = NULL;
2560 int result = 0;
2561
2562 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2563 goto end;
2564
2565 de_ctx->flags |= DE_QUIET;
2566 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2567 "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; sid:1;)");
2568 if (de_ctx->sig_list == NULL)
2569 goto end;
2570 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
2571 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2572 ud->flags & DETECT_CONTENT_NEGATED &&
2573 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
2574 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
2575 ud->fp_chop_offset == 3 &&
2576 ud->fp_chop_len == 4) {
2577 result = 1;
2578 } else {
2579 result = 0;
2580 }
2581
2582 end:
2583 SigCleanSignatures(de_ctx);
2584 DetectEngineCtxFree(de_ctx);
2585 return result;
2586 }
2587
DetectFastPatternTest89(void)2588 static int DetectFastPatternTest89(void)
2589 {
2590 DetectEngineCtx *de_ctx = NULL;
2591 int result = 0;
2592
2593 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2594 goto end;
2595
2596 de_ctx->flags |= DE_QUIET;
2597 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2598 "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; distance:10; uricontent:\"three\"; sid:1;)");
2599 if (de_ctx->sig_list != NULL)
2600 goto end;
2601
2602 result = 1;
2603
2604 end:
2605 SigCleanSignatures(de_ctx);
2606 DetectEngineCtxFree(de_ctx);
2607 return result;
2608 }
2609
DetectFastPatternTest90(void)2610 static int DetectFastPatternTest90(void)
2611 {
2612 DetectEngineCtx *de_ctx = NULL;
2613 int result = 0;
2614
2615 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2616 goto end;
2617
2618 de_ctx->flags |= DE_QUIET;
2619 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2620 "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; within:10; uricontent:\"three\"; sid:1;)");
2621 if (de_ctx->sig_list != NULL)
2622 goto end;
2623
2624 result = 1;
2625
2626 end:
2627 SigCleanSignatures(de_ctx);
2628 DetectEngineCtxFree(de_ctx);
2629 return result;
2630 }
2631
DetectFastPatternTest91(void)2632 static int DetectFastPatternTest91(void)
2633 {
2634 DetectEngineCtx *de_ctx = NULL;
2635 int result = 0;
2636
2637 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2638 goto end;
2639
2640 de_ctx->flags |= DE_QUIET;
2641 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2642 "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; offset:10; uricontent:\"three\"; sid:1;)");
2643 if (de_ctx->sig_list != NULL)
2644 goto end;
2645
2646 result = 1;
2647
2648 end:
2649 SigCleanSignatures(de_ctx);
2650 DetectEngineCtxFree(de_ctx);
2651 return result;
2652 }
2653
DetectFastPatternTest92(void)2654 static int DetectFastPatternTest92(void)
2655 {
2656 DetectEngineCtx *de_ctx = NULL;
2657 int result = 0;
2658
2659 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2660 goto end;
2661
2662 de_ctx->flags |= DE_QUIET;
2663 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2664 "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; depth:10; uricontent:\"three\"; sid:1;)");
2665 if (de_ctx->sig_list != NULL)
2666 goto end;
2667
2668 result = 1;
2669
2670 end:
2671 SigCleanSignatures(de_ctx);
2672 DetectEngineCtxFree(de_ctx);
2673 return result;
2674 }
2675
2676
2677 /* uricontent fast_pattern tests ^ */
2678 /* http_uri fast_pattern tests v */
2679
2680
DetectFastPatternTest93(void)2681 static int DetectFastPatternTest93(void)
2682 {
2683 DetectEngineCtx *de_ctx = NULL;
2684 int result = 0;
2685
2686 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2687 goto end;
2688
2689 de_ctx->flags |= DE_QUIET;
2690 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2691 "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; sid:1;)");
2692 if (de_ctx->sig_list == NULL)
2693 goto end;
2694 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
2695 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2696 ud->flags & DETECT_CONTENT_NEGATED &&
2697 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
2698 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
2699 ud->fp_chop_offset == 3 &&
2700 ud->fp_chop_len == 4) {
2701 result = 1;
2702 } else {
2703 result = 0;
2704 }
2705
2706 end:
2707 SigCleanSignatures(de_ctx);
2708 DetectEngineCtxFree(de_ctx);
2709 return result;
2710 }
2711
2712 /**
2713 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
2714 */
DetectFastPatternTest94(void)2715 static int DetectFastPatternTest94(void)
2716 {
2717 SigMatch *sm = NULL;
2718 DetectEngineCtx *de_ctx = NULL;
2719 int result = 0;
2720
2721 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2722 goto end;
2723
2724 de_ctx->flags |= DE_QUIET;
2725 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2726 "(content:\"/one/\"; fast_pattern:only; http_uri; "
2727 "msg:\"Testing fast_pattern\"; sid:1;)");
2728 if (de_ctx->sig_list == NULL)
2729 goto end;
2730
2731 result = 0;
2732 sm = de_ctx->sig_list->sm_lists[g_http_uri_buffer_id];
2733 while (sm != NULL) {
2734 if (sm->type == DETECT_CONTENT) {
2735 if ( ((DetectContentData *)sm->ctx)->flags &
2736 DETECT_CONTENT_FAST_PATTERN) {
2737 result = 1;
2738 break;
2739 } else {
2740 result = 0;
2741 break;
2742 }
2743 }
2744 sm = sm->next;
2745 }
2746
2747 end:
2748 SigCleanSignatures(de_ctx);
2749 DetectEngineCtxFree(de_ctx);
2750 return result;
2751 }
2752
2753 /**
2754 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
2755 */
DetectFastPatternTest95(void)2756 static int DetectFastPatternTest95(void)
2757 {
2758 SigMatch *sm = NULL;
2759 DetectEngineCtx *de_ctx = NULL;
2760 int result = 0;
2761
2762 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2763 goto end;
2764
2765 de_ctx->flags |= DE_QUIET;
2766 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2767 "(content:\"oneoneone\"; fast_pattern:3,4; http_uri; "
2768 "msg:\"Testing fast_pattern\"; sid:1;)");
2769 if (de_ctx->sig_list == NULL)
2770 goto end;
2771
2772 result = 0;
2773 sm = de_ctx->sig_list->sm_lists[g_http_uri_buffer_id];
2774 while (sm != NULL) {
2775 if (sm->type == DETECT_CONTENT) {
2776 if ( ((DetectContentData *)sm->ctx)->flags &
2777 DETECT_CONTENT_FAST_PATTERN) {
2778 result = 1;
2779 break;
2780 } else {
2781 result = 0;
2782 break;
2783 }
2784 }
2785 sm = sm->next;
2786 }
2787
2788 end:
2789 SigCleanSignatures(de_ctx);
2790 DetectEngineCtxFree(de_ctx);
2791 return result;
2792 }
2793
DetectFastPatternTest96(void)2794 static int DetectFastPatternTest96(void)
2795 {
2796 SigMatch *sm = NULL;
2797 DetectEngineCtx *de_ctx = NULL;
2798 int result = 0;
2799
2800 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2801 goto end;
2802
2803 de_ctx->flags |= DE_QUIET;
2804 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2805 "(content:\"one\"; fast_pattern:only; http_uri; sid:1;)");
2806 if (de_ctx->sig_list == NULL)
2807 goto end;
2808
2809 result = 0;
2810 sm = de_ctx->sig_list->sm_lists[g_http_uri_buffer_id];
2811 DetectContentData *ud = (DetectContentData *)sm->ctx;
2812 if (sm->type == DETECT_CONTENT) {
2813 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2814 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
2815 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
2816 ud->fp_chop_offset == 0 &&
2817 ud->fp_chop_len == 0) {
2818 result = 1;
2819 } else {
2820 result = 0;
2821 }
2822 }
2823
2824 end:
2825 SigCleanSignatures(de_ctx);
2826 DetectEngineCtxFree(de_ctx);
2827 return result;
2828 }
2829
DetectFastPatternTest97(void)2830 static int DetectFastPatternTest97(void)
2831 {
2832 SigMatch *sm = NULL;
2833 DetectEngineCtx *de_ctx = NULL;
2834 int result = 0;
2835
2836 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2837 goto end;
2838
2839 de_ctx->flags |= DE_QUIET;
2840 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2841 "(content:\"oneoneone\"; fast_pattern:3,4; http_uri; sid:1;)");
2842 if (de_ctx->sig_list == NULL)
2843 goto end;
2844
2845 result = 0;
2846 sm = de_ctx->sig_list->sm_lists[g_http_uri_buffer_id];
2847 DetectContentData *ud = (DetectContentData *)sm->ctx;
2848 if (sm->type == DETECT_CONTENT) {
2849 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
2850 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
2851 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
2852 ud->fp_chop_offset == 3 &&
2853 ud->fp_chop_len == 4) {
2854 result = 1;
2855 } else {
2856 result = 0;
2857 }
2858 }
2859
2860 end:
2861 SigCleanSignatures(de_ctx);
2862 DetectEngineCtxFree(de_ctx);
2863 return result;
2864 }
2865
DetectFastPatternTest98(void)2866 static int DetectFastPatternTest98(void)
2867 {
2868 DetectEngineCtx *de_ctx = NULL;
2869 int result = 0;
2870
2871 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2872 goto end;
2873
2874 de_ctx->flags |= DE_QUIET;
2875 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2876 "(uricontent:\"one\"; content:\"two\"; fast_pattern:only; http_uri; distance:10; sid:1;)");
2877 if (de_ctx->sig_list != NULL)
2878 goto end;
2879
2880 result = 1;
2881
2882 end:
2883 SigCleanSignatures(de_ctx);
2884 DetectEngineCtxFree(de_ctx);
2885 return result;
2886 }
2887
DetectFastPatternTest99(void)2888 static int DetectFastPatternTest99(void)
2889 {
2890 DetectEngineCtx *de_ctx = NULL;
2891 int result = 0;
2892
2893 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2894 goto end;
2895
2896 de_ctx->flags |= DE_QUIET;
2897 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2898 "(uricontent:\"one\"; content:\"two\"; distance:10; fast_pattern:only; http_uri; sid:1;)");
2899 if (de_ctx->sig_list != NULL)
2900 goto end;
2901
2902 result = 1;
2903
2904 end:
2905 SigCleanSignatures(de_ctx);
2906 DetectEngineCtxFree(de_ctx);
2907 return result;
2908 }
2909
DetectFastPatternTest100(void)2910 static int DetectFastPatternTest100(void)
2911 {
2912 DetectEngineCtx *de_ctx = NULL;
2913 int result = 0;
2914
2915 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2916 goto end;
2917
2918 de_ctx->flags |= DE_QUIET;
2919 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2920 "(uricontent:\"one\"; content:\"two\"; fast_pattern:only; http_uri; within:10; sid:1;)");
2921 if (de_ctx->sig_list != NULL)
2922 goto end;
2923
2924 result = 1;
2925
2926 end:
2927 SigCleanSignatures(de_ctx);
2928 DetectEngineCtxFree(de_ctx);
2929 return result;
2930 }
2931
DetectFastPatternTest101(void)2932 static int DetectFastPatternTest101(void)
2933 {
2934 DetectEngineCtx *de_ctx = NULL;
2935 int result = 0;
2936
2937 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2938 goto end;
2939
2940 de_ctx->flags |= DE_QUIET;
2941 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2942 "(uricontent:\"one\"; content:\"two\"; within:10; fast_pattern:only; http_uri; sid:1;)");
2943 if (de_ctx->sig_list != NULL)
2944 goto end;
2945
2946 result = 1;
2947
2948 end:
2949 SigCleanSignatures(de_ctx);
2950 DetectEngineCtxFree(de_ctx);
2951 return result;
2952 }
2953
DetectFastPatternTest102(void)2954 static int DetectFastPatternTest102(void)
2955 {
2956 DetectEngineCtx *de_ctx = NULL;
2957 int result = 0;
2958
2959 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2960 goto end;
2961
2962 de_ctx->flags |= DE_QUIET;
2963 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2964 "(uricontent:\"one\"; content:\"two\"; fast_pattern:only; http_uri; offset:10; sid:1;)");
2965 if (de_ctx->sig_list != NULL)
2966 goto end;
2967
2968 result = 1;
2969
2970 end:
2971 SigCleanSignatures(de_ctx);
2972 DetectEngineCtxFree(de_ctx);
2973 return result;
2974 }
2975
DetectFastPatternTest103(void)2976 static int DetectFastPatternTest103(void)
2977 {
2978 DetectEngineCtx *de_ctx = NULL;
2979 int result = 0;
2980
2981 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
2982 goto end;
2983
2984 de_ctx->flags |= DE_QUIET;
2985 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2986 "(uricontent:\"one\"; content:\"two\"; offset:10; fast_pattern:only; http_uri; sid:1;)");
2987 if (de_ctx->sig_list != NULL)
2988 goto end;
2989
2990 result = 1;
2991
2992 end:
2993 SigCleanSignatures(de_ctx);
2994 DetectEngineCtxFree(de_ctx);
2995 return result;
2996 }
2997
DetectFastPatternTest104(void)2998 static int DetectFastPatternTest104(void)
2999 {
3000 DetectEngineCtx *de_ctx = NULL;
3001 int result = 0;
3002
3003 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3004 goto end;
3005
3006 de_ctx->flags |= DE_QUIET;
3007 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3008 "(uricontent:\"one\"; content:\"two\"; fast_pattern:only; http_uri; depth:10; sid:1;)");
3009 if (de_ctx->sig_list != NULL)
3010 goto end;
3011
3012 result = 1;
3013
3014 end:
3015 SigCleanSignatures(de_ctx);
3016 DetectEngineCtxFree(de_ctx);
3017 return result;
3018 }
3019
DetectFastPatternTest105(void)3020 static int DetectFastPatternTest105(void)
3021 {
3022 DetectEngineCtx *de_ctx = NULL;
3023 int result = 0;
3024
3025 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3026 goto end;
3027
3028 de_ctx->flags |= DE_QUIET;
3029 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3030 "(uricontent:\"one\"; content:\"two\"; depth:10; fast_pattern:only; http_uri; sid:1;)");
3031 if (de_ctx->sig_list != NULL)
3032 goto end;
3033
3034 result = 1;
3035
3036 end:
3037 SigCleanSignatures(de_ctx);
3038 DetectEngineCtxFree(de_ctx);
3039 return result;
3040 }
3041
DetectFastPatternTest106(void)3042 static int DetectFastPatternTest106(void)
3043 {
3044 DetectEngineCtx *de_ctx = NULL;
3045 int result = 0;
3046
3047 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3048 goto end;
3049
3050 de_ctx->flags |= DE_QUIET;
3051 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3052 "(uricontent:\"one\"; content:!\"two\"; fast_pattern:only; http_uri; sid:1;)");
3053 if (de_ctx->sig_list != NULL)
3054 goto end;
3055
3056 result = 1;
3057
3058 end:
3059 SigCleanSignatures(de_ctx);
3060 DetectEngineCtxFree(de_ctx);
3061 return result;
3062 }
3063
DetectFastPatternTest107(void)3064 static int DetectFastPatternTest107(void)
3065 {
3066 DetectEngineCtx *de_ctx = NULL;
3067 int result = 0;
3068
3069 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3070 goto end;
3071
3072 de_ctx->flags |= DE_QUIET;
3073 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3074 "(uricontent: \"one\"; uricontent:\"two\"; distance:30; content:\"two\"; fast_pattern:only; http_uri; sid:1;)");
3075 if (de_ctx->sig_list == NULL)
3076 goto end;
3077
3078 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
3079 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3080 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
3081 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
3082 ud->fp_chop_offset == 0 &&
3083 ud->fp_chop_len == 0) {
3084 result = 1;
3085 } else {
3086 result = 0;
3087 }
3088
3089 end:
3090 SigCleanSignatures(de_ctx);
3091 DetectEngineCtxFree(de_ctx);
3092 return result;
3093 }
3094
DetectFastPatternTest108(void)3095 static int DetectFastPatternTest108(void)
3096 {
3097 DetectEngineCtx *de_ctx = NULL;
3098 int result = 0;
3099
3100 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3101 goto end;
3102
3103 de_ctx->flags |= DE_QUIET;
3104 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3105 "(uricontent:\"one\"; uricontent:\"two\"; within:30; content:\"two\"; fast_pattern:only; http_uri; sid:1;)");
3106 if (de_ctx->sig_list == NULL)
3107 goto end;
3108 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
3109 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3110 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
3111 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
3112 ud->fp_chop_offset == 0 &&
3113 ud->fp_chop_len == 0) {
3114 result = 1;
3115 } else {
3116 result = 0;
3117 }
3118
3119 end:
3120 SigCleanSignatures(de_ctx);
3121 DetectEngineCtxFree(de_ctx);
3122 return result;
3123 }
3124
DetectFastPatternTest109(void)3125 static int DetectFastPatternTest109(void)
3126 {
3127 DetectEngineCtx *de_ctx = NULL;
3128 int result = 0;
3129
3130 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3131 goto end;
3132
3133 de_ctx->flags |= DE_QUIET;
3134 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3135 "(uricontent:\"one\"; uricontent:\"two\"; offset:30; content:\"two\"; fast_pattern:only; http_uri; sid:1;)");
3136 if (de_ctx->sig_list == NULL)
3137 goto end;
3138 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
3139 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3140 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
3141 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
3142 ud->fp_chop_offset == 0 &&
3143 ud->fp_chop_len == 0) {
3144 result = 1;
3145 } else {
3146 result = 0;
3147 }
3148
3149 end:
3150 SigCleanSignatures(de_ctx);
3151 DetectEngineCtxFree(de_ctx);
3152 return result;
3153 }
3154
DetectFastPatternTest110(void)3155 static int DetectFastPatternTest110(void)
3156 {
3157 DetectEngineCtx *de_ctx = NULL;
3158 int result = 0;
3159
3160 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3161 goto end;
3162
3163 de_ctx->flags |= DE_QUIET;
3164 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3165 "(uricontent:\"one\"; uricontent:\"two\"; depth:30; content:\"two\"; fast_pattern:only; http_uri; sid:1;)");
3166 if (de_ctx->sig_list == NULL)
3167 goto end;
3168 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
3169 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3170 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
3171 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
3172 ud->fp_chop_offset == 0 &&
3173 ud->fp_chop_len == 0) {
3174 result = 1;
3175 } else {
3176 result = 0;
3177 }
3178
3179 end:
3180 SigCleanSignatures(de_ctx);
3181 DetectEngineCtxFree(de_ctx);
3182 return result;
3183 }
3184
DetectFastPatternTest111(void)3185 static int DetectFastPatternTest111(void)
3186 {
3187 DetectEngineCtx *de_ctx = NULL;
3188 int result = 0;
3189
3190 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3191 goto end;
3192
3193 de_ctx->flags |= DE_QUIET;
3194 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3195 "(content:!\"one\"; fast_pattern; http_uri; uricontent:\"two\"; sid:1;)");
3196 if (de_ctx->sig_list == NULL)
3197 goto end;
3198 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
3199 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3200 ud->flags & DETECT_CONTENT_NEGATED &&
3201 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
3202 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
3203 ud->fp_chop_offset == 0 &&
3204 ud->fp_chop_len == 0) {
3205 result = 1;
3206 } else {
3207 result = 0;
3208 }
3209
3210 end:
3211 SigCleanSignatures(de_ctx);
3212 DetectEngineCtxFree(de_ctx);
3213 return result;
3214 }
3215
DetectFastPatternTest112(void)3216 static int DetectFastPatternTest112(void)
3217 {
3218 DetectEngineCtx *de_ctx = NULL;
3219 int result = 0;
3220
3221 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3222 goto end;
3223
3224 de_ctx->flags |= DE_QUIET;
3225 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3226 "(uricontent:\"two\"; content:!\"one\"; fast_pattern; http_uri; distance:20; sid:1;)");
3227 if (de_ctx->sig_list != NULL)
3228 goto end;
3229
3230 result = 1;
3231
3232 end:
3233 SigCleanSignatures(de_ctx);
3234 DetectEngineCtxFree(de_ctx);
3235 return result;
3236 }
3237
DetectFastPatternTest113(void)3238 static int DetectFastPatternTest113(void)
3239 {
3240 DetectEngineCtx *de_ctx = NULL;
3241 int result = 0;
3242
3243 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3244 goto end;
3245
3246 de_ctx->flags |= DE_QUIET;
3247 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3248 "(uricontent:\"two\"; content:!\"one\"; fast_pattern; http_uri; within:20; sid:1;)");
3249 if (de_ctx->sig_list != NULL)
3250 goto end;
3251
3252 result = 1;
3253
3254 end:
3255 SigCleanSignatures(de_ctx);
3256 DetectEngineCtxFree(de_ctx);
3257 return result;
3258 }
3259
DetectFastPatternTest114(void)3260 static int DetectFastPatternTest114(void)
3261 {
3262 DetectEngineCtx *de_ctx = NULL;
3263 int result = 0;
3264
3265 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3266 goto end;
3267
3268 de_ctx->flags |= DE_QUIET;
3269 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3270 "(uricontent:\"two\"; content:!\"one\"; fast_pattern; http_uri; offset:20; sid:1;)");
3271 if (de_ctx->sig_list != NULL)
3272 goto end;
3273
3274 result = 1;
3275
3276 end:
3277 SigCleanSignatures(de_ctx);
3278 DetectEngineCtxFree(de_ctx);
3279 return result;
3280 }
3281
DetectFastPatternTest115(void)3282 static int DetectFastPatternTest115(void)
3283 {
3284 DetectEngineCtx *de_ctx = NULL;
3285 int result = 0;
3286
3287 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3288 goto end;
3289
3290 de_ctx->flags |= DE_QUIET;
3291 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3292 "(uricontent:\"two\"; content:!\"one\"; fast_pattern; http_uri; depth:20; sid:1;)");
3293 if (de_ctx->sig_list != NULL)
3294 goto end;
3295
3296 result = 1;
3297
3298 end:
3299 SigCleanSignatures(de_ctx);
3300 DetectEngineCtxFree(de_ctx);
3301 return result;
3302 }
3303
DetectFastPatternTest116(void)3304 static int DetectFastPatternTest116(void)
3305 {
3306 DetectEngineCtx *de_ctx = NULL;
3307 int result = 0;
3308
3309 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3310 goto end;
3311
3312 de_ctx->flags |= DE_QUIET;
3313 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3314 "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; sid:1;)");
3315 if (de_ctx->sig_list == NULL)
3316 goto end;
3317 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
3318 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3319 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
3320 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
3321 ud->fp_chop_offset == 3 &&
3322 ud->fp_chop_len == 4) {
3323 result = 1;
3324 } else {
3325 result = 0;
3326 }
3327
3328 end:
3329 SigCleanSignatures(de_ctx);
3330 DetectEngineCtxFree(de_ctx);
3331 return result;
3332 }
3333
DetectFastPatternTest117(void)3334 static int DetectFastPatternTest117(void)
3335 {
3336 DetectEngineCtx *de_ctx = NULL;
3337 int result = 0;
3338
3339 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3340 goto end;
3341
3342 de_ctx->flags |= DE_QUIET;
3343 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3344 "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; distance:30; sid:1;)");
3345 if (de_ctx->sig_list == NULL)
3346 goto end;
3347 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
3348 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3349 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
3350 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
3351 ud->fp_chop_offset == 3 &&
3352 ud->fp_chop_len == 4) {
3353 result = 1;
3354 } else {
3355 result = 0;
3356 }
3357
3358 end:
3359 SigCleanSignatures(de_ctx);
3360 DetectEngineCtxFree(de_ctx);
3361 return result;
3362 }
3363
DetectFastPatternTest118(void)3364 static int DetectFastPatternTest118(void)
3365 {
3366 DetectEngineCtx *de_ctx = NULL;
3367 int result = 0;
3368
3369 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3370 goto end;
3371
3372 de_ctx->flags |= DE_QUIET;
3373 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3374 "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; within:30; sid:1;)");
3375 if (de_ctx->sig_list == NULL)
3376 goto end;
3377 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
3378 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3379 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
3380 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
3381 ud->fp_chop_offset == 3 &&
3382 ud->fp_chop_len == 4) {
3383 result = 1;
3384 } else {
3385 result = 0;
3386 }
3387
3388 end:
3389 SigCleanSignatures(de_ctx);
3390 DetectEngineCtxFree(de_ctx);
3391 return result;
3392 }
3393
DetectFastPatternTest119(void)3394 static int DetectFastPatternTest119(void)
3395 {
3396 DetectEngineCtx *de_ctx = NULL;
3397 int result = 0;
3398
3399 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3400 goto end;
3401
3402 de_ctx->flags |= DE_QUIET;
3403 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3404 "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; offset:30; sid:1;)");
3405 if (de_ctx->sig_list == NULL)
3406 goto end;
3407 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
3408 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3409 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
3410 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
3411 ud->fp_chop_offset == 3 &&
3412 ud->fp_chop_len == 4) {
3413 result = 1;
3414 } else {
3415 result = 0;
3416 }
3417
3418 end:
3419 SigCleanSignatures(de_ctx);
3420 DetectEngineCtxFree(de_ctx);
3421 return result;
3422 }
3423
DetectFastPatternTest120(void)3424 static int DetectFastPatternTest120(void)
3425 {
3426 DetectEngineCtx *de_ctx = NULL;
3427 int result = 0;
3428
3429 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3430 goto end;
3431
3432 de_ctx->flags |= DE_QUIET;
3433 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3434 "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; depth:30; sid:1;)");
3435 if (de_ctx->sig_list == NULL)
3436 goto end;
3437 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
3438 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3439 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
3440 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
3441 ud->fp_chop_offset == 3 &&
3442 ud->fp_chop_len == 4) {
3443 result = 1;
3444 } else {
3445 result = 0;
3446 }
3447
3448 end:
3449 SigCleanSignatures(de_ctx);
3450 DetectEngineCtxFree(de_ctx);
3451 return result;
3452 }
3453
DetectFastPatternTest121(void)3454 static int DetectFastPatternTest121(void)
3455 {
3456 DetectEngineCtx *de_ctx = NULL;
3457 int result = 0;
3458
3459 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3460 goto end;
3461
3462 de_ctx->flags |= DE_QUIET;
3463 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3464 "(uricontent:\"one\"; uricontent:\"two\"; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_uri; sid:1;)");
3465 if (de_ctx->sig_list == NULL)
3466 goto end;
3467 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
3468 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3469 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
3470 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
3471 ud->fp_chop_offset == 3 &&
3472 ud->fp_chop_len == 4) {
3473 result = 1;
3474 } else {
3475 result = 0;
3476 }
3477
3478 end:
3479 SigCleanSignatures(de_ctx);
3480 DetectEngineCtxFree(de_ctx);
3481 return result;
3482 }
3483
DetectFastPatternTest122(void)3484 static int DetectFastPatternTest122(void)
3485 {
3486 DetectEngineCtx *de_ctx = NULL;
3487 int result = 0;
3488
3489 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3490 goto end;
3491
3492 de_ctx->flags |= DE_QUIET;
3493 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3494 "(uricontent:\"one\"; uricontent:\"two\"; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_uri; sid:1;)");
3495 if (de_ctx->sig_list == NULL)
3496 goto end;
3497 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
3498 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3499 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
3500 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
3501 ud->fp_chop_offset == 3 &&
3502 ud->fp_chop_len == 4) {
3503 result = 1;
3504 } else {
3505 result = 0;
3506 }
3507
3508 end:
3509 SigCleanSignatures(de_ctx);
3510 DetectEngineCtxFree(de_ctx);
3511 return result;
3512 }
3513
DetectFastPatternTest123(void)3514 static int DetectFastPatternTest123(void)
3515 {
3516 DetectEngineCtx *de_ctx = NULL;
3517 int result = 0;
3518
3519 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3520 goto end;
3521
3522 de_ctx->flags |= DE_QUIET;
3523 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3524 "(uricontent:\"one\"; uricontent:\"two\"; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_uri; sid:1;)");
3525 if (de_ctx->sig_list == NULL)
3526 goto end;
3527 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
3528 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3529 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
3530 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
3531 ud->fp_chop_offset == 3 &&
3532 ud->fp_chop_len == 4) {
3533 result = 1;
3534 } else {
3535 result = 0;
3536 }
3537
3538 end:
3539 SigCleanSignatures(de_ctx);
3540 DetectEngineCtxFree(de_ctx);
3541 return result;
3542 }
3543
DetectFastPatternTest124(void)3544 static int DetectFastPatternTest124(void)
3545 {
3546 DetectEngineCtx *de_ctx = NULL;
3547 int result = 0;
3548
3549 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3550 goto end;
3551
3552 de_ctx->flags |= DE_QUIET;
3553 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3554 "(uricontent:\"one\"; uricontent:\"two\"; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_uri; sid:1;)");
3555 if (de_ctx->sig_list == NULL)
3556 goto end;
3557 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->ctx;
3558 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3559 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
3560 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
3561 ud->fp_chop_offset == 3 &&
3562 ud->fp_chop_len == 4) {
3563 result = 1;
3564 } else {
3565 result = 0;
3566 }
3567
3568
3569 result = 1;
3570
3571 end:
3572 SigCleanSignatures(de_ctx);
3573 DetectEngineCtxFree(de_ctx);
3574 return result;
3575 }
3576
DetectFastPatternTest125(void)3577 static int DetectFastPatternTest125(void)
3578 {
3579 DetectEngineCtx *de_ctx = NULL;
3580 int result = 0;
3581
3582 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3583 goto end;
3584
3585 de_ctx->flags |= DE_QUIET;
3586 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3587 "(uricontent:\"one\"; content:\"two\"; fast_pattern:65977,4; http_uri; uricontent:\"three\"; distance:10; sid:1;)");
3588 if (de_ctx->sig_list != NULL)
3589 goto end;
3590
3591 result = 1;
3592
3593 end:
3594 SigCleanSignatures(de_ctx);
3595 DetectEngineCtxFree(de_ctx);
3596 return result;
3597 }
3598
DetectFastPatternTest126(void)3599 static int DetectFastPatternTest126(void)
3600 {
3601 DetectEngineCtx *de_ctx = NULL;
3602 int result = 0;
3603
3604 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3605 goto end;
3606
3607 de_ctx->flags |= DE_QUIET;
3608 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3609 "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,65977; http_uri; uricontent:\"three\"; distance:10; sid:1;)");
3610 if (de_ctx->sig_list != NULL)
3611 goto end;
3612
3613 result = 1;
3614
3615 end:
3616 SigCleanSignatures(de_ctx);
3617 DetectEngineCtxFree(de_ctx);
3618 return result;
3619 }
3620
DetectFastPatternTest127(void)3621 static int DetectFastPatternTest127(void)
3622 {
3623 DetectEngineCtx *de_ctx = NULL;
3624 int result = 0;
3625
3626 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3627 goto end;
3628
3629 de_ctx->flags |= DE_QUIET;
3630 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3631 "(uricontent:\"one\"; content:\"two\"; fast_pattern:65534,4; http_uri; uricontent:\"three\"; distance:10; sid:1;)");
3632 if (de_ctx->sig_list != NULL)
3633 goto end;
3634
3635 result = 1;
3636
3637 end:
3638 SigCleanSignatures(de_ctx);
3639 DetectEngineCtxFree(de_ctx);
3640 return result;
3641 }
3642
DetectFastPatternTest128(void)3643 static int DetectFastPatternTest128(void)
3644 {
3645 DetectEngineCtx *de_ctx = NULL;
3646 int result = 0;
3647
3648 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3649 goto end;
3650
3651 de_ctx->flags |= DE_QUIET;
3652 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3653 "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; sid:1;)");
3654 if (de_ctx->sig_list == NULL)
3655 goto end;
3656 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
3657 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3658 ud->flags & DETECT_CONTENT_NEGATED &&
3659 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
3660 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
3661 ud->fp_chop_offset == 3 &&
3662 ud->fp_chop_len == 4) {
3663 result = 1;
3664 } else {
3665 result = 0;
3666 }
3667
3668 end:
3669 SigCleanSignatures(de_ctx);
3670 DetectEngineCtxFree(de_ctx);
3671 return result;
3672 }
3673
DetectFastPatternTest129(void)3674 static int DetectFastPatternTest129(void)
3675 {
3676 DetectEngineCtx *de_ctx = NULL;
3677 int result = 0;
3678
3679 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3680 goto end;
3681
3682 de_ctx->flags |= DE_QUIET;
3683 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3684 "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; distance:10; uricontent:\"three\"; sid:1;)");
3685 if (de_ctx->sig_list != NULL)
3686 goto end;
3687
3688 result = 1;
3689
3690 end:
3691 SigCleanSignatures(de_ctx);
3692 DetectEngineCtxFree(de_ctx);
3693 return result;
3694 }
3695
DetectFastPatternTest130(void)3696 static int DetectFastPatternTest130(void)
3697 {
3698 DetectEngineCtx *de_ctx = NULL;
3699 int result = 0;
3700
3701 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3702 goto end;
3703
3704 de_ctx->flags |= DE_QUIET;
3705 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3706 "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; within:10; uricontent:\"three\"; sid:1;)");
3707 if (de_ctx->sig_list != NULL)
3708 goto end;
3709
3710 result = 1;
3711
3712 end:
3713 SigCleanSignatures(de_ctx);
3714 DetectEngineCtxFree(de_ctx);
3715 return result;
3716 }
3717
DetectFastPatternTest131(void)3718 static int DetectFastPatternTest131(void)
3719 {
3720 DetectEngineCtx *de_ctx = NULL;
3721 int result = 0;
3722
3723 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3724 goto end;
3725
3726 de_ctx->flags |= DE_QUIET;
3727 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3728 "(uricontent:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; http_uri; offset:10; uricontent:\"three\"; sid:1;)");
3729 if (de_ctx->sig_list != NULL)
3730 goto end;
3731
3732 result = 1;
3733
3734 end:
3735 SigCleanSignatures(de_ctx);
3736 DetectEngineCtxFree(de_ctx);
3737 return result;
3738 }
3739
DetectFastPatternTest132(void)3740 static int DetectFastPatternTest132(void)
3741 {
3742 DetectEngineCtx *de_ctx = NULL;
3743 int result = 0;
3744
3745 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3746 goto end;
3747
3748 de_ctx->flags |= DE_QUIET;
3749 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3750 "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; depth:10; uricontent:\"three\"; sid:1;)");
3751 if (de_ctx->sig_list != NULL)
3752 goto end;
3753
3754 result = 1;
3755
3756 end:
3757 SigCleanSignatures(de_ctx);
3758 DetectEngineCtxFree(de_ctx);
3759 return result;
3760 }
3761
DetectFastPatternTest133(void)3762 static int DetectFastPatternTest133(void)
3763 {
3764 DetectEngineCtx *de_ctx = NULL;
3765 int result = 0;
3766
3767 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3768 goto end;
3769
3770 de_ctx->flags |= DE_QUIET;
3771 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3772 "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; sid:1;)");
3773 if (de_ctx->sig_list == NULL)
3774 goto end;
3775 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_uri_buffer_id]->prev->ctx;
3776 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3777 ud->flags & DETECT_CONTENT_NEGATED &&
3778 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
3779 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
3780 ud->fp_chop_offset == 3 &&
3781 ud->fp_chop_len == 4) {
3782 result = 1;
3783 } else {
3784 result = 0;
3785 }
3786
3787 end:
3788 SigCleanSignatures(de_ctx);
3789 DetectEngineCtxFree(de_ctx);
3790 return result;
3791 }
3792
3793
3794 /* http_uri fast_pattern tests ^ */
3795 /* http_client_body fast_pattern tests v */
3796
3797
DetectFastPatternTest134(void)3798 static int DetectFastPatternTest134(void)
3799 {
3800 DetectEngineCtx *de_ctx = NULL;
3801 int result = 0;
3802
3803 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3804 goto end;
3805
3806 de_ctx->flags |= DE_QUIET;
3807 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3808 "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; sid:1;)");
3809 if (de_ctx->sig_list == NULL)
3810 goto end;
3811 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
3812 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3813 ud->flags & DETECT_CONTENT_NEGATED &&
3814 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
3815 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
3816 ud->fp_chop_offset == 3 &&
3817 ud->fp_chop_len == 4) {
3818 result = 1;
3819 } else {
3820 result = 0;
3821 }
3822
3823 end:
3824 SigCleanSignatures(de_ctx);
3825 DetectEngineCtxFree(de_ctx);
3826 return result;
3827 }
3828
3829 /**
3830 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
3831 */
DetectFastPatternTest135(void)3832 static int DetectFastPatternTest135(void)
3833 {
3834 SigMatch *sm = NULL;
3835 DetectEngineCtx *de_ctx = NULL;
3836 int result = 0;
3837
3838 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3839 goto end;
3840
3841 de_ctx->flags |= DE_QUIET;
3842 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3843 "(content:\"/one/\"; fast_pattern:only; http_client_body; "
3844 "msg:\"Testing fast_pattern\"; sid:1;)");
3845 if (de_ctx->sig_list == NULL)
3846 goto end;
3847
3848 result = 0;
3849 sm = de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id];
3850 if (sm != NULL) {
3851 if ( ((DetectContentData *)sm->ctx)->flags &
3852 DETECT_CONTENT_FAST_PATTERN) {
3853 result = 1;
3854 } else {
3855 result = 0;
3856 }
3857 }
3858
3859
3860 end:
3861 SigCleanSignatures(de_ctx);
3862 DetectEngineCtxFree(de_ctx);
3863 return result;
3864 }
3865
3866 /**
3867 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
3868 */
DetectFastPatternTest136(void)3869 static int DetectFastPatternTest136(void)
3870 {
3871 SigMatch *sm = NULL;
3872 DetectEngineCtx *de_ctx = NULL;
3873 int result = 0;
3874
3875 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3876 goto end;
3877
3878 de_ctx->flags |= DE_QUIET;
3879 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3880 "(content:\"oneoneone\"; fast_pattern:3,4; http_client_body; "
3881 "msg:\"Testing fast_pattern\"; sid:1;)");
3882 if (de_ctx->sig_list == NULL)
3883 goto end;
3884
3885 result = 0;
3886 sm = de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id];
3887 if (sm != NULL) {
3888 if ( ((DetectContentData *)sm->ctx)->flags &
3889 DETECT_CONTENT_FAST_PATTERN) {
3890 result = 1;
3891 } else {
3892 result = 0;
3893 }
3894 }
3895
3896 end:
3897 SigCleanSignatures(de_ctx);
3898 DetectEngineCtxFree(de_ctx);
3899 return result;
3900 }
3901
DetectFastPatternTest137(void)3902 static int DetectFastPatternTest137(void)
3903 {
3904 SigMatch *sm = NULL;
3905 DetectEngineCtx *de_ctx = NULL;
3906 int result = 0;
3907
3908 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3909 goto end;
3910
3911 de_ctx->flags |= DE_QUIET;
3912 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3913 "(content:\"one\"; fast_pattern:only; http_client_body; sid:1;)");
3914 if (de_ctx->sig_list == NULL)
3915 goto end;
3916
3917 result = 0;
3918 sm = de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id];
3919 DetectContentData *ud = (DetectContentData *)sm->ctx;
3920 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3921 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
3922 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
3923 ud->fp_chop_offset == 0 &&
3924 ud->fp_chop_len == 0) {
3925 result = 1;
3926 } else {
3927 result = 0;
3928 }
3929
3930 end:
3931 SigCleanSignatures(de_ctx);
3932 DetectEngineCtxFree(de_ctx);
3933 return result;
3934 }
3935
DetectFastPatternTest138(void)3936 static int DetectFastPatternTest138(void)
3937 {
3938 SigMatch *sm = NULL;
3939 DetectEngineCtx *de_ctx = NULL;
3940 int result = 0;
3941
3942 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3943 goto end;
3944
3945 de_ctx->flags |= DE_QUIET;
3946 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3947 "(content:\"oneoneone\"; fast_pattern:3,4; http_client_body; sid:1;)");
3948 if (de_ctx->sig_list == NULL)
3949 goto end;
3950
3951 result = 0;
3952 sm = de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id];
3953 DetectContentData *ud = (DetectContentData *)sm->ctx;
3954 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
3955 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
3956 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
3957 ud->fp_chop_offset == 3 &&
3958 ud->fp_chop_len == 4) {
3959 result = 1;
3960 } else {
3961 result = 0;
3962 }
3963
3964 end:
3965 SigCleanSignatures(de_ctx);
3966 DetectEngineCtxFree(de_ctx);
3967 return result;
3968 }
3969
DetectFastPatternTest139(void)3970 static int DetectFastPatternTest139(void)
3971 {
3972 DetectEngineCtx *de_ctx = NULL;
3973 int result = 0;
3974
3975 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3976 goto end;
3977
3978 de_ctx->flags |= DE_QUIET;
3979 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3980 "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:only; http_client_body; distance:10; sid:1;)");
3981 if (de_ctx->sig_list != NULL)
3982 goto end;
3983
3984 result = 1;
3985
3986 end:
3987 SigCleanSignatures(de_ctx);
3988 DetectEngineCtxFree(de_ctx);
3989 return result;
3990 }
3991
DetectFastPatternTest140(void)3992 static int DetectFastPatternTest140(void)
3993 {
3994 DetectEngineCtx *de_ctx = NULL;
3995 int result = 0;
3996
3997 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
3998 goto end;
3999
4000 de_ctx->flags |= DE_QUIET;
4001 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4002 "(content:\"one\"; http_client_body; content:\"two\"; distance:10; fast_pattern:only; http_client_body; sid:1;)");
4003 if (de_ctx->sig_list != NULL)
4004 goto end;
4005
4006 result = 1;
4007
4008 end:
4009 SigCleanSignatures(de_ctx);
4010 DetectEngineCtxFree(de_ctx);
4011 return result;
4012 }
4013
DetectFastPatternTest141(void)4014 static int DetectFastPatternTest141(void)
4015 {
4016 DetectEngineCtx *de_ctx = NULL;
4017 int result = 0;
4018
4019 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4020 goto end;
4021
4022 de_ctx->flags |= DE_QUIET;
4023 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4024 "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:only; http_client_body; within:10; sid:1;)");
4025 if (de_ctx->sig_list != NULL)
4026 goto end;
4027
4028 result = 1;
4029
4030 end:
4031 SigCleanSignatures(de_ctx);
4032 DetectEngineCtxFree(de_ctx);
4033 return result;
4034 }
4035
DetectFastPatternTest142(void)4036 static int DetectFastPatternTest142(void)
4037 {
4038 DetectEngineCtx *de_ctx = NULL;
4039 int result = 0;
4040
4041 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4042 goto end;
4043
4044 de_ctx->flags |= DE_QUIET;
4045 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4046 "(content:\"one\"; http_client_body; content:\"two\"; within:10; fast_pattern:only; http_client_body; sid:1;)");
4047 if (de_ctx->sig_list != NULL)
4048 goto end;
4049
4050 result = 1;
4051
4052 end:
4053 SigCleanSignatures(de_ctx);
4054 DetectEngineCtxFree(de_ctx);
4055 return result;
4056 }
4057
DetectFastPatternTest143(void)4058 static int DetectFastPatternTest143(void)
4059 {
4060 DetectEngineCtx *de_ctx = NULL;
4061 int result = 0;
4062
4063 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4064 goto end;
4065
4066 de_ctx->flags |= DE_QUIET;
4067 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4068 "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:only; http_client_body; offset:10; sid:1;)");
4069 if (de_ctx->sig_list != NULL)
4070 goto end;
4071
4072 result = 1;
4073
4074 end:
4075 SigCleanSignatures(de_ctx);
4076 DetectEngineCtxFree(de_ctx);
4077 return result;
4078 }
4079
DetectFastPatternTest144(void)4080 static int DetectFastPatternTest144(void)
4081 {
4082 DetectEngineCtx *de_ctx = NULL;
4083 int result = 0;
4084
4085 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4086 goto end;
4087
4088 de_ctx->flags |= DE_QUIET;
4089 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4090 "(content:\"one\"; http_client_body; content:\"two\"; offset:10; fast_pattern:only; http_client_body; sid:1;)");
4091 if (de_ctx->sig_list != NULL)
4092 goto end;
4093
4094 result = 1;
4095
4096 end:
4097 SigCleanSignatures(de_ctx);
4098 DetectEngineCtxFree(de_ctx);
4099 return result;
4100 }
4101
DetectFastPatternTest145(void)4102 static int DetectFastPatternTest145(void)
4103 {
4104 DetectEngineCtx *de_ctx = NULL;
4105 int result = 0;
4106
4107 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4108 goto end;
4109
4110 de_ctx->flags |= DE_QUIET;
4111 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4112 "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:only; http_client_body; depth:10; sid:1;)");
4113 if (de_ctx->sig_list != NULL)
4114 goto end;
4115
4116 result = 1;
4117
4118 end:
4119 SigCleanSignatures(de_ctx);
4120 DetectEngineCtxFree(de_ctx);
4121 return result;
4122 }
4123
DetectFastPatternTest146(void)4124 static int DetectFastPatternTest146(void)
4125 {
4126 DetectEngineCtx *de_ctx = NULL;
4127 int result = 0;
4128
4129 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4130 goto end;
4131
4132 de_ctx->flags |= DE_QUIET;
4133 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4134 "(content:\"one\"; http_client_body; content:\"two\"; depth:10; fast_pattern:only; http_client_body; sid:1;)");
4135 if (de_ctx->sig_list != NULL)
4136 goto end;
4137
4138 result = 1;
4139
4140 end:
4141 SigCleanSignatures(de_ctx);
4142 DetectEngineCtxFree(de_ctx);
4143 return result;
4144 }
4145
DetectFastPatternTest147(void)4146 static int DetectFastPatternTest147(void)
4147 {
4148 DetectEngineCtx *de_ctx = NULL;
4149 int result = 0;
4150
4151 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4152 goto end;
4153
4154 de_ctx->flags |= DE_QUIET;
4155 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4156 "(content:\"one\"; http_client_body; content:!\"two\"; fast_pattern:only; http_client_body; sid:1;)");
4157 if (de_ctx->sig_list != NULL)
4158 goto end;
4159
4160 result = 1;
4161
4162 end:
4163 SigCleanSignatures(de_ctx);
4164 DetectEngineCtxFree(de_ctx);
4165 return result;
4166 }
4167
DetectFastPatternTest148(void)4168 static int DetectFastPatternTest148(void)
4169 {
4170 DetectEngineCtx *de_ctx = NULL;
4171 int result = 0;
4172
4173 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4174 goto end;
4175
4176 de_ctx->flags |= DE_QUIET;
4177 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4178 "(content: \"one\"; http_client_body; content:\"two\"; http_client_body; distance:30; content:\"two\"; fast_pattern:only; http_client_body; sid:1;)");
4179 if (de_ctx->sig_list == NULL)
4180 goto end;
4181
4182 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
4183 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4184 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
4185 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
4186 ud->fp_chop_offset == 0 &&
4187 ud->fp_chop_len == 0) {
4188 result = 1;
4189 } else {
4190 result = 0;
4191 }
4192
4193 end:
4194 SigCleanSignatures(de_ctx);
4195 DetectEngineCtxFree(de_ctx);
4196 return result;
4197 }
4198
DetectFastPatternTest149(void)4199 static int DetectFastPatternTest149(void)
4200 {
4201 DetectEngineCtx *de_ctx = NULL;
4202 int result = 0;
4203
4204 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4205 goto end;
4206
4207 de_ctx->flags |= DE_QUIET;
4208 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4209 "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; within:30; content:\"two\"; fast_pattern:only; http_client_body; sid:1;)");
4210 if (de_ctx->sig_list == NULL)
4211 goto end;
4212 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
4213 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4214 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
4215 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
4216 ud->fp_chop_offset == 0 &&
4217 ud->fp_chop_len == 0) {
4218 result = 1;
4219 } else {
4220 result = 0;
4221 }
4222
4223 end:
4224 SigCleanSignatures(de_ctx);
4225 DetectEngineCtxFree(de_ctx);
4226 return result;
4227 }
4228
DetectFastPatternTest150(void)4229 static int DetectFastPatternTest150(void)
4230 {
4231 DetectEngineCtx *de_ctx = NULL;
4232 int result = 0;
4233
4234 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4235 goto end;
4236
4237 de_ctx->flags |= DE_QUIET;
4238 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4239 "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; offset:30; content:\"two\"; fast_pattern:only; http_client_body; sid:1;)");
4240 if (de_ctx->sig_list == NULL)
4241 goto end;
4242 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
4243 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4244 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
4245 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
4246 ud->fp_chop_offset == 0 &&
4247 ud->fp_chop_len == 0) {
4248 result = 1;
4249 } else {
4250 result = 0;
4251 }
4252
4253 end:
4254 SigCleanSignatures(de_ctx);
4255 DetectEngineCtxFree(de_ctx);
4256 return result;
4257 }
4258
DetectFastPatternTest151(void)4259 static int DetectFastPatternTest151(void)
4260 {
4261 DetectEngineCtx *de_ctx = NULL;
4262 int result = 0;
4263
4264 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4265 goto end;
4266
4267 de_ctx->flags |= DE_QUIET;
4268 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4269 "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; depth:30; content:\"two\"; fast_pattern:only; http_client_body; sid:1;)");
4270 if (de_ctx->sig_list == NULL)
4271 goto end;
4272 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
4273 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4274 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
4275 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
4276 ud->fp_chop_offset == 0 &&
4277 ud->fp_chop_len == 0) {
4278 result = 1;
4279 } else {
4280 result = 0;
4281 }
4282
4283 end:
4284 SigCleanSignatures(de_ctx);
4285 DetectEngineCtxFree(de_ctx);
4286 return result;
4287 }
4288
DetectFastPatternTest152(void)4289 static int DetectFastPatternTest152(void)
4290 {
4291 DetectEngineCtx *de_ctx = NULL;
4292 int result = 0;
4293
4294 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4295 goto end;
4296
4297 de_ctx->flags |= DE_QUIET;
4298 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4299 "(content:!\"one\"; fast_pattern; http_client_body; content:\"two\"; http_client_body; sid:1;)");
4300 if (de_ctx->sig_list == NULL)
4301 goto end;
4302 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
4303 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4304 ud->flags & DETECT_CONTENT_NEGATED &&
4305 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
4306 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
4307 ud->fp_chop_offset == 0 &&
4308 ud->fp_chop_len == 0) {
4309 result = 1;
4310 } else {
4311 result = 0;
4312 }
4313
4314 end:
4315 SigCleanSignatures(de_ctx);
4316 DetectEngineCtxFree(de_ctx);
4317 return result;
4318 }
4319
DetectFastPatternTest153(void)4320 static int DetectFastPatternTest153(void)
4321 {
4322 DetectEngineCtx *de_ctx = NULL;
4323 int result = 0;
4324
4325 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4326 goto end;
4327
4328 de_ctx->flags |= DE_QUIET;
4329 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4330 "(content:\"two\"; http_client_body; content:!\"one\"; fast_pattern; http_client_body; distance:20; sid:1;)");
4331 if (de_ctx->sig_list != NULL)
4332 goto end;
4333
4334 result = 1;
4335
4336 end:
4337 SigCleanSignatures(de_ctx);
4338 DetectEngineCtxFree(de_ctx);
4339 return result;
4340 }
4341
DetectFastPatternTest154(void)4342 static int DetectFastPatternTest154(void)
4343 {
4344 DetectEngineCtx *de_ctx = NULL;
4345 int result = 0;
4346
4347 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4348 goto end;
4349
4350 de_ctx->flags |= DE_QUIET;
4351 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4352 "(content:\"two\"; http_client_body; content:!\"one\"; fast_pattern; http_client_body; within:20; sid:1;)");
4353 if (de_ctx->sig_list != NULL)
4354 goto end;
4355
4356 result = 1;
4357
4358 end:
4359 SigCleanSignatures(de_ctx);
4360 DetectEngineCtxFree(de_ctx);
4361 return result;
4362 }
4363
DetectFastPatternTest155(void)4364 static int DetectFastPatternTest155(void)
4365 {
4366 DetectEngineCtx *de_ctx = NULL;
4367 int result = 0;
4368
4369 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4370 goto end;
4371
4372 de_ctx->flags |= DE_QUIET;
4373 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4374 "(content:\"two\"; http_client_body; content:!\"one\"; fast_pattern; http_client_body; offset:20; sid:1;)");
4375 if (de_ctx->sig_list != NULL)
4376 goto end;
4377
4378 result = 1;
4379
4380 end:
4381 SigCleanSignatures(de_ctx);
4382 DetectEngineCtxFree(de_ctx);
4383 return result;
4384 }
4385
DetectFastPatternTest156(void)4386 static int DetectFastPatternTest156(void)
4387 {
4388 DetectEngineCtx *de_ctx = NULL;
4389 int result = 0;
4390
4391 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4392 goto end;
4393
4394 de_ctx->flags |= DE_QUIET;
4395 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4396 "(content:\"two\"; http_client_body; content:!\"one\"; fast_pattern; http_client_body; depth:20; sid:1;)");
4397 if (de_ctx->sig_list != NULL)
4398 goto end;
4399
4400 result = 1;
4401
4402 end:
4403 SigCleanSignatures(de_ctx);
4404 DetectEngineCtxFree(de_ctx);
4405 return result;
4406 }
4407
DetectFastPatternTest157(void)4408 static int DetectFastPatternTest157(void)
4409 {
4410 DetectEngineCtx *de_ctx = NULL;
4411 int result = 0;
4412
4413 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4414 goto end;
4415
4416 de_ctx->flags |= DE_QUIET;
4417 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4418 "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; sid:1;)");
4419 if (de_ctx->sig_list == NULL)
4420 goto end;
4421 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
4422 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4423 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
4424 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
4425 ud->fp_chop_offset == 3 &&
4426 ud->fp_chop_len == 4) {
4427 result = 1;
4428 } else {
4429 result = 0;
4430 }
4431
4432 end:
4433 SigCleanSignatures(de_ctx);
4434 DetectEngineCtxFree(de_ctx);
4435 return result;
4436 }
4437
DetectFastPatternTest158(void)4438 static int DetectFastPatternTest158(void)
4439 {
4440 DetectEngineCtx *de_ctx = NULL;
4441 int result = 0;
4442
4443 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4444 goto end;
4445
4446 de_ctx->flags |= DE_QUIET;
4447 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4448 "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; distance:30; sid:1;)");
4449 if (de_ctx->sig_list == NULL)
4450 goto end;
4451 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
4452 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4453 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
4454 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
4455 ud->fp_chop_offset == 3 &&
4456 ud->fp_chop_len == 4) {
4457 result = 1;
4458 } else {
4459 result = 0;
4460 }
4461
4462 end:
4463 SigCleanSignatures(de_ctx);
4464 DetectEngineCtxFree(de_ctx);
4465 return result;
4466 }
4467
DetectFastPatternTest159(void)4468 static int DetectFastPatternTest159(void)
4469 {
4470 DetectEngineCtx *de_ctx = NULL;
4471 int result = 0;
4472
4473 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4474 goto end;
4475
4476 de_ctx->flags |= DE_QUIET;
4477 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4478 "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; within:30; sid:1;)");
4479 if (de_ctx->sig_list == NULL)
4480 goto end;
4481 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
4482 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4483 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
4484 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
4485 ud->fp_chop_offset == 3 &&
4486 ud->fp_chop_len == 4) {
4487 result = 1;
4488 } else {
4489 result = 0;
4490 }
4491
4492 end:
4493 SigCleanSignatures(de_ctx);
4494 DetectEngineCtxFree(de_ctx);
4495 return result;
4496 }
4497
DetectFastPatternTest160(void)4498 static int DetectFastPatternTest160(void)
4499 {
4500 DetectEngineCtx *de_ctx = NULL;
4501 int result = 0;
4502
4503 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4504 goto end;
4505
4506 de_ctx->flags |= DE_QUIET;
4507 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4508 "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; offset:30; sid:1;)");
4509 if (de_ctx->sig_list == NULL)
4510 goto end;
4511 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
4512 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4513 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
4514 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
4515 ud->fp_chop_offset == 3 &&
4516 ud->fp_chop_len == 4) {
4517 result = 1;
4518 } else {
4519 result = 0;
4520 }
4521
4522 end:
4523 SigCleanSignatures(de_ctx);
4524 DetectEngineCtxFree(de_ctx);
4525 return result;
4526 }
4527
DetectFastPatternTest161(void)4528 static int DetectFastPatternTest161(void)
4529 {
4530 DetectEngineCtx *de_ctx = NULL;
4531 int result = 0;
4532
4533 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4534 goto end;
4535
4536 de_ctx->flags |= DE_QUIET;
4537 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4538 "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; depth:30; sid:1;)");
4539 if (de_ctx->sig_list == NULL)
4540 goto end;
4541 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
4542 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4543 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
4544 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
4545 ud->fp_chop_offset == 3 &&
4546 ud->fp_chop_len == 4) {
4547 result = 1;
4548 } else {
4549 result = 0;
4550 }
4551
4552 end:
4553 SigCleanSignatures(de_ctx);
4554 DetectEngineCtxFree(de_ctx);
4555 return result;
4556 }
4557
DetectFastPatternTest162(void)4558 static int DetectFastPatternTest162(void)
4559 {
4560 DetectEngineCtx *de_ctx = NULL;
4561 int result = 0;
4562
4563 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4564 goto end;
4565
4566 de_ctx->flags |= DE_QUIET;
4567 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4568 "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_client_body; sid:1;)");
4569 if (de_ctx->sig_list == NULL)
4570 goto end;
4571 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
4572 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4573 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
4574 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
4575 ud->fp_chop_offset == 3 &&
4576 ud->fp_chop_len == 4) {
4577 result = 1;
4578 } else {
4579 result = 0;
4580 }
4581
4582 end:
4583 SigCleanSignatures(de_ctx);
4584 DetectEngineCtxFree(de_ctx);
4585 return result;
4586 }
4587
DetectFastPatternTest163(void)4588 static int DetectFastPatternTest163(void)
4589 {
4590 DetectEngineCtx *de_ctx = NULL;
4591 int result = 0;
4592
4593 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4594 goto end;
4595
4596 de_ctx->flags |= DE_QUIET;
4597 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4598 "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_client_body; sid:1;)");
4599 if (de_ctx->sig_list == NULL)
4600 goto end;
4601 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
4602 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4603 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
4604 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
4605 ud->fp_chop_offset == 3 &&
4606 ud->fp_chop_len == 4) {
4607 result = 1;
4608 } else {
4609 result = 0;
4610 }
4611
4612 end:
4613 SigCleanSignatures(de_ctx);
4614 DetectEngineCtxFree(de_ctx);
4615 return result;
4616 }
4617
DetectFastPatternTest164(void)4618 static int DetectFastPatternTest164(void)
4619 {
4620 DetectEngineCtx *de_ctx = NULL;
4621 int result = 0;
4622
4623 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4624 goto end;
4625
4626 de_ctx->flags |= DE_QUIET;
4627 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4628 "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_client_body; sid:1;)");
4629 if (de_ctx->sig_list == NULL)
4630 goto end;
4631 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
4632 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4633 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
4634 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
4635 ud->fp_chop_offset == 3 &&
4636 ud->fp_chop_len == 4) {
4637 result = 1;
4638 } else {
4639 result = 0;
4640 }
4641
4642 end:
4643 SigCleanSignatures(de_ctx);
4644 DetectEngineCtxFree(de_ctx);
4645 return result;
4646 }
4647
DetectFastPatternTest165(void)4648 static int DetectFastPatternTest165(void)
4649 {
4650 DetectEngineCtx *de_ctx = NULL;
4651 int result = 0;
4652
4653 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4654 goto end;
4655
4656 de_ctx->flags |= DE_QUIET;
4657 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4658 "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_client_body; sid:1;)");
4659 if (de_ctx->sig_list == NULL)
4660 goto end;
4661 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
4662 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4663 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
4664 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
4665 ud->fp_chop_offset == 3 &&
4666 ud->fp_chop_len == 4) {
4667 result = 1;
4668 } else {
4669 result = 0;
4670 }
4671
4672
4673 result = 1;
4674
4675 end:
4676 SigCleanSignatures(de_ctx);
4677 DetectEngineCtxFree(de_ctx);
4678 return result;
4679 }
4680
DetectFastPatternTest166(void)4681 static int DetectFastPatternTest166(void)
4682 {
4683 DetectEngineCtx *de_ctx = NULL;
4684 int result = 0;
4685
4686 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4687 goto end;
4688
4689 de_ctx->flags |= DE_QUIET;
4690 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4691 "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:65977,4; http_client_body; content:\"three\"; http_client_body; distance:10; sid:1;)");
4692 if (de_ctx->sig_list != NULL)
4693 goto end;
4694
4695 result = 1;
4696
4697 end:
4698 SigCleanSignatures(de_ctx);
4699 DetectEngineCtxFree(de_ctx);
4700 return result;
4701 }
4702
DetectFastPatternTest167(void)4703 static int DetectFastPatternTest167(void)
4704 {
4705 DetectEngineCtx *de_ctx = NULL;
4706 int result = 0;
4707
4708 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4709 goto end;
4710
4711 de_ctx->flags |= DE_QUIET;
4712 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4713 "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,65977; http_client_body; content:\"three\"; distance:10; http_client_body; sid:1;)");
4714 if (de_ctx->sig_list != NULL)
4715 goto end;
4716
4717 result = 1;
4718
4719 end:
4720 SigCleanSignatures(de_ctx);
4721 DetectEngineCtxFree(de_ctx);
4722 return result;
4723 }
4724
DetectFastPatternTest168(void)4725 static int DetectFastPatternTest168(void)
4726 {
4727 DetectEngineCtx *de_ctx = NULL;
4728 int result = 0;
4729
4730 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4731 goto end;
4732
4733 de_ctx->flags |= DE_QUIET;
4734 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4735 "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:65534,4; http_client_body; content:\"three\"; http_client_body; distance:10; sid:1;)");
4736 if (de_ctx->sig_list != NULL)
4737 goto end;
4738
4739 result = 1;
4740
4741 end:
4742 SigCleanSignatures(de_ctx);
4743 DetectEngineCtxFree(de_ctx);
4744 return result;
4745 }
4746
DetectFastPatternTest169(void)4747 static int DetectFastPatternTest169(void)
4748 {
4749 DetectEngineCtx *de_ctx = NULL;
4750 int result = 0;
4751
4752 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4753 goto end;
4754
4755 de_ctx->flags |= DE_QUIET;
4756 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4757 "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; sid:1;)");
4758 if (de_ctx->sig_list == NULL)
4759 goto end;
4760 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
4761 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4762 ud->flags & DETECT_CONTENT_NEGATED &&
4763 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
4764 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
4765 ud->fp_chop_offset == 3 &&
4766 ud->fp_chop_len == 4) {
4767 result = 1;
4768 } else {
4769 result = 0;
4770 }
4771
4772 end:
4773 SigCleanSignatures(de_ctx);
4774 DetectEngineCtxFree(de_ctx);
4775 return result;
4776 }
4777
DetectFastPatternTest170(void)4778 static int DetectFastPatternTest170(void)
4779 {
4780 DetectEngineCtx *de_ctx = NULL;
4781 int result = 0;
4782
4783 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4784 goto end;
4785
4786 de_ctx->flags |= DE_QUIET;
4787 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4788 "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; distance:10; content:\"three\"; http_client_body; sid:1;)");
4789 if (de_ctx->sig_list != NULL)
4790 goto end;
4791
4792 result = 1;
4793
4794 end:
4795 SigCleanSignatures(de_ctx);
4796 DetectEngineCtxFree(de_ctx);
4797 return result;
4798 }
4799
DetectFastPatternTest171(void)4800 static int DetectFastPatternTest171(void)
4801 {
4802 DetectEngineCtx *de_ctx = NULL;
4803 int result = 0;
4804
4805 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4806 goto end;
4807
4808 de_ctx->flags |= DE_QUIET;
4809 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4810 "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; within:10; content:\"three\"; http_client_body; sid:1;)");
4811 if (de_ctx->sig_list != NULL)
4812 goto end;
4813
4814 result = 1;
4815
4816 end:
4817 SigCleanSignatures(de_ctx);
4818 DetectEngineCtxFree(de_ctx);
4819 return result;
4820 }
4821
DetectFastPatternTest172(void)4822 static int DetectFastPatternTest172(void)
4823 {
4824 DetectEngineCtx *de_ctx = NULL;
4825 int result = 0;
4826
4827 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4828 goto end;
4829
4830 de_ctx->flags |= DE_QUIET;
4831 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4832 "(content:\"one\"; http_client_body; content:!\"twooneone\"; fast_pattern:3,4; http_client_body; offset:10; content:\"three\"; http_client_body; sid:1;)");
4833 if (de_ctx->sig_list != NULL)
4834 goto end;
4835
4836 result = 1;
4837
4838 end:
4839 SigCleanSignatures(de_ctx);
4840 DetectEngineCtxFree(de_ctx);
4841 return result;
4842 }
4843
DetectFastPatternTest173(void)4844 static int DetectFastPatternTest173(void)
4845 {
4846 DetectEngineCtx *de_ctx = NULL;
4847 int result = 0;
4848
4849 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4850 goto end;
4851
4852 de_ctx->flags |= DE_QUIET;
4853 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4854 "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; depth:10; content:\"three\"; http_client_body; sid:1;)");
4855 if (de_ctx->sig_list != NULL)
4856 goto end;
4857
4858 result = 1;
4859
4860 end:
4861 SigCleanSignatures(de_ctx);
4862 DetectEngineCtxFree(de_ctx);
4863 return result;
4864 }
4865
DetectFastPatternTest174(void)4866 static int DetectFastPatternTest174(void)
4867 {
4868 DetectEngineCtx *de_ctx = NULL;
4869 int result = 0;
4870
4871 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4872 goto end;
4873
4874 de_ctx->flags |= DE_QUIET;
4875 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4876 "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; sid:1;)");
4877 if (de_ctx->sig_list == NULL)
4878 goto end;
4879 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
4880 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
4881 ud->flags & DETECT_CONTENT_NEGATED &&
4882 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
4883 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
4884 ud->fp_chop_offset == 3 &&
4885 ud->fp_chop_len == 4) {
4886 result = 1;
4887 } else {
4888 result = 0;
4889 }
4890
4891 end:
4892 SigCleanSignatures(de_ctx);
4893 DetectEngineCtxFree(de_ctx);
4894 return result;
4895 }
4896
4897
4898 /* http_client_body fast_pattern tests ^ */
4899 /* content fast_pattern tests v */
4900
4901
DetectFastPatternTest175(void)4902 static int DetectFastPatternTest175(void)
4903 {
4904 DetectEngineCtx *de_ctx = NULL;
4905 int result = 0;
4906
4907 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4908 goto end;
4909
4910 de_ctx->flags |= DE_QUIET;
4911 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4912 "(content:\"two\"; content:!\"one\"; distance:20; fast_pattern; sid:1;)");
4913 if (de_ctx->sig_list != NULL)
4914 goto end;
4915
4916 result = 1;
4917
4918 end:
4919 SigCleanSignatures(de_ctx);
4920 DetectEngineCtxFree(de_ctx);
4921 return result;
4922 }
4923
DetectFastPatternTest176(void)4924 static int DetectFastPatternTest176(void)
4925 {
4926 DetectEngineCtx *de_ctx = NULL;
4927 int result = 0;
4928
4929 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4930 goto end;
4931
4932 de_ctx->flags |= DE_QUIET;
4933 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4934 "(content:\"two\"; content:!\"one\"; within:20; fast_pattern; sid:1;)");
4935 if (de_ctx->sig_list != NULL)
4936 goto end;
4937
4938 result = 1;
4939
4940 end:
4941 SigCleanSignatures(de_ctx);
4942 DetectEngineCtxFree(de_ctx);
4943 return result;
4944 }
4945
DetectFastPatternTest177(void)4946 static int DetectFastPatternTest177(void)
4947 {
4948 DetectEngineCtx *de_ctx = NULL;
4949 int result = 0;
4950
4951 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4952 goto end;
4953
4954 de_ctx->flags |= DE_QUIET;
4955 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4956 "(content:\"two\"; content:!\"one\"; offset:20; fast_pattern; sid:1;)");
4957 if (de_ctx->sig_list != NULL)
4958 goto end;
4959
4960 result = 1;
4961
4962 end:
4963 SigCleanSignatures(de_ctx);
4964 DetectEngineCtxFree(de_ctx);
4965 return result;
4966 }
4967
DetectFastPatternTest178(void)4968 static int DetectFastPatternTest178(void)
4969 {
4970 DetectEngineCtx *de_ctx = NULL;
4971 int result = 0;
4972
4973 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
4974 goto end;
4975
4976 de_ctx->flags |= DE_QUIET;
4977 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
4978 "(content:\"two\"; content:!\"one\"; depth:20; fast_pattern; sid:1;)");
4979 if (de_ctx->sig_list != NULL)
4980 goto end;
4981
4982 result = 1;
4983
4984 end:
4985 SigCleanSignatures(de_ctx);
4986 DetectEngineCtxFree(de_ctx);
4987 return result;
4988 }
4989
4990 /* content fast_pattern tests ^ */
4991 /* http_header fast_pattern tests v */
4992
4993
DetectFastPatternTest179(void)4994 static int DetectFastPatternTest179(void)
4995 {
4996 DetectEngineCtx *de_ctx = NULL;
4997 int result = 0;
4998
4999 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5000 goto end;
5001
5002 de_ctx->flags |= DE_QUIET;
5003 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5004 "(content:\"one\"; http_header; "
5005 "content:!\"oneonetwo\"; fast_pattern:3,4; http_header; "
5006 "content:\"three\"; http_header; sid:1;)");
5007 if (de_ctx->sig_list == NULL)
5008 goto end;
5009 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->prev->ctx;
5010 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5011 ud->flags & DETECT_CONTENT_NEGATED &&
5012 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
5013 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
5014 ud->fp_chop_offset == 3 &&
5015 ud->fp_chop_len == 4) {
5016 result = 1;
5017 } else {
5018 result = 0;
5019 }
5020
5021 end:
5022 SigCleanSignatures(de_ctx);
5023 DetectEngineCtxFree(de_ctx);
5024 return result;
5025 }
5026
5027 /**
5028 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
5029 */
DetectFastPatternTest180(void)5030 static int DetectFastPatternTest180(void)
5031 {
5032 SigMatch *sm = NULL;
5033 DetectEngineCtx *de_ctx = NULL;
5034 int result = 0;
5035
5036 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5037 goto end;
5038
5039 de_ctx->flags |= DE_QUIET;
5040 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5041 "(content:\"/one/\"; fast_pattern:only; http_header; "
5042 "msg:\"Testing fast_pattern\"; sid:1;)");
5043 if (de_ctx->sig_list == NULL)
5044 goto end;
5045
5046 result = 0;
5047 sm = de_ctx->sig_list->sm_lists[g_http_header_buffer_id];
5048 if (sm != NULL) {
5049 if ( ((DetectContentData *)sm->ctx)->flags &
5050 DETECT_CONTENT_FAST_PATTERN) {
5051 result = 1;
5052 } else {
5053 result = 0;
5054 }
5055 }
5056
5057
5058 end:
5059 SigCleanSignatures(de_ctx);
5060 DetectEngineCtxFree(de_ctx);
5061 return result;
5062 }
5063
5064 /**
5065 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
5066 */
DetectFastPatternTest181(void)5067 static int DetectFastPatternTest181(void)
5068 {
5069 SigMatch *sm = NULL;
5070 DetectEngineCtx *de_ctx = NULL;
5071 int result = 0;
5072
5073 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5074 goto end;
5075
5076 de_ctx->flags |= DE_QUIET;
5077 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5078 "(content:\"oneoneone\"; fast_pattern:3,4; http_header; "
5079 "msg:\"Testing fast_pattern\"; sid:1;)");
5080 if (de_ctx->sig_list == NULL)
5081 goto end;
5082
5083 result = 0;
5084 sm = de_ctx->sig_list->sm_lists[g_http_header_buffer_id];
5085 if (sm != NULL) {
5086 if ( ((DetectContentData *)sm->ctx)->flags &
5087 DETECT_CONTENT_FAST_PATTERN) {
5088 result = 1;
5089 } else {
5090 result = 0;
5091 }
5092 }
5093
5094 end:
5095 SigCleanSignatures(de_ctx);
5096 DetectEngineCtxFree(de_ctx);
5097 return result;
5098 }
5099
DetectFastPatternTest182(void)5100 static int DetectFastPatternTest182(void)
5101 {
5102 SigMatch *sm = NULL;
5103 DetectEngineCtx *de_ctx = NULL;
5104 int result = 0;
5105
5106 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5107 goto end;
5108
5109 de_ctx->flags |= DE_QUIET;
5110 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5111 "(content:\"one\"; fast_pattern:only; http_header; sid:1;)");
5112 if (de_ctx->sig_list == NULL)
5113 goto end;
5114
5115 result = 0;
5116 sm = de_ctx->sig_list->sm_lists[g_http_header_buffer_id];
5117 DetectContentData *ud = (DetectContentData *)sm->ctx;
5118 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5119 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
5120 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
5121 ud->fp_chop_offset == 0 &&
5122 ud->fp_chop_len == 0) {
5123 result = 1;
5124 } else {
5125 result = 0;
5126 }
5127
5128 end:
5129 SigCleanSignatures(de_ctx);
5130 DetectEngineCtxFree(de_ctx);
5131 return result;
5132 }
5133
DetectFastPatternTest183(void)5134 static int DetectFastPatternTest183(void)
5135 {
5136 SigMatch *sm = NULL;
5137 DetectEngineCtx *de_ctx = NULL;
5138 int result = 0;
5139
5140 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5141 goto end;
5142
5143 de_ctx->flags |= DE_QUIET;
5144 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5145 "(content:\"oneoneone\"; fast_pattern:3,4; http_header; sid:1;)");
5146 if (de_ctx->sig_list == NULL)
5147 goto end;
5148
5149 result = 0;
5150 sm = de_ctx->sig_list->sm_lists[g_http_header_buffer_id];
5151 DetectContentData *ud = (DetectContentData *)sm->ctx;
5152 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5153 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
5154 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
5155 ud->fp_chop_offset == 3 &&
5156 ud->fp_chop_len == 4) {
5157 result = 1;
5158 } else {
5159 result = 0;
5160 }
5161
5162 end:
5163 SigCleanSignatures(de_ctx);
5164 DetectEngineCtxFree(de_ctx);
5165 return result;
5166 }
5167
DetectFastPatternTest184(void)5168 static int DetectFastPatternTest184(void)
5169 {
5170 DetectEngineCtx *de_ctx = NULL;
5171 int result = 0;
5172
5173 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5174 goto end;
5175
5176 de_ctx->flags |= DE_QUIET;
5177 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5178 "(content:\"one\"; http_header; content:\"two\"; fast_pattern:only; http_header; distance:10; sid:1;)");
5179 if (de_ctx->sig_list != NULL)
5180 goto end;
5181
5182 result = 1;
5183
5184 end:
5185 SigCleanSignatures(de_ctx);
5186 DetectEngineCtxFree(de_ctx);
5187 return result;
5188 }
5189
DetectFastPatternTest185(void)5190 static int DetectFastPatternTest185(void)
5191 {
5192 DetectEngineCtx *de_ctx = NULL;
5193 int result = 0;
5194
5195 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5196 goto end;
5197
5198 de_ctx->flags |= DE_QUIET;
5199 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5200 "(content:\"one\"; http_header; content:\"two\"; distance:10; fast_pattern:only; http_header; sid:1;)");
5201 if (de_ctx->sig_list != NULL)
5202 goto end;
5203
5204 result = 1;
5205
5206 end:
5207 SigCleanSignatures(de_ctx);
5208 DetectEngineCtxFree(de_ctx);
5209 return result;
5210 }
5211
DetectFastPatternTest186(void)5212 static int DetectFastPatternTest186(void)
5213 {
5214 DetectEngineCtx *de_ctx = NULL;
5215 int result = 0;
5216
5217 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5218 goto end;
5219
5220 de_ctx->flags |= DE_QUIET;
5221 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5222 "(content:\"one\"; http_header; content:\"two\"; fast_pattern:only; http_header; within:10; sid:1;)");
5223 if (de_ctx->sig_list != NULL)
5224 goto end;
5225
5226 result = 1;
5227
5228 end:
5229 SigCleanSignatures(de_ctx);
5230 DetectEngineCtxFree(de_ctx);
5231 return result;
5232 }
5233
DetectFastPatternTest187(void)5234 static int DetectFastPatternTest187(void)
5235 {
5236 DetectEngineCtx *de_ctx = NULL;
5237 int result = 0;
5238
5239 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5240 goto end;
5241
5242 de_ctx->flags |= DE_QUIET;
5243 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5244 "(content:\"one\"; http_header; content:\"two\"; within:10; fast_pattern:only; http_header; sid:1;)");
5245 if (de_ctx->sig_list != NULL)
5246 goto end;
5247
5248 result = 1;
5249
5250 end:
5251 SigCleanSignatures(de_ctx);
5252 DetectEngineCtxFree(de_ctx);
5253 return result;
5254 }
5255
DetectFastPatternTest188(void)5256 static int DetectFastPatternTest188(void)
5257 {
5258 DetectEngineCtx *de_ctx = NULL;
5259 int result = 0;
5260
5261 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5262 goto end;
5263
5264 de_ctx->flags |= DE_QUIET;
5265 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5266 "(content:\"one\"; http_header; content:\"two\"; fast_pattern:only; http_header; offset:10; sid:1;)");
5267 if (de_ctx->sig_list != NULL)
5268 goto end;
5269
5270 result = 1;
5271
5272 end:
5273 SigCleanSignatures(de_ctx);
5274 DetectEngineCtxFree(de_ctx);
5275 return result;
5276 }
5277
DetectFastPatternTest189(void)5278 static int DetectFastPatternTest189(void)
5279 {
5280 DetectEngineCtx *de_ctx = NULL;
5281 int result = 0;
5282
5283 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5284 goto end;
5285
5286 de_ctx->flags |= DE_QUIET;
5287 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5288 "(content:\"one\"; http_header; content:\"two\"; offset:10; fast_pattern:only; http_header; sid:1;)");
5289 if (de_ctx->sig_list != NULL)
5290 goto end;
5291
5292 result = 1;
5293
5294 end:
5295 SigCleanSignatures(de_ctx);
5296 DetectEngineCtxFree(de_ctx);
5297 return result;
5298 }
5299
DetectFastPatternTest190(void)5300 static int DetectFastPatternTest190(void)
5301 {
5302 DetectEngineCtx *de_ctx = NULL;
5303 int result = 0;
5304
5305 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5306 goto end;
5307
5308 de_ctx->flags |= DE_QUIET;
5309 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5310 "(content:\"one\"; http_header; content:\"two\"; fast_pattern:only; http_header; depth:10; sid:1;)");
5311 if (de_ctx->sig_list != NULL)
5312 goto end;
5313
5314 result = 1;
5315
5316 end:
5317 SigCleanSignatures(de_ctx);
5318 DetectEngineCtxFree(de_ctx);
5319 return result;
5320 }
5321
DetectFastPatternTest191(void)5322 static int DetectFastPatternTest191(void)
5323 {
5324 DetectEngineCtx *de_ctx = NULL;
5325 int result = 0;
5326
5327 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5328 goto end;
5329
5330 de_ctx->flags |= DE_QUIET;
5331 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5332 "(content:\"one\"; http_header; content:\"two\"; depth:10; fast_pattern:only; http_header; sid:1;)");
5333 if (de_ctx->sig_list != NULL)
5334 goto end;
5335
5336 result = 1;
5337
5338 end:
5339 SigCleanSignatures(de_ctx);
5340 DetectEngineCtxFree(de_ctx);
5341 return result;
5342 }
5343
DetectFastPatternTest192(void)5344 static int DetectFastPatternTest192(void)
5345 {
5346 DetectEngineCtx *de_ctx = NULL;
5347 int result = 0;
5348
5349 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5350 goto end;
5351
5352 de_ctx->flags |= DE_QUIET;
5353 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5354 "(content:\"one\"; http_header; content:!\"two\"; fast_pattern:only; http_header; sid:1;)");
5355 if (de_ctx->sig_list != NULL)
5356 goto end;
5357
5358 result = 1;
5359
5360 end:
5361 SigCleanSignatures(de_ctx);
5362 DetectEngineCtxFree(de_ctx);
5363 return result;
5364 }
5365
DetectFastPatternTest193(void)5366 static int DetectFastPatternTest193(void)
5367 {
5368 DetectEngineCtx *de_ctx = NULL;
5369 int result = 0;
5370
5371 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5372 goto end;
5373
5374 de_ctx->flags |= DE_QUIET;
5375 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5376 "(content: \"one\"; http_header; content:\"two\"; http_header; distance:30; content:\"two\"; fast_pattern:only; http_header; sid:1;)");
5377 if (de_ctx->sig_list == NULL)
5378 goto end;
5379
5380 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->ctx;
5381 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5382 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
5383 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
5384 ud->fp_chop_offset == 0 &&
5385 ud->fp_chop_len == 0) {
5386 result = 1;
5387 } else {
5388 result = 0;
5389 }
5390
5391 end:
5392 SigCleanSignatures(de_ctx);
5393 DetectEngineCtxFree(de_ctx);
5394 return result;
5395 }
5396
DetectFastPatternTest194(void)5397 static int DetectFastPatternTest194(void)
5398 {
5399 DetectEngineCtx *de_ctx = NULL;
5400 int result = 0;
5401
5402 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5403 goto end;
5404
5405 de_ctx->flags |= DE_QUIET;
5406 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5407 "(content:\"one\"; http_header; content:\"two\"; http_header; within:30; content:\"two\"; fast_pattern:only; http_header; sid:1;)");
5408 if (de_ctx->sig_list == NULL)
5409 goto end;
5410 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->ctx;
5411 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5412 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
5413 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
5414 ud->fp_chop_offset == 0 &&
5415 ud->fp_chop_len == 0) {
5416 result = 1;
5417 } else {
5418 result = 0;
5419 }
5420
5421 end:
5422 SigCleanSignatures(de_ctx);
5423 DetectEngineCtxFree(de_ctx);
5424 return result;
5425 }
5426
DetectFastPatternTest195(void)5427 static int DetectFastPatternTest195(void)
5428 {
5429 DetectEngineCtx *de_ctx = NULL;
5430 int result = 0;
5431
5432 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5433 goto end;
5434
5435 de_ctx->flags |= DE_QUIET;
5436 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5437 "(content:\"one\"; http_header; content:\"two\"; http_header; offset:30; content:\"two\"; fast_pattern:only; http_header; sid:1;)");
5438 if (de_ctx->sig_list == NULL)
5439 goto end;
5440 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->ctx;
5441 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5442 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
5443 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
5444 ud->fp_chop_offset == 0 &&
5445 ud->fp_chop_len == 0) {
5446 result = 1;
5447 } else {
5448 result = 0;
5449 }
5450
5451 end:
5452 SigCleanSignatures(de_ctx);
5453 DetectEngineCtxFree(de_ctx);
5454 return result;
5455 }
5456
DetectFastPatternTest196(void)5457 static int DetectFastPatternTest196(void)
5458 {
5459 DetectEngineCtx *de_ctx = NULL;
5460 int result = 0;
5461
5462 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5463 goto end;
5464
5465 de_ctx->flags |= DE_QUIET;
5466 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5467 "(content:\"one\"; http_header; content:\"two\"; http_header; depth:30; content:\"two\"; fast_pattern:only; http_header; sid:1;)");
5468 if (de_ctx->sig_list == NULL)
5469 goto end;
5470 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->ctx;
5471 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5472 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
5473 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
5474 ud->fp_chop_offset == 0 &&
5475 ud->fp_chop_len == 0) {
5476 result = 1;
5477 } else {
5478 result = 0;
5479 }
5480
5481 end:
5482 SigCleanSignatures(de_ctx);
5483 DetectEngineCtxFree(de_ctx);
5484 return result;
5485 }
5486
DetectFastPatternTest197(void)5487 static int DetectFastPatternTest197(void)
5488 {
5489 DetectEngineCtx *de_ctx = NULL;
5490 int result = 0;
5491
5492 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5493 goto end;
5494
5495 de_ctx->flags |= DE_QUIET;
5496 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5497 "(content:!\"one\"; fast_pattern; http_header; content:\"two\"; http_header; sid:1;)");
5498 if (de_ctx->sig_list == NULL)
5499 goto end;
5500 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->prev->ctx;
5501 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5502 ud->flags & DETECT_CONTENT_NEGATED &&
5503 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
5504 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
5505 ud->fp_chop_offset == 0 &&
5506 ud->fp_chop_len == 0) {
5507 result = 1;
5508 } else {
5509 result = 0;
5510 }
5511
5512 end:
5513 SigCleanSignatures(de_ctx);
5514 DetectEngineCtxFree(de_ctx);
5515 return result;
5516 }
5517
DetectFastPatternTest198(void)5518 static int DetectFastPatternTest198(void)
5519 {
5520 DetectEngineCtx *de_ctx = NULL;
5521 int result = 0;
5522
5523 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5524 goto end;
5525
5526 de_ctx->flags |= DE_QUIET;
5527 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5528 "(content:\"two\"; http_header; content:!\"one\"; fast_pattern; http_header; distance:20; sid:1;)");
5529 if (de_ctx->sig_list != NULL)
5530 goto end;
5531
5532 result = 1;
5533
5534 end:
5535 SigCleanSignatures(de_ctx);
5536 DetectEngineCtxFree(de_ctx);
5537 return result;
5538 }
5539
DetectFastPatternTest199(void)5540 static int DetectFastPatternTest199(void)
5541 {
5542 DetectEngineCtx *de_ctx = NULL;
5543 int result = 0;
5544
5545 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5546 goto end;
5547
5548 de_ctx->flags |= DE_QUIET;
5549 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5550 "(content:\"two\"; http_header; content:!\"one\"; fast_pattern; http_header; within:20; sid:1;)");
5551 if (de_ctx->sig_list != NULL)
5552 goto end;
5553
5554 result = 1;
5555
5556 end:
5557 SigCleanSignatures(de_ctx);
5558 DetectEngineCtxFree(de_ctx);
5559 return result;
5560 }
5561
DetectFastPatternTest200(void)5562 static int DetectFastPatternTest200(void)
5563 {
5564 DetectEngineCtx *de_ctx = NULL;
5565 int result = 0;
5566
5567 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5568 goto end;
5569
5570 de_ctx->flags |= DE_QUIET;
5571 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5572 "(content:\"two\"; http_header; content:!\"one\"; fast_pattern; http_header; offset:20; sid:1;)");
5573 if (de_ctx->sig_list != NULL)
5574 goto end;
5575
5576 result = 1;
5577
5578 end:
5579 SigCleanSignatures(de_ctx);
5580 DetectEngineCtxFree(de_ctx);
5581 return result;
5582 }
5583
DetectFastPatternTest201(void)5584 static int DetectFastPatternTest201(void)
5585 {
5586 DetectEngineCtx *de_ctx = NULL;
5587 int result = 0;
5588
5589 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5590 goto end;
5591
5592 de_ctx->flags |= DE_QUIET;
5593 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5594 "(content:\"two\"; http_header; content:!\"one\"; fast_pattern; http_header; depth:20; sid:1;)");
5595 if (de_ctx->sig_list != NULL)
5596 goto end;
5597
5598 result = 1;
5599
5600 end:
5601 SigCleanSignatures(de_ctx);
5602 DetectEngineCtxFree(de_ctx);
5603 return result;
5604 }
5605
DetectFastPatternTest202(void)5606 static int DetectFastPatternTest202(void)
5607 {
5608 DetectEngineCtx *de_ctx = NULL;
5609 int result = 0;
5610
5611 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5612 goto end;
5613
5614 de_ctx->flags |= DE_QUIET;
5615 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5616 "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; sid:1;)");
5617 if (de_ctx->sig_list == NULL)
5618 goto end;
5619 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->prev->ctx;
5620 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5621 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
5622 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
5623 ud->fp_chop_offset == 3 &&
5624 ud->fp_chop_len == 4) {
5625 result = 1;
5626 } else {
5627 result = 0;
5628 }
5629
5630 end:
5631 SigCleanSignatures(de_ctx);
5632 DetectEngineCtxFree(de_ctx);
5633 return result;
5634 }
5635
DetectFastPatternTest203(void)5636 static int DetectFastPatternTest203(void)
5637 {
5638 DetectEngineCtx *de_ctx = NULL;
5639 int result = 0;
5640
5641 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5642 goto end;
5643
5644 de_ctx->flags |= DE_QUIET;
5645 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5646 "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; distance:30; sid:1;)");
5647 if (de_ctx->sig_list == NULL)
5648 goto end;
5649 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->prev->ctx;
5650 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5651 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
5652 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
5653 ud->fp_chop_offset == 3 &&
5654 ud->fp_chop_len == 4) {
5655 result = 1;
5656 } else {
5657 result = 0;
5658 }
5659
5660 end:
5661 SigCleanSignatures(de_ctx);
5662 DetectEngineCtxFree(de_ctx);
5663 return result;
5664 }
5665
DetectFastPatternTest204(void)5666 static int DetectFastPatternTest204(void)
5667 {
5668 DetectEngineCtx *de_ctx = NULL;
5669 int result = 0;
5670
5671 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5672 goto end;
5673
5674 de_ctx->flags |= DE_QUIET;
5675 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5676 "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; within:30; sid:1;)");
5677 if (de_ctx->sig_list == NULL)
5678 goto end;
5679 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->prev->ctx;
5680 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5681 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
5682 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
5683 ud->fp_chop_offset == 3 &&
5684 ud->fp_chop_len == 4) {
5685 result = 1;
5686 } else {
5687 result = 0;
5688 }
5689
5690 end:
5691 SigCleanSignatures(de_ctx);
5692 DetectEngineCtxFree(de_ctx);
5693 return result;
5694 }
5695
DetectFastPatternTest205(void)5696 static int DetectFastPatternTest205(void)
5697 {
5698 DetectEngineCtx *de_ctx = NULL;
5699 int result = 0;
5700
5701 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5702 goto end;
5703
5704 de_ctx->flags |= DE_QUIET;
5705 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5706 "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; offset:30; sid:1;)");
5707 if (de_ctx->sig_list == NULL)
5708 goto end;
5709 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->prev->ctx;
5710 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5711 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
5712 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
5713 ud->fp_chop_offset == 3 &&
5714 ud->fp_chop_len == 4) {
5715 result = 1;
5716 } else {
5717 result = 0;
5718 }
5719
5720 end:
5721 SigCleanSignatures(de_ctx);
5722 DetectEngineCtxFree(de_ctx);
5723 return result;
5724 }
5725
DetectFastPatternTest206(void)5726 static int DetectFastPatternTest206(void)
5727 {
5728 DetectEngineCtx *de_ctx = NULL;
5729 int result = 0;
5730
5731 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5732 goto end;
5733
5734 de_ctx->flags |= DE_QUIET;
5735 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5736 "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; depth:30; sid:1;)");
5737 if (de_ctx->sig_list == NULL)
5738 goto end;
5739 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->prev->ctx;
5740 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5741 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
5742 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
5743 ud->fp_chop_offset == 3 &&
5744 ud->fp_chop_len == 4) {
5745 result = 1;
5746 } else {
5747 result = 0;
5748 }
5749
5750 end:
5751 SigCleanSignatures(de_ctx);
5752 DetectEngineCtxFree(de_ctx);
5753 return result;
5754 }
5755
DetectFastPatternTest207(void)5756 static int DetectFastPatternTest207(void)
5757 {
5758 DetectEngineCtx *de_ctx = NULL;
5759 int result = 0;
5760
5761 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5762 goto end;
5763
5764 de_ctx->flags |= DE_QUIET;
5765 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5766 "(content:\"one\"; http_header; content:\"two\"; http_header; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_header; sid:1;)");
5767 if (de_ctx->sig_list == NULL)
5768 goto end;
5769 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->ctx;
5770 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5771 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
5772 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
5773 ud->fp_chop_offset == 3 &&
5774 ud->fp_chop_len == 4) {
5775 result = 1;
5776 } else {
5777 result = 0;
5778 }
5779
5780 end:
5781 SigCleanSignatures(de_ctx);
5782 DetectEngineCtxFree(de_ctx);
5783 return result;
5784 }
5785
DetectFastPatternTest208(void)5786 static int DetectFastPatternTest208(void)
5787 {
5788 DetectEngineCtx *de_ctx = NULL;
5789 int result = 0;
5790
5791 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5792 goto end;
5793
5794 de_ctx->flags |= DE_QUIET;
5795 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5796 "(content:\"one\"; http_header; content:\"two\"; http_header; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_header; sid:1;)");
5797 if (de_ctx->sig_list == NULL)
5798 goto end;
5799 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->ctx;
5800 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5801 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
5802 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
5803 ud->fp_chop_offset == 3 &&
5804 ud->fp_chop_len == 4) {
5805 result = 1;
5806 } else {
5807 result = 0;
5808 }
5809
5810 end:
5811 SigCleanSignatures(de_ctx);
5812 DetectEngineCtxFree(de_ctx);
5813 return result;
5814 }
5815
DetectFastPatternTest209(void)5816 static int DetectFastPatternTest209(void)
5817 {
5818 DetectEngineCtx *de_ctx = NULL;
5819 int result = 0;
5820
5821 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5822 goto end;
5823
5824 de_ctx->flags |= DE_QUIET;
5825 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5826 "(content:\"one\"; http_header; content:\"two\"; http_header; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_header; sid:1;)");
5827 if (de_ctx->sig_list == NULL)
5828 goto end;
5829 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->ctx;
5830 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5831 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
5832 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
5833 ud->fp_chop_offset == 3 &&
5834 ud->fp_chop_len == 4) {
5835 result = 1;
5836 } else {
5837 result = 0;
5838 }
5839
5840 end:
5841 SigCleanSignatures(de_ctx);
5842 DetectEngineCtxFree(de_ctx);
5843 return result;
5844 }
5845
DetectFastPatternTest210(void)5846 static int DetectFastPatternTest210(void)
5847 {
5848 DetectEngineCtx *de_ctx = NULL;
5849 int result = 0;
5850
5851 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5852 goto end;
5853
5854 de_ctx->flags |= DE_QUIET;
5855 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5856 "(content:\"one\"; http_header; content:\"two\"; http_header; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_header; sid:1;)");
5857 if (de_ctx->sig_list == NULL)
5858 goto end;
5859 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->ctx;
5860 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5861 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
5862 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
5863 ud->fp_chop_offset == 3 &&
5864 ud->fp_chop_len == 4) {
5865 result = 1;
5866 } else {
5867 result = 0;
5868 }
5869
5870
5871 result = 1;
5872
5873 end:
5874 SigCleanSignatures(de_ctx);
5875 DetectEngineCtxFree(de_ctx);
5876 return result;
5877 }
5878
DetectFastPatternTest211(void)5879 static int DetectFastPatternTest211(void)
5880 {
5881 DetectEngineCtx *de_ctx = NULL;
5882 int result = 0;
5883
5884 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5885 goto end;
5886
5887 de_ctx->flags |= DE_QUIET;
5888 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5889 "(content:\"one\"; http_header; content:\"two\"; fast_pattern:65977,4; http_header; content:\"three\"; http_header; distance:10; sid:1;)");
5890 if (de_ctx->sig_list != NULL)
5891 goto end;
5892
5893 result = 1;
5894
5895 end:
5896 SigCleanSignatures(de_ctx);
5897 DetectEngineCtxFree(de_ctx);
5898 return result;
5899 }
5900
DetectFastPatternTest212(void)5901 static int DetectFastPatternTest212(void)
5902 {
5903 DetectEngineCtx *de_ctx = NULL;
5904 int result = 0;
5905
5906 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5907 goto end;
5908
5909 de_ctx->flags |= DE_QUIET;
5910 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5911 "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,65977; http_header; content:\"three\"; distance:10; http_header; sid:1;)");
5912 if (de_ctx->sig_list != NULL)
5913 goto end;
5914
5915 result = 1;
5916
5917 end:
5918 SigCleanSignatures(de_ctx);
5919 DetectEngineCtxFree(de_ctx);
5920 return result;
5921 }
5922
DetectFastPatternTest213(void)5923 static int DetectFastPatternTest213(void)
5924 {
5925 DetectEngineCtx *de_ctx = NULL;
5926 int result = 0;
5927
5928 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5929 goto end;
5930
5931 de_ctx->flags |= DE_QUIET;
5932 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5933 "(content:\"one\"; http_header; content:\"two\"; fast_pattern:65534,4; http_header; content:\"three\"; http_header; distance:10; sid:1;)");
5934 if (de_ctx->sig_list != NULL)
5935 goto end;
5936
5937 result = 1;
5938
5939 end:
5940 SigCleanSignatures(de_ctx);
5941 DetectEngineCtxFree(de_ctx);
5942 return result;
5943 }
5944
DetectFastPatternTest214(void)5945 static int DetectFastPatternTest214(void)
5946 {
5947 DetectEngineCtx *de_ctx = NULL;
5948 int result = 0;
5949
5950 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5951 goto end;
5952
5953 de_ctx->flags |= DE_QUIET;
5954 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5955 "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; sid:1;)");
5956 if (de_ctx->sig_list == NULL)
5957 goto end;
5958 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->prev->ctx;
5959 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
5960 ud->flags & DETECT_CONTENT_NEGATED &&
5961 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
5962 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
5963 ud->fp_chop_offset == 3 &&
5964 ud->fp_chop_len == 4) {
5965 result = 1;
5966 } else {
5967 result = 0;
5968 }
5969
5970 end:
5971 SigCleanSignatures(de_ctx);
5972 DetectEngineCtxFree(de_ctx);
5973 return result;
5974 }
5975
DetectFastPatternTest215(void)5976 static int DetectFastPatternTest215(void)
5977 {
5978 DetectEngineCtx *de_ctx = NULL;
5979 int result = 0;
5980
5981 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
5982 goto end;
5983
5984 de_ctx->flags |= DE_QUIET;
5985 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
5986 "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; distance:10; content:\"three\"; http_header; sid:1;)");
5987 if (de_ctx->sig_list != NULL)
5988 goto end;
5989
5990 result = 1;
5991
5992 end:
5993 SigCleanSignatures(de_ctx);
5994 DetectEngineCtxFree(de_ctx);
5995 return result;
5996 }
5997
DetectFastPatternTest216(void)5998 static int DetectFastPatternTest216(void)
5999 {
6000 DetectEngineCtx *de_ctx = NULL;
6001 int result = 0;
6002
6003 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6004 goto end;
6005
6006 de_ctx->flags |= DE_QUIET;
6007 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
6008 "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; within:10; content:\"three\"; http_header; sid:1;)");
6009 if (de_ctx->sig_list != NULL)
6010 goto end;
6011
6012 result = 1;
6013
6014 end:
6015 SigCleanSignatures(de_ctx);
6016 DetectEngineCtxFree(de_ctx);
6017 return result;
6018 }
6019
DetectFastPatternTest217(void)6020 static int DetectFastPatternTest217(void)
6021 {
6022 DetectEngineCtx *de_ctx = NULL;
6023 int result = 0;
6024
6025 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6026 goto end;
6027
6028 de_ctx->flags |= DE_QUIET;
6029 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
6030 "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; offset:10; content:\"three\"; http_header; sid:1;)");
6031 if (de_ctx->sig_list != NULL)
6032 goto end;
6033
6034 result = 1;
6035
6036 end:
6037 SigCleanSignatures(de_ctx);
6038 DetectEngineCtxFree(de_ctx);
6039 return result;
6040 }
6041
DetectFastPatternTest218(void)6042 static int DetectFastPatternTest218(void)
6043 {
6044 DetectEngineCtx *de_ctx = NULL;
6045 int result = 0;
6046
6047 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6048 goto end;
6049
6050 de_ctx->flags |= DE_QUIET;
6051 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
6052 "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; depth:10; content:\"three\"; http_header; sid:1;)");
6053 if (de_ctx->sig_list != NULL)
6054 goto end;
6055
6056 result = 1;
6057
6058 end:
6059 SigCleanSignatures(de_ctx);
6060 DetectEngineCtxFree(de_ctx);
6061 return result;
6062 }
6063
DetectFastPatternTest219(void)6064 static int DetectFastPatternTest219(void)
6065 {
6066 DetectEngineCtx *de_ctx = NULL;
6067 int result = 0;
6068
6069 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6070 goto end;
6071
6072 de_ctx->flags |= DE_QUIET;
6073 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
6074 "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; sid:1;)");
6075 if (de_ctx->sig_list == NULL)
6076 goto end;
6077 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_header_buffer_id]->prev->ctx;
6078 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6079 ud->flags & DETECT_CONTENT_NEGATED &&
6080 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
6081 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
6082 ud->fp_chop_offset == 3 &&
6083 ud->fp_chop_len == 4) {
6084 result = 1;
6085 } else {
6086 result = 0;
6087 }
6088
6089 end:
6090 SigCleanSignatures(de_ctx);
6091 DetectEngineCtxFree(de_ctx);
6092 return result;
6093 }
6094
6095
6096 /* http_header fast_pattern tests ^ */
6097 /* http_raw_header fast_pattern tests v */
6098
6099
DetectFastPatternTest220(void)6100 static int DetectFastPatternTest220(void)
6101 {
6102 DetectEngineCtx *de_ctx = NULL;
6103 int result = 0;
6104
6105 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6106 goto end;
6107
6108 de_ctx->flags |= DE_QUIET;
6109 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6110 "(flow:to_server; content:\"one\"; http_raw_header; "
6111 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; "
6112 "content:\"three\"; http_raw_header; sid:1;)");
6113 if (de_ctx->sig_list == NULL)
6114 goto end;
6115 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->prev->ctx;
6116 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6117 ud->flags & DETECT_CONTENT_NEGATED &&
6118 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
6119 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
6120 ud->fp_chop_offset == 3 &&
6121 ud->fp_chop_len == 4) {
6122 result = 1;
6123 } else {
6124 result = 0;
6125 }
6126
6127 end:
6128 SigCleanSignatures(de_ctx);
6129 DetectEngineCtxFree(de_ctx);
6130 return result;
6131 }
6132
6133 /**
6134 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
6135 */
DetectFastPatternTest221(void)6136 static int DetectFastPatternTest221(void)
6137 {
6138 SigMatch *sm = NULL;
6139 DetectEngineCtx *de_ctx = NULL;
6140 int result = 0;
6141
6142 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6143 goto end;
6144
6145 de_ctx->flags |= DE_QUIET;
6146 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6147 "(flow:to_server; content:\"/one/\"; fast_pattern:only; http_raw_header; "
6148 "msg:\"Testing fast_pattern\"; sid:1;)");
6149 if (de_ctx->sig_list == NULL)
6150 goto end;
6151
6152 result = 0;
6153 sm = de_ctx->sig_list->sm_lists[g_http_raw_header_buffer_id];
6154 if (sm != NULL) {
6155 if ( ((DetectContentData *)sm->ctx)->flags &
6156 DETECT_CONTENT_FAST_PATTERN) {
6157 result = 1;
6158 } else {
6159 result = 0;
6160 }
6161 }
6162
6163
6164 end:
6165 SigCleanSignatures(de_ctx);
6166 DetectEngineCtxFree(de_ctx);
6167 return result;
6168 }
6169
6170 /**
6171 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
6172 */
DetectFastPatternTest222(void)6173 static int DetectFastPatternTest222(void)
6174 {
6175 SigMatch *sm = NULL;
6176 DetectEngineCtx *de_ctx = NULL;
6177 int result = 0;
6178
6179 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6180 goto end;
6181
6182 de_ctx->flags |= DE_QUIET;
6183 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6184 "(flow:to_server; content:\"oneoneone\"; fast_pattern:3,4; http_raw_header; "
6185 "msg:\"Testing fast_pattern\"; sid:1;)");
6186 if (de_ctx->sig_list == NULL)
6187 goto end;
6188
6189 result = 0;
6190 sm = de_ctx->sig_list->sm_lists[g_http_raw_header_buffer_id];
6191 if (sm != NULL) {
6192 if ( ((DetectContentData *)sm->ctx)->flags &
6193 DETECT_CONTENT_FAST_PATTERN) {
6194 result = 1;
6195 } else {
6196 result = 0;
6197 }
6198 }
6199
6200 end:
6201 SigCleanSignatures(de_ctx);
6202 DetectEngineCtxFree(de_ctx);
6203 return result;
6204 }
6205
DetectFastPatternTest223(void)6206 static int DetectFastPatternTest223(void)
6207 {
6208 SigMatch *sm = NULL;
6209 DetectEngineCtx *de_ctx = NULL;
6210 int result = 0;
6211
6212 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6213 goto end;
6214
6215 de_ctx->flags |= DE_QUIET;
6216 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6217 "(flow:to_server; content:\"one\"; fast_pattern:only; http_raw_header; sid:1;)");
6218 if (de_ctx->sig_list == NULL)
6219 goto end;
6220
6221 result = 0;
6222 sm = de_ctx->sig_list->sm_lists[g_http_raw_header_buffer_id];
6223 DetectContentData *ud = (DetectContentData *)sm->ctx;
6224 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6225 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
6226 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
6227 ud->fp_chop_offset == 0 &&
6228 ud->fp_chop_len == 0) {
6229 result = 1;
6230 } else {
6231 result = 0;
6232 }
6233
6234 end:
6235 SigCleanSignatures(de_ctx);
6236 DetectEngineCtxFree(de_ctx);
6237 return result;
6238 }
6239
DetectFastPatternTest224(void)6240 static int DetectFastPatternTest224(void)
6241 {
6242 SigMatch *sm = NULL;
6243 DetectEngineCtx *de_ctx = NULL;
6244 int result = 0;
6245
6246 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6247 goto end;
6248
6249 de_ctx->flags |= DE_QUIET;
6250 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6251 "(flow:to_server; content:\"oneoneone\"; fast_pattern:3,4; http_raw_header; sid:1;)");
6252 if (de_ctx->sig_list == NULL)
6253 goto end;
6254
6255 result = 0;
6256 sm = de_ctx->sig_list->sm_lists[g_http_raw_header_buffer_id];
6257 DetectContentData *ud = (DetectContentData *)sm->ctx;
6258 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6259 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
6260 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
6261 ud->fp_chop_offset == 3 &&
6262 ud->fp_chop_len == 4) {
6263 result = 1;
6264 } else {
6265 result = 0;
6266 }
6267
6268 end:
6269 SigCleanSignatures(de_ctx);
6270 DetectEngineCtxFree(de_ctx);
6271 return result;
6272 }
6273
DetectFastPatternTest225(void)6274 static int DetectFastPatternTest225(void)
6275 {
6276 DetectEngineCtx *de_ctx = NULL;
6277 int result = 0;
6278
6279 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6280 goto end;
6281
6282 de_ctx->flags |= DE_QUIET;
6283 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6284 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:only; http_raw_header; distance:10; sid:1;)");
6285 if (de_ctx->sig_list != NULL)
6286 goto end;
6287
6288 result = 1;
6289
6290 end:
6291 SigCleanSignatures(de_ctx);
6292 DetectEngineCtxFree(de_ctx);
6293 return result;
6294 }
6295
DetectFastPatternTest226(void)6296 static int DetectFastPatternTest226(void)
6297 {
6298 DetectEngineCtx *de_ctx = NULL;
6299 int result = 0;
6300
6301 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6302 goto end;
6303
6304 de_ctx->flags |= DE_QUIET;
6305 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6306 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; distance:10; fast_pattern:only; http_raw_header; sid:1;)");
6307 if (de_ctx->sig_list != NULL)
6308 goto end;
6309
6310 result = 1;
6311
6312 end:
6313 SigCleanSignatures(de_ctx);
6314 DetectEngineCtxFree(de_ctx);
6315 return result;
6316 }
6317
DetectFastPatternTest227(void)6318 static int DetectFastPatternTest227(void)
6319 {
6320 DetectEngineCtx *de_ctx = NULL;
6321 int result = 0;
6322
6323 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6324 goto end;
6325
6326 de_ctx->flags |= DE_QUIET;
6327 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6328 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:only; http_raw_header; within:10; sid:1;)");
6329 if (de_ctx->sig_list != NULL)
6330 goto end;
6331
6332 result = 1;
6333
6334 end:
6335 SigCleanSignatures(de_ctx);
6336 DetectEngineCtxFree(de_ctx);
6337 return result;
6338 }
6339
DetectFastPatternTest228(void)6340 static int DetectFastPatternTest228(void)
6341 {
6342 DetectEngineCtx *de_ctx = NULL;
6343 int result = 0;
6344
6345 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6346 goto end;
6347
6348 de_ctx->flags |= DE_QUIET;
6349 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6350 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; within:10; fast_pattern:only; http_raw_header; sid:1;)");
6351 if (de_ctx->sig_list != NULL)
6352 goto end;
6353
6354 result = 1;
6355
6356 end:
6357 SigCleanSignatures(de_ctx);
6358 DetectEngineCtxFree(de_ctx);
6359 return result;
6360 }
6361
DetectFastPatternTest229(void)6362 static int DetectFastPatternTest229(void)
6363 {
6364 DetectEngineCtx *de_ctx = NULL;
6365 int result = 0;
6366
6367 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6368 goto end;
6369
6370 de_ctx->flags |= DE_QUIET;
6371 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6372 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:only; http_raw_header; offset:10; sid:1;)");
6373 if (de_ctx->sig_list != NULL)
6374 goto end;
6375
6376 result = 1;
6377
6378 end:
6379 SigCleanSignatures(de_ctx);
6380 DetectEngineCtxFree(de_ctx);
6381 return result;
6382 }
6383
DetectFastPatternTest230(void)6384 static int DetectFastPatternTest230(void)
6385 {
6386 DetectEngineCtx *de_ctx = NULL;
6387 int result = 0;
6388
6389 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6390 goto end;
6391
6392 de_ctx->flags |= DE_QUIET;
6393 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6394 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; offset:10; fast_pattern:only; http_raw_header; sid:1;)");
6395 if (de_ctx->sig_list != NULL)
6396 goto end;
6397
6398 result = 1;
6399
6400 end:
6401 SigCleanSignatures(de_ctx);
6402 DetectEngineCtxFree(de_ctx);
6403 return result;
6404 }
6405
DetectFastPatternTest231(void)6406 static int DetectFastPatternTest231(void)
6407 {
6408 DetectEngineCtx *de_ctx = NULL;
6409 int result = 0;
6410
6411 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6412 goto end;
6413
6414 de_ctx->flags |= DE_QUIET;
6415 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6416 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:only; http_raw_header; depth:10; sid:1;)");
6417 if (de_ctx->sig_list != NULL)
6418 goto end;
6419
6420 result = 1;
6421
6422 end:
6423 SigCleanSignatures(de_ctx);
6424 DetectEngineCtxFree(de_ctx);
6425 return result;
6426 }
6427
DetectFastPatternTest232(void)6428 static int DetectFastPatternTest232(void)
6429 {
6430 DetectEngineCtx *de_ctx = NULL;
6431 int result = 0;
6432
6433 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6434 goto end;
6435
6436 de_ctx->flags |= DE_QUIET;
6437 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6438 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; depth:10; fast_pattern:only; http_raw_header; sid:1;)");
6439 if (de_ctx->sig_list != NULL)
6440 goto end;
6441
6442 result = 1;
6443
6444 end:
6445 SigCleanSignatures(de_ctx);
6446 DetectEngineCtxFree(de_ctx);
6447 return result;
6448 }
6449
DetectFastPatternTest233(void)6450 static int DetectFastPatternTest233(void)
6451 {
6452 DetectEngineCtx *de_ctx = NULL;
6453 int result = 0;
6454
6455 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6456 goto end;
6457
6458 de_ctx->flags |= DE_QUIET;
6459 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6460 "(flow:to_server; content:\"one\"; http_raw_header; content:!\"two\"; fast_pattern:only; http_raw_header; sid:1;)");
6461 if (de_ctx->sig_list != NULL)
6462 goto end;
6463
6464 result = 1;
6465
6466 end:
6467 SigCleanSignatures(de_ctx);
6468 DetectEngineCtxFree(de_ctx);
6469 return result;
6470 }
6471
DetectFastPatternTest234(void)6472 static int DetectFastPatternTest234(void)
6473 {
6474 DetectEngineCtx *de_ctx = NULL;
6475 int result = 0;
6476
6477 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6478 goto end;
6479
6480 de_ctx->flags |= DE_QUIET;
6481 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6482 "(flow:to_server; content: \"one\"; http_raw_header; content:\"two\"; http_raw_header; distance:30; content:\"two\"; fast_pattern:only; http_raw_header; sid:1;)");
6483 if (de_ctx->sig_list == NULL)
6484 goto end;
6485
6486 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->ctx;
6487 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6488 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
6489 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
6490 ud->fp_chop_offset == 0 &&
6491 ud->fp_chop_len == 0) {
6492 result = 1;
6493 } else {
6494 result = 0;
6495 }
6496
6497 end:
6498 SigCleanSignatures(de_ctx);
6499 DetectEngineCtxFree(de_ctx);
6500 return result;
6501 }
6502
DetectFastPatternTest235(void)6503 static int DetectFastPatternTest235(void)
6504 {
6505 DetectEngineCtx *de_ctx = NULL;
6506 int result = 0;
6507
6508 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6509 goto end;
6510
6511 de_ctx->flags |= DE_QUIET;
6512 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6513 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; within:30; content:\"two\"; fast_pattern:only; http_raw_header; sid:1;)");
6514 if (de_ctx->sig_list == NULL)
6515 goto end;
6516 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->ctx;
6517 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6518 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
6519 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
6520 ud->fp_chop_offset == 0 &&
6521 ud->fp_chop_len == 0) {
6522 result = 1;
6523 } else {
6524 result = 0;
6525 }
6526
6527 end:
6528 SigCleanSignatures(de_ctx);
6529 DetectEngineCtxFree(de_ctx);
6530 return result;
6531 }
6532
DetectFastPatternTest236(void)6533 static int DetectFastPatternTest236(void)
6534 {
6535 DetectEngineCtx *de_ctx = NULL;
6536 int result = 0;
6537
6538 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6539 goto end;
6540
6541 de_ctx->flags |= DE_QUIET;
6542 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6543 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; offset:30; content:\"two\"; fast_pattern:only; http_raw_header; sid:1;)");
6544 if (de_ctx->sig_list == NULL)
6545 goto end;
6546 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->ctx;
6547 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6548 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
6549 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
6550 ud->fp_chop_offset == 0 &&
6551 ud->fp_chop_len == 0) {
6552 result = 1;
6553 } else {
6554 result = 0;
6555 }
6556
6557 end:
6558 SigCleanSignatures(de_ctx);
6559 DetectEngineCtxFree(de_ctx);
6560 return result;
6561 }
6562
DetectFastPatternTest237(void)6563 static int DetectFastPatternTest237(void)
6564 {
6565 DetectEngineCtx *de_ctx = NULL;
6566 int result = 0;
6567
6568 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6569 goto end;
6570
6571 de_ctx->flags |= DE_QUIET;
6572 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6573 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; depth:30; content:\"two\"; fast_pattern:only; http_raw_header; sid:1;)");
6574 if (de_ctx->sig_list == NULL)
6575 goto end;
6576 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->ctx;
6577 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6578 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
6579 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
6580 ud->fp_chop_offset == 0 &&
6581 ud->fp_chop_len == 0) {
6582 result = 1;
6583 } else {
6584 result = 0;
6585 }
6586
6587 end:
6588 SigCleanSignatures(de_ctx);
6589 DetectEngineCtxFree(de_ctx);
6590 return result;
6591 }
6592
DetectFastPatternTest238(void)6593 static int DetectFastPatternTest238(void)
6594 {
6595 DetectEngineCtx *de_ctx = NULL;
6596 int result = 0;
6597
6598 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6599 goto end;
6600
6601 de_ctx->flags |= DE_QUIET;
6602 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6603 "(flow:to_server; content:!\"one\"; fast_pattern; http_raw_header; content:\"two\"; http_raw_header; sid:1;)");
6604 if (de_ctx->sig_list == NULL)
6605 goto end;
6606 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->prev->ctx;
6607 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6608 ud->flags & DETECT_CONTENT_NEGATED &&
6609 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
6610 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
6611 ud->fp_chop_offset == 0 &&
6612 ud->fp_chop_len == 0) {
6613 result = 1;
6614 } else {
6615 result = 0;
6616 }
6617
6618 end:
6619 SigCleanSignatures(de_ctx);
6620 DetectEngineCtxFree(de_ctx);
6621 return result;
6622 }
6623
DetectFastPatternTest239(void)6624 static int DetectFastPatternTest239(void)
6625 {
6626 DetectEngineCtx *de_ctx = NULL;
6627 int result = 0;
6628
6629 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6630 goto end;
6631
6632 de_ctx->flags |= DE_QUIET;
6633 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6634 "(flow:to_server; content:\"two\"; http_raw_header; content:!\"one\"; fast_pattern; http_raw_header; distance:20; sid:1;)");
6635 if (de_ctx->sig_list != NULL)
6636 goto end;
6637
6638 result = 1;
6639
6640 end:
6641 SigCleanSignatures(de_ctx);
6642 DetectEngineCtxFree(de_ctx);
6643 return result;
6644 }
6645
DetectFastPatternTest240(void)6646 static int DetectFastPatternTest240(void)
6647 {
6648 DetectEngineCtx *de_ctx = NULL;
6649 int result = 0;
6650
6651 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6652 goto end;
6653
6654 de_ctx->flags |= DE_QUIET;
6655 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6656 "(flow:to_server; content:\"two\"; http_raw_header; content:!\"one\"; fast_pattern; http_raw_header; within:20; sid:1;)");
6657 if (de_ctx->sig_list != NULL)
6658 goto end;
6659
6660 result = 1;
6661
6662 end:
6663 SigCleanSignatures(de_ctx);
6664 DetectEngineCtxFree(de_ctx);
6665 return result;
6666 }
6667
DetectFastPatternTest241(void)6668 static int DetectFastPatternTest241(void)
6669 {
6670 DetectEngineCtx *de_ctx = NULL;
6671 int result = 0;
6672
6673 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6674 goto end;
6675
6676 de_ctx->flags |= DE_QUIET;
6677 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6678 "(flow:to_server; content:\"two\"; http_raw_header; content:!\"one\"; fast_pattern; http_raw_header; offset:20; sid:1;)");
6679 if (de_ctx->sig_list != NULL)
6680 goto end;
6681
6682 result = 1;
6683
6684 end:
6685 SigCleanSignatures(de_ctx);
6686 DetectEngineCtxFree(de_ctx);
6687 return result;
6688 }
6689
DetectFastPatternTest242(void)6690 static int DetectFastPatternTest242(void)
6691 {
6692 DetectEngineCtx *de_ctx = NULL;
6693 int result = 0;
6694
6695 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6696 goto end;
6697
6698 de_ctx->flags |= DE_QUIET;
6699 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6700 "(flow:to_server; content:\"two\"; http_raw_header; content:!\"one\"; fast_pattern; http_raw_header; depth:20; sid:1;)");
6701 if (de_ctx->sig_list != NULL)
6702 goto end;
6703
6704 result = 1;
6705
6706 end:
6707 SigCleanSignatures(de_ctx);
6708 DetectEngineCtxFree(de_ctx);
6709 return result;
6710 }
6711
DetectFastPatternTest243(void)6712 static int DetectFastPatternTest243(void)
6713 {
6714 DetectEngineCtx *de_ctx = NULL;
6715 int result = 0;
6716
6717 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6718 goto end;
6719
6720 de_ctx->flags |= DE_QUIET;
6721 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6722 "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; sid:1;)");
6723 if (de_ctx->sig_list == NULL)
6724 goto end;
6725 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->prev->ctx;
6726 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6727 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
6728 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
6729 ud->fp_chop_offset == 3 &&
6730 ud->fp_chop_len == 4) {
6731 result = 1;
6732 } else {
6733 result = 0;
6734 }
6735
6736 end:
6737 SigCleanSignatures(de_ctx);
6738 DetectEngineCtxFree(de_ctx);
6739 return result;
6740 }
6741
DetectFastPatternTest244(void)6742 static int DetectFastPatternTest244(void)
6743 {
6744 DetectEngineCtx *de_ctx = NULL;
6745 int result = 0;
6746
6747 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6748 goto end;
6749
6750 de_ctx->flags |= DE_QUIET;
6751 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6752 "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; distance:30; sid:1;)");
6753 if (de_ctx->sig_list == NULL)
6754 goto end;
6755 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->prev->ctx;
6756 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6757 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
6758 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
6759 ud->fp_chop_offset == 3 &&
6760 ud->fp_chop_len == 4) {
6761 result = 1;
6762 } else {
6763 result = 0;
6764 }
6765
6766 end:
6767 SigCleanSignatures(de_ctx);
6768 DetectEngineCtxFree(de_ctx);
6769 return result;
6770 }
6771
DetectFastPatternTest245(void)6772 static int DetectFastPatternTest245(void)
6773 {
6774 DetectEngineCtx *de_ctx = NULL;
6775 int result = 0;
6776
6777 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6778 goto end;
6779
6780 de_ctx->flags |= DE_QUIET;
6781 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6782 "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; within:30; sid:1;)");
6783 if (de_ctx->sig_list == NULL)
6784 goto end;
6785 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->prev->ctx;
6786 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6787 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
6788 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
6789 ud->fp_chop_offset == 3 &&
6790 ud->fp_chop_len == 4) {
6791 result = 1;
6792 } else {
6793 result = 0;
6794 }
6795
6796 end:
6797 SigCleanSignatures(de_ctx);
6798 DetectEngineCtxFree(de_ctx);
6799 return result;
6800 }
6801
DetectFastPatternTest246(void)6802 static int DetectFastPatternTest246(void)
6803 {
6804 DetectEngineCtx *de_ctx = NULL;
6805 int result = 0;
6806
6807 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6808 goto end;
6809
6810 de_ctx->flags |= DE_QUIET;
6811 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6812 "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; offset:30; sid:1;)");
6813 if (de_ctx->sig_list == NULL)
6814 goto end;
6815 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->prev->ctx;
6816 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6817 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
6818 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
6819 ud->fp_chop_offset == 3 &&
6820 ud->fp_chop_len == 4) {
6821 result = 1;
6822 } else {
6823 result = 0;
6824 }
6825
6826 end:
6827 SigCleanSignatures(de_ctx);
6828 DetectEngineCtxFree(de_ctx);
6829 return result;
6830 }
6831
DetectFastPatternTest247(void)6832 static int DetectFastPatternTest247(void)
6833 {
6834 DetectEngineCtx *de_ctx = NULL;
6835 int result = 0;
6836
6837 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6838 goto end;
6839
6840 de_ctx->flags |= DE_QUIET;
6841 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6842 "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; depth:30; sid:1;)");
6843 if (de_ctx->sig_list == NULL)
6844 goto end;
6845 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->prev->ctx;
6846 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6847 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
6848 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
6849 ud->fp_chop_offset == 3 &&
6850 ud->fp_chop_len == 4) {
6851 result = 1;
6852 } else {
6853 result = 0;
6854 }
6855
6856 end:
6857 SigCleanSignatures(de_ctx);
6858 DetectEngineCtxFree(de_ctx);
6859 return result;
6860 }
6861
DetectFastPatternTest248(void)6862 static int DetectFastPatternTest248(void)
6863 {
6864 DetectEngineCtx *de_ctx = NULL;
6865 int result = 0;
6866
6867 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6868 goto end;
6869
6870 de_ctx->flags |= DE_QUIET;
6871 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6872 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_raw_header; sid:1;)");
6873 if (de_ctx->sig_list == NULL)
6874 goto end;
6875 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->ctx;
6876 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6877 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
6878 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
6879 ud->fp_chop_offset == 3 &&
6880 ud->fp_chop_len == 4) {
6881 result = 1;
6882 } else {
6883 result = 0;
6884 }
6885
6886 end:
6887 SigCleanSignatures(de_ctx);
6888 DetectEngineCtxFree(de_ctx);
6889 return result;
6890 }
6891
DetectFastPatternTest249(void)6892 static int DetectFastPatternTest249(void)
6893 {
6894 DetectEngineCtx *de_ctx = NULL;
6895 int result = 0;
6896
6897 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6898 goto end;
6899
6900 de_ctx->flags |= DE_QUIET;
6901 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6902 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_raw_header; sid:1;)");
6903 if (de_ctx->sig_list == NULL)
6904 goto end;
6905 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->ctx;
6906 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6907 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
6908 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
6909 ud->fp_chop_offset == 3 &&
6910 ud->fp_chop_len == 4) {
6911 result = 1;
6912 } else {
6913 result = 0;
6914 }
6915
6916 end:
6917 SigCleanSignatures(de_ctx);
6918 DetectEngineCtxFree(de_ctx);
6919 return result;
6920 }
6921
DetectFastPatternTest250(void)6922 static int DetectFastPatternTest250(void)
6923 {
6924 DetectEngineCtx *de_ctx = NULL;
6925 int result = 0;
6926
6927 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6928 goto end;
6929
6930 de_ctx->flags |= DE_QUIET;
6931 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6932 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_raw_header; sid:1;)");
6933 if (de_ctx->sig_list == NULL)
6934 goto end;
6935 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->ctx;
6936 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6937 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
6938 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
6939 ud->fp_chop_offset == 3 &&
6940 ud->fp_chop_len == 4) {
6941 result = 1;
6942 } else {
6943 result = 0;
6944 }
6945
6946 end:
6947 SigCleanSignatures(de_ctx);
6948 DetectEngineCtxFree(de_ctx);
6949 return result;
6950 }
6951
DetectFastPatternTest251(void)6952 static int DetectFastPatternTest251(void)
6953 {
6954 DetectEngineCtx *de_ctx = NULL;
6955 int result = 0;
6956
6957 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6958 goto end;
6959
6960 de_ctx->flags |= DE_QUIET;
6961 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6962 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_raw_header; sid:1;)");
6963 if (de_ctx->sig_list == NULL)
6964 goto end;
6965 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->ctx;
6966 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
6967 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
6968 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
6969 ud->fp_chop_offset == 3 &&
6970 ud->fp_chop_len == 4) {
6971 result = 1;
6972 } else {
6973 result = 0;
6974 }
6975
6976
6977 result = 1;
6978
6979 end:
6980 SigCleanSignatures(de_ctx);
6981 DetectEngineCtxFree(de_ctx);
6982 return result;
6983 }
6984
DetectFastPatternTest252(void)6985 static int DetectFastPatternTest252(void)
6986 {
6987 DetectEngineCtx *de_ctx = NULL;
6988 int result = 0;
6989
6990 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
6991 goto end;
6992
6993 de_ctx->flags |= DE_QUIET;
6994 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
6995 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:65977,4; http_raw_header; content:\"three\"; http_raw_header; distance:10; sid:1;)");
6996 if (de_ctx->sig_list != NULL)
6997 goto end;
6998
6999 result = 1;
7000
7001 end:
7002 SigCleanSignatures(de_ctx);
7003 DetectEngineCtxFree(de_ctx);
7004 return result;
7005 }
7006
DetectFastPatternTest253(void)7007 static int DetectFastPatternTest253(void)
7008 {
7009 DetectEngineCtx *de_ctx = NULL;
7010 int result = 0;
7011
7012 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7013 goto end;
7014
7015 de_ctx->flags |= DE_QUIET;
7016 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
7017 "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,65977; http_raw_header; content:\"three\"; distance:10; http_raw_header; sid:1;)");
7018 if (de_ctx->sig_list != NULL)
7019 goto end;
7020
7021 result = 1;
7022
7023 end:
7024 SigCleanSignatures(de_ctx);
7025 DetectEngineCtxFree(de_ctx);
7026 return result;
7027 }
7028
DetectFastPatternTest254(void)7029 static int DetectFastPatternTest254(void)
7030 {
7031 DetectEngineCtx *de_ctx = NULL;
7032 int result = 0;
7033
7034 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7035 goto end;
7036
7037 de_ctx->flags |= DE_QUIET;
7038 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
7039 "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:65534,4; http_raw_header; content:\"three\"; http_raw_header; distance:10; sid:1;)");
7040 if (de_ctx->sig_list != NULL)
7041 goto end;
7042
7043 result = 1;
7044
7045 end:
7046 SigCleanSignatures(de_ctx);
7047 DetectEngineCtxFree(de_ctx);
7048 return result;
7049 }
7050
DetectFastPatternTest255(void)7051 static int DetectFastPatternTest255(void)
7052 {
7053 DetectEngineCtx *de_ctx = NULL;
7054 int result = 0;
7055
7056 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7057 goto end;
7058
7059 de_ctx->flags |= DE_QUIET;
7060 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
7061 "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; sid:1;)");
7062 if (de_ctx->sig_list == NULL)
7063 goto end;
7064 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->prev->ctx;
7065 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7066 ud->flags & DETECT_CONTENT_NEGATED &&
7067 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
7068 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
7069 ud->fp_chop_offset == 3 &&
7070 ud->fp_chop_len == 4) {
7071 result = 1;
7072 } else {
7073 result = 0;
7074 }
7075
7076 end:
7077 SigCleanSignatures(de_ctx);
7078 DetectEngineCtxFree(de_ctx);
7079 return result;
7080 }
7081
DetectFastPatternTest256(void)7082 static int DetectFastPatternTest256(void)
7083 {
7084 DetectEngineCtx *de_ctx = NULL;
7085 int result = 0;
7086
7087 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7088 goto end;
7089
7090 de_ctx->flags |= DE_QUIET;
7091 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
7092 "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; distance:10; content:\"three\"; http_raw_header; sid:1;)");
7093 if (de_ctx->sig_list != NULL)
7094 goto end;
7095
7096 result = 1;
7097
7098 end:
7099 SigCleanSignatures(de_ctx);
7100 DetectEngineCtxFree(de_ctx);
7101 return result;
7102 }
7103
DetectFastPatternTest257(void)7104 static int DetectFastPatternTest257(void)
7105 {
7106 DetectEngineCtx *de_ctx = NULL;
7107 int result = 0;
7108
7109 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7110 goto end;
7111
7112 de_ctx->flags |= DE_QUIET;
7113 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
7114 "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; within:10; content:\"three\"; http_raw_header; sid:1;)");
7115 if (de_ctx->sig_list != NULL)
7116 goto end;
7117
7118 result = 1;
7119
7120 end:
7121 SigCleanSignatures(de_ctx);
7122 DetectEngineCtxFree(de_ctx);
7123 return result;
7124 }
7125
DetectFastPatternTest258(void)7126 static int DetectFastPatternTest258(void)
7127 {
7128 DetectEngineCtx *de_ctx = NULL;
7129 int result = 0;
7130
7131 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7132 goto end;
7133
7134 de_ctx->flags |= DE_QUIET;
7135 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
7136 "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; offset:10; content:\"three\"; http_raw_header; sid:1;)");
7137 if (de_ctx->sig_list != NULL)
7138 goto end;
7139
7140 result = 1;
7141
7142 end:
7143 SigCleanSignatures(de_ctx);
7144 DetectEngineCtxFree(de_ctx);
7145 return result;
7146 }
7147
DetectFastPatternTest259(void)7148 static int DetectFastPatternTest259(void)
7149 {
7150 DetectEngineCtx *de_ctx = NULL;
7151 int result = 0;
7152
7153 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7154 goto end;
7155
7156 de_ctx->flags |= DE_QUIET;
7157 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
7158 "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; depth:10; content:\"three\"; http_raw_header; sid:1;)");
7159 if (de_ctx->sig_list != NULL)
7160 goto end;
7161
7162 result = 1;
7163
7164 end:
7165 SigCleanSignatures(de_ctx);
7166 DetectEngineCtxFree(de_ctx);
7167 return result;
7168 }
7169
DetectFastPatternTest260(void)7170 static int DetectFastPatternTest260(void)
7171 {
7172 DetectEngineCtx *de_ctx = NULL;
7173 int result = 0;
7174
7175 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7176 goto end;
7177
7178 de_ctx->flags |= DE_QUIET;
7179 de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
7180 "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; sid:1;)");
7181 if (de_ctx->sig_list == NULL)
7182 goto end;
7183 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_header_buffer_id]->prev->ctx;
7184 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7185 ud->flags & DETECT_CONTENT_NEGATED &&
7186 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
7187 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
7188 ud->fp_chop_offset == 3 &&
7189 ud->fp_chop_len == 4) {
7190 result = 1;
7191 } else {
7192 result = 0;
7193 }
7194
7195 end:
7196 SigCleanSignatures(de_ctx);
7197 DetectEngineCtxFree(de_ctx);
7198 return result;
7199 }
7200
7201
7202 /* http_raw_header fast_pattern tests ^ */
7203 /* http_method fast_pattern tests v */
7204
7205
DetectFastPatternTest261(void)7206 static int DetectFastPatternTest261(void)
7207 {
7208 DetectEngineCtx *de_ctx = NULL;
7209 int result = 0;
7210
7211 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7212 goto end;
7213
7214 de_ctx->flags |= DE_QUIET;
7215 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7216 "(content:\"one\"; http_method; "
7217 "content:!\"oneonetwo\"; fast_pattern:3,4; http_method; "
7218 "content:\"three\"; http_method; sid:1;)");
7219 if (de_ctx->sig_list == NULL)
7220 goto end;
7221 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
7222 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7223 ud->flags & DETECT_CONTENT_NEGATED &&
7224 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
7225 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
7226 ud->fp_chop_offset == 3 &&
7227 ud->fp_chop_len == 4) {
7228 result = 1;
7229 } else {
7230 result = 0;
7231 }
7232
7233 end:
7234 SigCleanSignatures(de_ctx);
7235 DetectEngineCtxFree(de_ctx);
7236 return result;
7237 }
7238
7239 /**
7240 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
7241 */
DetectFastPatternTest262(void)7242 static int DetectFastPatternTest262(void)
7243 {
7244 SigMatch *sm = NULL;
7245 DetectEngineCtx *de_ctx = NULL;
7246 int result = 0;
7247
7248 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7249 goto end;
7250
7251 de_ctx->flags |= DE_QUIET;
7252 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7253 "(content:\"/one/\"; fast_pattern:only; http_method; "
7254 "msg:\"Testing fast_pattern\"; sid:1;)");
7255 if (de_ctx->sig_list == NULL)
7256 goto end;
7257
7258 result = 0;
7259 sm = de_ctx->sig_list->sm_lists[g_http_method_buffer_id];
7260 if (sm != NULL) {
7261 if ( ((DetectContentData *)sm->ctx)->flags &
7262 DETECT_CONTENT_FAST_PATTERN) {
7263 result = 1;
7264 } else {
7265 result = 0;
7266 }
7267 }
7268
7269
7270 end:
7271 SigCleanSignatures(de_ctx);
7272 DetectEngineCtxFree(de_ctx);
7273 return result;
7274 }
7275
7276 /**
7277 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
7278 */
DetectFastPatternTest263(void)7279 static int DetectFastPatternTest263(void)
7280 {
7281 SigMatch *sm = NULL;
7282 DetectEngineCtx *de_ctx = NULL;
7283 int result = 0;
7284
7285 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7286 goto end;
7287
7288 de_ctx->flags |= DE_QUIET;
7289 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7290 "(content:\"oneoneone\"; fast_pattern:3,4; http_method; "
7291 "msg:\"Testing fast_pattern\"; sid:1;)");
7292 if (de_ctx->sig_list == NULL)
7293 goto end;
7294
7295 result = 0;
7296 sm = de_ctx->sig_list->sm_lists[g_http_method_buffer_id];
7297 if (sm != NULL) {
7298 if ( ((DetectContentData *)sm->ctx)->flags &
7299 DETECT_CONTENT_FAST_PATTERN) {
7300 result = 1;
7301 } else {
7302 result = 0;
7303 }
7304 }
7305
7306 end:
7307 SigCleanSignatures(de_ctx);
7308 DetectEngineCtxFree(de_ctx);
7309 return result;
7310 }
7311
DetectFastPatternTest264(void)7312 static int DetectFastPatternTest264(void)
7313 {
7314 SigMatch *sm = NULL;
7315 DetectEngineCtx *de_ctx = NULL;
7316 int result = 0;
7317
7318 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7319 goto end;
7320
7321 de_ctx->flags |= DE_QUIET;
7322 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7323 "(content:\"one\"; fast_pattern:only; http_method; sid:1;)");
7324 if (de_ctx->sig_list == NULL)
7325 goto end;
7326
7327 result = 0;
7328 sm = de_ctx->sig_list->sm_lists[g_http_method_buffer_id];
7329 DetectContentData *ud = (DetectContentData *)sm->ctx;
7330 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7331 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
7332 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
7333 ud->fp_chop_offset == 0 &&
7334 ud->fp_chop_len == 0) {
7335 result = 1;
7336 } else {
7337 result = 0;
7338 }
7339
7340 end:
7341 SigCleanSignatures(de_ctx);
7342 DetectEngineCtxFree(de_ctx);
7343 return result;
7344 }
7345
DetectFastPatternTest265(void)7346 static int DetectFastPatternTest265(void)
7347 {
7348 SigMatch *sm = NULL;
7349 DetectEngineCtx *de_ctx = NULL;
7350 int result = 0;
7351
7352 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7353 goto end;
7354
7355 de_ctx->flags |= DE_QUIET;
7356 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7357 "(content:\"oneoneone\"; fast_pattern:3,4; http_method; sid:1;)");
7358 if (de_ctx->sig_list == NULL)
7359 goto end;
7360
7361 result = 0;
7362 sm = de_ctx->sig_list->sm_lists[g_http_method_buffer_id];
7363 DetectContentData *ud = (DetectContentData *)sm->ctx;
7364 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7365 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
7366 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
7367 ud->fp_chop_offset == 3 &&
7368 ud->fp_chop_len == 4) {
7369 result = 1;
7370 } else {
7371 result = 0;
7372 }
7373
7374 end:
7375 SigCleanSignatures(de_ctx);
7376 DetectEngineCtxFree(de_ctx);
7377 return result;
7378 }
7379
DetectFastPatternTest266(void)7380 static int DetectFastPatternTest266(void)
7381 {
7382 DetectEngineCtx *de_ctx = NULL;
7383 int result = 0;
7384
7385 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7386 goto end;
7387
7388 de_ctx->flags |= DE_QUIET;
7389 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7390 "(content:\"one\"; http_method; content:\"two\"; fast_pattern:only; http_method; distance:10; sid:1;)");
7391 if (de_ctx->sig_list != NULL)
7392 goto end;
7393
7394 result = 1;
7395
7396 end:
7397 SigCleanSignatures(de_ctx);
7398 DetectEngineCtxFree(de_ctx);
7399 return result;
7400 }
7401
DetectFastPatternTest267(void)7402 static int DetectFastPatternTest267(void)
7403 {
7404 DetectEngineCtx *de_ctx = NULL;
7405 int result = 0;
7406
7407 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7408 goto end;
7409
7410 de_ctx->flags |= DE_QUIET;
7411 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7412 "(content:\"one\"; http_method; content:\"two\"; distance:10; fast_pattern:only; http_method; sid:1;)");
7413 if (de_ctx->sig_list != NULL)
7414 goto end;
7415
7416 result = 1;
7417
7418 end:
7419 SigCleanSignatures(de_ctx);
7420 DetectEngineCtxFree(de_ctx);
7421 return result;
7422 }
7423
DetectFastPatternTest268(void)7424 static int DetectFastPatternTest268(void)
7425 {
7426 DetectEngineCtx *de_ctx = NULL;
7427 int result = 0;
7428
7429 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7430 goto end;
7431
7432 de_ctx->flags |= DE_QUIET;
7433 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7434 "(content:\"one\"; http_method; content:\"two\"; fast_pattern:only; http_method; within:10; sid:1;)");
7435 if (de_ctx->sig_list != NULL)
7436 goto end;
7437
7438 result = 1;
7439
7440 end:
7441 SigCleanSignatures(de_ctx);
7442 DetectEngineCtxFree(de_ctx);
7443 return result;
7444 }
7445
DetectFastPatternTest269(void)7446 static int DetectFastPatternTest269(void)
7447 {
7448 DetectEngineCtx *de_ctx = NULL;
7449 int result = 0;
7450
7451 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7452 goto end;
7453
7454 de_ctx->flags |= DE_QUIET;
7455 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7456 "(content:\"one\"; http_method; content:\"two\"; within:10; fast_pattern:only; http_method; sid:1;)");
7457 if (de_ctx->sig_list != NULL)
7458 goto end;
7459
7460 result = 1;
7461
7462 end:
7463 SigCleanSignatures(de_ctx);
7464 DetectEngineCtxFree(de_ctx);
7465 return result;
7466 }
7467
DetectFastPatternTest270(void)7468 static int DetectFastPatternTest270(void)
7469 {
7470 DetectEngineCtx *de_ctx = NULL;
7471 int result = 0;
7472
7473 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7474 goto end;
7475
7476 de_ctx->flags |= DE_QUIET;
7477 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7478 "(content:\"one\"; http_method; content:\"two\"; fast_pattern:only; http_method; offset:10; sid:1;)");
7479 if (de_ctx->sig_list != NULL)
7480 goto end;
7481
7482 result = 1;
7483
7484 end:
7485 SigCleanSignatures(de_ctx);
7486 DetectEngineCtxFree(de_ctx);
7487 return result;
7488 }
7489
DetectFastPatternTest271(void)7490 static int DetectFastPatternTest271(void)
7491 {
7492 DetectEngineCtx *de_ctx = NULL;
7493 int result = 0;
7494
7495 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7496 goto end;
7497
7498 de_ctx->flags |= DE_QUIET;
7499 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7500 "(content:\"one\"; http_method; content:\"two\"; offset:10; fast_pattern:only; http_method; sid:1;)");
7501 if (de_ctx->sig_list != NULL)
7502 goto end;
7503
7504 result = 1;
7505
7506 end:
7507 SigCleanSignatures(de_ctx);
7508 DetectEngineCtxFree(de_ctx);
7509 return result;
7510 }
7511
DetectFastPatternTest272(void)7512 static int DetectFastPatternTest272(void)
7513 {
7514 DetectEngineCtx *de_ctx = NULL;
7515 int result = 0;
7516
7517 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7518 goto end;
7519
7520 de_ctx->flags |= DE_QUIET;
7521 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7522 "(content:\"one\"; http_method; content:\"two\"; fast_pattern:only; http_method; depth:10; sid:1;)");
7523 if (de_ctx->sig_list != NULL)
7524 goto end;
7525
7526 result = 1;
7527
7528 end:
7529 SigCleanSignatures(de_ctx);
7530 DetectEngineCtxFree(de_ctx);
7531 return result;
7532 }
7533
DetectFastPatternTest273(void)7534 static int DetectFastPatternTest273(void)
7535 {
7536 DetectEngineCtx *de_ctx = NULL;
7537 int result = 0;
7538
7539 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7540 goto end;
7541
7542 de_ctx->flags |= DE_QUIET;
7543 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7544 "(content:\"one\"; http_method; content:\"two\"; depth:10; fast_pattern:only; http_method; sid:1;)");
7545 if (de_ctx->sig_list != NULL)
7546 goto end;
7547
7548 result = 1;
7549
7550 end:
7551 SigCleanSignatures(de_ctx);
7552 DetectEngineCtxFree(de_ctx);
7553 return result;
7554 }
7555
DetectFastPatternTest274(void)7556 static int DetectFastPatternTest274(void)
7557 {
7558 DetectEngineCtx *de_ctx = NULL;
7559 int result = 0;
7560
7561 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7562 goto end;
7563
7564 de_ctx->flags |= DE_QUIET;
7565 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7566 "(content:\"one\"; http_method; content:!\"two\"; fast_pattern:only; http_method; sid:1;)");
7567 if (de_ctx->sig_list != NULL)
7568 goto end;
7569
7570 result = 1;
7571
7572 end:
7573 SigCleanSignatures(de_ctx);
7574 DetectEngineCtxFree(de_ctx);
7575 return result;
7576 }
7577
DetectFastPatternTest275(void)7578 static int DetectFastPatternTest275(void)
7579 {
7580 DetectEngineCtx *de_ctx = NULL;
7581 int result = 0;
7582
7583 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7584 goto end;
7585
7586 de_ctx->flags |= DE_QUIET;
7587 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7588 "(content: \"one\"; http_method; content:\"two\"; http_method; distance:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)");
7589 if (de_ctx->sig_list == NULL)
7590 goto end;
7591
7592 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
7593 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7594 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
7595 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
7596 ud->fp_chop_offset == 0 &&
7597 ud->fp_chop_len == 0) {
7598 result = 1;
7599 } else {
7600 result = 0;
7601 }
7602
7603 end:
7604 SigCleanSignatures(de_ctx);
7605 DetectEngineCtxFree(de_ctx);
7606 return result;
7607 }
7608
DetectFastPatternTest276(void)7609 static int DetectFastPatternTest276(void)
7610 {
7611 DetectEngineCtx *de_ctx = NULL;
7612 int result = 0;
7613
7614 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7615 goto end;
7616
7617 de_ctx->flags |= DE_QUIET;
7618 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7619 "(content:\"one\"; http_method; content:\"two\"; http_method; within:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)");
7620 if (de_ctx->sig_list == NULL)
7621 goto end;
7622 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
7623 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7624 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
7625 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
7626 ud->fp_chop_offset == 0 &&
7627 ud->fp_chop_len == 0) {
7628 result = 1;
7629 } else {
7630 result = 0;
7631 }
7632
7633 end:
7634 SigCleanSignatures(de_ctx);
7635 DetectEngineCtxFree(de_ctx);
7636 return result;
7637 }
7638
DetectFastPatternTest277(void)7639 static int DetectFastPatternTest277(void)
7640 {
7641 DetectEngineCtx *de_ctx = NULL;
7642 int result = 0;
7643
7644 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7645 goto end;
7646
7647 de_ctx->flags |= DE_QUIET;
7648 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7649 "(content:\"one\"; http_method; content:\"two\"; http_method; offset:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)");
7650 if (de_ctx->sig_list == NULL)
7651 goto end;
7652 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
7653 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7654 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
7655 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
7656 ud->fp_chop_offset == 0 &&
7657 ud->fp_chop_len == 0) {
7658 result = 1;
7659 } else {
7660 result = 0;
7661 }
7662
7663 end:
7664 SigCleanSignatures(de_ctx);
7665 DetectEngineCtxFree(de_ctx);
7666 return result;
7667 }
7668
DetectFastPatternTest278(void)7669 static int DetectFastPatternTest278(void)
7670 {
7671 DetectEngineCtx *de_ctx = NULL;
7672 int result = 0;
7673
7674 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7675 goto end;
7676
7677 de_ctx->flags |= DE_QUIET;
7678 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7679 "(content:\"one\"; http_method; content:\"two\"; http_method; depth:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)");
7680 if (de_ctx->sig_list == NULL)
7681 goto end;
7682 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
7683 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7684 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
7685 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
7686 ud->fp_chop_offset == 0 &&
7687 ud->fp_chop_len == 0) {
7688 result = 1;
7689 } else {
7690 result = 0;
7691 }
7692
7693 end:
7694 SigCleanSignatures(de_ctx);
7695 DetectEngineCtxFree(de_ctx);
7696 return result;
7697 }
7698
DetectFastPatternTest279(void)7699 static int DetectFastPatternTest279(void)
7700 {
7701 DetectEngineCtx *de_ctx = NULL;
7702 int result = 0;
7703
7704 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7705 goto end;
7706
7707 de_ctx->flags |= DE_QUIET;
7708 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7709 "(content:!\"one\"; fast_pattern; http_method; content:\"two\"; http_method; sid:1;)");
7710 if (de_ctx->sig_list == NULL)
7711 goto end;
7712 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
7713 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7714 ud->flags & DETECT_CONTENT_NEGATED &&
7715 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
7716 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
7717 ud->fp_chop_offset == 0 &&
7718 ud->fp_chop_len == 0) {
7719 result = 1;
7720 } else {
7721 result = 0;
7722 }
7723
7724 end:
7725 SigCleanSignatures(de_ctx);
7726 DetectEngineCtxFree(de_ctx);
7727 return result;
7728 }
7729
DetectFastPatternTest280(void)7730 static int DetectFastPatternTest280(void)
7731 {
7732 DetectEngineCtx *de_ctx = NULL;
7733 int result = 0;
7734
7735 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7736 goto end;
7737
7738 de_ctx->flags |= DE_QUIET;
7739 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7740 "(content:\"two\"; http_method; content:!\"one\"; fast_pattern; http_method; distance:20; sid:1;)");
7741 if (de_ctx->sig_list != NULL)
7742 goto end;
7743
7744 result = 1;
7745
7746 end:
7747 SigCleanSignatures(de_ctx);
7748 DetectEngineCtxFree(de_ctx);
7749 return result;
7750 }
7751
DetectFastPatternTest281(void)7752 static int DetectFastPatternTest281(void)
7753 {
7754 DetectEngineCtx *de_ctx = NULL;
7755 int result = 0;
7756
7757 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7758 goto end;
7759
7760 de_ctx->flags |= DE_QUIET;
7761 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7762 "(content:\"two\"; http_method; content:!\"one\"; fast_pattern; http_method; within:20; sid:1;)");
7763 if (de_ctx->sig_list != NULL)
7764 goto end;
7765
7766 result = 1;
7767
7768 end:
7769 SigCleanSignatures(de_ctx);
7770 DetectEngineCtxFree(de_ctx);
7771 return result;
7772 }
7773
DetectFastPatternTest282(void)7774 static int DetectFastPatternTest282(void)
7775 {
7776 DetectEngineCtx *de_ctx = NULL;
7777 int result = 0;
7778
7779 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7780 goto end;
7781
7782 de_ctx->flags |= DE_QUIET;
7783 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7784 "(content:\"two\"; http_method; content:!\"one\"; fast_pattern; http_method; offset:20; sid:1;)");
7785 if (de_ctx->sig_list != NULL)
7786 goto end;
7787
7788 result = 1;
7789
7790 end:
7791 SigCleanSignatures(de_ctx);
7792 DetectEngineCtxFree(de_ctx);
7793 return result;
7794 }
7795
DetectFastPatternTest283(void)7796 static int DetectFastPatternTest283(void)
7797 {
7798 DetectEngineCtx *de_ctx = NULL;
7799 int result = 0;
7800
7801 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7802 goto end;
7803
7804 de_ctx->flags |= DE_QUIET;
7805 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7806 "(content:\"two\"; http_method; content:!\"one\"; fast_pattern; http_method; depth:20; sid:1;)");
7807 if (de_ctx->sig_list != NULL)
7808 goto end;
7809
7810 result = 1;
7811
7812 end:
7813 SigCleanSignatures(de_ctx);
7814 DetectEngineCtxFree(de_ctx);
7815 return result;
7816 }
7817
DetectFastPatternTest284(void)7818 static int DetectFastPatternTest284(void)
7819 {
7820 DetectEngineCtx *de_ctx = NULL;
7821 int result = 0;
7822
7823 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7824 goto end;
7825
7826 de_ctx->flags |= DE_QUIET;
7827 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7828 "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; sid:1;)");
7829 if (de_ctx->sig_list == NULL)
7830 goto end;
7831 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
7832 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7833 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
7834 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
7835 ud->fp_chop_offset == 3 &&
7836 ud->fp_chop_len == 4) {
7837 result = 1;
7838 } else {
7839 result = 0;
7840 }
7841
7842 end:
7843 SigCleanSignatures(de_ctx);
7844 DetectEngineCtxFree(de_ctx);
7845 return result;
7846 }
7847
DetectFastPatternTest285(void)7848 static int DetectFastPatternTest285(void)
7849 {
7850 DetectEngineCtx *de_ctx = NULL;
7851 int result = 0;
7852
7853 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7854 goto end;
7855
7856 de_ctx->flags |= DE_QUIET;
7857 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7858 "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; distance:30; sid:1;)");
7859 if (de_ctx->sig_list == NULL)
7860 goto end;
7861 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
7862 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7863 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
7864 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
7865 ud->fp_chop_offset == 3 &&
7866 ud->fp_chop_len == 4) {
7867 result = 1;
7868 } else {
7869 result = 0;
7870 }
7871
7872 end:
7873 SigCleanSignatures(de_ctx);
7874 DetectEngineCtxFree(de_ctx);
7875 return result;
7876 }
7877
DetectFastPatternTest286(void)7878 static int DetectFastPatternTest286(void)
7879 {
7880 DetectEngineCtx *de_ctx = NULL;
7881 int result = 0;
7882
7883 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7884 goto end;
7885
7886 de_ctx->flags |= DE_QUIET;
7887 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7888 "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; within:30; sid:1;)");
7889 if (de_ctx->sig_list == NULL)
7890 goto end;
7891 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
7892 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7893 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
7894 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
7895 ud->fp_chop_offset == 3 &&
7896 ud->fp_chop_len == 4) {
7897 result = 1;
7898 } else {
7899 result = 0;
7900 }
7901
7902 end:
7903 SigCleanSignatures(de_ctx);
7904 DetectEngineCtxFree(de_ctx);
7905 return result;
7906 }
7907
DetectFastPatternTest287(void)7908 static int DetectFastPatternTest287(void)
7909 {
7910 DetectEngineCtx *de_ctx = NULL;
7911 int result = 0;
7912
7913 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7914 goto end;
7915
7916 de_ctx->flags |= DE_QUIET;
7917 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7918 "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; offset:30; sid:1;)");
7919 if (de_ctx->sig_list == NULL)
7920 goto end;
7921 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
7922 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7923 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
7924 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
7925 ud->fp_chop_offset == 3 &&
7926 ud->fp_chop_len == 4) {
7927 result = 1;
7928 } else {
7929 result = 0;
7930 }
7931
7932 end:
7933 SigCleanSignatures(de_ctx);
7934 DetectEngineCtxFree(de_ctx);
7935 return result;
7936 }
7937
DetectFastPatternTest288(void)7938 static int DetectFastPatternTest288(void)
7939 {
7940 DetectEngineCtx *de_ctx = NULL;
7941 int result = 0;
7942
7943 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7944 goto end;
7945
7946 de_ctx->flags |= DE_QUIET;
7947 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7948 "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; depth:30; sid:1;)");
7949 if (de_ctx->sig_list == NULL)
7950 goto end;
7951 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
7952 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7953 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
7954 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
7955 ud->fp_chop_offset == 3 &&
7956 ud->fp_chop_len == 4) {
7957 result = 1;
7958 } else {
7959 result = 0;
7960 }
7961
7962 end:
7963 SigCleanSignatures(de_ctx);
7964 DetectEngineCtxFree(de_ctx);
7965 return result;
7966 }
7967
DetectFastPatternTest289(void)7968 static int DetectFastPatternTest289(void)
7969 {
7970 DetectEngineCtx *de_ctx = NULL;
7971 int result = 0;
7972
7973 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
7974 goto end;
7975
7976 de_ctx->flags |= DE_QUIET;
7977 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
7978 "(content:\"one\"; http_method; content:\"two\"; http_method; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)");
7979 if (de_ctx->sig_list == NULL)
7980 goto end;
7981 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
7982 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
7983 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
7984 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
7985 ud->fp_chop_offset == 3 &&
7986 ud->fp_chop_len == 4) {
7987 result = 1;
7988 } else {
7989 result = 0;
7990 }
7991
7992 end:
7993 SigCleanSignatures(de_ctx);
7994 DetectEngineCtxFree(de_ctx);
7995 return result;
7996 }
7997
DetectFastPatternTest290(void)7998 static int DetectFastPatternTest290(void)
7999 {
8000 DetectEngineCtx *de_ctx = NULL;
8001 int result = 0;
8002
8003 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8004 goto end;
8005
8006 de_ctx->flags |= DE_QUIET;
8007 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8008 "(content:\"one\"; http_method; content:\"two\"; http_method; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)");
8009 if (de_ctx->sig_list == NULL)
8010 goto end;
8011 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
8012 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8013 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
8014 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
8015 ud->fp_chop_offset == 3 &&
8016 ud->fp_chop_len == 4) {
8017 result = 1;
8018 } else {
8019 result = 0;
8020 }
8021
8022 end:
8023 SigCleanSignatures(de_ctx);
8024 DetectEngineCtxFree(de_ctx);
8025 return result;
8026 }
8027
DetectFastPatternTest291(void)8028 static int DetectFastPatternTest291(void)
8029 {
8030 DetectEngineCtx *de_ctx = NULL;
8031 int result = 0;
8032
8033 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8034 goto end;
8035
8036 de_ctx->flags |= DE_QUIET;
8037 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8038 "(content:\"one\"; http_method; content:\"two\"; http_method; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)");
8039 if (de_ctx->sig_list == NULL)
8040 goto end;
8041 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
8042 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8043 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
8044 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
8045 ud->fp_chop_offset == 3 &&
8046 ud->fp_chop_len == 4) {
8047 result = 1;
8048 } else {
8049 result = 0;
8050 }
8051
8052 end:
8053 SigCleanSignatures(de_ctx);
8054 DetectEngineCtxFree(de_ctx);
8055 return result;
8056 }
8057
DetectFastPatternTest292(void)8058 static int DetectFastPatternTest292(void)
8059 {
8060 DetectEngineCtx *de_ctx = NULL;
8061 int result = 0;
8062
8063 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8064 goto end;
8065
8066 de_ctx->flags |= DE_QUIET;
8067 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8068 "(content:\"one\"; http_method; content:\"two\"; http_method; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)");
8069 if (de_ctx->sig_list == NULL)
8070 goto end;
8071 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->ctx;
8072 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8073 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
8074 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
8075 ud->fp_chop_offset == 3 &&
8076 ud->fp_chop_len == 4) {
8077 result = 1;
8078 } else {
8079 result = 0;
8080 }
8081
8082
8083 result = 1;
8084
8085 end:
8086 SigCleanSignatures(de_ctx);
8087 DetectEngineCtxFree(de_ctx);
8088 return result;
8089 }
8090
DetectFastPatternTest293(void)8091 static int DetectFastPatternTest293(void)
8092 {
8093 DetectEngineCtx *de_ctx = NULL;
8094 int result = 0;
8095
8096 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8097 goto end;
8098
8099 de_ctx->flags |= DE_QUIET;
8100 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8101 "(content:\"one\"; http_method; content:\"two\"; fast_pattern:65977,4; http_method; content:\"three\"; http_method; distance:10; sid:1;)");
8102 if (de_ctx->sig_list != NULL)
8103 goto end;
8104
8105 result = 1;
8106
8107 end:
8108 SigCleanSignatures(de_ctx);
8109 DetectEngineCtxFree(de_ctx);
8110 return result;
8111 }
8112
DetectFastPatternTest294(void)8113 static int DetectFastPatternTest294(void)
8114 {
8115 DetectEngineCtx *de_ctx = NULL;
8116 int result = 0;
8117
8118 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8119 goto end;
8120
8121 de_ctx->flags |= DE_QUIET;
8122 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8123 "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,65977; http_method; content:\"three\"; distance:10; http_method; sid:1;)");
8124 if (de_ctx->sig_list != NULL)
8125 goto end;
8126
8127 result = 1;
8128
8129 end:
8130 SigCleanSignatures(de_ctx);
8131 DetectEngineCtxFree(de_ctx);
8132 return result;
8133 }
8134
DetectFastPatternTest295(void)8135 static int DetectFastPatternTest295(void)
8136 {
8137 DetectEngineCtx *de_ctx = NULL;
8138 int result = 0;
8139
8140 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8141 goto end;
8142
8143 de_ctx->flags |= DE_QUIET;
8144 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8145 "(content:\"one\"; http_method; content:\"two\"; fast_pattern:65534,4; http_method; content:\"three\"; http_method; distance:10; sid:1;)");
8146 if (de_ctx->sig_list != NULL)
8147 goto end;
8148
8149 result = 1;
8150
8151 end:
8152 SigCleanSignatures(de_ctx);
8153 DetectEngineCtxFree(de_ctx);
8154 return result;
8155 }
8156
DetectFastPatternTest296(void)8157 static int DetectFastPatternTest296(void)
8158 {
8159 DetectEngineCtx *de_ctx = NULL;
8160 int result = 0;
8161
8162 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8163 goto end;
8164
8165 de_ctx->flags |= DE_QUIET;
8166 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8167 "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; sid:1;)");
8168 if (de_ctx->sig_list == NULL)
8169 goto end;
8170 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
8171 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8172 ud->flags & DETECT_CONTENT_NEGATED &&
8173 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
8174 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
8175 ud->fp_chop_offset == 3 &&
8176 ud->fp_chop_len == 4) {
8177 result = 1;
8178 } else {
8179 result = 0;
8180 }
8181
8182 end:
8183 SigCleanSignatures(de_ctx);
8184 DetectEngineCtxFree(de_ctx);
8185 return result;
8186 }
8187
DetectFastPatternTest297(void)8188 static int DetectFastPatternTest297(void)
8189 {
8190 DetectEngineCtx *de_ctx = NULL;
8191 int result = 0;
8192
8193 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8194 goto end;
8195
8196 de_ctx->flags |= DE_QUIET;
8197 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8198 "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; distance:10; content:\"three\"; http_method; sid:1;)");
8199 if (de_ctx->sig_list != NULL)
8200 goto end;
8201
8202 result = 1;
8203
8204 end:
8205 SigCleanSignatures(de_ctx);
8206 DetectEngineCtxFree(de_ctx);
8207 return result;
8208 }
8209
DetectFastPatternTest298(void)8210 static int DetectFastPatternTest298(void)
8211 {
8212 DetectEngineCtx *de_ctx = NULL;
8213 int result = 0;
8214
8215 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8216 goto end;
8217
8218 de_ctx->flags |= DE_QUIET;
8219 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8220 "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; within:10; content:\"three\"; http_method; sid:1;)");
8221 if (de_ctx->sig_list != NULL)
8222 goto end;
8223
8224 result = 1;
8225
8226 end:
8227 SigCleanSignatures(de_ctx);
8228 DetectEngineCtxFree(de_ctx);
8229 return result;
8230 }
8231
DetectFastPatternTest299(void)8232 static int DetectFastPatternTest299(void)
8233 {
8234 DetectEngineCtx *de_ctx = NULL;
8235 int result = 0;
8236
8237 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8238 goto end;
8239
8240 de_ctx->flags |= DE_QUIET;
8241 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8242 "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; offset:10; content:\"three\"; http_method; sid:1;)");
8243 if (de_ctx->sig_list != NULL)
8244 goto end;
8245
8246 result = 1;
8247
8248 end:
8249 SigCleanSignatures(de_ctx);
8250 DetectEngineCtxFree(de_ctx);
8251 return result;
8252 }
8253
DetectFastPatternTest300(void)8254 static int DetectFastPatternTest300(void)
8255 {
8256 DetectEngineCtx *de_ctx = NULL;
8257 int result = 0;
8258
8259 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8260 goto end;
8261
8262 de_ctx->flags |= DE_QUIET;
8263 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8264 "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; depth:10; content:\"three\"; http_method; sid:1;)");
8265 if (de_ctx->sig_list != NULL)
8266 goto end;
8267
8268 result = 1;
8269
8270 end:
8271 SigCleanSignatures(de_ctx);
8272 DetectEngineCtxFree(de_ctx);
8273 return result;
8274 }
8275
DetectFastPatternTest301(void)8276 static int DetectFastPatternTest301(void)
8277 {
8278 DetectEngineCtx *de_ctx = NULL;
8279 int result = 0;
8280
8281 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8282 goto end;
8283
8284 de_ctx->flags |= DE_QUIET;
8285 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8286 "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; sid:1;)");
8287 if (de_ctx->sig_list == NULL)
8288 goto end;
8289 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_method_buffer_id]->prev->ctx;
8290 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8291 ud->flags & DETECT_CONTENT_NEGATED &&
8292 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
8293 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
8294 ud->fp_chop_offset == 3 &&
8295 ud->fp_chop_len == 4) {
8296 result = 1;
8297 } else {
8298 result = 0;
8299 }
8300
8301 end:
8302 SigCleanSignatures(de_ctx);
8303 DetectEngineCtxFree(de_ctx);
8304 return result;
8305 }
8306
8307
8308 /* http_method fast_pattern tests ^ */
8309 /* http_cookie fast_pattern tests v */
8310
8311
DetectFastPatternTest302(void)8312 static int DetectFastPatternTest302(void)
8313 {
8314 DetectEngineCtx *de_ctx = NULL;
8315 int result = 0;
8316
8317 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8318 goto end;
8319
8320 de_ctx->flags |= DE_QUIET;
8321 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8322 "(content:\"one\"; http_cookie; "
8323 "content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; "
8324 "content:\"three\"; http_cookie; sid:1;)");
8325 if (de_ctx->sig_list == NULL)
8326 goto end;
8327 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->prev->ctx;
8328 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8329 ud->flags & DETECT_CONTENT_NEGATED &&
8330 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
8331 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
8332 ud->fp_chop_offset == 3 &&
8333 ud->fp_chop_len == 4) {
8334 result = 1;
8335 } else {
8336 result = 0;
8337 }
8338
8339 end:
8340 SigCleanSignatures(de_ctx);
8341 DetectEngineCtxFree(de_ctx);
8342 return result;
8343 }
8344
8345 /**
8346 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
8347 */
DetectFastPatternTest303(void)8348 static int DetectFastPatternTest303(void)
8349 {
8350 SigMatch *sm = NULL;
8351 DetectEngineCtx *de_ctx = NULL;
8352 int result = 0;
8353
8354 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8355 goto end;
8356
8357 de_ctx->flags |= DE_QUIET;
8358 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8359 "(content:\"/one/\"; fast_pattern:only; http_cookie; "
8360 "msg:\"Testing fast_pattern\"; sid:1;)");
8361 if (de_ctx->sig_list == NULL)
8362 goto end;
8363
8364 result = 0;
8365 sm = de_ctx->sig_list->sm_lists[g_http_cookie_buffer_id];
8366 if (sm != NULL) {
8367 if ( ((DetectContentData *)sm->ctx)->flags &
8368 DETECT_CONTENT_FAST_PATTERN) {
8369 result = 1;
8370 } else {
8371 result = 0;
8372 }
8373 }
8374
8375
8376 end:
8377 SigCleanSignatures(de_ctx);
8378 DetectEngineCtxFree(de_ctx);
8379 return result;
8380 }
8381
8382 /**
8383 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
8384 */
DetectFastPatternTest304(void)8385 static int DetectFastPatternTest304(void)
8386 {
8387 SigMatch *sm = NULL;
8388 DetectEngineCtx *de_ctx = NULL;
8389 int result = 0;
8390
8391 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8392 goto end;
8393
8394 de_ctx->flags |= DE_QUIET;
8395 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8396 "(content:\"oneoneone\"; fast_pattern:3,4; http_cookie; "
8397 "msg:\"Testing fast_pattern\"; sid:1;)");
8398 if (de_ctx->sig_list == NULL)
8399 goto end;
8400
8401 result = 0;
8402 sm = de_ctx->sig_list->sm_lists[g_http_cookie_buffer_id];
8403 if (sm != NULL) {
8404 if ( ((DetectContentData *)sm->ctx)->flags &
8405 DETECT_CONTENT_FAST_PATTERN) {
8406 result = 1;
8407 } else {
8408 result = 0;
8409 }
8410 }
8411
8412 end:
8413 SigCleanSignatures(de_ctx);
8414 DetectEngineCtxFree(de_ctx);
8415 return result;
8416 }
8417
DetectFastPatternTest305(void)8418 static int DetectFastPatternTest305(void)
8419 {
8420 SigMatch *sm = NULL;
8421 DetectEngineCtx *de_ctx = NULL;
8422 int result = 0;
8423
8424 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8425 goto end;
8426
8427 de_ctx->flags |= DE_QUIET;
8428 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8429 "(content:\"one\"; fast_pattern:only; http_cookie; sid:1;)");
8430 if (de_ctx->sig_list == NULL)
8431 goto end;
8432
8433 result = 0;
8434 sm = de_ctx->sig_list->sm_lists[g_http_cookie_buffer_id];
8435 DetectContentData *ud = (DetectContentData *)sm->ctx;
8436 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8437 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
8438 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
8439 ud->fp_chop_offset == 0 &&
8440 ud->fp_chop_len == 0) {
8441 result = 1;
8442 } else {
8443 result = 0;
8444 }
8445
8446 end:
8447 SigCleanSignatures(de_ctx);
8448 DetectEngineCtxFree(de_ctx);
8449 return result;
8450 }
8451
DetectFastPatternTest306(void)8452 static int DetectFastPatternTest306(void)
8453 {
8454 SigMatch *sm = NULL;
8455 DetectEngineCtx *de_ctx = NULL;
8456 int result = 0;
8457
8458 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8459 goto end;
8460
8461 de_ctx->flags |= DE_QUIET;
8462 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8463 "(content:\"oneoneone\"; fast_pattern:3,4; http_cookie; sid:1;)");
8464 if (de_ctx->sig_list == NULL)
8465 goto end;
8466
8467 result = 0;
8468 sm = de_ctx->sig_list->sm_lists[g_http_cookie_buffer_id];
8469 DetectContentData *ud = (DetectContentData *)sm->ctx;
8470 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8471 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
8472 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
8473 ud->fp_chop_offset == 3 &&
8474 ud->fp_chop_len == 4) {
8475 result = 1;
8476 } else {
8477 result = 0;
8478 }
8479
8480 end:
8481 SigCleanSignatures(de_ctx);
8482 DetectEngineCtxFree(de_ctx);
8483 return result;
8484 }
8485
DetectFastPatternTest307(void)8486 static int DetectFastPatternTest307(void)
8487 {
8488 DetectEngineCtx *de_ctx = NULL;
8489 int result = 0;
8490
8491 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8492 goto end;
8493
8494 de_ctx->flags |= DE_QUIET;
8495 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8496 "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:only; http_cookie; distance:10; sid:1;)");
8497 if (de_ctx->sig_list != NULL)
8498 goto end;
8499
8500 result = 1;
8501
8502 end:
8503 SigCleanSignatures(de_ctx);
8504 DetectEngineCtxFree(de_ctx);
8505 return result;
8506 }
8507
DetectFastPatternTest308(void)8508 static int DetectFastPatternTest308(void)
8509 {
8510 DetectEngineCtx *de_ctx = NULL;
8511 int result = 0;
8512
8513 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8514 goto end;
8515
8516 de_ctx->flags |= DE_QUIET;
8517 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8518 "(content:\"one\"; http_cookie; content:\"two\"; distance:10; fast_pattern:only; http_cookie; sid:1;)");
8519 if (de_ctx->sig_list != NULL)
8520 goto end;
8521
8522 result = 1;
8523
8524 end:
8525 SigCleanSignatures(de_ctx);
8526 DetectEngineCtxFree(de_ctx);
8527 return result;
8528 }
8529
DetectFastPatternTest309(void)8530 static int DetectFastPatternTest309(void)
8531 {
8532 DetectEngineCtx *de_ctx = NULL;
8533 int result = 0;
8534
8535 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8536 goto end;
8537
8538 de_ctx->flags |= DE_QUIET;
8539 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8540 "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:only; http_cookie; within:10; sid:1;)");
8541 if (de_ctx->sig_list != NULL)
8542 goto end;
8543
8544 result = 1;
8545
8546 end:
8547 SigCleanSignatures(de_ctx);
8548 DetectEngineCtxFree(de_ctx);
8549 return result;
8550 }
8551
DetectFastPatternTest310(void)8552 static int DetectFastPatternTest310(void)
8553 {
8554 DetectEngineCtx *de_ctx = NULL;
8555 int result = 0;
8556
8557 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8558 goto end;
8559
8560 de_ctx->flags |= DE_QUIET;
8561 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8562 "(content:\"one\"; http_cookie; content:\"two\"; within:10; fast_pattern:only; http_cookie; sid:1;)");
8563 if (de_ctx->sig_list != NULL)
8564 goto end;
8565
8566 result = 1;
8567
8568 end:
8569 SigCleanSignatures(de_ctx);
8570 DetectEngineCtxFree(de_ctx);
8571 return result;
8572 }
8573
DetectFastPatternTest311(void)8574 static int DetectFastPatternTest311(void)
8575 {
8576 DetectEngineCtx *de_ctx = NULL;
8577 int result = 0;
8578
8579 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8580 goto end;
8581
8582 de_ctx->flags |= DE_QUIET;
8583 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8584 "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:only; http_cookie; offset:10; sid:1;)");
8585 if (de_ctx->sig_list != NULL)
8586 goto end;
8587
8588 result = 1;
8589
8590 end:
8591 SigCleanSignatures(de_ctx);
8592 DetectEngineCtxFree(de_ctx);
8593 return result;
8594 }
8595
DetectFastPatternTest312(void)8596 static int DetectFastPatternTest312(void)
8597 {
8598 DetectEngineCtx *de_ctx = NULL;
8599 int result = 0;
8600
8601 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8602 goto end;
8603
8604 de_ctx->flags |= DE_QUIET;
8605 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8606 "(content:\"one\"; http_cookie; content:\"two\"; offset:10; fast_pattern:only; http_cookie; sid:1;)");
8607 if (de_ctx->sig_list != NULL)
8608 goto end;
8609
8610 result = 1;
8611
8612 end:
8613 SigCleanSignatures(de_ctx);
8614 DetectEngineCtxFree(de_ctx);
8615 return result;
8616 }
8617
DetectFastPatternTest313(void)8618 static int DetectFastPatternTest313(void)
8619 {
8620 DetectEngineCtx *de_ctx = NULL;
8621 int result = 0;
8622
8623 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8624 goto end;
8625
8626 de_ctx->flags |= DE_QUIET;
8627 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8628 "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:only; http_cookie; depth:10; sid:1;)");
8629 if (de_ctx->sig_list != NULL)
8630 goto end;
8631
8632 result = 1;
8633
8634 end:
8635 SigCleanSignatures(de_ctx);
8636 DetectEngineCtxFree(de_ctx);
8637 return result;
8638 }
8639
DetectFastPatternTest314(void)8640 static int DetectFastPatternTest314(void)
8641 {
8642 DetectEngineCtx *de_ctx = NULL;
8643 int result = 0;
8644
8645 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8646 goto end;
8647
8648 de_ctx->flags |= DE_QUIET;
8649 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8650 "(content:\"one\"; http_cookie; content:\"two\"; depth:10; fast_pattern:only; http_cookie; sid:1;)");
8651 if (de_ctx->sig_list != NULL)
8652 goto end;
8653
8654 result = 1;
8655
8656 end:
8657 SigCleanSignatures(de_ctx);
8658 DetectEngineCtxFree(de_ctx);
8659 return result;
8660 }
8661
DetectFastPatternTest315(void)8662 static int DetectFastPatternTest315(void)
8663 {
8664 DetectEngineCtx *de_ctx = NULL;
8665 int result = 0;
8666
8667 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8668 goto end;
8669
8670 de_ctx->flags |= DE_QUIET;
8671 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8672 "(content:\"one\"; http_cookie; content:!\"two\"; fast_pattern:only; http_cookie; sid:1;)");
8673 if (de_ctx->sig_list != NULL)
8674 goto end;
8675
8676 result = 1;
8677
8678 end:
8679 SigCleanSignatures(de_ctx);
8680 DetectEngineCtxFree(de_ctx);
8681 return result;
8682 }
8683
DetectFastPatternTest316(void)8684 static int DetectFastPatternTest316(void)
8685 {
8686 DetectEngineCtx *de_ctx = NULL;
8687 int result = 0;
8688
8689 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8690 goto end;
8691
8692 de_ctx->flags |= DE_QUIET;
8693 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8694 "(content: \"one\"; http_cookie; content:\"two\"; http_cookie; distance:30; content:\"two\"; fast_pattern:only; http_cookie; sid:1;)");
8695 if (de_ctx->sig_list == NULL)
8696 goto end;
8697
8698 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->ctx;
8699 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8700 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
8701 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
8702 ud->fp_chop_offset == 0 &&
8703 ud->fp_chop_len == 0) {
8704 result = 1;
8705 } else {
8706 result = 0;
8707 }
8708
8709 end:
8710 SigCleanSignatures(de_ctx);
8711 DetectEngineCtxFree(de_ctx);
8712 return result;
8713 }
8714
DetectFastPatternTest317(void)8715 static int DetectFastPatternTest317(void)
8716 {
8717 DetectEngineCtx *de_ctx = NULL;
8718 int result = 0;
8719
8720 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8721 goto end;
8722
8723 de_ctx->flags |= DE_QUIET;
8724 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8725 "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; within:30; content:\"two\"; fast_pattern:only; http_cookie; sid:1;)");
8726 if (de_ctx->sig_list == NULL)
8727 goto end;
8728 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->ctx;
8729 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8730 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
8731 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
8732 ud->fp_chop_offset == 0 &&
8733 ud->fp_chop_len == 0) {
8734 result = 1;
8735 } else {
8736 result = 0;
8737 }
8738
8739 end:
8740 SigCleanSignatures(de_ctx);
8741 DetectEngineCtxFree(de_ctx);
8742 return result;
8743 }
8744
DetectFastPatternTest318(void)8745 static int DetectFastPatternTest318(void)
8746 {
8747 DetectEngineCtx *de_ctx = NULL;
8748 int result = 0;
8749
8750 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8751 goto end;
8752
8753 de_ctx->flags |= DE_QUIET;
8754 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8755 "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; offset:30; content:\"two\"; fast_pattern:only; http_cookie; sid:1;)");
8756 if (de_ctx->sig_list == NULL)
8757 goto end;
8758 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->ctx;
8759 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8760 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
8761 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
8762 ud->fp_chop_offset == 0 &&
8763 ud->fp_chop_len == 0) {
8764 result = 1;
8765 } else {
8766 result = 0;
8767 }
8768
8769 end:
8770 SigCleanSignatures(de_ctx);
8771 DetectEngineCtxFree(de_ctx);
8772 return result;
8773 }
8774
DetectFastPatternTest319(void)8775 static int DetectFastPatternTest319(void)
8776 {
8777 DetectEngineCtx *de_ctx = NULL;
8778 int result = 0;
8779
8780 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8781 goto end;
8782
8783 de_ctx->flags |= DE_QUIET;
8784 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8785 "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; depth:30; content:\"two\"; fast_pattern:only; http_cookie; sid:1;)");
8786 if (de_ctx->sig_list == NULL)
8787 goto end;
8788 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->ctx;
8789 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8790 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
8791 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
8792 ud->fp_chop_offset == 0 &&
8793 ud->fp_chop_len == 0) {
8794 result = 1;
8795 } else {
8796 result = 0;
8797 }
8798
8799 end:
8800 SigCleanSignatures(de_ctx);
8801 DetectEngineCtxFree(de_ctx);
8802 return result;
8803 }
8804
DetectFastPatternTest320(void)8805 static int DetectFastPatternTest320(void)
8806 {
8807 DetectEngineCtx *de_ctx = NULL;
8808 int result = 0;
8809
8810 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8811 goto end;
8812
8813 de_ctx->flags |= DE_QUIET;
8814 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8815 "(content:!\"one\"; fast_pattern; http_cookie; content:\"two\"; http_cookie; sid:1;)");
8816 if (de_ctx->sig_list == NULL)
8817 goto end;
8818 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->prev->ctx;
8819 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8820 ud->flags & DETECT_CONTENT_NEGATED &&
8821 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
8822 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
8823 ud->fp_chop_offset == 0 &&
8824 ud->fp_chop_len == 0) {
8825 result = 1;
8826 } else {
8827 result = 0;
8828 }
8829
8830 end:
8831 SigCleanSignatures(de_ctx);
8832 DetectEngineCtxFree(de_ctx);
8833 return result;
8834 }
8835
DetectFastPatternTest321(void)8836 static int DetectFastPatternTest321(void)
8837 {
8838 DetectEngineCtx *de_ctx = NULL;
8839 int result = 0;
8840
8841 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8842 goto end;
8843
8844 de_ctx->flags |= DE_QUIET;
8845 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8846 "(content:\"two\"; http_cookie; content:!\"one\"; fast_pattern; http_cookie; distance:20; sid:1;)");
8847 if (de_ctx->sig_list != NULL)
8848 goto end;
8849
8850 result = 1;
8851
8852 end:
8853 SigCleanSignatures(de_ctx);
8854 DetectEngineCtxFree(de_ctx);
8855 return result;
8856 }
8857
DetectFastPatternTest322(void)8858 static int DetectFastPatternTest322(void)
8859 {
8860 DetectEngineCtx *de_ctx = NULL;
8861 int result = 0;
8862
8863 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8864 goto end;
8865
8866 de_ctx->flags |= DE_QUIET;
8867 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8868 "(content:\"two\"; http_cookie; content:!\"one\"; fast_pattern; http_cookie; within:20; sid:1;)");
8869 if (de_ctx->sig_list != NULL)
8870 goto end;
8871
8872 result = 1;
8873
8874 end:
8875 SigCleanSignatures(de_ctx);
8876 DetectEngineCtxFree(de_ctx);
8877 return result;
8878 }
8879
DetectFastPatternTest323(void)8880 static int DetectFastPatternTest323(void)
8881 {
8882 DetectEngineCtx *de_ctx = NULL;
8883 int result = 0;
8884
8885 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8886 goto end;
8887
8888 de_ctx->flags |= DE_QUIET;
8889 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8890 "(content:\"two\"; http_cookie; content:!\"one\"; fast_pattern; http_cookie; offset:20; sid:1;)");
8891 if (de_ctx->sig_list != NULL)
8892 goto end;
8893
8894 result = 1;
8895
8896 end:
8897 SigCleanSignatures(de_ctx);
8898 DetectEngineCtxFree(de_ctx);
8899 return result;
8900 }
8901
DetectFastPatternTest324(void)8902 static int DetectFastPatternTest324(void)
8903 {
8904 DetectEngineCtx *de_ctx = NULL;
8905 int result = 0;
8906
8907 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8908 goto end;
8909
8910 de_ctx->flags |= DE_QUIET;
8911 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8912 "(content:\"two\"; http_cookie; content:!\"one\"; fast_pattern; http_cookie; depth:20; sid:1;)");
8913 if (de_ctx->sig_list != NULL)
8914 goto end;
8915
8916 result = 1;
8917
8918 end:
8919 SigCleanSignatures(de_ctx);
8920 DetectEngineCtxFree(de_ctx);
8921 return result;
8922 }
8923
DetectFastPatternTest325(void)8924 static int DetectFastPatternTest325(void)
8925 {
8926 DetectEngineCtx *de_ctx = NULL;
8927 int result = 0;
8928
8929 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8930 goto end;
8931
8932 de_ctx->flags |= DE_QUIET;
8933 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8934 "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; sid:1;)");
8935 if (de_ctx->sig_list == NULL)
8936 goto end;
8937 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->prev->ctx;
8938 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8939 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
8940 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
8941 ud->fp_chop_offset == 3 &&
8942 ud->fp_chop_len == 4) {
8943 result = 1;
8944 } else {
8945 result = 0;
8946 }
8947
8948 end:
8949 SigCleanSignatures(de_ctx);
8950 DetectEngineCtxFree(de_ctx);
8951 return result;
8952 }
8953
DetectFastPatternTest326(void)8954 static int DetectFastPatternTest326(void)
8955 {
8956 DetectEngineCtx *de_ctx = NULL;
8957 int result = 0;
8958
8959 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8960 goto end;
8961
8962 de_ctx->flags |= DE_QUIET;
8963 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8964 "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; distance:30; sid:1;)");
8965 if (de_ctx->sig_list == NULL)
8966 goto end;
8967 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->prev->ctx;
8968 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8969 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
8970 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
8971 ud->fp_chop_offset == 3 &&
8972 ud->fp_chop_len == 4) {
8973 result = 1;
8974 } else {
8975 result = 0;
8976 }
8977
8978 end:
8979 SigCleanSignatures(de_ctx);
8980 DetectEngineCtxFree(de_ctx);
8981 return result;
8982 }
8983
DetectFastPatternTest327(void)8984 static int DetectFastPatternTest327(void)
8985 {
8986 DetectEngineCtx *de_ctx = NULL;
8987 int result = 0;
8988
8989 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
8990 goto end;
8991
8992 de_ctx->flags |= DE_QUIET;
8993 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
8994 "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; within:30; sid:1;)");
8995 if (de_ctx->sig_list == NULL)
8996 goto end;
8997 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->prev->ctx;
8998 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
8999 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
9000 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
9001 ud->fp_chop_offset == 3 &&
9002 ud->fp_chop_len == 4) {
9003 result = 1;
9004 } else {
9005 result = 0;
9006 }
9007
9008 end:
9009 SigCleanSignatures(de_ctx);
9010 DetectEngineCtxFree(de_ctx);
9011 return result;
9012 }
9013
DetectFastPatternTest328(void)9014 static int DetectFastPatternTest328(void)
9015 {
9016 DetectEngineCtx *de_ctx = NULL;
9017 int result = 0;
9018
9019 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9020 goto end;
9021
9022 de_ctx->flags |= DE_QUIET;
9023 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9024 "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; offset:30; sid:1;)");
9025 if (de_ctx->sig_list == NULL)
9026 goto end;
9027 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->prev->ctx;
9028 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9029 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
9030 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
9031 ud->fp_chop_offset == 3 &&
9032 ud->fp_chop_len == 4) {
9033 result = 1;
9034 } else {
9035 result = 0;
9036 }
9037
9038 end:
9039 SigCleanSignatures(de_ctx);
9040 DetectEngineCtxFree(de_ctx);
9041 return result;
9042 }
9043
DetectFastPatternTest329(void)9044 static int DetectFastPatternTest329(void)
9045 {
9046 DetectEngineCtx *de_ctx = NULL;
9047 int result = 0;
9048
9049 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9050 goto end;
9051
9052 de_ctx->flags |= DE_QUIET;
9053 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9054 "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; depth:30; sid:1;)");
9055 if (de_ctx->sig_list == NULL)
9056 goto end;
9057 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->prev->ctx;
9058 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9059 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
9060 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
9061 ud->fp_chop_offset == 3 &&
9062 ud->fp_chop_len == 4) {
9063 result = 1;
9064 } else {
9065 result = 0;
9066 }
9067
9068 end:
9069 SigCleanSignatures(de_ctx);
9070 DetectEngineCtxFree(de_ctx);
9071 return result;
9072 }
9073
DetectFastPatternTest330(void)9074 static int DetectFastPatternTest330(void)
9075 {
9076 DetectEngineCtx *de_ctx = NULL;
9077 int result = 0;
9078
9079 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9080 goto end;
9081
9082 de_ctx->flags |= DE_QUIET;
9083 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9084 "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_cookie; sid:1;)");
9085 if (de_ctx->sig_list == NULL)
9086 goto end;
9087 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->ctx;
9088 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9089 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
9090 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
9091 ud->fp_chop_offset == 3 &&
9092 ud->fp_chop_len == 4) {
9093 result = 1;
9094 } else {
9095 result = 0;
9096 }
9097
9098 end:
9099 SigCleanSignatures(de_ctx);
9100 DetectEngineCtxFree(de_ctx);
9101 return result;
9102 }
9103
DetectFastPatternTest331(void)9104 static int DetectFastPatternTest331(void)
9105 {
9106 DetectEngineCtx *de_ctx = NULL;
9107 int result = 0;
9108
9109 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9110 goto end;
9111
9112 de_ctx->flags |= DE_QUIET;
9113 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9114 "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_cookie; sid:1;)");
9115 if (de_ctx->sig_list == NULL)
9116 goto end;
9117 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->ctx;
9118 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9119 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
9120 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
9121 ud->fp_chop_offset == 3 &&
9122 ud->fp_chop_len == 4) {
9123 result = 1;
9124 } else {
9125 result = 0;
9126 }
9127
9128 end:
9129 SigCleanSignatures(de_ctx);
9130 DetectEngineCtxFree(de_ctx);
9131 return result;
9132 }
9133
DetectFastPatternTest332(void)9134 static int DetectFastPatternTest332(void)
9135 {
9136 DetectEngineCtx *de_ctx = NULL;
9137 int result = 0;
9138
9139 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9140 goto end;
9141
9142 de_ctx->flags |= DE_QUIET;
9143 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9144 "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_cookie; sid:1;)");
9145 if (de_ctx->sig_list == NULL)
9146 goto end;
9147 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->ctx;
9148 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9149 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
9150 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
9151 ud->fp_chop_offset == 3 &&
9152 ud->fp_chop_len == 4) {
9153 result = 1;
9154 } else {
9155 result = 0;
9156 }
9157
9158 end:
9159 SigCleanSignatures(de_ctx);
9160 DetectEngineCtxFree(de_ctx);
9161 return result;
9162 }
9163
DetectFastPatternTest333(void)9164 static int DetectFastPatternTest333(void)
9165 {
9166 DetectEngineCtx *de_ctx = NULL;
9167 int result = 0;
9168
9169 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9170 goto end;
9171
9172 de_ctx->flags |= DE_QUIET;
9173 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9174 "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_cookie; sid:1;)");
9175 if (de_ctx->sig_list == NULL)
9176 goto end;
9177 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->ctx;
9178 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9179 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
9180 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
9181 ud->fp_chop_offset == 3 &&
9182 ud->fp_chop_len == 4) {
9183 result = 1;
9184 } else {
9185 result = 0;
9186 }
9187
9188
9189 result = 1;
9190
9191 end:
9192 SigCleanSignatures(de_ctx);
9193 DetectEngineCtxFree(de_ctx);
9194 return result;
9195 }
9196
DetectFastPatternTest334(void)9197 static int DetectFastPatternTest334(void)
9198 {
9199 DetectEngineCtx *de_ctx = NULL;
9200 int result = 0;
9201
9202 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9203 goto end;
9204
9205 de_ctx->flags |= DE_QUIET;
9206 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9207 "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:65977,4; http_cookie; content:\"three\"; http_cookie; distance:10; sid:1;)");
9208 if (de_ctx->sig_list != NULL)
9209 goto end;
9210
9211 result = 1;
9212
9213 end:
9214 SigCleanSignatures(de_ctx);
9215 DetectEngineCtxFree(de_ctx);
9216 return result;
9217 }
9218
DetectFastPatternTest335(void)9219 static int DetectFastPatternTest335(void)
9220 {
9221 DetectEngineCtx *de_ctx = NULL;
9222 int result = 0;
9223
9224 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9225 goto end;
9226
9227 de_ctx->flags |= DE_QUIET;
9228 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9229 "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,65977; http_cookie; content:\"three\"; distance:10; http_cookie; sid:1;)");
9230 if (de_ctx->sig_list != NULL)
9231 goto end;
9232
9233 result = 1;
9234
9235 end:
9236 SigCleanSignatures(de_ctx);
9237 DetectEngineCtxFree(de_ctx);
9238 return result;
9239 }
9240
DetectFastPatternTest336(void)9241 static int DetectFastPatternTest336(void)
9242 {
9243 DetectEngineCtx *de_ctx = NULL;
9244 int result = 0;
9245
9246 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9247 goto end;
9248
9249 de_ctx->flags |= DE_QUIET;
9250 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9251 "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:65534,4; http_cookie; content:\"three\"; http_cookie; distance:10; sid:1;)");
9252 if (de_ctx->sig_list != NULL)
9253 goto end;
9254
9255 result = 1;
9256
9257 end:
9258 SigCleanSignatures(de_ctx);
9259 DetectEngineCtxFree(de_ctx);
9260 return result;
9261 }
9262
DetectFastPatternTest337(void)9263 static int DetectFastPatternTest337(void)
9264 {
9265 DetectEngineCtx *de_ctx = NULL;
9266 int result = 0;
9267
9268 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9269 goto end;
9270
9271 de_ctx->flags |= DE_QUIET;
9272 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9273 "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; sid:1;)");
9274 if (de_ctx->sig_list == NULL)
9275 goto end;
9276 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->prev->ctx;
9277 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9278 ud->flags & DETECT_CONTENT_NEGATED &&
9279 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
9280 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
9281 ud->fp_chop_offset == 3 &&
9282 ud->fp_chop_len == 4) {
9283 result = 1;
9284 } else {
9285 result = 0;
9286 }
9287
9288 end:
9289 SigCleanSignatures(de_ctx);
9290 DetectEngineCtxFree(de_ctx);
9291 return result;
9292 }
9293
DetectFastPatternTest338(void)9294 static int DetectFastPatternTest338(void)
9295 {
9296 DetectEngineCtx *de_ctx = NULL;
9297 int result = 0;
9298
9299 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9300 goto end;
9301
9302 de_ctx->flags |= DE_QUIET;
9303 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9304 "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; distance:10; content:\"three\"; http_cookie; sid:1;)");
9305 if (de_ctx->sig_list != NULL)
9306 goto end;
9307
9308 result = 1;
9309
9310 end:
9311 SigCleanSignatures(de_ctx);
9312 DetectEngineCtxFree(de_ctx);
9313 return result;
9314 }
9315
DetectFastPatternTest339(void)9316 static int DetectFastPatternTest339(void)
9317 {
9318 DetectEngineCtx *de_ctx = NULL;
9319 int result = 0;
9320
9321 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9322 goto end;
9323
9324 de_ctx->flags |= DE_QUIET;
9325 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9326 "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; within:10; content:\"three\"; http_cookie; sid:1;)");
9327 if (de_ctx->sig_list != NULL)
9328 goto end;
9329
9330 result = 1;
9331
9332 end:
9333 SigCleanSignatures(de_ctx);
9334 DetectEngineCtxFree(de_ctx);
9335 return result;
9336 }
9337
DetectFastPatternTest340(void)9338 static int DetectFastPatternTest340(void)
9339 {
9340 DetectEngineCtx *de_ctx = NULL;
9341 int result = 0;
9342
9343 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9344 goto end;
9345
9346 de_ctx->flags |= DE_QUIET;
9347 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9348 "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; offset:10; content:\"three\"; http_cookie; sid:1;)");
9349 if (de_ctx->sig_list != NULL)
9350 goto end;
9351
9352 result = 1;
9353
9354 end:
9355 SigCleanSignatures(de_ctx);
9356 DetectEngineCtxFree(de_ctx);
9357 return result;
9358 }
9359
DetectFastPatternTest341(void)9360 static int DetectFastPatternTest341(void)
9361 {
9362 DetectEngineCtx *de_ctx = NULL;
9363 int result = 0;
9364
9365 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9366 goto end;
9367
9368 de_ctx->flags |= DE_QUIET;
9369 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9370 "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; depth:10; content:\"three2\"; http_cookie; sid:1;)");
9371 if (de_ctx->sig_list != NULL)
9372 goto end;
9373
9374 result = 1;
9375
9376 end:
9377 SigCleanSignatures(de_ctx);
9378 DetectEngineCtxFree(de_ctx);
9379 return result;
9380 }
9381
DetectFastPatternTest342(void)9382 static int DetectFastPatternTest342(void)
9383 {
9384 DetectEngineCtx *de_ctx = NULL;
9385 int result = 0;
9386
9387 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9388 goto end;
9389
9390 de_ctx->flags |= DE_QUIET;
9391 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9392 "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; sid:1;)");
9393 if (de_ctx->sig_list == NULL)
9394 goto end;
9395 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_cookie_buffer_id]->prev->ctx;
9396 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9397 ud->flags & DETECT_CONTENT_NEGATED &&
9398 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
9399 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
9400 ud->fp_chop_offset == 3 &&
9401 ud->fp_chop_len == 4) {
9402 result = 1;
9403 } else {
9404 result = 0;
9405 }
9406
9407 end:
9408 SigCleanSignatures(de_ctx);
9409 DetectEngineCtxFree(de_ctx);
9410 return result;
9411 }
9412
9413
9414 /* http_cookie fast_pattern tests ^ */
9415 /* http_raw_uri fast_pattern tests v */
9416
9417
DetectFastPatternTest343(void)9418 static int DetectFastPatternTest343(void)
9419 {
9420 DetectEngineCtx *de_ctx = NULL;
9421 int result = 0;
9422
9423 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9424 goto end;
9425
9426 de_ctx->flags |= DE_QUIET;
9427 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9428 "(content:\"one\"; http_raw_uri; "
9429 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
9430 "content:\"three\"; http_raw_uri; sid:1;)");
9431 if (de_ctx->sig_list == NULL)
9432 goto end;
9433 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->prev->ctx;
9434 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9435 ud->flags & DETECT_CONTENT_NEGATED &&
9436 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
9437 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
9438 ud->fp_chop_offset == 3 &&
9439 ud->fp_chop_len == 4) {
9440 result = 1;
9441 } else {
9442 result = 0;
9443 }
9444
9445 end:
9446 SigCleanSignatures(de_ctx);
9447 DetectEngineCtxFree(de_ctx);
9448 return result;
9449 }
9450
9451 /**
9452 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
9453 */
DetectFastPatternTest344(void)9454 static int DetectFastPatternTest344(void)
9455 {
9456 SigMatch *sm = NULL;
9457 DetectEngineCtx *de_ctx = NULL;
9458 int result = 0;
9459
9460 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9461 goto end;
9462
9463 de_ctx->flags |= DE_QUIET;
9464 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9465 "(content:\"/one/\"; fast_pattern:only; http_raw_uri; "
9466 "msg:\"Testing fast_pattern\"; sid:1;)");
9467 if (de_ctx->sig_list == NULL)
9468 goto end;
9469
9470 result = 0;
9471 sm = de_ctx->sig_list->sm_lists[g_http_raw_uri_buffer_id];
9472 if (sm != NULL) {
9473 if ( ((DetectContentData *)sm->ctx)->flags &
9474 DETECT_CONTENT_FAST_PATTERN) {
9475 result = 1;
9476 } else {
9477 result = 0;
9478 }
9479 }
9480
9481
9482 end:
9483 SigCleanSignatures(de_ctx);
9484 DetectEngineCtxFree(de_ctx);
9485 return result;
9486 }
9487
9488 /**
9489 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
9490 */
DetectFastPatternTest345(void)9491 static int DetectFastPatternTest345(void)
9492 {
9493 SigMatch *sm = NULL;
9494 DetectEngineCtx *de_ctx = NULL;
9495 int result = 0;
9496
9497 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9498 goto end;
9499
9500 de_ctx->flags |= DE_QUIET;
9501 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9502 "(content:\"oneoneone\"; fast_pattern:3,4; http_raw_uri; "
9503 "msg:\"Testing fast_pattern\"; sid:1;)");
9504 if (de_ctx->sig_list == NULL)
9505 goto end;
9506
9507 result = 0;
9508 sm = de_ctx->sig_list->sm_lists[g_http_raw_uri_buffer_id];
9509 if (sm != NULL) {
9510 if ( ((DetectContentData *)sm->ctx)->flags &
9511 DETECT_CONTENT_FAST_PATTERN) {
9512 result = 1;
9513 } else {
9514 result = 0;
9515 }
9516 }
9517
9518 end:
9519 SigCleanSignatures(de_ctx);
9520 DetectEngineCtxFree(de_ctx);
9521 return result;
9522 }
9523
DetectFastPatternTest346(void)9524 static int DetectFastPatternTest346(void)
9525 {
9526 SigMatch *sm = NULL;
9527 DetectEngineCtx *de_ctx = NULL;
9528 int result = 0;
9529
9530 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9531 goto end;
9532
9533 de_ctx->flags |= DE_QUIET;
9534 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9535 "(content:\"one\"; fast_pattern:only; http_raw_uri; sid:1;)");
9536 if (de_ctx->sig_list == NULL)
9537 goto end;
9538
9539 result = 0;
9540 sm = de_ctx->sig_list->sm_lists[g_http_raw_uri_buffer_id];
9541 DetectContentData *ud = (DetectContentData *)sm->ctx;
9542 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9543 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
9544 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
9545 ud->fp_chop_offset == 0 &&
9546 ud->fp_chop_len == 0) {
9547 result = 1;
9548 } else {
9549 result = 0;
9550 }
9551
9552 end:
9553 SigCleanSignatures(de_ctx);
9554 DetectEngineCtxFree(de_ctx);
9555 return result;
9556 }
9557
DetectFastPatternTest347(void)9558 static int DetectFastPatternTest347(void)
9559 {
9560 SigMatch *sm = NULL;
9561 DetectEngineCtx *de_ctx = NULL;
9562 int result = 0;
9563
9564 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9565 goto end;
9566
9567 de_ctx->flags |= DE_QUIET;
9568 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9569 "(content:\"oneoneone\"; fast_pattern:3,4; http_raw_uri; sid:1;)");
9570 if (de_ctx->sig_list == NULL)
9571 goto end;
9572
9573 result = 0;
9574 sm = de_ctx->sig_list->sm_lists[g_http_raw_uri_buffer_id];
9575 DetectContentData *ud = (DetectContentData *)sm->ctx;
9576 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9577 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
9578 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
9579 ud->fp_chop_offset == 3 &&
9580 ud->fp_chop_len == 4) {
9581 result = 1;
9582 } else {
9583 result = 0;
9584 }
9585
9586 end:
9587 SigCleanSignatures(de_ctx);
9588 DetectEngineCtxFree(de_ctx);
9589 return result;
9590 }
9591
DetectFastPatternTest348(void)9592 static int DetectFastPatternTest348(void)
9593 {
9594 DetectEngineCtx *de_ctx = NULL;
9595 int result = 0;
9596
9597 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9598 goto end;
9599
9600 de_ctx->flags |= DE_QUIET;
9601 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9602 "(content:\"one\"; http_raw_uri; "
9603 "content:\"two\"; fast_pattern:only; http_raw_uri; distance:10; sid:1;)");
9604 if (de_ctx->sig_list != NULL)
9605 goto end;
9606
9607 result = 1;
9608
9609 end:
9610 SigCleanSignatures(de_ctx);
9611 DetectEngineCtxFree(de_ctx);
9612 return result;
9613 }
9614
DetectFastPatternTest349(void)9615 static int DetectFastPatternTest349(void)
9616 {
9617 DetectEngineCtx *de_ctx = NULL;
9618 int result = 0;
9619
9620 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9621 goto end;
9622
9623 de_ctx->flags |= DE_QUIET;
9624 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9625 "(content:\"one\"; http_raw_uri; "
9626 "content:\"two\"; distance:10; fast_pattern:only; http_raw_uri; sid:1;)");
9627 if (de_ctx->sig_list != NULL)
9628 goto end;
9629
9630 result = 1;
9631
9632 end:
9633 SigCleanSignatures(de_ctx);
9634 DetectEngineCtxFree(de_ctx);
9635 return result;
9636 }
9637
DetectFastPatternTest350(void)9638 static int DetectFastPatternTest350(void)
9639 {
9640 DetectEngineCtx *de_ctx = NULL;
9641 int result = 0;
9642
9643 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9644 goto end;
9645
9646 de_ctx->flags |= DE_QUIET;
9647 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9648 "(content:\"one\"; http_raw_uri; "
9649 "content:\"two\"; fast_pattern:only; http_raw_uri; within:10; sid:1;)");
9650 if (de_ctx->sig_list != NULL)
9651 goto end;
9652
9653 result = 1;
9654
9655 end:
9656 SigCleanSignatures(de_ctx);
9657 DetectEngineCtxFree(de_ctx);
9658 return result;
9659 }
9660
DetectFastPatternTest351(void)9661 static int DetectFastPatternTest351(void)
9662 {
9663 DetectEngineCtx *de_ctx = NULL;
9664 int result = 0;
9665
9666 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9667 goto end;
9668
9669 de_ctx->flags |= DE_QUIET;
9670 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9671 "(content:\"one\"; http_raw_uri; "
9672 "content:\"two\"; within:10; fast_pattern:only; http_raw_uri; sid:1;)");
9673 if (de_ctx->sig_list != NULL)
9674 goto end;
9675
9676 result = 1;
9677
9678 end:
9679 SigCleanSignatures(de_ctx);
9680 DetectEngineCtxFree(de_ctx);
9681 return result;
9682 }
9683
DetectFastPatternTest352(void)9684 static int DetectFastPatternTest352(void)
9685 {
9686 DetectEngineCtx *de_ctx = NULL;
9687 int result = 0;
9688
9689 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9690 goto end;
9691
9692 de_ctx->flags |= DE_QUIET;
9693 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9694 "(content:\"one\"; http_raw_uri; "
9695 "content:\"two\"; fast_pattern:only; http_raw_uri; offset:10; sid:1;)");
9696 if (de_ctx->sig_list != NULL)
9697 goto end;
9698
9699 result = 1;
9700
9701 end:
9702 SigCleanSignatures(de_ctx);
9703 DetectEngineCtxFree(de_ctx);
9704 return result;
9705 }
9706
DetectFastPatternTest353(void)9707 static int DetectFastPatternTest353(void)
9708 {
9709 DetectEngineCtx *de_ctx = NULL;
9710 int result = 0;
9711
9712 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9713 goto end;
9714
9715 de_ctx->flags |= DE_QUIET;
9716 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9717 "(content:\"one\"; http_raw_uri; "
9718 "content:\"two\"; offset:10; fast_pattern:only; http_raw_uri; sid:1;)");
9719 if (de_ctx->sig_list != NULL)
9720 goto end;
9721
9722 result = 1;
9723
9724 end:
9725 SigCleanSignatures(de_ctx);
9726 DetectEngineCtxFree(de_ctx);
9727 return result;
9728 }
9729
DetectFastPatternTest354(void)9730 static int DetectFastPatternTest354(void)
9731 {
9732 DetectEngineCtx *de_ctx = NULL;
9733 int result = 0;
9734
9735 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9736 goto end;
9737
9738 de_ctx->flags |= DE_QUIET;
9739 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9740 "(content:\"one\"; http_raw_uri; "
9741 "content:\"two\"; fast_pattern:only; http_raw_uri; depth:10; sid:1;)");
9742 if (de_ctx->sig_list != NULL)
9743 goto end;
9744
9745 result = 1;
9746
9747 end:
9748 SigCleanSignatures(de_ctx);
9749 DetectEngineCtxFree(de_ctx);
9750 return result;
9751 }
9752
DetectFastPatternTest355(void)9753 static int DetectFastPatternTest355(void)
9754 {
9755 DetectEngineCtx *de_ctx = NULL;
9756 int result = 0;
9757
9758 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9759 goto end;
9760
9761 de_ctx->flags |= DE_QUIET;
9762 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9763 "(content:\"one\"; http_raw_uri; "
9764 "content:\"two\"; depth:10; fast_pattern:only; http_raw_uri; sid:1;)");
9765 if (de_ctx->sig_list != NULL)
9766 goto end;
9767
9768 result = 1;
9769
9770 end:
9771 SigCleanSignatures(de_ctx);
9772 DetectEngineCtxFree(de_ctx);
9773 return result;
9774 }
9775
DetectFastPatternTest356(void)9776 static int DetectFastPatternTest356(void)
9777 {
9778 DetectEngineCtx *de_ctx = NULL;
9779 int result = 0;
9780
9781 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9782 goto end;
9783
9784 de_ctx->flags |= DE_QUIET;
9785 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9786 "(content:\"one\"; http_raw_uri; "
9787 "content:!\"two\"; fast_pattern:only; http_raw_uri; sid:1;)");
9788 if (de_ctx->sig_list != NULL)
9789 goto end;
9790
9791 result = 1;
9792
9793 end:
9794 SigCleanSignatures(de_ctx);
9795 DetectEngineCtxFree(de_ctx);
9796 return result;
9797 }
9798
DetectFastPatternTest357(void)9799 static int DetectFastPatternTest357(void)
9800 {
9801 DetectEngineCtx *de_ctx = NULL;
9802 int result = 0;
9803
9804 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9805 goto end;
9806
9807 de_ctx->flags |= DE_QUIET;
9808 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9809 "(content: \"one\"; http_raw_uri; "
9810 "content:\"two\"; http_raw_uri; distance:30; "
9811 "content:\"two\"; fast_pattern:only; http_raw_uri; sid:1;)");
9812 if (de_ctx->sig_list == NULL)
9813 goto end;
9814
9815 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->ctx;
9816 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9817 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
9818 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
9819 ud->fp_chop_offset == 0 &&
9820 ud->fp_chop_len == 0) {
9821 result = 1;
9822 } else {
9823 result = 0;
9824 }
9825
9826 end:
9827 SigCleanSignatures(de_ctx);
9828 DetectEngineCtxFree(de_ctx);
9829 return result;
9830 }
9831
DetectFastPatternTest358(void)9832 static int DetectFastPatternTest358(void)
9833 {
9834 DetectEngineCtx *de_ctx = NULL;
9835 int result = 0;
9836
9837 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9838 goto end;
9839
9840 de_ctx->flags |= DE_QUIET;
9841 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9842 "(content:\"one\"; http_raw_uri; "
9843 "content:\"two\"; http_raw_uri; within:30; "
9844 "content:\"two\"; fast_pattern:only; http_raw_uri; sid:1;)");
9845 if (de_ctx->sig_list == NULL)
9846 goto end;
9847 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->ctx;
9848 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9849 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
9850 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
9851 ud->fp_chop_offset == 0 &&
9852 ud->fp_chop_len == 0) {
9853 result = 1;
9854 } else {
9855 result = 0;
9856 }
9857
9858 end:
9859 SigCleanSignatures(de_ctx);
9860 DetectEngineCtxFree(de_ctx);
9861 return result;
9862 }
9863
DetectFastPatternTest359(void)9864 static int DetectFastPatternTest359(void)
9865 {
9866 DetectEngineCtx *de_ctx = NULL;
9867 int result = 0;
9868
9869 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9870 goto end;
9871
9872 de_ctx->flags |= DE_QUIET;
9873 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9874 "(content:\"one\"; http_raw_uri; "
9875 "content:\"two\"; http_raw_uri; offset:30; "
9876 "content:\"two\"; fast_pattern:only; http_raw_uri; sid:1;)");
9877 if (de_ctx->sig_list == NULL)
9878 goto end;
9879 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->ctx;
9880 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9881 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
9882 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
9883 ud->fp_chop_offset == 0 &&
9884 ud->fp_chop_len == 0) {
9885 result = 1;
9886 } else {
9887 result = 0;
9888 }
9889
9890 end:
9891 SigCleanSignatures(de_ctx);
9892 DetectEngineCtxFree(de_ctx);
9893 return result;
9894 }
9895
DetectFastPatternTest360(void)9896 static int DetectFastPatternTest360(void)
9897 {
9898 DetectEngineCtx *de_ctx = NULL;
9899 int result = 0;
9900
9901 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9902 goto end;
9903
9904 de_ctx->flags |= DE_QUIET;
9905 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9906 "(content:\"one\"; http_raw_uri; "
9907 "content:\"two\"; http_raw_uri; depth:30; "
9908 "content:\"two\"; fast_pattern:only; http_raw_uri; sid:1;)");
9909 if (de_ctx->sig_list == NULL)
9910 goto end;
9911 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->ctx;
9912 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9913 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
9914 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
9915 ud->fp_chop_offset == 0 &&
9916 ud->fp_chop_len == 0) {
9917 result = 1;
9918 } else {
9919 result = 0;
9920 }
9921
9922 end:
9923 SigCleanSignatures(de_ctx);
9924 DetectEngineCtxFree(de_ctx);
9925 return result;
9926 }
9927
DetectFastPatternTest361(void)9928 static int DetectFastPatternTest361(void)
9929 {
9930 DetectEngineCtx *de_ctx = NULL;
9931 int result = 0;
9932
9933 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9934 goto end;
9935
9936 de_ctx->flags |= DE_QUIET;
9937 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9938 "(content:!\"one\"; fast_pattern; http_raw_uri; "
9939 "content:\"two\"; http_raw_uri; sid:1;)");
9940 if (de_ctx->sig_list == NULL)
9941 goto end;
9942 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->prev->ctx;
9943 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
9944 ud->flags & DETECT_CONTENT_NEGATED &&
9945 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
9946 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
9947 ud->fp_chop_offset == 0 &&
9948 ud->fp_chop_len == 0) {
9949 result = 1;
9950 } else {
9951 result = 0;
9952 }
9953
9954 end:
9955 SigCleanSignatures(de_ctx);
9956 DetectEngineCtxFree(de_ctx);
9957 return result;
9958 }
9959
DetectFastPatternTest362(void)9960 static int DetectFastPatternTest362(void)
9961 {
9962 DetectEngineCtx *de_ctx = NULL;
9963 int result = 0;
9964
9965 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9966 goto end;
9967
9968 de_ctx->flags |= DE_QUIET;
9969 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9970 "(content:\"two\"; http_raw_uri; "
9971 "content:!\"one\"; fast_pattern; http_raw_uri; distance:20; sid:1;)");
9972 if (de_ctx->sig_list != NULL)
9973 goto end;
9974
9975 result = 1;
9976
9977 end:
9978 SigCleanSignatures(de_ctx);
9979 DetectEngineCtxFree(de_ctx);
9980 return result;
9981 }
9982
DetectFastPatternTest363(void)9983 static int DetectFastPatternTest363(void)
9984 {
9985 DetectEngineCtx *de_ctx = NULL;
9986 int result = 0;
9987
9988 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
9989 goto end;
9990
9991 de_ctx->flags |= DE_QUIET;
9992 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
9993 "(content:\"two\"; http_raw_uri; "
9994 "content:!\"one\"; fast_pattern; http_raw_uri; within:20; sid:1;)");
9995 if (de_ctx->sig_list != NULL)
9996 goto end;
9997
9998 result = 1;
9999
10000 end:
10001 SigCleanSignatures(de_ctx);
10002 DetectEngineCtxFree(de_ctx);
10003 return result;
10004 }
10005
DetectFastPatternTest364(void)10006 static int DetectFastPatternTest364(void)
10007 {
10008 DetectEngineCtx *de_ctx = NULL;
10009 int result = 0;
10010
10011 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10012 goto end;
10013
10014 de_ctx->flags |= DE_QUIET;
10015 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10016 "(content:\"two\"; http_raw_uri; "
10017 "content:!\"one\"; fast_pattern; http_raw_uri; offset:20; sid:1;)");
10018 if (de_ctx->sig_list != NULL)
10019 goto end;
10020
10021 result = 1;
10022
10023 end:
10024 SigCleanSignatures(de_ctx);
10025 DetectEngineCtxFree(de_ctx);
10026 return result;
10027 }
10028
DetectFastPatternTest365(void)10029 static int DetectFastPatternTest365(void)
10030 {
10031 DetectEngineCtx *de_ctx = NULL;
10032 int result = 0;
10033
10034 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10035 goto end;
10036
10037 de_ctx->flags |= DE_QUIET;
10038 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10039 "(content:\"two\"; http_raw_uri; "
10040 "content:!\"one\"; fast_pattern; http_raw_uri; depth:20; sid:1;)");
10041 if (de_ctx->sig_list != NULL)
10042 goto end;
10043
10044 result = 1;
10045
10046 end:
10047 SigCleanSignatures(de_ctx);
10048 DetectEngineCtxFree(de_ctx);
10049 return result;
10050 }
10051
DetectFastPatternTest366(void)10052 static int DetectFastPatternTest366(void)
10053 {
10054 DetectEngineCtx *de_ctx = NULL;
10055 int result = 0;
10056
10057 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10058 goto end;
10059
10060 de_ctx->flags |= DE_QUIET;
10061 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10062 "(content:\"one\"; http_raw_uri; "
10063 "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
10064 "content:\"three\"; http_raw_uri; sid:1;)");
10065 if (de_ctx->sig_list == NULL)
10066 goto end;
10067 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->prev->ctx;
10068 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10069 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
10070 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
10071 ud->fp_chop_offset == 3 &&
10072 ud->fp_chop_len == 4) {
10073 result = 1;
10074 } else {
10075 result = 0;
10076 }
10077
10078 end:
10079 SigCleanSignatures(de_ctx);
10080 DetectEngineCtxFree(de_ctx);
10081 return result;
10082 }
10083
DetectFastPatternTest367(void)10084 static int DetectFastPatternTest367(void)
10085 {
10086 DetectEngineCtx *de_ctx = NULL;
10087 int result = 0;
10088
10089 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10090 goto end;
10091
10092 de_ctx->flags |= DE_QUIET;
10093 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10094 "(content:\"one\"; http_raw_uri; "
10095 "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
10096 "content:\"three\"; http_raw_uri; distance:30; sid:1;)");
10097 if (de_ctx->sig_list == NULL)
10098 goto end;
10099 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->prev->ctx;
10100 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10101 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
10102 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
10103 ud->fp_chop_offset == 3 &&
10104 ud->fp_chop_len == 4) {
10105 result = 1;
10106 } else {
10107 result = 0;
10108 }
10109
10110 end:
10111 SigCleanSignatures(de_ctx);
10112 DetectEngineCtxFree(de_ctx);
10113 return result;
10114 }
10115
DetectFastPatternTest368(void)10116 static int DetectFastPatternTest368(void)
10117 {
10118 DetectEngineCtx *de_ctx = NULL;
10119 int result = 0;
10120
10121 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10122 goto end;
10123
10124 de_ctx->flags |= DE_QUIET;
10125 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10126 "(content:\"one\"; http_raw_uri; "
10127 "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
10128 "content:\"three\"; http_raw_uri; within:30; sid:1;)");
10129 if (de_ctx->sig_list == NULL)
10130 goto end;
10131 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->prev->ctx;
10132 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10133 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
10134 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
10135 ud->fp_chop_offset == 3 &&
10136 ud->fp_chop_len == 4) {
10137 result = 1;
10138 } else {
10139 result = 0;
10140 }
10141
10142 end:
10143 SigCleanSignatures(de_ctx);
10144 DetectEngineCtxFree(de_ctx);
10145 return result;
10146 }
10147
DetectFastPatternTest369(void)10148 static int DetectFastPatternTest369(void)
10149 {
10150 DetectEngineCtx *de_ctx = NULL;
10151 int result = 0;
10152
10153 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10154 goto end;
10155
10156 de_ctx->flags |= DE_QUIET;
10157 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10158 "(content:\"one\"; http_raw_uri; "
10159 "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
10160 "content:\"three\"; http_raw_uri; offset:30; sid:1;)");
10161 if (de_ctx->sig_list == NULL)
10162 goto end;
10163 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->prev->ctx;
10164 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10165 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
10166 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
10167 ud->fp_chop_offset == 3 &&
10168 ud->fp_chop_len == 4) {
10169 result = 1;
10170 } else {
10171 result = 0;
10172 }
10173
10174 end:
10175 SigCleanSignatures(de_ctx);
10176 DetectEngineCtxFree(de_ctx);
10177 return result;
10178 }
10179
DetectFastPatternTest370(void)10180 static int DetectFastPatternTest370(void)
10181 {
10182 DetectEngineCtx *de_ctx = NULL;
10183 int result = 0;
10184
10185 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10186 goto end;
10187
10188 de_ctx->flags |= DE_QUIET;
10189 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10190 "(content:\"one\"; http_raw_uri; "
10191 "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
10192 "content:\"three\"; http_raw_uri; depth:30; sid:1;)");
10193 if (de_ctx->sig_list == NULL)
10194 goto end;
10195 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->prev->ctx;
10196 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10197 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
10198 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
10199 ud->fp_chop_offset == 3 &&
10200 ud->fp_chop_len == 4) {
10201 result = 1;
10202 } else {
10203 result = 0;
10204 }
10205
10206 end:
10207 SigCleanSignatures(de_ctx);
10208 DetectEngineCtxFree(de_ctx);
10209 return result;
10210 }
10211
DetectFastPatternTest371(void)10212 static int DetectFastPatternTest371(void)
10213 {
10214 DetectEngineCtx *de_ctx = NULL;
10215 int result = 0;
10216
10217 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10218 goto end;
10219
10220 de_ctx->flags |= DE_QUIET;
10221 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10222 "(content:\"one\"; http_raw_uri; "
10223 "content:\"two\"; http_raw_uri; distance:10; "
10224 "content:\"oneonethree\"; fast_pattern:3,4; http_raw_uri; sid:1;)");
10225 if (de_ctx->sig_list == NULL)
10226 goto end;
10227 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->ctx;
10228 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10229 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
10230 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
10231 ud->fp_chop_offset == 3 &&
10232 ud->fp_chop_len == 4) {
10233 result = 1;
10234 } else {
10235 result = 0;
10236 }
10237
10238 end:
10239 SigCleanSignatures(de_ctx);
10240 DetectEngineCtxFree(de_ctx);
10241 return result;
10242 }
10243
DetectFastPatternTest372(void)10244 static int DetectFastPatternTest372(void)
10245 {
10246 DetectEngineCtx *de_ctx = NULL;
10247 int result = 0;
10248
10249 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10250 goto end;
10251
10252 de_ctx->flags |= DE_QUIET;
10253 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10254 "(content:\"one\"; http_raw_uri; "
10255 "content:\"two\"; http_raw_uri; within:10; "
10256 "content:\"oneonethree\"; fast_pattern:3,4; http_raw_uri; sid:1;)");
10257 if (de_ctx->sig_list == NULL)
10258 goto end;
10259 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->ctx;
10260 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10261 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
10262 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
10263 ud->fp_chop_offset == 3 &&
10264 ud->fp_chop_len == 4) {
10265 result = 1;
10266 } else {
10267 result = 0;
10268 }
10269
10270 end:
10271 SigCleanSignatures(de_ctx);
10272 DetectEngineCtxFree(de_ctx);
10273 return result;
10274 }
10275
DetectFastPatternTest373(void)10276 static int DetectFastPatternTest373(void)
10277 {
10278 DetectEngineCtx *de_ctx = NULL;
10279 int result = 0;
10280
10281 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10282 goto end;
10283
10284 de_ctx->flags |= DE_QUIET;
10285 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10286 "(content:\"one\"; http_raw_uri; "
10287 "content:\"two\"; http_raw_uri; offset:10; "
10288 "content:\"oneonethree\"; fast_pattern:3,4; http_raw_uri; sid:1;)");
10289 if (de_ctx->sig_list == NULL)
10290 goto end;
10291 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->ctx;
10292 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10293 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
10294 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
10295 ud->fp_chop_offset == 3 &&
10296 ud->fp_chop_len == 4) {
10297 result = 1;
10298 } else {
10299 result = 0;
10300 }
10301
10302 end:
10303 SigCleanSignatures(de_ctx);
10304 DetectEngineCtxFree(de_ctx);
10305 return result;
10306 }
10307
DetectFastPatternTest374(void)10308 static int DetectFastPatternTest374(void)
10309 {
10310 DetectEngineCtx *de_ctx = NULL;
10311 int result = 0;
10312
10313 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10314 goto end;
10315
10316 de_ctx->flags |= DE_QUIET;
10317 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10318 "(content:\"one\"; http_raw_uri; "
10319 "content:\"two\"; http_raw_uri; depth:10; "
10320 "content:\"oneonethree\"; fast_pattern:3,4; http_raw_uri; sid:1;)");
10321 if (de_ctx->sig_list == NULL)
10322 goto end;
10323 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->ctx;
10324 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10325 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
10326 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
10327 ud->fp_chop_offset == 3 &&
10328 ud->fp_chop_len == 4) {
10329 result = 1;
10330 } else {
10331 result = 0;
10332 }
10333
10334
10335 result = 1;
10336
10337 end:
10338 SigCleanSignatures(de_ctx);
10339 DetectEngineCtxFree(de_ctx);
10340 return result;
10341 }
10342
DetectFastPatternTest375(void)10343 static int DetectFastPatternTest375(void)
10344 {
10345 DetectEngineCtx *de_ctx = NULL;
10346 int result = 0;
10347
10348 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10349 goto end;
10350
10351 de_ctx->flags |= DE_QUIET;
10352 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10353 "(content:\"one\"; http_raw_uri; "
10354 "content:\"two\"; fast_pattern:65977,4; http_raw_uri; "
10355 "content:\"three\"; http_raw_uri; distance:10; sid:1;)");
10356 if (de_ctx->sig_list != NULL)
10357 goto end;
10358
10359 result = 1;
10360
10361 end:
10362 SigCleanSignatures(de_ctx);
10363 DetectEngineCtxFree(de_ctx);
10364 return result;
10365 }
10366
DetectFastPatternTest376(void)10367 static int DetectFastPatternTest376(void)
10368 {
10369 DetectEngineCtx *de_ctx = NULL;
10370 int result = 0;
10371
10372 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10373 goto end;
10374
10375 de_ctx->flags |= DE_QUIET;
10376 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10377 "(content:\"one\"; http_raw_uri; "
10378 "content:\"oneonetwo\"; fast_pattern:3,65977; http_raw_uri; "
10379 "content:\"three\"; distance:10; http_raw_uri; sid:1;)");
10380 if (de_ctx->sig_list != NULL)
10381 goto end;
10382
10383 result = 1;
10384
10385 end:
10386 SigCleanSignatures(de_ctx);
10387 DetectEngineCtxFree(de_ctx);
10388 return result;
10389 }
10390
DetectFastPatternTest377(void)10391 static int DetectFastPatternTest377(void)
10392 {
10393 DetectEngineCtx *de_ctx = NULL;
10394 int result = 0;
10395
10396 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10397 goto end;
10398
10399 de_ctx->flags |= DE_QUIET;
10400 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10401 "(content:\"one\"; http_raw_uri; "
10402 "content:\"two\"; fast_pattern:65534,4; http_raw_uri; "
10403 "content:\"three\"; http_raw_uri; distance:10; sid:1;)");
10404 if (de_ctx->sig_list != NULL)
10405 goto end;
10406
10407 result = 1;
10408
10409 end:
10410 SigCleanSignatures(de_ctx);
10411 DetectEngineCtxFree(de_ctx);
10412 return result;
10413 }
10414
DetectFastPatternTest378(void)10415 static int DetectFastPatternTest378(void)
10416 {
10417 DetectEngineCtx *de_ctx = NULL;
10418 int result = 0;
10419
10420 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10421 goto end;
10422
10423 de_ctx->flags |= DE_QUIET;
10424 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10425 "(content:\"one\"; http_raw_uri; "
10426 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
10427 "content:\"three\"; http_raw_uri; sid:1;)");
10428 if (de_ctx->sig_list == NULL)
10429 goto end;
10430 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->prev->ctx;
10431 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10432 ud->flags & DETECT_CONTENT_NEGATED &&
10433 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
10434 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
10435 ud->fp_chop_offset == 3 &&
10436 ud->fp_chop_len == 4) {
10437 result = 1;
10438 } else {
10439 result = 0;
10440 }
10441
10442 end:
10443 SigCleanSignatures(de_ctx);
10444 DetectEngineCtxFree(de_ctx);
10445 return result;
10446 }
10447
DetectFastPatternTest379(void)10448 static int DetectFastPatternTest379(void)
10449 {
10450 DetectEngineCtx *de_ctx = NULL;
10451 int result = 0;
10452
10453 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10454 goto end;
10455
10456 de_ctx->flags |= DE_QUIET;
10457 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10458 "(content:\"one\"; http_raw_uri; "
10459 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; distance:10; "
10460 "content:\"three\"; http_raw_uri; sid:1;)");
10461 if (de_ctx->sig_list != NULL)
10462 goto end;
10463
10464 result = 1;
10465
10466 end:
10467 SigCleanSignatures(de_ctx);
10468 DetectEngineCtxFree(de_ctx);
10469 return result;
10470 }
10471
DetectFastPatternTest380(void)10472 static int DetectFastPatternTest380(void)
10473 {
10474 DetectEngineCtx *de_ctx = NULL;
10475 int result = 0;
10476
10477 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10478 goto end;
10479
10480 de_ctx->flags |= DE_QUIET;
10481 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10482 "(content:\"one\"; http_raw_uri; "
10483 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; within:10; "
10484 "content:\"three\"; http_raw_uri; sid:1;)");
10485 if (de_ctx->sig_list != NULL)
10486 goto end;
10487
10488 result = 1;
10489
10490 end:
10491 SigCleanSignatures(de_ctx);
10492 DetectEngineCtxFree(de_ctx);
10493 return result;
10494 }
10495
DetectFastPatternTest381(void)10496 static int DetectFastPatternTest381(void)
10497 {
10498 DetectEngineCtx *de_ctx = NULL;
10499 int result = 0;
10500
10501 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10502 goto end;
10503
10504 de_ctx->flags |= DE_QUIET;
10505 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10506 "(content:\"one\"; http_raw_uri; "
10507 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; offset:10; "
10508 "content:\"three\"; http_raw_uri; sid:1;)");
10509 if (de_ctx->sig_list != NULL)
10510 goto end;
10511
10512 result = 1;
10513
10514 end:
10515 SigCleanSignatures(de_ctx);
10516 DetectEngineCtxFree(de_ctx);
10517 return result;
10518 }
10519
DetectFastPatternTest382(void)10520 static int DetectFastPatternTest382(void)
10521 {
10522 DetectEngineCtx *de_ctx = NULL;
10523 int result = 0;
10524
10525 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10526 goto end;
10527
10528 de_ctx->flags |= DE_QUIET;
10529 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10530 "(content:\"one\"; http_raw_uri; "
10531 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; depth:10; "
10532 "content:\"three\"; http_raw_uri; sid:1;)");
10533 if (de_ctx->sig_list != NULL)
10534 goto end;
10535
10536 result = 1;
10537
10538 end:
10539 SigCleanSignatures(de_ctx);
10540 DetectEngineCtxFree(de_ctx);
10541 return result;
10542 }
10543
DetectFastPatternTest383(void)10544 static int DetectFastPatternTest383(void)
10545 {
10546 DetectEngineCtx *de_ctx = NULL;
10547 int result = 0;
10548
10549 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10550 goto end;
10551
10552 de_ctx->flags |= DE_QUIET;
10553 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10554 "(content:\"one\"; http_raw_uri; "
10555 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
10556 "content:\"three\"; http_raw_uri; sid:1;)");
10557 if (de_ctx->sig_list == NULL)
10558 goto end;
10559 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_uri_buffer_id]->prev->ctx;
10560 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10561 ud->flags & DETECT_CONTENT_NEGATED &&
10562 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
10563 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
10564 ud->fp_chop_offset == 3 &&
10565 ud->fp_chop_len == 4) {
10566 result = 1;
10567 } else {
10568 result = 0;
10569 }
10570
10571 end:
10572 SigCleanSignatures(de_ctx);
10573 DetectEngineCtxFree(de_ctx);
10574 return result;
10575 }
10576
10577
10578 /* http_raw_uri fast_pattern tests ^ */
10579 /* http_stat_msg fast_pattern tests v */
10580
10581
DetectFastPatternTest384(void)10582 static int DetectFastPatternTest384(void)
10583 {
10584 DetectEngineCtx *de_ctx = NULL;
10585 int result = 0;
10586
10587 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10588 goto end;
10589
10590 de_ctx->flags |= DE_QUIET;
10591 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10592 "(content:\"one\"; http_stat_msg; "
10593 "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
10594 "content:\"three\"; http_stat_msg; sid:1;)");
10595 if (de_ctx->sig_list == NULL)
10596 goto end;
10597 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->prev->ctx;
10598 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10599 ud->flags & DETECT_CONTENT_NEGATED &&
10600 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
10601 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
10602 ud->fp_chop_offset == 3 &&
10603 ud->fp_chop_len == 4) {
10604 result = 1;
10605 } else {
10606 result = 0;
10607 }
10608
10609 end:
10610 SigCleanSignatures(de_ctx);
10611 DetectEngineCtxFree(de_ctx);
10612 return result;
10613 }
10614
10615 /**
10616 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
10617 */
DetectFastPatternTest385(void)10618 static int DetectFastPatternTest385(void)
10619 {
10620 SigMatch *sm = NULL;
10621 DetectEngineCtx *de_ctx = NULL;
10622 int result = 0;
10623
10624 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10625 goto end;
10626
10627 de_ctx->flags |= DE_QUIET;
10628 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10629 "(content:\"one\"; fast_pattern:only; http_stat_msg; "
10630 "msg:\"Testing fast_pattern\"; sid:1;)");
10631 if (de_ctx->sig_list == NULL)
10632 goto end;
10633
10634 result = 0;
10635 sm = de_ctx->sig_list->sm_lists[g_http_stat_msg_buffer_id];
10636 if (sm != NULL) {
10637 if ( ((DetectContentData *)sm->ctx)->flags &
10638 DETECT_CONTENT_FAST_PATTERN) {
10639 result = 1;
10640 } else {
10641 result = 0;
10642 }
10643 }
10644
10645
10646 end:
10647 SigCleanSignatures(de_ctx);
10648 DetectEngineCtxFree(de_ctx);
10649 return result;
10650 }
10651
10652 /**
10653 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
10654 */
DetectFastPatternTest386(void)10655 static int DetectFastPatternTest386(void)
10656 {
10657 SigMatch *sm = NULL;
10658 DetectEngineCtx *de_ctx = NULL;
10659 int result = 0;
10660
10661 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10662 goto end;
10663
10664 de_ctx->flags |= DE_QUIET;
10665 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10666 "(content:\"oneoneone\"; fast_pattern:3,4; http_stat_msg; "
10667 "msg:\"Testing fast_pattern\"; sid:1;)");
10668 if (de_ctx->sig_list == NULL)
10669 goto end;
10670
10671 result = 0;
10672 sm = de_ctx->sig_list->sm_lists[g_http_stat_msg_buffer_id];
10673 if (sm != NULL) {
10674 if ( ((DetectContentData *)sm->ctx)->flags &
10675 DETECT_CONTENT_FAST_PATTERN) {
10676 result = 1;
10677 } else {
10678 result = 0;
10679 }
10680 }
10681
10682 end:
10683 SigCleanSignatures(de_ctx);
10684 DetectEngineCtxFree(de_ctx);
10685 return result;
10686 }
10687
DetectFastPatternTest387(void)10688 static int DetectFastPatternTest387(void)
10689 {
10690 SigMatch *sm = NULL;
10691 DetectEngineCtx *de_ctx = NULL;
10692 int result = 0;
10693
10694 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10695 goto end;
10696
10697 de_ctx->flags |= DE_QUIET;
10698 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10699 "(content:\"one\"; fast_pattern:only; http_stat_msg; sid:1;)");
10700 if (de_ctx->sig_list == NULL)
10701 goto end;
10702
10703 sm = de_ctx->sig_list->sm_lists[g_http_stat_msg_buffer_id];
10704 if (sm == NULL) {
10705 goto end;
10706 }
10707 DetectContentData *ud = (DetectContentData *)sm->ctx;
10708 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10709 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
10710 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
10711 ud->fp_chop_offset == 0 &&
10712 ud->fp_chop_len == 0) {
10713 result = 1;
10714 } else {
10715 result = 0;
10716 }
10717
10718 end:
10719 SigCleanSignatures(de_ctx);
10720 DetectEngineCtxFree(de_ctx);
10721 return result;
10722 }
10723
DetectFastPatternTest388(void)10724 static int DetectFastPatternTest388(void)
10725 {
10726 SigMatch *sm = NULL;
10727 DetectEngineCtx *de_ctx = NULL;
10728 int result = 0;
10729
10730 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10731 goto end;
10732
10733 de_ctx->flags |= DE_QUIET;
10734 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10735 "(content:\"oneoneone\"; fast_pattern:3,4; http_stat_msg; sid:1;)");
10736 if (de_ctx->sig_list == NULL)
10737 goto end;
10738
10739 sm = de_ctx->sig_list->sm_lists[g_http_stat_msg_buffer_id];
10740 if (sm == NULL) {
10741 goto end;
10742 }
10743
10744 DetectContentData *ud = (DetectContentData *)sm->ctx;
10745 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10746 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
10747 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
10748 ud->fp_chop_offset == 3 &&
10749 ud->fp_chop_len == 4) {
10750 result = 1;
10751 } else {
10752 result = 0;
10753 }
10754
10755 end:
10756 SigCleanSignatures(de_ctx);
10757 DetectEngineCtxFree(de_ctx);
10758 return result;
10759 }
10760
DetectFastPatternTest389(void)10761 static int DetectFastPatternTest389(void)
10762 {
10763 DetectEngineCtx *de_ctx = NULL;
10764 int result = 0;
10765
10766 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10767 goto end;
10768
10769 de_ctx->flags |= DE_QUIET;
10770 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10771 "(content:\"one\"; http_stat_msg; "
10772 "content:\"two\"; fast_pattern:only; http_stat_msg; distance:10; sid:1;)");
10773 if (de_ctx->sig_list != NULL)
10774 goto end;
10775
10776 result = 1;
10777
10778 end:
10779 SigCleanSignatures(de_ctx);
10780 DetectEngineCtxFree(de_ctx);
10781 return result;
10782 }
10783
DetectFastPatternTest390(void)10784 static int DetectFastPatternTest390(void)
10785 {
10786 DetectEngineCtx *de_ctx = NULL;
10787 int result = 0;
10788
10789 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10790 goto end;
10791
10792 de_ctx->flags |= DE_QUIET;
10793 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10794 "(content:\"one\"; http_stat_msg; "
10795 "content:\"two\"; distance:10; fast_pattern:only; http_stat_msg; sid:1;)");
10796 if (de_ctx->sig_list != NULL)
10797 goto end;
10798
10799 result = 1;
10800
10801 end:
10802 SigCleanSignatures(de_ctx);
10803 DetectEngineCtxFree(de_ctx);
10804 return result;
10805 }
10806
DetectFastPatternTest391(void)10807 static int DetectFastPatternTest391(void)
10808 {
10809 DetectEngineCtx *de_ctx = NULL;
10810 int result = 0;
10811
10812 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10813 goto end;
10814
10815 de_ctx->flags |= DE_QUIET;
10816 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10817 "(content:\"one\"; http_stat_msg; "
10818 "content:\"two\"; fast_pattern:only; http_stat_msg; within:10; sid:1;)");
10819 if (de_ctx->sig_list != NULL)
10820 goto end;
10821
10822 result = 1;
10823
10824 end:
10825 SigCleanSignatures(de_ctx);
10826 DetectEngineCtxFree(de_ctx);
10827 return result;
10828 }
10829
DetectFastPatternTest392(void)10830 static int DetectFastPatternTest392(void)
10831 {
10832 DetectEngineCtx *de_ctx = NULL;
10833 int result = 0;
10834
10835 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10836 goto end;
10837
10838 de_ctx->flags |= DE_QUIET;
10839 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10840 "(content:\"one\"; http_stat_msg; "
10841 "content:\"two\"; within:10; fast_pattern:only; http_stat_msg; sid:1;)");
10842 if (de_ctx->sig_list != NULL)
10843 goto end;
10844
10845 result = 1;
10846
10847 end:
10848 SigCleanSignatures(de_ctx);
10849 DetectEngineCtxFree(de_ctx);
10850 return result;
10851 }
10852
DetectFastPatternTest393(void)10853 static int DetectFastPatternTest393(void)
10854 {
10855 DetectEngineCtx *de_ctx = NULL;
10856 int result = 0;
10857
10858 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10859 goto end;
10860
10861 de_ctx->flags |= DE_QUIET;
10862 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10863 "(content:\"one\"; http_stat_msg; "
10864 "content:\"two\"; fast_pattern:only; http_stat_msg; offset:10; sid:1;)");
10865 if (de_ctx->sig_list != NULL)
10866 goto end;
10867
10868 result = 1;
10869
10870 end:
10871 SigCleanSignatures(de_ctx);
10872 DetectEngineCtxFree(de_ctx);
10873 return result;
10874 }
10875
DetectFastPatternTest394(void)10876 static int DetectFastPatternTest394(void)
10877 {
10878 DetectEngineCtx *de_ctx = NULL;
10879 int result = 0;
10880
10881 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10882 goto end;
10883
10884 de_ctx->flags |= DE_QUIET;
10885 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10886 "(content:\"one\"; http_stat_msg; "
10887 "content:\"two\"; offset:10; fast_pattern:only; http_stat_msg; sid:1;)");
10888 if (de_ctx->sig_list != NULL)
10889 goto end;
10890
10891 result = 1;
10892
10893 end:
10894 SigCleanSignatures(de_ctx);
10895 DetectEngineCtxFree(de_ctx);
10896 return result;
10897 }
10898
DetectFastPatternTest395(void)10899 static int DetectFastPatternTest395(void)
10900 {
10901 DetectEngineCtx *de_ctx = NULL;
10902 int result = 0;
10903
10904 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10905 goto end;
10906
10907 de_ctx->flags |= DE_QUIET;
10908 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10909 "(content:\"one\"; http_stat_msg; "
10910 "content:\"two\"; fast_pattern:only; http_stat_msg; depth:10; sid:1;)");
10911 if (de_ctx->sig_list != NULL)
10912 goto end;
10913
10914 result = 1;
10915
10916 end:
10917 SigCleanSignatures(de_ctx);
10918 DetectEngineCtxFree(de_ctx);
10919 return result;
10920 }
10921
DetectFastPatternTest396(void)10922 static int DetectFastPatternTest396(void)
10923 {
10924 DetectEngineCtx *de_ctx = NULL;
10925 int result = 0;
10926
10927 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10928 goto end;
10929
10930 de_ctx->flags |= DE_QUIET;
10931 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10932 "(content:\"one\"; http_stat_msg; "
10933 "content:\"two\"; depth:10; fast_pattern:only; http_stat_msg; sid:1;)");
10934 if (de_ctx->sig_list != NULL)
10935 goto end;
10936
10937 result = 1;
10938
10939 end:
10940 SigCleanSignatures(de_ctx);
10941 DetectEngineCtxFree(de_ctx);
10942 return result;
10943 }
10944
DetectFastPatternTest397(void)10945 static int DetectFastPatternTest397(void)
10946 {
10947 DetectEngineCtx *de_ctx = NULL;
10948 int result = 0;
10949
10950 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10951 goto end;
10952
10953 de_ctx->flags |= DE_QUIET;
10954 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10955 "(content:\"one\"; http_stat_msg; "
10956 "content:!\"two\"; fast_pattern:only; http_stat_msg; sid:1;)");
10957 if (de_ctx->sig_list != NULL)
10958 goto end;
10959
10960 result = 1;
10961
10962 end:
10963 SigCleanSignatures(de_ctx);
10964 DetectEngineCtxFree(de_ctx);
10965 return result;
10966 }
10967
DetectFastPatternTest398(void)10968 static int DetectFastPatternTest398(void)
10969 {
10970 DetectEngineCtx *de_ctx = NULL;
10971 int result = 0;
10972
10973 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
10974 goto end;
10975
10976 de_ctx->flags |= DE_QUIET;
10977 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
10978 "(content:\" one\"; http_stat_msg; "
10979 "content:\"two\"; http_stat_msg; distance:30; "
10980 "content:\"two\"; fast_pattern:only; http_stat_msg; sid:1;)");
10981 if (de_ctx->sig_list == NULL)
10982 goto end;
10983
10984 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->ctx;
10985 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
10986 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
10987 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
10988 ud->fp_chop_offset == 0 &&
10989 ud->fp_chop_len == 0) {
10990 result = 1;
10991 } else {
10992 result = 0;
10993 }
10994
10995 end:
10996 SigCleanSignatures(de_ctx);
10997 DetectEngineCtxFree(de_ctx);
10998 return result;
10999 }
11000
DetectFastPatternTest399(void)11001 static int DetectFastPatternTest399(void)
11002 {
11003 DetectEngineCtx *de_ctx = NULL;
11004 int result = 0;
11005
11006 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11007 goto end;
11008
11009 de_ctx->flags |= DE_QUIET;
11010 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11011 "(content:\"one\"; http_stat_msg; "
11012 "content:\"two\"; http_stat_msg; within:30; "
11013 "content:\"two\"; fast_pattern:only; http_stat_msg; sid:1;)");
11014 if (de_ctx->sig_list == NULL)
11015 goto end;
11016 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->ctx;
11017 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11018 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
11019 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
11020 ud->fp_chop_offset == 0 &&
11021 ud->fp_chop_len == 0) {
11022 result = 1;
11023 } else {
11024 result = 0;
11025 }
11026
11027 end:
11028 SigCleanSignatures(de_ctx);
11029 DetectEngineCtxFree(de_ctx);
11030 return result;
11031 }
11032
DetectFastPatternTest400(void)11033 static int DetectFastPatternTest400(void)
11034 {
11035 DetectEngineCtx *de_ctx = NULL;
11036 int result = 0;
11037
11038 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11039 goto end;
11040
11041 de_ctx->flags |= DE_QUIET;
11042 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11043 "(content:\"one\"; http_stat_msg; "
11044 "content:\"two\"; http_stat_msg; offset:30; "
11045 "content:\"two\"; fast_pattern:only; http_stat_msg; sid:1;)");
11046 if (de_ctx->sig_list == NULL)
11047 goto end;
11048 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->ctx;
11049 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11050 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
11051 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
11052 ud->fp_chop_offset == 0 &&
11053 ud->fp_chop_len == 0) {
11054 result = 1;
11055 } else {
11056 result = 0;
11057 }
11058
11059 end:
11060 SigCleanSignatures(de_ctx);
11061 DetectEngineCtxFree(de_ctx);
11062 return result;
11063 }
11064
DetectFastPatternTest401(void)11065 static int DetectFastPatternTest401(void)
11066 {
11067 DetectEngineCtx *de_ctx = NULL;
11068 int result = 0;
11069
11070 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11071 goto end;
11072
11073 de_ctx->flags |= DE_QUIET;
11074 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11075 "(content:\"one\"; http_stat_msg; "
11076 "content:\"two\"; http_stat_msg; depth:30; "
11077 "content:\"two\"; fast_pattern:only; http_stat_msg; sid:1;)");
11078 if (de_ctx->sig_list == NULL)
11079 goto end;
11080 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->ctx;
11081 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11082 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
11083 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
11084 ud->fp_chop_offset == 0 &&
11085 ud->fp_chop_len == 0) {
11086 result = 1;
11087 } else {
11088 result = 0;
11089 }
11090
11091 end:
11092 SigCleanSignatures(de_ctx);
11093 DetectEngineCtxFree(de_ctx);
11094 return result;
11095 }
11096
DetectFastPatternTest402(void)11097 static int DetectFastPatternTest402(void)
11098 {
11099 DetectEngineCtx *de_ctx = NULL;
11100 int result = 0;
11101
11102 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11103 goto end;
11104
11105 de_ctx->flags |= DE_QUIET;
11106 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11107 "(content:!\"one\"; fast_pattern; http_stat_msg; "
11108 "content:\"two\"; http_stat_msg; sid:1;)");
11109 if (de_ctx->sig_list == NULL)
11110 goto end;
11111 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->prev->ctx;
11112 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11113 ud->flags & DETECT_CONTENT_NEGATED &&
11114 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
11115 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
11116 ud->fp_chop_offset == 0 &&
11117 ud->fp_chop_len == 0) {
11118 result = 1;
11119 } else {
11120 result = 0;
11121 }
11122
11123 end:
11124 SigCleanSignatures(de_ctx);
11125 DetectEngineCtxFree(de_ctx);
11126 return result;
11127 }
11128
DetectFastPatternTest403(void)11129 static int DetectFastPatternTest403(void)
11130 {
11131 DetectEngineCtx *de_ctx = NULL;
11132 int result = 0;
11133
11134 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11135 goto end;
11136
11137 de_ctx->flags |= DE_QUIET;
11138 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11139 "(content:\"two\"; http_stat_msg; "
11140 "content:!\"one\"; fast_pattern; http_stat_msg; distance:20; sid:1;)");
11141 if (de_ctx->sig_list != NULL)
11142 goto end;
11143
11144 result = 1;
11145
11146 end:
11147 SigCleanSignatures(de_ctx);
11148 DetectEngineCtxFree(de_ctx);
11149 return result;
11150 }
11151
DetectFastPatternTest404(void)11152 static int DetectFastPatternTest404(void)
11153 {
11154 DetectEngineCtx *de_ctx = NULL;
11155 int result = 0;
11156
11157 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11158 goto end;
11159
11160 de_ctx->flags |= DE_QUIET;
11161 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11162 "(content:\"two\"; http_stat_msg; "
11163 "content:!\"one\"; fast_pattern; http_stat_msg; within:20; sid:1;)");
11164 if (de_ctx->sig_list != NULL)
11165 goto end;
11166
11167 result = 1;
11168
11169 end:
11170 SigCleanSignatures(de_ctx);
11171 DetectEngineCtxFree(de_ctx);
11172 return result;
11173 }
11174
DetectFastPatternTest405(void)11175 static int DetectFastPatternTest405(void)
11176 {
11177 DetectEngineCtx *de_ctx = NULL;
11178 int result = 0;
11179
11180 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11181 goto end;
11182
11183 de_ctx->flags |= DE_QUIET;
11184 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11185 "(content:\"two\"; http_stat_msg; "
11186 "content:!\"one\"; fast_pattern; http_stat_msg; offset:20; sid:1;)");
11187 if (de_ctx->sig_list != NULL)
11188 goto end;
11189
11190 result = 1;
11191
11192 end:
11193 SigCleanSignatures(de_ctx);
11194 DetectEngineCtxFree(de_ctx);
11195 return result;
11196 }
11197
DetectFastPatternTest406(void)11198 static int DetectFastPatternTest406(void)
11199 {
11200 DetectEngineCtx *de_ctx = NULL;
11201 int result = 0;
11202
11203 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11204 goto end;
11205
11206 de_ctx->flags |= DE_QUIET;
11207 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11208 "(content:\"two\"; http_stat_msg; "
11209 "content:!\"one\"; fast_pattern; http_stat_msg; depth:20; sid:1;)");
11210 if (de_ctx->sig_list != NULL)
11211 goto end;
11212
11213 result = 1;
11214
11215 end:
11216 SigCleanSignatures(de_ctx);
11217 DetectEngineCtxFree(de_ctx);
11218 return result;
11219 }
11220
DetectFastPatternTest407(void)11221 static int DetectFastPatternTest407(void)
11222 {
11223 DetectEngineCtx *de_ctx = NULL;
11224 int result = 0;
11225
11226 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11227 goto end;
11228
11229 de_ctx->flags |= DE_QUIET;
11230 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11231 "(content:\"one\"; http_stat_msg; "
11232 "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
11233 "content:\"three\"; http_stat_msg; sid:1;)");
11234 if (de_ctx->sig_list == NULL)
11235 goto end;
11236 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->prev->ctx;
11237 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11238 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
11239 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
11240 ud->fp_chop_offset == 3 &&
11241 ud->fp_chop_len == 4) {
11242 result = 1;
11243 } else {
11244 result = 0;
11245 }
11246
11247 end:
11248 SigCleanSignatures(de_ctx);
11249 DetectEngineCtxFree(de_ctx);
11250 return result;
11251 }
11252
DetectFastPatternTest408(void)11253 static int DetectFastPatternTest408(void)
11254 {
11255 DetectEngineCtx *de_ctx = NULL;
11256 int result = 0;
11257
11258 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11259 goto end;
11260
11261 de_ctx->flags |= DE_QUIET;
11262 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11263 "(content:\"one\"; http_stat_msg; "
11264 "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
11265 "content:\"three\"; http_stat_msg; distance:30; sid:1;)");
11266 if (de_ctx->sig_list == NULL)
11267 goto end;
11268 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->prev->ctx;
11269 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11270 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
11271 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
11272 ud->fp_chop_offset == 3 &&
11273 ud->fp_chop_len == 4) {
11274 result = 1;
11275 } else {
11276 result = 0;
11277 }
11278
11279 end:
11280 SigCleanSignatures(de_ctx);
11281 DetectEngineCtxFree(de_ctx);
11282 return result;
11283 }
11284
DetectFastPatternTest409(void)11285 static int DetectFastPatternTest409(void)
11286 {
11287 DetectEngineCtx *de_ctx = NULL;
11288 int result = 0;
11289
11290 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11291 goto end;
11292
11293 de_ctx->flags |= DE_QUIET;
11294 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11295 "(content:\"one\"; http_stat_msg; "
11296 "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
11297 "content:\"three\"; http_stat_msg; within:30; sid:1;)");
11298 if (de_ctx->sig_list == NULL)
11299 goto end;
11300 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->prev->ctx;
11301 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11302 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
11303 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
11304 ud->fp_chop_offset == 3 &&
11305 ud->fp_chop_len == 4) {
11306 result = 1;
11307 } else {
11308 result = 0;
11309 }
11310
11311 end:
11312 SigCleanSignatures(de_ctx);
11313 DetectEngineCtxFree(de_ctx);
11314 return result;
11315 }
11316
DetectFastPatternTest410(void)11317 static int DetectFastPatternTest410(void)
11318 {
11319 DetectEngineCtx *de_ctx = NULL;
11320 int result = 0;
11321
11322 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11323 goto end;
11324
11325 de_ctx->flags |= DE_QUIET;
11326 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11327 "(content:\"one\"; http_stat_msg; "
11328 "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
11329 "content:\"three\"; http_stat_msg; offset:30; sid:1;)");
11330 if (de_ctx->sig_list == NULL)
11331 goto end;
11332 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->prev->ctx;
11333 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11334 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
11335 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
11336 ud->fp_chop_offset == 3 &&
11337 ud->fp_chop_len == 4) {
11338 result = 1;
11339 } else {
11340 result = 0;
11341 }
11342
11343 end:
11344 SigCleanSignatures(de_ctx);
11345 DetectEngineCtxFree(de_ctx);
11346 return result;
11347 }
11348
DetectFastPatternTest411(void)11349 static int DetectFastPatternTest411(void)
11350 {
11351 DetectEngineCtx *de_ctx = NULL;
11352 int result = 0;
11353
11354 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11355 goto end;
11356
11357 de_ctx->flags |= DE_QUIET;
11358 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11359 "(content:\"one\"; http_stat_msg; "
11360 "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
11361 "content:\"three\"; http_stat_msg; depth:30; sid:1;)");
11362 if (de_ctx->sig_list == NULL)
11363 goto end;
11364 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->prev->ctx;
11365 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11366 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
11367 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
11368 ud->fp_chop_offset == 3 &&
11369 ud->fp_chop_len == 4) {
11370 result = 1;
11371 } else {
11372 result = 0;
11373 }
11374
11375 end:
11376 SigCleanSignatures(de_ctx);
11377 DetectEngineCtxFree(de_ctx);
11378 return result;
11379 }
11380
DetectFastPatternTest412(void)11381 static int DetectFastPatternTest412(void)
11382 {
11383 DetectEngineCtx *de_ctx = NULL;
11384 int result = 0;
11385
11386 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11387 goto end;
11388
11389 de_ctx->flags |= DE_QUIET;
11390 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11391 "(content:\"one\"; http_stat_msg; "
11392 "content:\"two\"; http_stat_msg; distance:10; "
11393 "content:\"oneonethree\"; fast_pattern:3,4; http_stat_msg; sid:1;)");
11394 if (de_ctx->sig_list == NULL)
11395 goto end;
11396 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->ctx;
11397 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11398 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
11399 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
11400 ud->fp_chop_offset == 3 &&
11401 ud->fp_chop_len == 4) {
11402 result = 1;
11403 } else {
11404 result = 0;
11405 }
11406
11407 end:
11408 SigCleanSignatures(de_ctx);
11409 DetectEngineCtxFree(de_ctx);
11410 return result;
11411 }
11412
DetectFastPatternTest413(void)11413 static int DetectFastPatternTest413(void)
11414 {
11415 DetectEngineCtx *de_ctx = NULL;
11416 int result = 0;
11417
11418 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11419 goto end;
11420
11421 de_ctx->flags |= DE_QUIET;
11422 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11423 "(content:\"one\"; http_stat_msg; "
11424 "content:\"two\"; http_stat_msg; within:10; "
11425 "content:\"oneonethree\"; fast_pattern:3,4; http_stat_msg; sid:1;)");
11426 if (de_ctx->sig_list == NULL)
11427 goto end;
11428 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->ctx;
11429 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11430 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
11431 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
11432 ud->fp_chop_offset == 3 &&
11433 ud->fp_chop_len == 4) {
11434 result = 1;
11435 } else {
11436 result = 0;
11437 }
11438
11439 end:
11440 SigCleanSignatures(de_ctx);
11441 DetectEngineCtxFree(de_ctx);
11442 return result;
11443 }
11444
DetectFastPatternTest414(void)11445 static int DetectFastPatternTest414(void)
11446 {
11447 DetectEngineCtx *de_ctx = NULL;
11448 int result = 0;
11449
11450 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11451 goto end;
11452
11453 de_ctx->flags |= DE_QUIET;
11454 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11455 "(content:\"one\"; http_stat_msg; "
11456 "content:\"two\"; http_stat_msg; offset:10; "
11457 "content:\"oneonethree\"; fast_pattern:3,4; http_stat_msg; sid:1;)");
11458 if (de_ctx->sig_list == NULL)
11459 goto end;
11460 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->ctx;
11461 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11462 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
11463 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
11464 ud->fp_chop_offset == 3 &&
11465 ud->fp_chop_len == 4) {
11466 result = 1;
11467 } else {
11468 result = 0;
11469 }
11470
11471 end:
11472 SigCleanSignatures(de_ctx);
11473 DetectEngineCtxFree(de_ctx);
11474 return result;
11475 }
11476
DetectFastPatternTest415(void)11477 static int DetectFastPatternTest415(void)
11478 {
11479 DetectEngineCtx *de_ctx = NULL;
11480 int result = 0;
11481
11482 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11483 goto end;
11484
11485 de_ctx->flags |= DE_QUIET;
11486 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11487 "(content:\"one\"; http_stat_msg; "
11488 "content:\"two\"; http_stat_msg; depth:10; "
11489 "content:\"oneonethree\"; fast_pattern:3,4; http_stat_msg; sid:1;)");
11490 if (de_ctx->sig_list == NULL)
11491 goto end;
11492 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->ctx;
11493 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11494 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
11495 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
11496 ud->fp_chop_offset == 3 &&
11497 ud->fp_chop_len == 4) {
11498 result = 1;
11499 } else {
11500 result = 0;
11501 }
11502
11503
11504 result = 1;
11505
11506 end:
11507 SigCleanSignatures(de_ctx);
11508 DetectEngineCtxFree(de_ctx);
11509 return result;
11510 }
11511
DetectFastPatternTest416(void)11512 static int DetectFastPatternTest416(void)
11513 {
11514 DetectEngineCtx *de_ctx = NULL;
11515 int result = 0;
11516
11517 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11518 goto end;
11519
11520 de_ctx->flags |= DE_QUIET;
11521 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11522 "(content:\"one\"; http_stat_msg; "
11523 "content:\"two\"; fast_pattern:65977,4; http_stat_msg; "
11524 "content:\"three\"; http_stat_msg; distance:10; sid:1;)");
11525 if (de_ctx->sig_list != NULL)
11526 goto end;
11527
11528 result = 1;
11529
11530 end:
11531 SigCleanSignatures(de_ctx);
11532 DetectEngineCtxFree(de_ctx);
11533 return result;
11534 }
11535
DetectFastPatternTest417(void)11536 static int DetectFastPatternTest417(void)
11537 {
11538 DetectEngineCtx *de_ctx = NULL;
11539 int result = 0;
11540
11541 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11542 goto end;
11543
11544 de_ctx->flags |= DE_QUIET;
11545 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11546 "(content:\"one\"; http_stat_msg; "
11547 "content:\"oneonetwo\"; fast_pattern:3,65977; http_stat_msg; "
11548 "content:\"three\"; distance:10; http_stat_msg; sid:1;)");
11549 if (de_ctx->sig_list != NULL)
11550 goto end;
11551
11552 result = 1;
11553
11554 end:
11555 SigCleanSignatures(de_ctx);
11556 DetectEngineCtxFree(de_ctx);
11557 return result;
11558 }
11559
DetectFastPatternTest418(void)11560 static int DetectFastPatternTest418(void)
11561 {
11562 DetectEngineCtx *de_ctx = NULL;
11563 int result = 0;
11564
11565 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11566 goto end;
11567
11568 de_ctx->flags |= DE_QUIET;
11569 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11570 "(content:\"one\"; http_stat_msg; "
11571 "content:\"two\"; fast_pattern:65534,4; http_stat_msg; "
11572 "content:\"three\"; http_stat_msg; distance:10; sid:1;)");
11573 if (de_ctx->sig_list != NULL)
11574 goto end;
11575
11576 result = 1;
11577
11578 end:
11579 SigCleanSignatures(de_ctx);
11580 DetectEngineCtxFree(de_ctx);
11581 return result;
11582 }
11583
DetectFastPatternTest419(void)11584 static int DetectFastPatternTest419(void)
11585 {
11586 DetectEngineCtx *de_ctx = NULL;
11587 int result = 0;
11588
11589 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11590 goto end;
11591
11592 de_ctx->flags |= DE_QUIET;
11593 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11594 "(content:\"one\"; http_stat_msg; "
11595 "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
11596 "content:\"three\"; http_stat_msg; sid:1;)");
11597 if (de_ctx->sig_list == NULL)
11598 goto end;
11599 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->prev->ctx;
11600 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11601 ud->flags & DETECT_CONTENT_NEGATED &&
11602 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
11603 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
11604 ud->fp_chop_offset == 3 &&
11605 ud->fp_chop_len == 4) {
11606 result = 1;
11607 } else {
11608 result = 0;
11609 }
11610
11611 end:
11612 SigCleanSignatures(de_ctx);
11613 DetectEngineCtxFree(de_ctx);
11614 return result;
11615 }
11616
DetectFastPatternTest420(void)11617 static int DetectFastPatternTest420(void)
11618 {
11619 DetectEngineCtx *de_ctx = NULL;
11620 int result = 0;
11621
11622 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11623 goto end;
11624
11625 de_ctx->flags |= DE_QUIET;
11626 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11627 "(content:\"one\"; http_stat_msg; "
11628 "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; distance:10; "
11629 "content:\"three\"; http_stat_msg; sid:1;)");
11630 if (de_ctx->sig_list != NULL)
11631 goto end;
11632
11633 result = 1;
11634
11635 end:
11636 SigCleanSignatures(de_ctx);
11637 DetectEngineCtxFree(de_ctx);
11638 return result;
11639 }
11640
DetectFastPatternTest421(void)11641 static int DetectFastPatternTest421(void)
11642 {
11643 DetectEngineCtx *de_ctx = NULL;
11644 int result = 0;
11645
11646 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11647 goto end;
11648
11649 de_ctx->flags |= DE_QUIET;
11650 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11651 "(content:\"one\"; http_stat_msg; "
11652 "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; within:10; "
11653 "content:\"three\"; http_stat_msg; sid:1;)");
11654 if (de_ctx->sig_list != NULL)
11655 goto end;
11656
11657 result = 1;
11658
11659 end:
11660 SigCleanSignatures(de_ctx);
11661 DetectEngineCtxFree(de_ctx);
11662 return result;
11663 }
11664
DetectFastPatternTest422(void)11665 static int DetectFastPatternTest422(void)
11666 {
11667 DetectEngineCtx *de_ctx = NULL;
11668 int result = 0;
11669
11670 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11671 goto end;
11672
11673 de_ctx->flags |= DE_QUIET;
11674 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11675 "(content:\"one\"; http_stat_msg; "
11676 "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; offset:10; "
11677 "content:\"three\"; http_stat_msg; sid:1;)");
11678 if (de_ctx->sig_list != NULL)
11679 goto end;
11680
11681 result = 1;
11682
11683 end:
11684 SigCleanSignatures(de_ctx);
11685 DetectEngineCtxFree(de_ctx);
11686 return result;
11687 }
11688
DetectFastPatternTest423(void)11689 static int DetectFastPatternTest423(void)
11690 {
11691 DetectEngineCtx *de_ctx = NULL;
11692 int result = 0;
11693
11694 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11695 goto end;
11696
11697 de_ctx->flags |= DE_QUIET;
11698 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11699 "(content:\"one\"; http_stat_msg; "
11700 "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; depth:10; "
11701 "content:\"three\"; http_stat_msg; sid:1;)");
11702 if (de_ctx->sig_list != NULL)
11703 goto end;
11704
11705 result = 1;
11706
11707 end:
11708 SigCleanSignatures(de_ctx);
11709 DetectEngineCtxFree(de_ctx);
11710 return result;
11711 }
11712
DetectFastPatternTest424(void)11713 static int DetectFastPatternTest424(void)
11714 {
11715 DetectEngineCtx *de_ctx = NULL;
11716 int result = 0;
11717
11718 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11719 goto end;
11720
11721 de_ctx->flags |= DE_QUIET;
11722 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11723 "(content:\"one\"; http_stat_msg; "
11724 "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
11725 "content:\"three\"; http_stat_msg; sid:1;)");
11726 if (de_ctx->sig_list == NULL)
11727 goto end;
11728 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_msg_buffer_id]->prev->ctx;
11729 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11730 ud->flags & DETECT_CONTENT_NEGATED &&
11731 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
11732 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
11733 ud->fp_chop_offset == 3 &&
11734 ud->fp_chop_len == 4) {
11735 result = 1;
11736 } else {
11737 result = 0;
11738 }
11739
11740 end:
11741 SigCleanSignatures(de_ctx);
11742 DetectEngineCtxFree(de_ctx);
11743 return result;
11744 }
11745
11746
11747 /* http_stat_msg fast_pattern tests ^ */
11748 /* http_stat_code fast_pattern tests v */
11749
11750
DetectFastPatternTest425(void)11751 static int DetectFastPatternTest425(void)
11752 {
11753 DetectEngineCtx *de_ctx = NULL;
11754 int result = 0;
11755
11756 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11757 goto end;
11758
11759 de_ctx->flags |= DE_QUIET;
11760 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11761 "(content:\"one\"; http_stat_code; "
11762 "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
11763 "content:\"three\"; http_stat_code; sid:1;)");
11764 if (de_ctx->sig_list == NULL)
11765 goto end;
11766 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->prev->ctx;
11767 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11768 ud->flags & DETECT_CONTENT_NEGATED &&
11769 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
11770 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
11771 ud->fp_chop_offset == 3 &&
11772 ud->fp_chop_len == 4) {
11773 result = 1;
11774 } else {
11775 result = 0;
11776 }
11777
11778 end:
11779 SigCleanSignatures(de_ctx);
11780 DetectEngineCtxFree(de_ctx);
11781 return result;
11782 }
11783
11784 /**
11785 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
11786 */
DetectFastPatternTest426(void)11787 static int DetectFastPatternTest426(void)
11788 {
11789 SigMatch *sm = NULL;
11790 DetectEngineCtx *de_ctx = NULL;
11791 int result = 0;
11792
11793 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11794 goto end;
11795
11796 de_ctx->flags |= DE_QUIET;
11797 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11798 "(content:\"one\"; fast_pattern:only; http_stat_code; "
11799 "msg:\"Testing fast_pattern\"; sid:1;)");
11800 if (de_ctx->sig_list == NULL)
11801 goto end;
11802
11803 result = 0;
11804 sm = de_ctx->sig_list->sm_lists[g_http_stat_code_buffer_id];
11805 if (sm != NULL) {
11806 if ( ((DetectContentData *)sm->ctx)->flags &
11807 DETECT_CONTENT_FAST_PATTERN) {
11808 result = 1;
11809 } else {
11810 result = 0;
11811 }
11812 }
11813
11814
11815 end:
11816 SigCleanSignatures(de_ctx);
11817 DetectEngineCtxFree(de_ctx);
11818 return result;
11819 }
11820
11821 /**
11822 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
11823 */
DetectFastPatternTest427(void)11824 static int DetectFastPatternTest427(void)
11825 {
11826 SigMatch *sm = NULL;
11827 DetectEngineCtx *de_ctx = NULL;
11828 int result = 0;
11829
11830 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11831 goto end;
11832
11833 de_ctx->flags |= DE_QUIET;
11834 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11835 "(content:\"oneoneone\"; fast_pattern:3,4; http_stat_code; "
11836 "msg:\"Testing fast_pattern\"; sid:1;)");
11837 if (de_ctx->sig_list == NULL)
11838 goto end;
11839
11840 result = 0;
11841 sm = de_ctx->sig_list->sm_lists[g_http_stat_code_buffer_id];
11842 if (sm != NULL) {
11843 if ( ((DetectContentData *)sm->ctx)->flags &
11844 DETECT_CONTENT_FAST_PATTERN) {
11845 result = 1;
11846 } else {
11847 result = 0;
11848 }
11849 }
11850
11851 end:
11852 SigCleanSignatures(de_ctx);
11853 DetectEngineCtxFree(de_ctx);
11854 return result;
11855 }
11856
DetectFastPatternTest428(void)11857 static int DetectFastPatternTest428(void)
11858 {
11859 SigMatch *sm = NULL;
11860 DetectEngineCtx *de_ctx = NULL;
11861 int result = 0;
11862
11863 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11864 goto end;
11865
11866 de_ctx->flags |= DE_QUIET;
11867 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11868 "(content:\"one\"; fast_pattern:only; http_stat_code; sid:1;)");
11869 if (de_ctx->sig_list == NULL)
11870 goto end;
11871
11872 sm = de_ctx->sig_list->sm_lists[g_http_stat_code_buffer_id];
11873 if (sm == NULL) {
11874 goto end;
11875 }
11876
11877 DetectContentData *ud = (DetectContentData *)sm->ctx;
11878 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11879 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
11880 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
11881 ud->fp_chop_offset == 0 &&
11882 ud->fp_chop_len == 0) {
11883 result = 1;
11884 } else {
11885 result = 0;
11886 }
11887
11888 end:
11889 SigCleanSignatures(de_ctx);
11890 DetectEngineCtxFree(de_ctx);
11891 return result;
11892 }
11893
DetectFastPatternTest429(void)11894 static int DetectFastPatternTest429(void)
11895 {
11896 SigMatch *sm = NULL;
11897 DetectEngineCtx *de_ctx = NULL;
11898 int result = 0;
11899
11900 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11901 goto end;
11902
11903 de_ctx->flags |= DE_QUIET;
11904 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11905 "(content:\"oneoneone\"; fast_pattern:3,4; http_stat_code; sid:1;)");
11906 if (de_ctx->sig_list == NULL)
11907 goto end;
11908
11909 sm = de_ctx->sig_list->sm_lists[g_http_stat_code_buffer_id];
11910 if (sm == NULL) {
11911 goto end;
11912 }
11913
11914 DetectContentData *ud = (DetectContentData *)sm->ctx;
11915 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
11916 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
11917 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
11918 ud->fp_chop_offset == 3 &&
11919 ud->fp_chop_len == 4) {
11920 result = 1;
11921 } else {
11922 result = 0;
11923 }
11924
11925 end:
11926 SigCleanSignatures(de_ctx);
11927 DetectEngineCtxFree(de_ctx);
11928 return result;
11929 }
11930
DetectFastPatternTest430(void)11931 static int DetectFastPatternTest430(void)
11932 {
11933 DetectEngineCtx *de_ctx = NULL;
11934 int result = 0;
11935
11936 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11937 goto end;
11938
11939 de_ctx->flags |= DE_QUIET;
11940 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11941 "(content:\"one\"; http_stat_code; "
11942 "content:\"two\"; fast_pattern:only; http_stat_code; distance:10; sid:1;)");
11943 if (de_ctx->sig_list != NULL)
11944 goto end;
11945
11946 result = 1;
11947
11948 end:
11949 SigCleanSignatures(de_ctx);
11950 DetectEngineCtxFree(de_ctx);
11951 return result;
11952 }
11953
DetectFastPatternTest431(void)11954 static int DetectFastPatternTest431(void)
11955 {
11956 DetectEngineCtx *de_ctx = NULL;
11957 int result = 0;
11958
11959 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11960 goto end;
11961
11962 de_ctx->flags |= DE_QUIET;
11963 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11964 "(content:\"one\"; http_stat_code; "
11965 "content:\"two\"; distance:10; fast_pattern:only; http_stat_code; sid:1;)");
11966 if (de_ctx->sig_list != NULL)
11967 goto end;
11968
11969 result = 1;
11970
11971 end:
11972 SigCleanSignatures(de_ctx);
11973 DetectEngineCtxFree(de_ctx);
11974 return result;
11975 }
11976
DetectFastPatternTest432(void)11977 static int DetectFastPatternTest432(void)
11978 {
11979 DetectEngineCtx *de_ctx = NULL;
11980 int result = 0;
11981
11982 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
11983 goto end;
11984
11985 de_ctx->flags |= DE_QUIET;
11986 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
11987 "(content:\"one\"; http_stat_code; "
11988 "content:\"two\"; fast_pattern:only; http_stat_code; within:10; sid:1;)");
11989 if (de_ctx->sig_list != NULL)
11990 goto end;
11991
11992 result = 1;
11993
11994 end:
11995 SigCleanSignatures(de_ctx);
11996 DetectEngineCtxFree(de_ctx);
11997 return result;
11998 }
11999
DetectFastPatternTest433(void)12000 static int DetectFastPatternTest433(void)
12001 {
12002 DetectEngineCtx *de_ctx = NULL;
12003 int result = 0;
12004
12005 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12006 goto end;
12007
12008 de_ctx->flags |= DE_QUIET;
12009 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12010 "(content:\"one\"; http_stat_code; "
12011 "content:\"two\"; within:10; fast_pattern:only; http_stat_code; sid:1;)");
12012 if (de_ctx->sig_list != NULL)
12013 goto end;
12014
12015 result = 1;
12016
12017 end:
12018 SigCleanSignatures(de_ctx);
12019 DetectEngineCtxFree(de_ctx);
12020 return result;
12021 }
12022
DetectFastPatternTest434(void)12023 static int DetectFastPatternTest434(void)
12024 {
12025 DetectEngineCtx *de_ctx = NULL;
12026 int result = 0;
12027
12028 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12029 goto end;
12030
12031 de_ctx->flags |= DE_QUIET;
12032 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12033 "(content:\"one\"; http_stat_code; "
12034 "content:\"two\"; fast_pattern:only; http_stat_code; offset:10; sid:1;)");
12035 if (de_ctx->sig_list != NULL)
12036 goto end;
12037
12038 result = 1;
12039
12040 end:
12041 SigCleanSignatures(de_ctx);
12042 DetectEngineCtxFree(de_ctx);
12043 return result;
12044 }
12045
DetectFastPatternTest435(void)12046 static int DetectFastPatternTest435(void)
12047 {
12048 DetectEngineCtx *de_ctx = NULL;
12049 int result = 0;
12050
12051 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12052 goto end;
12053
12054 de_ctx->flags |= DE_QUIET;
12055 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12056 "(content:\"one\"; http_stat_code; "
12057 "content:\"two\"; offset:10; fast_pattern:only; http_stat_code; sid:1;)");
12058 if (de_ctx->sig_list != NULL)
12059 goto end;
12060
12061 result = 1;
12062
12063 end:
12064 SigCleanSignatures(de_ctx);
12065 DetectEngineCtxFree(de_ctx);
12066 return result;
12067 }
12068
DetectFastPatternTest436(void)12069 static int DetectFastPatternTest436(void)
12070 {
12071 DetectEngineCtx *de_ctx = NULL;
12072 int result = 0;
12073
12074 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12075 goto end;
12076
12077 de_ctx->flags |= DE_QUIET;
12078 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12079 "(content:\"one\"; http_stat_code; "
12080 "content:\"two\"; fast_pattern:only; http_stat_code; depth:10; sid:1;)");
12081 if (de_ctx->sig_list != NULL)
12082 goto end;
12083
12084 result = 1;
12085
12086 end:
12087 SigCleanSignatures(de_ctx);
12088 DetectEngineCtxFree(de_ctx);
12089 return result;
12090 }
12091
DetectFastPatternTest437(void)12092 static int DetectFastPatternTest437(void)
12093 {
12094 DetectEngineCtx *de_ctx = NULL;
12095 int result = 0;
12096
12097 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12098 goto end;
12099
12100 de_ctx->flags |= DE_QUIET;
12101 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12102 "(content:\"one\"; http_stat_code; "
12103 "content:\"two\"; depth:10; fast_pattern:only; http_stat_code; sid:1;)");
12104 if (de_ctx->sig_list != NULL)
12105 goto end;
12106
12107 result = 1;
12108
12109 end:
12110 SigCleanSignatures(de_ctx);
12111 DetectEngineCtxFree(de_ctx);
12112 return result;
12113 }
12114
DetectFastPatternTest438(void)12115 static int DetectFastPatternTest438(void)
12116 {
12117 DetectEngineCtx *de_ctx = NULL;
12118 int result = 0;
12119
12120 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12121 goto end;
12122
12123 de_ctx->flags |= DE_QUIET;
12124 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12125 "(content:\"one\"; http_stat_code; "
12126 "content:!\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
12127 if (de_ctx->sig_list != NULL)
12128 goto end;
12129
12130 result = 1;
12131
12132 end:
12133 SigCleanSignatures(de_ctx);
12134 DetectEngineCtxFree(de_ctx);
12135 return result;
12136 }
12137
DetectFastPatternTest439(void)12138 static int DetectFastPatternTest439(void)
12139 {
12140 DetectEngineCtx *de_ctx = NULL;
12141 int result = 0;
12142
12143 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12144 goto end;
12145
12146 de_ctx->flags |= DE_QUIET;
12147 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12148 "(content:\" one\"; http_stat_code; "
12149 "content:\"two\"; http_stat_code; distance:30; "
12150 "content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
12151 if (de_ctx->sig_list == NULL)
12152 goto end;
12153
12154 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->ctx;
12155 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12156 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
12157 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
12158 ud->fp_chop_offset == 0 &&
12159 ud->fp_chop_len == 0) {
12160 result = 1;
12161 } else {
12162 result = 0;
12163 }
12164
12165 end:
12166 SigCleanSignatures(de_ctx);
12167 DetectEngineCtxFree(de_ctx);
12168 return result;
12169 }
12170
DetectFastPatternTest440(void)12171 static int DetectFastPatternTest440(void)
12172 {
12173 DetectEngineCtx *de_ctx = NULL;
12174 int result = 0;
12175
12176 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12177 goto end;
12178
12179 de_ctx->flags |= DE_QUIET;
12180 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12181 "(content:\"one\"; http_stat_code; "
12182 "content:\"two\"; http_stat_code; within:30; "
12183 "content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
12184 if (de_ctx->sig_list == NULL)
12185 goto end;
12186 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->ctx;
12187 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12188 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
12189 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
12190 ud->fp_chop_offset == 0 &&
12191 ud->fp_chop_len == 0) {
12192 result = 1;
12193 } else {
12194 result = 0;
12195 }
12196
12197 end:
12198 SigCleanSignatures(de_ctx);
12199 DetectEngineCtxFree(de_ctx);
12200 return result;
12201 }
12202
DetectFastPatternTest441(void)12203 static int DetectFastPatternTest441(void)
12204 {
12205 DetectEngineCtx *de_ctx = NULL;
12206 int result = 0;
12207
12208 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12209 goto end;
12210
12211 de_ctx->flags |= DE_QUIET;
12212 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12213 "(content:\"one\"; http_stat_code; "
12214 "content:\"two\"; http_stat_code; offset:30; "
12215 "content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
12216 if (de_ctx->sig_list == NULL)
12217 goto end;
12218 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->ctx;
12219 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12220 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
12221 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
12222 ud->fp_chop_offset == 0 &&
12223 ud->fp_chop_len == 0) {
12224 result = 1;
12225 } else {
12226 result = 0;
12227 }
12228
12229 end:
12230 SigCleanSignatures(de_ctx);
12231 DetectEngineCtxFree(de_ctx);
12232 return result;
12233 }
12234
DetectFastPatternTest442(void)12235 static int DetectFastPatternTest442(void)
12236 {
12237 DetectEngineCtx *de_ctx = NULL;
12238 int result = 0;
12239
12240 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12241 goto end;
12242
12243 de_ctx->flags |= DE_QUIET;
12244 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12245 "(content:\"one\"; http_stat_code; "
12246 "content:\"two\"; http_stat_code; depth:30; "
12247 "content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
12248 if (de_ctx->sig_list == NULL)
12249 goto end;
12250 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->ctx;
12251 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12252 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
12253 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
12254 ud->fp_chop_offset == 0 &&
12255 ud->fp_chop_len == 0) {
12256 result = 1;
12257 } else {
12258 result = 0;
12259 }
12260
12261 end:
12262 SigCleanSignatures(de_ctx);
12263 DetectEngineCtxFree(de_ctx);
12264 return result;
12265 }
12266
DetectFastPatternTest443(void)12267 static int DetectFastPatternTest443(void)
12268 {
12269 DetectEngineCtx *de_ctx = NULL;
12270 int result = 0;
12271
12272 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12273 goto end;
12274
12275 de_ctx->flags |= DE_QUIET;
12276 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12277 "(content:!\"one\"; fast_pattern; http_stat_code; "
12278 "content:\"two\"; http_stat_code; sid:1;)");
12279 if (de_ctx->sig_list == NULL)
12280 goto end;
12281 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->prev->ctx;
12282 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12283 ud->flags & DETECT_CONTENT_NEGATED &&
12284 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
12285 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
12286 ud->fp_chop_offset == 0 &&
12287 ud->fp_chop_len == 0) {
12288 result = 1;
12289 } else {
12290 result = 0;
12291 }
12292
12293 end:
12294 SigCleanSignatures(de_ctx);
12295 DetectEngineCtxFree(de_ctx);
12296 return result;
12297 }
12298
DetectFastPatternTest444(void)12299 static int DetectFastPatternTest444(void)
12300 {
12301 DetectEngineCtx *de_ctx = NULL;
12302 int result = 0;
12303
12304 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12305 goto end;
12306
12307 de_ctx->flags |= DE_QUIET;
12308 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12309 "(content:\"two\"; http_stat_code; "
12310 "content:!\"one\"; fast_pattern; http_stat_code; distance:20; sid:1;)");
12311 if (de_ctx->sig_list != NULL)
12312 goto end;
12313
12314 result = 1;
12315
12316 end:
12317 SigCleanSignatures(de_ctx);
12318 DetectEngineCtxFree(de_ctx);
12319 return result;
12320 }
12321
DetectFastPatternTest445(void)12322 static int DetectFastPatternTest445(void)
12323 {
12324 DetectEngineCtx *de_ctx = NULL;
12325 int result = 0;
12326
12327 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12328 goto end;
12329
12330 de_ctx->flags |= DE_QUIET;
12331 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12332 "(content:\"two\"; http_stat_code; "
12333 "content:!\"one\"; fast_pattern; http_stat_code; within:20; sid:1;)");
12334 if (de_ctx->sig_list != NULL)
12335 goto end;
12336
12337 result = 1;
12338
12339 end:
12340 SigCleanSignatures(de_ctx);
12341 DetectEngineCtxFree(de_ctx);
12342 return result;
12343 }
12344
DetectFastPatternTest446(void)12345 static int DetectFastPatternTest446(void)
12346 {
12347 DetectEngineCtx *de_ctx = NULL;
12348 int result = 0;
12349
12350 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12351 goto end;
12352
12353 de_ctx->flags |= DE_QUIET;
12354 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12355 "(content:\"two\"; http_stat_code; "
12356 "content:!\"one\"; fast_pattern; http_stat_code; offset:20; sid:1;)");
12357 if (de_ctx->sig_list != NULL)
12358 goto end;
12359
12360 result = 1;
12361
12362 end:
12363 SigCleanSignatures(de_ctx);
12364 DetectEngineCtxFree(de_ctx);
12365 return result;
12366 }
12367
DetectFastPatternTest447(void)12368 static int DetectFastPatternTest447(void)
12369 {
12370 DetectEngineCtx *de_ctx = NULL;
12371 int result = 0;
12372
12373 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12374 goto end;
12375
12376 de_ctx->flags |= DE_QUIET;
12377 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12378 "(content:\"two\"; http_stat_code; "
12379 "content:!\"one\"; fast_pattern; http_stat_code; depth:20; sid:1;)");
12380 if (de_ctx->sig_list != NULL)
12381 goto end;
12382
12383 result = 1;
12384
12385 end:
12386 SigCleanSignatures(de_ctx);
12387 DetectEngineCtxFree(de_ctx);
12388 return result;
12389 }
12390
DetectFastPatternTest448(void)12391 static int DetectFastPatternTest448(void)
12392 {
12393 DetectEngineCtx *de_ctx = NULL;
12394 int result = 0;
12395
12396 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12397 goto end;
12398
12399 de_ctx->flags |= DE_QUIET;
12400 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12401 "(content:\"one\"; http_stat_code; "
12402 "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
12403 "content:\"three\"; http_stat_code; sid:1;)");
12404 if (de_ctx->sig_list == NULL)
12405 goto end;
12406 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->prev->ctx;
12407 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12408 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
12409 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
12410 ud->fp_chop_offset == 3 &&
12411 ud->fp_chop_len == 4) {
12412 result = 1;
12413 } else {
12414 result = 0;
12415 }
12416
12417 end:
12418 SigCleanSignatures(de_ctx);
12419 DetectEngineCtxFree(de_ctx);
12420 return result;
12421 }
12422
DetectFastPatternTest449(void)12423 static int DetectFastPatternTest449(void)
12424 {
12425 DetectEngineCtx *de_ctx = NULL;
12426 int result = 0;
12427
12428 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12429 goto end;
12430
12431 de_ctx->flags |= DE_QUIET;
12432 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12433 "(content:\"one\"; http_stat_code; "
12434 "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
12435 "content:\"three\"; http_stat_code; distance:30; sid:1;)");
12436 if (de_ctx->sig_list == NULL)
12437 goto end;
12438 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->prev->ctx;
12439 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12440 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
12441 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
12442 ud->fp_chop_offset == 3 &&
12443 ud->fp_chop_len == 4) {
12444 result = 1;
12445 } else {
12446 result = 0;
12447 }
12448
12449 end:
12450 SigCleanSignatures(de_ctx);
12451 DetectEngineCtxFree(de_ctx);
12452 return result;
12453 }
12454
DetectFastPatternTest450(void)12455 static int DetectFastPatternTest450(void)
12456 {
12457 DetectEngineCtx *de_ctx = NULL;
12458 int result = 0;
12459
12460 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12461 goto end;
12462
12463 de_ctx->flags |= DE_QUIET;
12464 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12465 "(content:\"one\"; http_stat_code; "
12466 "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
12467 "content:\"three\"; http_stat_code; within:30; sid:1;)");
12468 if (de_ctx->sig_list == NULL)
12469 goto end;
12470 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->prev->ctx;
12471 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12472 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
12473 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
12474 ud->fp_chop_offset == 3 &&
12475 ud->fp_chop_len == 4) {
12476 result = 1;
12477 } else {
12478 result = 0;
12479 }
12480
12481 end:
12482 SigCleanSignatures(de_ctx);
12483 DetectEngineCtxFree(de_ctx);
12484 return result;
12485 }
12486
DetectFastPatternTest451(void)12487 static int DetectFastPatternTest451(void)
12488 {
12489 DetectEngineCtx *de_ctx = NULL;
12490 int result = 0;
12491
12492 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12493 goto end;
12494
12495 de_ctx->flags |= DE_QUIET;
12496 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12497 "(content:\"one\"; http_stat_code; "
12498 "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
12499 "content:\"three\"; http_stat_code; offset:30; sid:1;)");
12500 if (de_ctx->sig_list == NULL)
12501 goto end;
12502 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->prev->ctx;
12503 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12504 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
12505 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
12506 ud->fp_chop_offset == 3 &&
12507 ud->fp_chop_len == 4) {
12508 result = 1;
12509 } else {
12510 result = 0;
12511 }
12512
12513 end:
12514 SigCleanSignatures(de_ctx);
12515 DetectEngineCtxFree(de_ctx);
12516 return result;
12517 }
12518
DetectFastPatternTest452(void)12519 static int DetectFastPatternTest452(void)
12520 {
12521 DetectEngineCtx *de_ctx = NULL;
12522 int result = 0;
12523
12524 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12525 goto end;
12526
12527 de_ctx->flags |= DE_QUIET;
12528 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12529 "(content:\"one\"; http_stat_code; "
12530 "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
12531 "content:\"three\"; http_stat_code; depth:30; sid:1;)");
12532 if (de_ctx->sig_list == NULL)
12533 goto end;
12534 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->prev->ctx;
12535 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12536 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
12537 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
12538 ud->fp_chop_offset == 3 &&
12539 ud->fp_chop_len == 4) {
12540 result = 1;
12541 } else {
12542 result = 0;
12543 }
12544
12545 end:
12546 SigCleanSignatures(de_ctx);
12547 DetectEngineCtxFree(de_ctx);
12548 return result;
12549 }
12550
DetectFastPatternTest453(void)12551 static int DetectFastPatternTest453(void)
12552 {
12553 DetectEngineCtx *de_ctx = NULL;
12554 int result = 0;
12555
12556 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12557 goto end;
12558
12559 de_ctx->flags |= DE_QUIET;
12560 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12561 "(content:\"one\"; http_stat_code; "
12562 "content:\"two\"; http_stat_code; distance:10; "
12563 "content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)");
12564 if (de_ctx->sig_list == NULL)
12565 goto end;
12566 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->ctx;
12567 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12568 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
12569 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
12570 ud->fp_chop_offset == 3 &&
12571 ud->fp_chop_len == 4) {
12572 result = 1;
12573 } else {
12574 result = 0;
12575 }
12576
12577 end:
12578 SigCleanSignatures(de_ctx);
12579 DetectEngineCtxFree(de_ctx);
12580 return result;
12581 }
12582
DetectFastPatternTest454(void)12583 static int DetectFastPatternTest454(void)
12584 {
12585 DetectEngineCtx *de_ctx = NULL;
12586 int result = 0;
12587
12588 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12589 goto end;
12590
12591 de_ctx->flags |= DE_QUIET;
12592 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12593 "(content:\"one\"; http_stat_code; "
12594 "content:\"two\"; http_stat_code; within:10; "
12595 "content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)");
12596 if (de_ctx->sig_list == NULL)
12597 goto end;
12598 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->ctx;
12599 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12600 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
12601 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
12602 ud->fp_chop_offset == 3 &&
12603 ud->fp_chop_len == 4) {
12604 result = 1;
12605 } else {
12606 result = 0;
12607 }
12608
12609 end:
12610 SigCleanSignatures(de_ctx);
12611 DetectEngineCtxFree(de_ctx);
12612 return result;
12613 }
12614
DetectFastPatternTest455(void)12615 static int DetectFastPatternTest455(void)
12616 {
12617 DetectEngineCtx *de_ctx = NULL;
12618 int result = 0;
12619
12620 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12621 goto end;
12622
12623 de_ctx->flags |= DE_QUIET;
12624 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12625 "(content:\"one\"; http_stat_code; "
12626 "content:\"two\"; http_stat_code; offset:10; "
12627 "content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)");
12628 if (de_ctx->sig_list == NULL)
12629 goto end;
12630 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->ctx;
12631 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12632 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
12633 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
12634 ud->fp_chop_offset == 3 &&
12635 ud->fp_chop_len == 4) {
12636 result = 1;
12637 } else {
12638 result = 0;
12639 }
12640
12641 end:
12642 SigCleanSignatures(de_ctx);
12643 DetectEngineCtxFree(de_ctx);
12644 return result;
12645 }
12646
DetectFastPatternTest456(void)12647 static int DetectFastPatternTest456(void)
12648 {
12649 DetectEngineCtx *de_ctx = NULL;
12650 int result = 0;
12651
12652 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12653 goto end;
12654
12655 de_ctx->flags |= DE_QUIET;
12656 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12657 "(content:\"one\"; http_stat_code; "
12658 "content:\"two\"; http_stat_code; depth:10; "
12659 "content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)");
12660 if (de_ctx->sig_list == NULL)
12661 goto end;
12662 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->ctx;
12663 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12664 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
12665 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
12666 ud->fp_chop_offset == 3 &&
12667 ud->fp_chop_len == 4) {
12668 result = 1;
12669 } else {
12670 result = 0;
12671 }
12672
12673
12674 result = 1;
12675
12676 end:
12677 SigCleanSignatures(de_ctx);
12678 DetectEngineCtxFree(de_ctx);
12679 return result;
12680 }
12681
DetectFastPatternTest457(void)12682 static int DetectFastPatternTest457(void)
12683 {
12684 DetectEngineCtx *de_ctx = NULL;
12685 int result = 0;
12686
12687 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12688 goto end;
12689
12690 de_ctx->flags |= DE_QUIET;
12691 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12692 "(content:\"one\"; http_stat_code; "
12693 "content:\"two\"; fast_pattern:65977,4; http_stat_code; "
12694 "content:\"three\"; http_stat_code; distance:10; sid:1;)");
12695 if (de_ctx->sig_list != NULL)
12696 goto end;
12697
12698 result = 1;
12699
12700 end:
12701 SigCleanSignatures(de_ctx);
12702 DetectEngineCtxFree(de_ctx);
12703 return result;
12704 }
12705
DetectFastPatternTest458(void)12706 static int DetectFastPatternTest458(void)
12707 {
12708 DetectEngineCtx *de_ctx = NULL;
12709 int result = 0;
12710
12711 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12712 goto end;
12713
12714 de_ctx->flags |= DE_QUIET;
12715 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12716 "(content:\"one\"; http_stat_code; "
12717 "content:\"oneonetwo\"; fast_pattern:3,65977; http_stat_code; "
12718 "content:\"three\"; distance:10; http_stat_code; sid:1;)");
12719 if (de_ctx->sig_list != NULL)
12720 goto end;
12721
12722 result = 1;
12723
12724 end:
12725 SigCleanSignatures(de_ctx);
12726 DetectEngineCtxFree(de_ctx);
12727 return result;
12728 }
12729
DetectFastPatternTest459(void)12730 static int DetectFastPatternTest459(void)
12731 {
12732 DetectEngineCtx *de_ctx = NULL;
12733 int result = 0;
12734
12735 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12736 goto end;
12737
12738 de_ctx->flags |= DE_QUIET;
12739 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12740 "(content:\"one\"; http_stat_code; "
12741 "content:\"two\"; fast_pattern:65534,4; http_stat_code; "
12742 "content:\"three\"; http_stat_code; distance:10; sid:1;)");
12743 if (de_ctx->sig_list != NULL)
12744 goto end;
12745
12746 result = 1;
12747
12748 end:
12749 SigCleanSignatures(de_ctx);
12750 DetectEngineCtxFree(de_ctx);
12751 return result;
12752 }
12753
DetectFastPatternTest460(void)12754 static int DetectFastPatternTest460(void)
12755 {
12756 DetectEngineCtx *de_ctx = NULL;
12757 int result = 0;
12758
12759 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12760 goto end;
12761
12762 de_ctx->flags |= DE_QUIET;
12763 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12764 "(content:\"one\"; http_stat_code; "
12765 "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
12766 "content:\"three\"; http_stat_code; sid:1;)");
12767 if (de_ctx->sig_list == NULL)
12768 goto end;
12769 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->prev->ctx;
12770 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12771 ud->flags & DETECT_CONTENT_NEGATED &&
12772 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
12773 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
12774 ud->fp_chop_offset == 3 &&
12775 ud->fp_chop_len == 4) {
12776 result = 1;
12777 } else {
12778 result = 0;
12779 }
12780
12781 end:
12782 SigCleanSignatures(de_ctx);
12783 DetectEngineCtxFree(de_ctx);
12784 return result;
12785 }
12786
DetectFastPatternTest461(void)12787 static int DetectFastPatternTest461(void)
12788 {
12789 DetectEngineCtx *de_ctx = NULL;
12790 int result = 0;
12791
12792 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12793 goto end;
12794
12795 de_ctx->flags |= DE_QUIET;
12796 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12797 "(content:\"one\"; http_stat_code; "
12798 "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; distance:10; "
12799 "content:\"three\"; http_stat_code; sid:1;)");
12800 if (de_ctx->sig_list != NULL)
12801 goto end;
12802
12803 result = 1;
12804
12805 end:
12806 SigCleanSignatures(de_ctx);
12807 DetectEngineCtxFree(de_ctx);
12808 return result;
12809 }
12810
DetectFastPatternTest462(void)12811 static int DetectFastPatternTest462(void)
12812 {
12813 DetectEngineCtx *de_ctx = NULL;
12814 int result = 0;
12815
12816 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12817 goto end;
12818
12819 de_ctx->flags |= DE_QUIET;
12820 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12821 "(content:\"one\"; http_stat_code; "
12822 "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; within:10; "
12823 "content:\"three\"; http_stat_code; sid:1;)");
12824 if (de_ctx->sig_list != NULL)
12825 goto end;
12826
12827 result = 1;
12828
12829 end:
12830 SigCleanSignatures(de_ctx);
12831 DetectEngineCtxFree(de_ctx);
12832 return result;
12833 }
12834
DetectFastPatternTest463(void)12835 static int DetectFastPatternTest463(void)
12836 {
12837 DetectEngineCtx *de_ctx = NULL;
12838 int result = 0;
12839
12840 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12841 goto end;
12842
12843 de_ctx->flags |= DE_QUIET;
12844 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12845 "(content:\"one\"; http_stat_code; "
12846 "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; offset:10; "
12847 "content:\"three\"; http_stat_code; sid:1;)");
12848 if (de_ctx->sig_list != NULL)
12849 goto end;
12850
12851 result = 1;
12852
12853 end:
12854 SigCleanSignatures(de_ctx);
12855 DetectEngineCtxFree(de_ctx);
12856 return result;
12857 }
12858
DetectFastPatternTest464(void)12859 static int DetectFastPatternTest464(void)
12860 {
12861 DetectEngineCtx *de_ctx = NULL;
12862 int result = 0;
12863
12864 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12865 goto end;
12866
12867 de_ctx->flags |= DE_QUIET;
12868 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12869 "(content:\"one\"; http_stat_code; "
12870 "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; depth:10; "
12871 "content:\"three\"; http_stat_code; sid:1;)");
12872 if (de_ctx->sig_list != NULL)
12873 goto end;
12874
12875 result = 1;
12876
12877 end:
12878 SigCleanSignatures(de_ctx);
12879 DetectEngineCtxFree(de_ctx);
12880 return result;
12881 }
12882
DetectFastPatternTest465(void)12883 static int DetectFastPatternTest465(void)
12884 {
12885 DetectEngineCtx *de_ctx = NULL;
12886 int result = 0;
12887
12888 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12889 goto end;
12890
12891 de_ctx->flags |= DE_QUIET;
12892 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12893 "(content:\"one\"; http_stat_code; "
12894 "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
12895 "content:\"three\"; http_stat_code; sid:1;)");
12896 if (de_ctx->sig_list == NULL)
12897 goto end;
12898 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_stat_code_buffer_id]->prev->ctx;
12899 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12900 ud->flags & DETECT_CONTENT_NEGATED &&
12901 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
12902 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
12903 ud->fp_chop_offset == 3 &&
12904 ud->fp_chop_len == 4) {
12905 result = 1;
12906 } else {
12907 result = 0;
12908 }
12909
12910 end:
12911 SigCleanSignatures(de_ctx);
12912 DetectEngineCtxFree(de_ctx);
12913 return result;
12914 }
12915
12916
12917 /* http_stat_code fast_pattern tests ^ */
12918 /* http_server_body fast_pattern tests v */
12919
12920
DetectFastPatternTest466(void)12921 static int DetectFastPatternTest466(void)
12922 {
12923 DetectEngineCtx *de_ctx = NULL;
12924 int result = 0;
12925
12926 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12927 goto end;
12928
12929 de_ctx->flags |= DE_QUIET;
12930 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12931 "(content:\"one\"; http_server_body; "
12932 "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
12933 "content:\"three\"; http_server_body; sid:1;)");
12934 if (de_ctx->sig_list == NULL)
12935 goto end;
12936
12937 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
12938 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
12939 ud->flags & DETECT_CONTENT_NEGATED &&
12940 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
12941 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
12942 ud->fp_chop_offset == 3 &&
12943 ud->fp_chop_len == 4) {
12944 result = 1;
12945 } else {
12946 result = 0;
12947 }
12948
12949 end:
12950 SigCleanSignatures(de_ctx);
12951 DetectEngineCtxFree(de_ctx);
12952 return result;
12953 }
12954
12955 /**
12956 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
12957 */
DetectFastPatternTest467(void)12958 static int DetectFastPatternTest467(void)
12959 {
12960 SigMatch *sm = NULL;
12961 DetectEngineCtx *de_ctx = NULL;
12962 int result = 0;
12963
12964 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
12965 goto end;
12966
12967 de_ctx->flags |= DE_QUIET;
12968 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
12969 "(content:\"one\"; fast_pattern:only; http_server_body; "
12970 "msg:\"Testing fast_pattern\"; sid:1;)");
12971 if (de_ctx->sig_list == NULL)
12972 goto end;
12973
12974 result = 0;
12975 sm = de_ctx->sig_list->sm_lists[g_file_data_buffer_id];
12976 if (sm != NULL) {
12977 if ( ((DetectContentData *)sm->ctx)->flags &
12978 DETECT_CONTENT_FAST_PATTERN) {
12979 result = 1;
12980 } else {
12981 result = 0;
12982 }
12983 }
12984
12985
12986 end:
12987 SigCleanSignatures(de_ctx);
12988 DetectEngineCtxFree(de_ctx);
12989 return result;
12990 }
12991
12992 /**
12993 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
12994 */
DetectFastPatternTest468(void)12995 static int DetectFastPatternTest468(void)
12996 {
12997 SigMatch *sm = NULL;
12998 DetectEngineCtx *de_ctx = NULL;
12999 int result = 0;
13000
13001 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13002 goto end;
13003
13004 de_ctx->flags |= DE_QUIET;
13005 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13006 "(content:\"oneoneone\"; fast_pattern:3,4; http_server_body; "
13007 "msg:\"Testing fast_pattern\"; sid:1;)");
13008 if (de_ctx->sig_list == NULL)
13009 goto end;
13010
13011 result = 0;
13012 sm = de_ctx->sig_list->sm_lists[g_file_data_buffer_id];
13013 if (sm != NULL) {
13014 if ( ((DetectContentData *)sm->ctx)->flags &
13015 DETECT_CONTENT_FAST_PATTERN) {
13016 result = 1;
13017 } else {
13018 result = 0;
13019 }
13020 }
13021
13022 end:
13023 SigCleanSignatures(de_ctx);
13024 DetectEngineCtxFree(de_ctx);
13025 return result;
13026 }
13027
DetectFastPatternTest469(void)13028 static int DetectFastPatternTest469(void)
13029 {
13030 SigMatch *sm = NULL;
13031 DetectEngineCtx *de_ctx = NULL;
13032 int result = 0;
13033
13034 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13035 goto end;
13036
13037 de_ctx->flags |= DE_QUIET;
13038 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13039 "(content:\"one\"; fast_pattern:only; http_server_body; sid:1;)");
13040 if (de_ctx->sig_list == NULL)
13041 goto end;
13042
13043 sm = de_ctx->sig_list->sm_lists[g_file_data_buffer_id];
13044 if (sm == NULL) {
13045 goto end;
13046 }
13047 DetectContentData *ud = (DetectContentData *)sm->ctx;
13048 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13049 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
13050 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
13051 ud->fp_chop_offset == 0 &&
13052 ud->fp_chop_len == 0) {
13053 result = 1;
13054 } else {
13055 result = 0;
13056 }
13057
13058 end:
13059 SigCleanSignatures(de_ctx);
13060 DetectEngineCtxFree(de_ctx);
13061 return result;
13062 }
13063
DetectFastPatternTest470(void)13064 static int DetectFastPatternTest470(void)
13065 {
13066 SigMatch *sm = NULL;
13067 DetectEngineCtx *de_ctx = NULL;
13068 int result = 0;
13069
13070 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13071 goto end;
13072
13073 de_ctx->flags |= DE_QUIET;
13074 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13075 "(content:\"oneoneone\"; fast_pattern:3,4; http_server_body; sid:1;)");
13076 if (de_ctx->sig_list == NULL)
13077 goto end;
13078
13079 sm = de_ctx->sig_list->sm_lists[g_file_data_buffer_id];
13080 if (sm == NULL) {
13081 goto end;
13082 }
13083
13084 DetectContentData *ud = (DetectContentData *)sm->ctx;
13085 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13086 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
13087 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
13088 ud->fp_chop_offset == 3 &&
13089 ud->fp_chop_len == 4) {
13090 result = 1;
13091 } else {
13092 result = 0;
13093 }
13094
13095 end:
13096 SigCleanSignatures(de_ctx);
13097 DetectEngineCtxFree(de_ctx);
13098 return result;
13099 }
13100
DetectFastPatternTest471(void)13101 static int DetectFastPatternTest471(void)
13102 {
13103 DetectEngineCtx *de_ctx = NULL;
13104 int result = 0;
13105
13106 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13107 goto end;
13108
13109 de_ctx->flags |= DE_QUIET;
13110 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13111 "(content:\"one\"; http_server_body; "
13112 "content:\"two\"; fast_pattern:only; http_server_body; distance:10; sid:1;)");
13113 if (de_ctx->sig_list != NULL)
13114 goto end;
13115
13116 result = 1;
13117
13118 end:
13119 SigCleanSignatures(de_ctx);
13120 DetectEngineCtxFree(de_ctx);
13121 return result;
13122 }
13123
DetectFastPatternTest472(void)13124 static int DetectFastPatternTest472(void)
13125 {
13126 DetectEngineCtx *de_ctx = NULL;
13127 int result = 0;
13128
13129 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13130 goto end;
13131
13132 de_ctx->flags |= DE_QUIET;
13133 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13134 "(content:\"one\"; http_server_body; "
13135 "content:\"two\"; distance:10; fast_pattern:only; http_server_body; sid:1;)");
13136 if (de_ctx->sig_list != NULL)
13137 goto end;
13138
13139 result = 1;
13140
13141 end:
13142 SigCleanSignatures(de_ctx);
13143 DetectEngineCtxFree(de_ctx);
13144 return result;
13145 }
13146
DetectFastPatternTest473(void)13147 static int DetectFastPatternTest473(void)
13148 {
13149 DetectEngineCtx *de_ctx = NULL;
13150 int result = 0;
13151
13152 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13153 goto end;
13154
13155 de_ctx->flags |= DE_QUIET;
13156 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13157 "(content:\"one\"; http_server_body; "
13158 "content:\"two\"; fast_pattern:only; http_server_body; within:10; sid:1;)");
13159 if (de_ctx->sig_list != NULL)
13160 goto end;
13161
13162 result = 1;
13163
13164 end:
13165 SigCleanSignatures(de_ctx);
13166 DetectEngineCtxFree(de_ctx);
13167 return result;
13168 }
13169
DetectFastPatternTest474(void)13170 static int DetectFastPatternTest474(void)
13171 {
13172 DetectEngineCtx *de_ctx = NULL;
13173 int result = 0;
13174
13175 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13176 goto end;
13177
13178 de_ctx->flags |= DE_QUIET;
13179 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13180 "(content:\"one\"; http_server_body; "
13181 "content:\"two\"; within:10; fast_pattern:only; http_server_body; sid:1;)");
13182 if (de_ctx->sig_list != NULL)
13183 goto end;
13184
13185 result = 1;
13186
13187 end:
13188 SigCleanSignatures(de_ctx);
13189 DetectEngineCtxFree(de_ctx);
13190 return result;
13191 }
13192
DetectFastPatternTest475(void)13193 static int DetectFastPatternTest475(void)
13194 {
13195 DetectEngineCtx *de_ctx = NULL;
13196 int result = 0;
13197
13198 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13199 goto end;
13200
13201 de_ctx->flags |= DE_QUIET;
13202 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13203 "(content:\"one\"; http_server_body; "
13204 "content:\"two\"; fast_pattern:only; http_server_body; offset:10; sid:1;)");
13205 if (de_ctx->sig_list != NULL)
13206 goto end;
13207
13208 result = 1;
13209
13210 end:
13211 SigCleanSignatures(de_ctx);
13212 DetectEngineCtxFree(de_ctx);
13213 return result;
13214 }
13215
DetectFastPatternTest476(void)13216 static int DetectFastPatternTest476(void)
13217 {
13218 DetectEngineCtx *de_ctx = NULL;
13219 int result = 0;
13220
13221 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13222 goto end;
13223
13224 de_ctx->flags |= DE_QUIET;
13225 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13226 "(content:\"one\"; http_server_body; "
13227 "content:\"two\"; offset:10; fast_pattern:only; http_server_body; sid:1;)");
13228 if (de_ctx->sig_list != NULL)
13229 goto end;
13230
13231 result = 1;
13232
13233 end:
13234 SigCleanSignatures(de_ctx);
13235 DetectEngineCtxFree(de_ctx);
13236 return result;
13237 }
13238
DetectFastPatternTest477(void)13239 static int DetectFastPatternTest477(void)
13240 {
13241 DetectEngineCtx *de_ctx = NULL;
13242 int result = 0;
13243
13244 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13245 goto end;
13246
13247 de_ctx->flags |= DE_QUIET;
13248 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13249 "(content:\"one\"; http_server_body; "
13250 "content:\"two\"; fast_pattern:only; http_server_body; depth:10; sid:1;)");
13251 if (de_ctx->sig_list != NULL)
13252 goto end;
13253
13254 result = 1;
13255
13256 end:
13257 SigCleanSignatures(de_ctx);
13258 DetectEngineCtxFree(de_ctx);
13259 return result;
13260 }
13261
DetectFastPatternTest478(void)13262 static int DetectFastPatternTest478(void)
13263 {
13264 DetectEngineCtx *de_ctx = NULL;
13265 int result = 0;
13266
13267 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13268 goto end;
13269
13270 de_ctx->flags |= DE_QUIET;
13271 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13272 "(content:\"one\"; http_server_body; "
13273 "content:\"two\"; depth:10; fast_pattern:only; http_server_body; sid:1;)");
13274 if (de_ctx->sig_list != NULL)
13275 goto end;
13276
13277 result = 1;
13278
13279 end:
13280 SigCleanSignatures(de_ctx);
13281 DetectEngineCtxFree(de_ctx);
13282 return result;
13283 }
13284
DetectFastPatternTest479(void)13285 static int DetectFastPatternTest479(void)
13286 {
13287 DetectEngineCtx *de_ctx = NULL;
13288 int result = 0;
13289
13290 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13291 goto end;
13292
13293 de_ctx->flags |= DE_QUIET;
13294 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13295 "(content:\"one\"; http_server_body; "
13296 "content:!\"two\"; fast_pattern:only; http_server_body; sid:1;)");
13297 if (de_ctx->sig_list != NULL)
13298 goto end;
13299
13300 result = 1;
13301
13302 end:
13303 SigCleanSignatures(de_ctx);
13304 DetectEngineCtxFree(de_ctx);
13305 return result;
13306 }
13307
DetectFastPatternTest480(void)13308 static int DetectFastPatternTest480(void)
13309 {
13310 DetectEngineCtx *de_ctx = NULL;
13311 int result = 0;
13312
13313 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13314 goto end;
13315
13316 de_ctx->flags |= DE_QUIET;
13317 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13318 "(content:\" one\"; http_server_body; "
13319 "content:\"two\"; http_server_body; distance:30; "
13320 "content:\"two\"; fast_pattern:only; http_server_body; sid:1;)");
13321 if (de_ctx->sig_list == NULL)
13322 goto end;
13323
13324 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
13325 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13326 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
13327 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
13328 ud->fp_chop_offset == 0 &&
13329 ud->fp_chop_len == 0) {
13330 result = 1;
13331 } else {
13332 result = 0;
13333 }
13334
13335 end:
13336 SigCleanSignatures(de_ctx);
13337 DetectEngineCtxFree(de_ctx);
13338 return result;
13339 }
13340
DetectFastPatternTest481(void)13341 static int DetectFastPatternTest481(void)
13342 {
13343 DetectEngineCtx *de_ctx = NULL;
13344 int result = 0;
13345
13346 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13347 goto end;
13348
13349 de_ctx->flags |= DE_QUIET;
13350 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13351 "(content:\"one\"; http_server_body; "
13352 "content:\"two\"; http_server_body; within:30; "
13353 "content:\"two\"; fast_pattern:only; http_server_body; sid:1;)");
13354 if (de_ctx->sig_list == NULL)
13355 goto end;
13356
13357 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
13358 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13359 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
13360 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
13361 ud->fp_chop_offset == 0 &&
13362 ud->fp_chop_len == 0) {
13363 result = 1;
13364 } else {
13365 result = 0;
13366 }
13367
13368 end:
13369 SigCleanSignatures(de_ctx);
13370 DetectEngineCtxFree(de_ctx);
13371 return result;
13372 }
13373
DetectFastPatternTest482(void)13374 static int DetectFastPatternTest482(void)
13375 {
13376 DetectEngineCtx *de_ctx = NULL;
13377 int result = 0;
13378
13379 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13380 goto end;
13381
13382 de_ctx->flags |= DE_QUIET;
13383 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13384 "(content:\"one\"; http_server_body; "
13385 "content:\"two\"; http_server_body; offset:30; "
13386 "content:\"two\"; fast_pattern:only; http_server_body; sid:1;)");
13387 if (de_ctx->sig_list == NULL)
13388 goto end;
13389
13390 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
13391 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13392 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
13393 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
13394 ud->fp_chop_offset == 0 &&
13395 ud->fp_chop_len == 0) {
13396 result = 1;
13397 } else {
13398 result = 0;
13399 }
13400
13401 end:
13402 SigCleanSignatures(de_ctx);
13403 DetectEngineCtxFree(de_ctx);
13404 return result;
13405 }
13406
DetectFastPatternTest483(void)13407 static int DetectFastPatternTest483(void)
13408 {
13409 DetectEngineCtx *de_ctx = NULL;
13410 int result = 0;
13411
13412 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13413 goto end;
13414
13415 de_ctx->flags |= DE_QUIET;
13416 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13417 "(content:\"one\"; http_server_body; "
13418 "content:\"two\"; http_server_body; depth:30; "
13419 "content:\"two\"; fast_pattern:only; http_server_body; sid:1;)");
13420 if (de_ctx->sig_list == NULL)
13421 goto end;
13422
13423 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
13424 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13425 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
13426 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
13427 ud->fp_chop_offset == 0 &&
13428 ud->fp_chop_len == 0) {
13429 result = 1;
13430 } else {
13431 result = 0;
13432 }
13433
13434 end:
13435 SigCleanSignatures(de_ctx);
13436 DetectEngineCtxFree(de_ctx);
13437 return result;
13438 }
13439
DetectFastPatternTest484(void)13440 static int DetectFastPatternTest484(void)
13441 {
13442 DetectEngineCtx *de_ctx = NULL;
13443 int result = 0;
13444
13445 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13446 goto end;
13447
13448 de_ctx->flags |= DE_QUIET;
13449 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13450 "(content:!\"one\"; fast_pattern; http_server_body; "
13451 "content:\"two\"; http_server_body; sid:1;)");
13452 if (de_ctx->sig_list == NULL)
13453 goto end;
13454
13455 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
13456 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13457 ud->flags & DETECT_CONTENT_NEGATED &&
13458 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
13459 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
13460 ud->fp_chop_offset == 0 &&
13461 ud->fp_chop_len == 0) {
13462 result = 1;
13463 } else {
13464 result = 0;
13465 }
13466
13467 end:
13468 SigCleanSignatures(de_ctx);
13469 DetectEngineCtxFree(de_ctx);
13470 return result;
13471 }
13472
DetectFastPatternTest485(void)13473 static int DetectFastPatternTest485(void)
13474 {
13475 DetectEngineCtx *de_ctx = NULL;
13476 int result = 0;
13477
13478 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13479 goto end;
13480
13481 de_ctx->flags |= DE_QUIET;
13482 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13483 "(content:\"two\"; http_server_body; "
13484 "content:!\"one\"; fast_pattern; http_server_body; distance:20; sid:1;)");
13485 if (de_ctx->sig_list != NULL)
13486 goto end;
13487
13488 result = 1;
13489
13490 end:
13491 SigCleanSignatures(de_ctx);
13492 DetectEngineCtxFree(de_ctx);
13493 return result;
13494 }
13495
DetectFastPatternTest486(void)13496 static int DetectFastPatternTest486(void)
13497 {
13498 DetectEngineCtx *de_ctx = NULL;
13499 int result = 0;
13500
13501 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13502 goto end;
13503
13504 de_ctx->flags |= DE_QUIET;
13505 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13506 "(content:\"two\"; http_server_body; "
13507 "content:!\"one\"; fast_pattern; http_server_body; within:20; sid:1;)");
13508 if (de_ctx->sig_list != NULL)
13509 goto end;
13510
13511 result = 1;
13512
13513 end:
13514 SigCleanSignatures(de_ctx);
13515 DetectEngineCtxFree(de_ctx);
13516 return result;
13517 }
13518
DetectFastPatternTest487(void)13519 static int DetectFastPatternTest487(void)
13520 {
13521 DetectEngineCtx *de_ctx = NULL;
13522 int result = 0;
13523
13524 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13525 goto end;
13526
13527 de_ctx->flags |= DE_QUIET;
13528 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13529 "(content:\"two\"; http_server_body; "
13530 "content:!\"one\"; fast_pattern; http_server_body; offset:20; sid:1;)");
13531 if (de_ctx->sig_list != NULL)
13532 goto end;
13533
13534 result = 1;
13535
13536 end:
13537 SigCleanSignatures(de_ctx);
13538 DetectEngineCtxFree(de_ctx);
13539 return result;
13540 }
13541
DetectFastPatternTest488(void)13542 static int DetectFastPatternTest488(void)
13543 {
13544 DetectEngineCtx *de_ctx = NULL;
13545 int result = 0;
13546
13547 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13548 goto end;
13549
13550 de_ctx->flags |= DE_QUIET;
13551 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13552 "(content:\"two\"; http_server_body; "
13553 "content:!\"one\"; fast_pattern; http_server_body; depth:20; sid:1;)");
13554 if (de_ctx->sig_list != NULL)
13555 goto end;
13556
13557 result = 1;
13558
13559 end:
13560 SigCleanSignatures(de_ctx);
13561 DetectEngineCtxFree(de_ctx);
13562 return result;
13563 }
13564
DetectFastPatternTest489(void)13565 static int DetectFastPatternTest489(void)
13566 {
13567 DetectEngineCtx *de_ctx = NULL;
13568 int result = 0;
13569
13570 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13571 goto end;
13572
13573 de_ctx->flags |= DE_QUIET;
13574 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13575 "(content:\"one\"; http_server_body; "
13576 "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
13577 "content:\"three\"; http_server_body; sid:1;)");
13578 if (de_ctx->sig_list == NULL)
13579 goto end;
13580
13581 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
13582 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13583 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
13584 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
13585 ud->fp_chop_offset == 3 &&
13586 ud->fp_chop_len == 4) {
13587 result = 1;
13588 } else {
13589 result = 0;
13590 }
13591
13592 end:
13593 SigCleanSignatures(de_ctx);
13594 DetectEngineCtxFree(de_ctx);
13595 return result;
13596 }
13597
DetectFastPatternTest490(void)13598 static int DetectFastPatternTest490(void)
13599 {
13600 DetectEngineCtx *de_ctx = NULL;
13601 int result = 0;
13602
13603 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13604 goto end;
13605
13606 de_ctx->flags |= DE_QUIET;
13607 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13608 "(content:\"one\"; http_server_body; "
13609 "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
13610 "content:\"three\"; http_server_body; distance:30; sid:1;)");
13611 if (de_ctx->sig_list == NULL)
13612 goto end;
13613
13614 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
13615 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13616 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
13617 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
13618 ud->fp_chop_offset == 3 &&
13619 ud->fp_chop_len == 4) {
13620 result = 1;
13621 } else {
13622 result = 0;
13623 }
13624
13625 end:
13626 SigCleanSignatures(de_ctx);
13627 DetectEngineCtxFree(de_ctx);
13628 return result;
13629 }
13630
DetectFastPatternTest491(void)13631 static int DetectFastPatternTest491(void)
13632 {
13633 DetectEngineCtx *de_ctx = NULL;
13634 int result = 0;
13635
13636 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13637 goto end;
13638
13639 de_ctx->flags |= DE_QUIET;
13640 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13641 "(content:\"one\"; http_server_body; "
13642 "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
13643 "content:\"three\"; http_server_body; within:30; sid:1;)");
13644 if (de_ctx->sig_list == NULL)
13645 goto end;
13646
13647 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
13648 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13649 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
13650 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
13651 ud->fp_chop_offset == 3 &&
13652 ud->fp_chop_len == 4) {
13653 result = 1;
13654 } else {
13655 result = 0;
13656 }
13657
13658 end:
13659 SigCleanSignatures(de_ctx);
13660 DetectEngineCtxFree(de_ctx);
13661 return result;
13662 }
13663
DetectFastPatternTest492(void)13664 static int DetectFastPatternTest492(void)
13665 {
13666 DetectEngineCtx *de_ctx = NULL;
13667 int result = 0;
13668
13669 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13670 goto end;
13671
13672 de_ctx->flags |= DE_QUIET;
13673 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13674 "(content:\"one\"; http_server_body; "
13675 "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
13676 "content:\"three\"; http_server_body; offset:30; sid:1;)");
13677 if (de_ctx->sig_list == NULL)
13678 goto end;
13679
13680 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
13681 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13682 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
13683 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
13684 ud->fp_chop_offset == 3 &&
13685 ud->fp_chop_len == 4) {
13686 result = 1;
13687 } else {
13688 result = 0;
13689 }
13690
13691 end:
13692 SigCleanSignatures(de_ctx);
13693 DetectEngineCtxFree(de_ctx);
13694 return result;
13695 }
13696
DetectFastPatternTest493(void)13697 static int DetectFastPatternTest493(void)
13698 {
13699 DetectEngineCtx *de_ctx = NULL;
13700 int result = 0;
13701
13702 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13703 goto end;
13704
13705 de_ctx->flags |= DE_QUIET;
13706 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13707 "(content:\"one\"; http_server_body; "
13708 "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
13709 "content:\"three\"; http_server_body; depth:30; sid:1;)");
13710 if (de_ctx->sig_list == NULL)
13711 goto end;
13712
13713 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
13714 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13715 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
13716 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
13717 ud->fp_chop_offset == 3 &&
13718 ud->fp_chop_len == 4) {
13719 result = 1;
13720 } else {
13721 result = 0;
13722 }
13723
13724 end:
13725 SigCleanSignatures(de_ctx);
13726 DetectEngineCtxFree(de_ctx);
13727 return result;
13728 }
13729
DetectFastPatternTest494(void)13730 static int DetectFastPatternTest494(void)
13731 {
13732 DetectEngineCtx *de_ctx = NULL;
13733 int result = 0;
13734
13735 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13736 goto end;
13737
13738 de_ctx->flags |= DE_QUIET;
13739 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13740 "(content:\"one\"; http_server_body; "
13741 "content:\"two\"; http_server_body; distance:10; "
13742 "content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)");
13743 if (de_ctx->sig_list == NULL)
13744 goto end;
13745
13746 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
13747 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13748 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
13749 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
13750 ud->fp_chop_offset == 3 &&
13751 ud->fp_chop_len == 4) {
13752 result = 1;
13753 } else {
13754 result = 0;
13755 }
13756
13757 end:
13758 SigCleanSignatures(de_ctx);
13759 DetectEngineCtxFree(de_ctx);
13760 return result;
13761 }
13762
DetectFastPatternTest495(void)13763 static int DetectFastPatternTest495(void)
13764 {
13765 DetectEngineCtx *de_ctx = NULL;
13766 int result = 0;
13767
13768 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13769 goto end;
13770
13771 de_ctx->flags |= DE_QUIET;
13772 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13773 "(content:\"one\"; http_server_body; "
13774 "content:\"two\"; http_server_body; within:10; "
13775 "content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)");
13776 if (de_ctx->sig_list == NULL)
13777 goto end;
13778
13779 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
13780 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13781 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
13782 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
13783 ud->fp_chop_offset == 3 &&
13784 ud->fp_chop_len == 4) {
13785 result = 1;
13786 } else {
13787 result = 0;
13788 }
13789
13790 end:
13791 SigCleanSignatures(de_ctx);
13792 DetectEngineCtxFree(de_ctx);
13793 return result;
13794 }
13795
DetectFastPatternTest496(void)13796 static int DetectFastPatternTest496(void)
13797 {
13798 DetectEngineCtx *de_ctx = NULL;
13799 int result = 0;
13800
13801 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13802 goto end;
13803
13804 de_ctx->flags |= DE_QUIET;
13805 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13806 "(content:\"one\"; http_server_body; "
13807 "content:\"two\"; http_server_body; offset:10; "
13808 "content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)");
13809 if (de_ctx->sig_list == NULL)
13810 goto end;
13811
13812 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
13813 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13814 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
13815 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
13816 ud->fp_chop_offset == 3 &&
13817 ud->fp_chop_len == 4) {
13818 result = 1;
13819 } else {
13820 result = 0;
13821 }
13822
13823 end:
13824 SigCleanSignatures(de_ctx);
13825 DetectEngineCtxFree(de_ctx);
13826 return result;
13827 }
13828
DetectFastPatternTest497(void)13829 static int DetectFastPatternTest497(void)
13830 {
13831 DetectEngineCtx *de_ctx = NULL;
13832 int result = 0;
13833
13834 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13835 goto end;
13836
13837 de_ctx->flags |= DE_QUIET;
13838 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13839 "(content:\"one\"; http_server_body; "
13840 "content:\"two\"; http_server_body; depth:10; "
13841 "content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)");
13842 if (de_ctx->sig_list == NULL)
13843 goto end;
13844
13845 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
13846 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13847 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
13848 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
13849 ud->fp_chop_offset == 3 &&
13850 ud->fp_chop_len == 4) {
13851 result = 1;
13852 } else {
13853 result = 0;
13854 }
13855
13856
13857 result = 1;
13858
13859 end:
13860 SigCleanSignatures(de_ctx);
13861 DetectEngineCtxFree(de_ctx);
13862 return result;
13863 }
13864
DetectFastPatternTest498(void)13865 static int DetectFastPatternTest498(void)
13866 {
13867 DetectEngineCtx *de_ctx = NULL;
13868 int result = 0;
13869
13870 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13871 goto end;
13872
13873 de_ctx->flags |= DE_QUIET;
13874 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13875 "(content:\"one\"; http_server_body; "
13876 "content:\"two\"; fast_pattern:65977,4; http_server_body; "
13877 "content:\"three\"; http_server_body; distance:10; sid:1;)");
13878 if (de_ctx->sig_list != NULL)
13879 goto end;
13880
13881 result = 1;
13882
13883 end:
13884 SigCleanSignatures(de_ctx);
13885 DetectEngineCtxFree(de_ctx);
13886 return result;
13887 }
13888
DetectFastPatternTest499(void)13889 static int DetectFastPatternTest499(void)
13890 {
13891 DetectEngineCtx *de_ctx = NULL;
13892 int result = 0;
13893
13894 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13895 goto end;
13896
13897 de_ctx->flags |= DE_QUIET;
13898 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13899 "(content:\"one\"; http_server_body; "
13900 "content:\"oneonetwo\"; fast_pattern:3,65977; http_server_body; "
13901 "content:\"three\"; distance:10; http_server_body; sid:1;)");
13902 if (de_ctx->sig_list != NULL)
13903 goto end;
13904
13905 result = 1;
13906
13907 end:
13908 SigCleanSignatures(de_ctx);
13909 DetectEngineCtxFree(de_ctx);
13910 return result;
13911 }
13912
DetectFastPatternTest500(void)13913 static int DetectFastPatternTest500(void)
13914 {
13915 DetectEngineCtx *de_ctx = NULL;
13916 int result = 0;
13917
13918 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13919 goto end;
13920
13921 de_ctx->flags |= DE_QUIET;
13922 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13923 "(content:\"one\"; http_server_body; "
13924 "content:\"two\"; fast_pattern:65534,4; http_server_body; "
13925 "content:\"three\"; http_server_body; distance:10; sid:1;)");
13926 if (de_ctx->sig_list != NULL)
13927 goto end;
13928
13929 result = 1;
13930
13931 end:
13932 SigCleanSignatures(de_ctx);
13933 DetectEngineCtxFree(de_ctx);
13934 return result;
13935 }
13936
DetectFastPatternTest501(void)13937 static int DetectFastPatternTest501(void)
13938 {
13939 DetectEngineCtx *de_ctx = NULL;
13940 int result = 0;
13941
13942 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13943 goto end;
13944
13945 de_ctx->flags |= DE_QUIET;
13946 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13947 "(content:\"one\"; http_server_body; "
13948 "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
13949 "content:\"three\"; http_server_body; sid:1;)");
13950 if (de_ctx->sig_list == NULL)
13951 goto end;
13952
13953 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
13954 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
13955 ud->flags & DETECT_CONTENT_NEGATED &&
13956 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
13957 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
13958 ud->fp_chop_offset == 3 &&
13959 ud->fp_chop_len == 4) {
13960 result = 1;
13961 } else {
13962 result = 0;
13963 }
13964
13965 end:
13966 SigCleanSignatures(de_ctx);
13967 DetectEngineCtxFree(de_ctx);
13968 return result;
13969 }
13970
DetectFastPatternTest502(void)13971 static int DetectFastPatternTest502(void)
13972 {
13973 DetectEngineCtx *de_ctx = NULL;
13974 int result = 0;
13975
13976 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
13977 goto end;
13978
13979 de_ctx->flags |= DE_QUIET;
13980 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
13981 "(content:\"one\"; http_server_body; "
13982 "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; distance:10; "
13983 "content:\"three\"; http_server_body; sid:1;)");
13984 if (de_ctx->sig_list != NULL)
13985 goto end;
13986
13987 result = 1;
13988
13989 end:
13990 SigCleanSignatures(de_ctx);
13991 DetectEngineCtxFree(de_ctx);
13992 return result;
13993 }
13994
DetectFastPatternTest503(void)13995 static int DetectFastPatternTest503(void)
13996 {
13997 DetectEngineCtx *de_ctx = NULL;
13998 int result = 0;
13999
14000 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14001 goto end;
14002
14003 de_ctx->flags |= DE_QUIET;
14004 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14005 "(content:\"one\"; http_server_body; "
14006 "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; within:10; "
14007 "content:\"three\"; http_server_body; sid:1;)");
14008 if (de_ctx->sig_list != NULL)
14009 goto end;
14010
14011 result = 1;
14012
14013 end:
14014 SigCleanSignatures(de_ctx);
14015 DetectEngineCtxFree(de_ctx);
14016 return result;
14017 }
14018
DetectFastPatternTest504(void)14019 static int DetectFastPatternTest504(void)
14020 {
14021 DetectEngineCtx *de_ctx = NULL;
14022 int result = 0;
14023
14024 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14025 goto end;
14026
14027 de_ctx->flags |= DE_QUIET;
14028 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14029 "(content:\"one\"; http_server_body; "
14030 "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; offset:10; "
14031 "content:\"three\"; http_server_body; sid:1;)");
14032 if (de_ctx->sig_list != NULL)
14033 goto end;
14034
14035 result = 1;
14036
14037 end:
14038 SigCleanSignatures(de_ctx);
14039 DetectEngineCtxFree(de_ctx);
14040 return result;
14041 }
14042
DetectFastPatternTest505(void)14043 static int DetectFastPatternTest505(void)
14044 {
14045 DetectEngineCtx *de_ctx = NULL;
14046 int result = 0;
14047
14048 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14049 goto end;
14050
14051 de_ctx->flags |= DE_QUIET;
14052 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14053 "(content:\"one\"; http_server_body; "
14054 "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; depth:10; "
14055 "content:\"three\"; http_server_body; sid:1;)");
14056 if (de_ctx->sig_list != NULL)
14057 goto end;
14058
14059 result = 1;
14060
14061 end:
14062 SigCleanSignatures(de_ctx);
14063 DetectEngineCtxFree(de_ctx);
14064 return result;
14065 }
14066
DetectFastPatternTest506(void)14067 static int DetectFastPatternTest506(void)
14068 {
14069 DetectEngineCtx *de_ctx = NULL;
14070 int result = 0;
14071
14072 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14073 goto end;
14074
14075 de_ctx->flags |= DE_QUIET;
14076 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14077 "(content:\"one\"; http_server_body; "
14078 "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
14079 "content:\"three\"; http_server_body; sid:1;)");
14080 if (de_ctx->sig_list == NULL)
14081 goto end;
14082
14083 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
14084 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14085 ud->flags & DETECT_CONTENT_NEGATED &&
14086 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
14087 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
14088 ud->fp_chop_offset == 3 &&
14089 ud->fp_chop_len == 4) {
14090 result = 1;
14091 } else {
14092 result = 0;
14093 }
14094
14095 end:
14096 SigCleanSignatures(de_ctx);
14097 DetectEngineCtxFree(de_ctx);
14098 return result;
14099 }
14100
14101
14102 /* http_server_body fast_pattern tests ^ */
14103 /* file_data fast_pattern tests v */
14104
14105 /** \test file_data and icmp don't mix */
DetectFastPatternTest507(void)14106 static int DetectFastPatternTest507(void)
14107 {
14108 DetectEngineCtx *de_ctx = DetectEngineCtxInit();
14109 FAIL_IF_NULL(de_ctx);
14110 de_ctx->flags |= DE_QUIET;
14111
14112 Signature *s = DetectEngineAppendSig(de_ctx,
14113 "alert icmp any any -> any any "
14114 "(file_data; content:\"one\"; "
14115 "content:!\"oneonetwo\"; fast_pattern:3,4; "
14116 "content:\"three\"; sid:1;)");
14117 FAIL_IF_NOT_NULL(s);
14118
14119 DetectEngineCtxFree(de_ctx);
14120 PASS;
14121 }
14122
14123 /**
14124 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
14125 */
DetectFastPatternTest508(void)14126 static int DetectFastPatternTest508(void)
14127 {
14128 SigMatch *sm = NULL;
14129 DetectEngineCtx *de_ctx = NULL;
14130 int result = 0;
14131
14132 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14133 goto end;
14134
14135 de_ctx->flags |= DE_QUIET;
14136 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14137 "(file_data; content:\"one\"; fast_pattern:only; "
14138 "msg:\"Testing fast_pattern\"; sid:1;)");
14139 if (de_ctx->sig_list == NULL)
14140 goto end;
14141
14142 result = 0;
14143 sm = de_ctx->sig_list->sm_lists[g_file_data_buffer_id];
14144 if (sm != NULL) {
14145 if ( ((DetectContentData *)sm->ctx)->flags &
14146 DETECT_CONTENT_FAST_PATTERN) {
14147 result = 1;
14148 } else {
14149 result = 0;
14150 }
14151 }
14152
14153
14154 end:
14155 SigCleanSignatures(de_ctx);
14156 DetectEngineCtxFree(de_ctx);
14157 return result;
14158 }
14159
14160 /**
14161 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
14162 */
DetectFastPatternTest509(void)14163 static int DetectFastPatternTest509(void)
14164 {
14165 SigMatch *sm = NULL;
14166 DetectEngineCtx *de_ctx = NULL;
14167 int result = 0;
14168
14169 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14170 goto end;
14171
14172 de_ctx->flags |= DE_QUIET;
14173 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14174 "(file_data; content:\"oneoneone\"; fast_pattern:3,4; "
14175 "msg:\"Testing fast_pattern\"; sid:1;)");
14176 if (de_ctx->sig_list == NULL)
14177 goto end;
14178
14179 result = 0;
14180 sm = de_ctx->sig_list->sm_lists[g_file_data_buffer_id];
14181 if (sm != NULL) {
14182 if ( ((DetectContentData *)sm->ctx)->flags &
14183 DETECT_CONTENT_FAST_PATTERN) {
14184 result = 1;
14185 } else {
14186 result = 0;
14187 }
14188 }
14189
14190 end:
14191 SigCleanSignatures(de_ctx);
14192 DetectEngineCtxFree(de_ctx);
14193 return result;
14194 }
14195
DetectFastPatternTest510(void)14196 static int DetectFastPatternTest510(void)
14197 {
14198 SigMatch *sm = NULL;
14199 DetectEngineCtx *de_ctx = NULL;
14200 int result = 0;
14201
14202 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14203 goto end;
14204
14205 de_ctx->flags |= DE_QUIET;
14206 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14207 "(file_data; content:\"one\"; fast_pattern:only; sid:1;)");
14208 if (de_ctx->sig_list == NULL)
14209 goto end;
14210
14211 sm = de_ctx->sig_list->sm_lists[g_file_data_buffer_id];
14212 if (sm == NULL) {
14213 goto end;
14214 }
14215 DetectContentData *ud = (DetectContentData *)sm->ctx;
14216 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14217 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
14218 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
14219 ud->fp_chop_offset == 0 &&
14220 ud->fp_chop_len == 0) {
14221 result = 1;
14222 } else {
14223 result = 0;
14224 }
14225
14226 end:
14227 SigCleanSignatures(de_ctx);
14228 DetectEngineCtxFree(de_ctx);
14229 return result;
14230 }
14231
DetectFastPatternTest511(void)14232 static int DetectFastPatternTest511(void)
14233 {
14234 SigMatch *sm = NULL;
14235 DetectEngineCtx *de_ctx = NULL;
14236 int result = 0;
14237
14238 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14239 goto end;
14240
14241 de_ctx->flags |= DE_QUIET;
14242 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14243 "(file_data; content:\"oneoneone\"; fast_pattern:3,4; sid:1;)");
14244 if (de_ctx->sig_list == NULL)
14245 goto end;
14246
14247 sm = de_ctx->sig_list->sm_lists[g_file_data_buffer_id];
14248 if (sm == NULL) {
14249 goto end;
14250 }
14251
14252 DetectContentData *ud = (DetectContentData *)sm->ctx;
14253 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14254 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
14255 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
14256 ud->fp_chop_offset == 3 &&
14257 ud->fp_chop_len == 4) {
14258 result = 1;
14259 } else {
14260 result = 0;
14261 }
14262
14263 end:
14264 SigCleanSignatures(de_ctx);
14265 DetectEngineCtxFree(de_ctx);
14266 return result;
14267 }
14268
DetectFastPatternTest512(void)14269 static int DetectFastPatternTest512(void)
14270 {
14271 DetectEngineCtx *de_ctx = NULL;
14272 int result = 0;
14273
14274 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14275 goto end;
14276
14277 de_ctx->flags |= DE_QUIET;
14278 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14279 "(file_data; content:\"one\"; "
14280 "content:\"two\"; fast_pattern:only; distance:10; sid:1;)");
14281 if (de_ctx->sig_list != NULL)
14282 goto end;
14283
14284 result = 1;
14285
14286 end:
14287 SigCleanSignatures(de_ctx);
14288 DetectEngineCtxFree(de_ctx);
14289 return result;
14290 }
14291
DetectFastPatternTest513(void)14292 static int DetectFastPatternTest513(void)
14293 {
14294 DetectEngineCtx *de_ctx = NULL;
14295 int result = 0;
14296
14297 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14298 goto end;
14299
14300 de_ctx->flags |= DE_QUIET;
14301 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14302 "(file_data; content:\"one\"; "
14303 "content:\"two\"; distance:10; fast_pattern:only; sid:1;)");
14304 if (de_ctx->sig_list != NULL)
14305 goto end;
14306
14307 result = 1;
14308
14309 end:
14310 SigCleanSignatures(de_ctx);
14311 DetectEngineCtxFree(de_ctx);
14312 return result;
14313 }
14314
DetectFastPatternTest514(void)14315 static int DetectFastPatternTest514(void)
14316 {
14317 DetectEngineCtx *de_ctx = NULL;
14318 int result = 0;
14319
14320 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14321 goto end;
14322
14323 de_ctx->flags |= DE_QUIET;
14324 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14325 "(file_data; content:\"one\"; "
14326 "content:\"two\"; fast_pattern:only; within:10; sid:1;)");
14327 if (de_ctx->sig_list != NULL)
14328 goto end;
14329
14330 result = 1;
14331
14332 end:
14333 SigCleanSignatures(de_ctx);
14334 DetectEngineCtxFree(de_ctx);
14335 return result;
14336 }
14337
DetectFastPatternTest515(void)14338 static int DetectFastPatternTest515(void)
14339 {
14340 DetectEngineCtx *de_ctx = NULL;
14341 int result = 0;
14342
14343 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14344 goto end;
14345
14346 de_ctx->flags |= DE_QUIET;
14347 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14348 "(file_data; content:\"one\"; "
14349 "content:\"two\"; within:10; fast_pattern:only; sid:1;)");
14350 if (de_ctx->sig_list != NULL)
14351 goto end;
14352
14353 result = 1;
14354
14355 end:
14356 SigCleanSignatures(de_ctx);
14357 DetectEngineCtxFree(de_ctx);
14358 return result;
14359 }
14360
DetectFastPatternTest516(void)14361 static int DetectFastPatternTest516(void)
14362 {
14363 DetectEngineCtx *de_ctx = NULL;
14364 int result = 0;
14365
14366 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14367 goto end;
14368
14369 de_ctx->flags |= DE_QUIET;
14370 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14371 "(file_data; content:\"one\"; "
14372 "content:\"two\"; fast_pattern:only; offset:10; sid:1;)");
14373 if (de_ctx->sig_list != NULL)
14374 goto end;
14375
14376 result = 1;
14377
14378 end:
14379 SigCleanSignatures(de_ctx);
14380 DetectEngineCtxFree(de_ctx);
14381 return result;
14382 }
14383
DetectFastPatternTest517(void)14384 static int DetectFastPatternTest517(void)
14385 {
14386 DetectEngineCtx *de_ctx = NULL;
14387 int result = 0;
14388
14389 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14390 goto end;
14391
14392 de_ctx->flags |= DE_QUIET;
14393 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14394 "(file_data; content:\"one\"; "
14395 "content:\"two\"; offset:10; fast_pattern:only; sid:1;)");
14396 if (de_ctx->sig_list != NULL)
14397 goto end;
14398
14399 result = 1;
14400
14401 end:
14402 SigCleanSignatures(de_ctx);
14403 DetectEngineCtxFree(de_ctx);
14404 return result;
14405 }
14406
DetectFastPatternTest518(void)14407 static int DetectFastPatternTest518(void)
14408 {
14409 DetectEngineCtx *de_ctx = NULL;
14410 int result = 0;
14411
14412 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14413 goto end;
14414
14415 de_ctx->flags |= DE_QUIET;
14416 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14417 "(file_data; content:\"one\"; "
14418 "content:\"two\"; fast_pattern:only; depth:10; sid:1;)");
14419 if (de_ctx->sig_list != NULL)
14420 goto end;
14421
14422 result = 1;
14423
14424 end:
14425 SigCleanSignatures(de_ctx);
14426 DetectEngineCtxFree(de_ctx);
14427 return result;
14428 }
14429
DetectFastPatternTest519(void)14430 static int DetectFastPatternTest519(void)
14431 {
14432 DetectEngineCtx *de_ctx = NULL;
14433 int result = 0;
14434
14435 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14436 goto end;
14437
14438 de_ctx->flags |= DE_QUIET;
14439 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14440 "(file_data; content:\"one\"; "
14441 "content:\"two\"; depth:10; fast_pattern:only; sid:1;)");
14442 if (de_ctx->sig_list != NULL)
14443 goto end;
14444
14445 result = 1;
14446
14447 end:
14448 SigCleanSignatures(de_ctx);
14449 DetectEngineCtxFree(de_ctx);
14450 return result;
14451 }
14452
DetectFastPatternTest520(void)14453 static int DetectFastPatternTest520(void)
14454 {
14455 DetectEngineCtx *de_ctx = NULL;
14456 int result = 0;
14457
14458 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14459 goto end;
14460
14461 de_ctx->flags |= DE_QUIET;
14462 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14463 "(file_data; content:\"one\"; "
14464 "content:!\"two\"; fast_pattern:only; sid:1;)");
14465 if (de_ctx->sig_list != NULL)
14466 goto end;
14467
14468 result = 1;
14469
14470 end:
14471 SigCleanSignatures(de_ctx);
14472 DetectEngineCtxFree(de_ctx);
14473 return result;
14474 }
14475
DetectFastPatternTest521(void)14476 static int DetectFastPatternTest521(void)
14477 {
14478 DetectEngineCtx *de_ctx = NULL;
14479 int result = 0;
14480
14481 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14482 goto end;
14483
14484 de_ctx->flags |= DE_QUIET;
14485 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14486 "(file_data; content:\" one\"; "
14487 "content:\"two\"; distance:30; "
14488 "content:\"two\"; fast_pattern:only; sid:1;)");
14489 if (de_ctx->sig_list == NULL)
14490 goto end;
14491
14492 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
14493 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14494 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
14495 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
14496 ud->fp_chop_offset == 0 &&
14497 ud->fp_chop_len == 0) {
14498 result = 1;
14499 } else {
14500 result = 0;
14501 }
14502
14503 end:
14504 SigCleanSignatures(de_ctx);
14505 DetectEngineCtxFree(de_ctx);
14506 return result;
14507 }
14508
DetectFastPatternTest522(void)14509 static int DetectFastPatternTest522(void)
14510 {
14511 DetectEngineCtx *de_ctx = NULL;
14512 int result = 0;
14513
14514 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14515 goto end;
14516
14517 de_ctx->flags |= DE_QUIET;
14518 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14519 "(file_data; content:\"one\"; "
14520 "content:\"two\"; within:30; "
14521 "content:\"two\"; fast_pattern:only; sid:1;)");
14522 if (de_ctx->sig_list == NULL)
14523 goto end;
14524
14525 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
14526 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14527 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
14528 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
14529 ud->fp_chop_offset == 0 &&
14530 ud->fp_chop_len == 0) {
14531 result = 1;
14532 } else {
14533 result = 0;
14534 }
14535
14536 end:
14537 SigCleanSignatures(de_ctx);
14538 DetectEngineCtxFree(de_ctx);
14539 return result;
14540 }
14541
DetectFastPatternTest523(void)14542 static int DetectFastPatternTest523(void)
14543 {
14544 DetectEngineCtx *de_ctx = NULL;
14545 int result = 0;
14546
14547 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14548 goto end;
14549
14550 de_ctx->flags |= DE_QUIET;
14551 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14552 "(file_data; content:\"one\"; "
14553 "content:\"two\"; offset:30; "
14554 "content:\"two\"; fast_pattern:only; sid:1;)");
14555 if (de_ctx->sig_list == NULL)
14556 goto end;
14557
14558 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
14559 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14560 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
14561 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
14562 ud->fp_chop_offset == 0 &&
14563 ud->fp_chop_len == 0) {
14564 result = 1;
14565 } else {
14566 result = 0;
14567 }
14568
14569 end:
14570 SigCleanSignatures(de_ctx);
14571 DetectEngineCtxFree(de_ctx);
14572 return result;
14573 }
14574
DetectFastPatternTest524(void)14575 static int DetectFastPatternTest524(void)
14576 {
14577 DetectEngineCtx *de_ctx = NULL;
14578 int result = 0;
14579
14580 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14581 goto end;
14582
14583 de_ctx->flags |= DE_QUIET;
14584 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14585 "(file_data; content:\"one\"; "
14586 "content:\"two\"; depth:30; "
14587 "content:\"two\"; fast_pattern:only; sid:1;)");
14588 if (de_ctx->sig_list == NULL)
14589 goto end;
14590
14591 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
14592 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14593 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
14594 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
14595 ud->fp_chop_offset == 0 &&
14596 ud->fp_chop_len == 0) {
14597 result = 1;
14598 } else {
14599 result = 0;
14600 }
14601
14602 end:
14603 SigCleanSignatures(de_ctx);
14604 DetectEngineCtxFree(de_ctx);
14605 return result;
14606 }
14607
DetectFastPatternTest525(void)14608 static int DetectFastPatternTest525(void)
14609 {
14610 DetectEngineCtx *de_ctx = NULL;
14611 int result = 0;
14612
14613 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14614 goto end;
14615
14616 de_ctx->flags |= DE_QUIET;
14617 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14618 "(file_data; content:!\"one\"; fast_pattern; "
14619 "content:\"two\"; sid:1;)");
14620 if (de_ctx->sig_list == NULL)
14621 goto end;
14622
14623 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
14624 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14625 ud->flags & DETECT_CONTENT_NEGATED &&
14626 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
14627 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
14628 ud->fp_chop_offset == 0 &&
14629 ud->fp_chop_len == 0) {
14630 result = 1;
14631 } else {
14632 result = 0;
14633 }
14634
14635 end:
14636 SigCleanSignatures(de_ctx);
14637 DetectEngineCtxFree(de_ctx);
14638 return result;
14639 }
14640
DetectFastPatternTest526(void)14641 static int DetectFastPatternTest526(void)
14642 {
14643 DetectEngineCtx *de_ctx = NULL;
14644 int result = 0;
14645
14646 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14647 goto end;
14648
14649 de_ctx->flags |= DE_QUIET;
14650 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14651 "(file_data; content:\"two\"; "
14652 "content:!\"one\"; fast_pattern; distance:20; sid:1;)");
14653 if (de_ctx->sig_list != NULL)
14654 goto end;
14655
14656 result = 1;
14657
14658 end:
14659 SigCleanSignatures(de_ctx);
14660 DetectEngineCtxFree(de_ctx);
14661 return result;
14662 }
14663
DetectFastPatternTest527(void)14664 static int DetectFastPatternTest527(void)
14665 {
14666 DetectEngineCtx *de_ctx = NULL;
14667 int result = 0;
14668
14669 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14670 goto end;
14671
14672 de_ctx->flags |= DE_QUIET;
14673 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14674 "(file_data; content:\"two\"; "
14675 "content:!\"one\"; fast_pattern; within:20; sid:1;)");
14676 if (de_ctx->sig_list != NULL)
14677 goto end;
14678
14679 result = 1;
14680
14681 end:
14682 SigCleanSignatures(de_ctx);
14683 DetectEngineCtxFree(de_ctx);
14684 return result;
14685 }
14686
DetectFastPatternTest528(void)14687 static int DetectFastPatternTest528(void)
14688 {
14689 DetectEngineCtx *de_ctx = NULL;
14690 int result = 0;
14691
14692 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14693 goto end;
14694
14695 de_ctx->flags |= DE_QUIET;
14696 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14697 "(file_data; content:\"two\"; "
14698 "content:!\"one\"; fast_pattern; offset:20; sid:1;)");
14699 if (de_ctx->sig_list != NULL)
14700 goto end;
14701
14702 result = 1;
14703
14704 end:
14705 SigCleanSignatures(de_ctx);
14706 DetectEngineCtxFree(de_ctx);
14707 return result;
14708 }
14709
DetectFastPatternTest529(void)14710 static int DetectFastPatternTest529(void)
14711 {
14712 DetectEngineCtx *de_ctx = NULL;
14713 int result = 0;
14714
14715 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14716 goto end;
14717
14718 de_ctx->flags |= DE_QUIET;
14719 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14720 "(file_data; content:\"two\"; "
14721 "content:!\"one\"; fast_pattern; depth:20; sid:1;)");
14722 if (de_ctx->sig_list != NULL)
14723 goto end;
14724
14725 result = 1;
14726
14727 end:
14728 SigCleanSignatures(de_ctx);
14729 DetectEngineCtxFree(de_ctx);
14730 return result;
14731 }
14732
DetectFastPatternTest530(void)14733 static int DetectFastPatternTest530(void)
14734 {
14735 DetectEngineCtx *de_ctx = NULL;
14736 int result = 0;
14737
14738 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14739 goto end;
14740
14741 de_ctx->flags |= DE_QUIET;
14742 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14743 "(file_data; content:\"one\"; "
14744 "content:\"oneonetwo\"; fast_pattern:3,4; "
14745 "content:\"three\"; sid:1;)");
14746 if (de_ctx->sig_list == NULL)
14747 goto end;
14748
14749 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
14750 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14751 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
14752 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
14753 ud->fp_chop_offset == 3 &&
14754 ud->fp_chop_len == 4) {
14755 result = 1;
14756 } else {
14757 result = 0;
14758 }
14759
14760 end:
14761 SigCleanSignatures(de_ctx);
14762 DetectEngineCtxFree(de_ctx);
14763 return result;
14764 }
14765
DetectFastPatternTest531(void)14766 static int DetectFastPatternTest531(void)
14767 {
14768 DetectEngineCtx *de_ctx = NULL;
14769 int result = 0;
14770
14771 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14772 goto end;
14773
14774 de_ctx->flags |= DE_QUIET;
14775 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14776 "(file_data; content:\"one\"; "
14777 "content:\"oneonetwo\"; fast_pattern:3,4; "
14778 "content:\"three\"; distance:30; sid:1;)");
14779 if (de_ctx->sig_list == NULL)
14780 goto end;
14781
14782 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
14783 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14784 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
14785 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
14786 ud->fp_chop_offset == 3 &&
14787 ud->fp_chop_len == 4) {
14788 result = 1;
14789 } else {
14790 result = 0;
14791 }
14792
14793 end:
14794 SigCleanSignatures(de_ctx);
14795 DetectEngineCtxFree(de_ctx);
14796 return result;
14797 }
14798
DetectFastPatternTest532(void)14799 static int DetectFastPatternTest532(void)
14800 {
14801 DetectEngineCtx *de_ctx = NULL;
14802 int result = 0;
14803
14804 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14805 goto end;
14806
14807 de_ctx->flags |= DE_QUIET;
14808 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14809 "(file_data; content:\"one\"; "
14810 "content:\"oneonetwo\"; fast_pattern:3,4; "
14811 "content:\"three\"; within:30; sid:1;)");
14812 if (de_ctx->sig_list == NULL)
14813 goto end;
14814
14815 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
14816 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14817 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
14818 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
14819 ud->fp_chop_offset == 3 &&
14820 ud->fp_chop_len == 4) {
14821 result = 1;
14822 } else {
14823 result = 0;
14824 }
14825
14826 end:
14827 SigCleanSignatures(de_ctx);
14828 DetectEngineCtxFree(de_ctx);
14829 return result;
14830 }
14831
DetectFastPatternTest533(void)14832 static int DetectFastPatternTest533(void)
14833 {
14834 DetectEngineCtx *de_ctx = NULL;
14835 int result = 0;
14836
14837 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14838 goto end;
14839
14840 de_ctx->flags |= DE_QUIET;
14841 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14842 "(file_data; content:\"one\"; "
14843 "content:\"oneonetwo\"; fast_pattern:3,4; "
14844 "content:\"three\"; offset:30; sid:1;)");
14845 if (de_ctx->sig_list == NULL)
14846 goto end;
14847
14848 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
14849 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14850 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
14851 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
14852 ud->fp_chop_offset == 3 &&
14853 ud->fp_chop_len == 4) {
14854 result = 1;
14855 } else {
14856 result = 0;
14857 }
14858
14859 end:
14860 SigCleanSignatures(de_ctx);
14861 DetectEngineCtxFree(de_ctx);
14862 return result;
14863 }
14864
DetectFastPatternTest534(void)14865 static int DetectFastPatternTest534(void)
14866 {
14867 DetectEngineCtx *de_ctx = NULL;
14868 int result = 0;
14869
14870 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14871 goto end;
14872
14873 de_ctx->flags |= DE_QUIET;
14874 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14875 "(file_data; content:\"one\"; "
14876 "content:\"oneonetwo\"; fast_pattern:3,4; "
14877 "content:\"three\"; depth:30; sid:1;)");
14878 if (de_ctx->sig_list == NULL)
14879 goto end;
14880
14881 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
14882 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14883 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
14884 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
14885 ud->fp_chop_offset == 3 &&
14886 ud->fp_chop_len == 4) {
14887 result = 1;
14888 } else {
14889 result = 0;
14890 }
14891
14892 end:
14893 SigCleanSignatures(de_ctx);
14894 DetectEngineCtxFree(de_ctx);
14895 return result;
14896 }
14897
DetectFastPatternTest535(void)14898 static int DetectFastPatternTest535(void)
14899 {
14900 DetectEngineCtx *de_ctx = NULL;
14901 int result = 0;
14902
14903 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14904 goto end;
14905
14906 de_ctx->flags |= DE_QUIET;
14907 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14908 "(file_data; content:\"one\"; "
14909 "content:\"two\"; distance:10; "
14910 "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
14911 if (de_ctx->sig_list == NULL)
14912 goto end;
14913
14914 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
14915 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14916 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
14917 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
14918 ud->fp_chop_offset == 3 &&
14919 ud->fp_chop_len == 4) {
14920 result = 1;
14921 } else {
14922 result = 0;
14923 }
14924
14925 end:
14926 SigCleanSignatures(de_ctx);
14927 DetectEngineCtxFree(de_ctx);
14928 return result;
14929 }
14930
DetectFastPatternTest536(void)14931 static int DetectFastPatternTest536(void)
14932 {
14933 DetectEngineCtx *de_ctx = NULL;
14934 int result = 0;
14935
14936 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14937 goto end;
14938
14939 de_ctx->flags |= DE_QUIET;
14940 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14941 "(file_data; content:\"one\"; "
14942 "content:\"two\"; within:10; "
14943 "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
14944 if (de_ctx->sig_list == NULL)
14945 goto end;
14946
14947 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
14948 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14949 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
14950 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
14951 ud->fp_chop_offset == 3 &&
14952 ud->fp_chop_len == 4) {
14953 result = 1;
14954 } else {
14955 result = 0;
14956 }
14957
14958 end:
14959 SigCleanSignatures(de_ctx);
14960 DetectEngineCtxFree(de_ctx);
14961 return result;
14962 }
14963
DetectFastPatternTest537(void)14964 static int DetectFastPatternTest537(void)
14965 {
14966 DetectEngineCtx *de_ctx = NULL;
14967 int result = 0;
14968
14969 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
14970 goto end;
14971
14972 de_ctx->flags |= DE_QUIET;
14973 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
14974 "(file_data; content:\"one\"; "
14975 "content:\"two\"; offset:10; "
14976 "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
14977 if (de_ctx->sig_list == NULL)
14978 goto end;
14979
14980 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
14981 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
14982 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
14983 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
14984 ud->fp_chop_offset == 3 &&
14985 ud->fp_chop_len == 4) {
14986 result = 1;
14987 } else {
14988 result = 0;
14989 }
14990
14991 end:
14992 SigCleanSignatures(de_ctx);
14993 DetectEngineCtxFree(de_ctx);
14994 return result;
14995 }
14996
DetectFastPatternTest538(void)14997 static int DetectFastPatternTest538(void)
14998 {
14999 DetectEngineCtx *de_ctx = NULL;
15000 int result = 0;
15001
15002 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15003 goto end;
15004
15005 de_ctx->flags |= DE_QUIET;
15006 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15007 "(file_data; content:\"one\"; "
15008 "content:\"two\"; depth:10; "
15009 "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
15010 if (de_ctx->sig_list == NULL)
15011 goto end;
15012
15013 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->ctx;
15014 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
15015 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
15016 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
15017 ud->fp_chop_offset == 3 &&
15018 ud->fp_chop_len == 4) {
15019 result = 1;
15020 } else {
15021 result = 0;
15022 }
15023
15024
15025 result = 1;
15026
15027 end:
15028 SigCleanSignatures(de_ctx);
15029 DetectEngineCtxFree(de_ctx);
15030 return result;
15031 }
15032
DetectFastPatternTest539(void)15033 static int DetectFastPatternTest539(void)
15034 {
15035 DetectEngineCtx *de_ctx = NULL;
15036 int result = 0;
15037
15038 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15039 goto end;
15040
15041 de_ctx->flags |= DE_QUIET;
15042 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15043 "(file_data; content:\"one\"; "
15044 "content:\"two\"; fast_pattern:65977,4; "
15045 "content:\"three\"; distance:10; sid:1;)");
15046 if (de_ctx->sig_list != NULL)
15047 goto end;
15048
15049 result = 1;
15050
15051 end:
15052 SigCleanSignatures(de_ctx);
15053 DetectEngineCtxFree(de_ctx);
15054 return result;
15055 }
15056
DetectFastPatternTest540(void)15057 static int DetectFastPatternTest540(void)
15058 {
15059 DetectEngineCtx *de_ctx = NULL;
15060 int result = 0;
15061
15062 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15063 goto end;
15064
15065 de_ctx->flags |= DE_QUIET;
15066 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15067 "(file_data; content:\"one\"; "
15068 "content:\"oneonetwo\"; fast_pattern:3,65977; "
15069 "content:\"three\"; distance:10; sid:1;)");
15070 if (de_ctx->sig_list != NULL)
15071 goto end;
15072
15073 result = 1;
15074
15075 end:
15076 SigCleanSignatures(de_ctx);
15077 DetectEngineCtxFree(de_ctx);
15078 return result;
15079 }
15080
DetectFastPatternTest541(void)15081 static int DetectFastPatternTest541(void)
15082 {
15083 DetectEngineCtx *de_ctx = NULL;
15084 int result = 0;
15085
15086 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15087 goto end;
15088
15089 de_ctx->flags |= DE_QUIET;
15090 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15091 "(file_data; content:\"one\"; "
15092 "content:\"two\"; fast_pattern:65534,4; "
15093 "content:\"three\"; distance:10; sid:1;)");
15094 if (de_ctx->sig_list != NULL)
15095 goto end;
15096
15097 result = 1;
15098
15099 end:
15100 SigCleanSignatures(de_ctx);
15101 DetectEngineCtxFree(de_ctx);
15102 return result;
15103 }
15104
DetectFastPatternTest542(void)15105 static int DetectFastPatternTest542(void)
15106 {
15107 DetectEngineCtx *de_ctx = NULL;
15108 int result = 0;
15109
15110 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15111 goto end;
15112
15113 de_ctx->flags |= DE_QUIET;
15114 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15115 "(file_data; content:\"one\"; "
15116 "content:!\"oneonetwo\"; fast_pattern:3,4; "
15117 "content:\"three\"; sid:1;)");
15118 if (de_ctx->sig_list == NULL)
15119 goto end;
15120
15121 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
15122 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
15123 ud->flags & DETECT_CONTENT_NEGATED &&
15124 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
15125 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
15126 ud->fp_chop_offset == 3 &&
15127 ud->fp_chop_len == 4) {
15128 result = 1;
15129 } else {
15130 result = 0;
15131 }
15132
15133 end:
15134 SigCleanSignatures(de_ctx);
15135 DetectEngineCtxFree(de_ctx);
15136 return result;
15137 }
15138
DetectFastPatternTest543(void)15139 static int DetectFastPatternTest543(void)
15140 {
15141 DetectEngineCtx *de_ctx = NULL;
15142 int result = 0;
15143
15144 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15145 goto end;
15146
15147 de_ctx->flags |= DE_QUIET;
15148 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15149 "(file_data; content:\"one\"; "
15150 "content:!\"oneonetwo\"; fast_pattern:3,4; distance:10; "
15151 "content:\"three\"; sid:1;)");
15152 if (de_ctx->sig_list != NULL)
15153 goto end;
15154
15155 result = 1;
15156
15157 end:
15158 SigCleanSignatures(de_ctx);
15159 DetectEngineCtxFree(de_ctx);
15160 return result;
15161 }
15162
DetectFastPatternTest544(void)15163 static int DetectFastPatternTest544(void)
15164 {
15165 DetectEngineCtx *de_ctx = NULL;
15166 int result = 0;
15167
15168 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15169 goto end;
15170
15171 de_ctx->flags |= DE_QUIET;
15172 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15173 "(file_data; content:\"one\"; "
15174 "content:!\"oneonetwo\"; fast_pattern:3,4; within:10; "
15175 "content:\"three\"; sid:1;)");
15176 if (de_ctx->sig_list != NULL)
15177 goto end;
15178
15179 result = 1;
15180
15181 end:
15182 SigCleanSignatures(de_ctx);
15183 DetectEngineCtxFree(de_ctx);
15184 return result;
15185 }
15186
DetectFastPatternTest545(void)15187 static int DetectFastPatternTest545(void)
15188 {
15189 DetectEngineCtx *de_ctx = NULL;
15190 int result = 0;
15191
15192 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15193 goto end;
15194
15195 de_ctx->flags |= DE_QUIET;
15196 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15197 "(file_data; content:\"one\"; "
15198 "content:!\"oneonetwo\"; fast_pattern:3,4; offset:10; "
15199 "content:\"three\"; sid:1;)");
15200 if (de_ctx->sig_list != NULL)
15201 goto end;
15202
15203 result = 1;
15204
15205 end:
15206 SigCleanSignatures(de_ctx);
15207 DetectEngineCtxFree(de_ctx);
15208 return result;
15209 }
15210
DetectFastPatternTest546(void)15211 static int DetectFastPatternTest546(void)
15212 {
15213 DetectEngineCtx *de_ctx = NULL;
15214 int result = 0;
15215
15216 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15217 goto end;
15218
15219 de_ctx->flags |= DE_QUIET;
15220 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15221 "(file_data; content:\"one\"; "
15222 "content:!\"oneonetwo\"; fast_pattern:3,4; depth:10; "
15223 "content:\"three\"; sid:1;)");
15224 if (de_ctx->sig_list != NULL)
15225 goto end;
15226
15227 result = 1;
15228
15229 end:
15230 SigCleanSignatures(de_ctx);
15231 DetectEngineCtxFree(de_ctx);
15232 return result;
15233 }
15234
DetectFastPatternTest547(void)15235 static int DetectFastPatternTest547(void)
15236 {
15237 DetectEngineCtx *de_ctx = NULL;
15238 int result = 0;
15239
15240 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15241 goto end;
15242
15243 de_ctx->flags |= DE_QUIET;
15244 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15245 "(file_data; content:\"one\"; "
15246 "content:!\"oneonetwo\"; fast_pattern:3,4; "
15247 "content:\"three\"; sid:1;)");
15248 if (de_ctx->sig_list == NULL)
15249 goto end;
15250
15251 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_file_data_buffer_id]->prev->ctx;
15252 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
15253 ud->flags & DETECT_CONTENT_NEGATED &&
15254 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
15255 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
15256 ud->fp_chop_offset == 3 &&
15257 ud->fp_chop_len == 4) {
15258 result = 1;
15259 } else {
15260 result = 0;
15261 }
15262
15263 end:
15264 SigCleanSignatures(de_ctx);
15265 DetectEngineCtxFree(de_ctx);
15266 return result;
15267 }
15268
15269
15270 /* file_data fast_pattern tests ^ */
15271 /* http_user_agent fast_pattern tests v */
15272
15273
DetectFastPatternTest548(void)15274 static int DetectFastPatternTest548(void)
15275 {
15276 DetectEngineCtx *de_ctx = NULL;
15277 int result = 0;
15278
15279 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15280 goto end;
15281
15282 de_ctx->flags |= DE_QUIET;
15283 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15284 "(content:\"one\"; http_user_agent; "
15285 "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
15286 "content:\"three\"; http_user_agent; sid:1;)");
15287 if (de_ctx->sig_list == NULL)
15288 goto end;
15289 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->prev->ctx;
15290 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
15291 ud->flags & DETECT_CONTENT_NEGATED &&
15292 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
15293 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
15294 ud->fp_chop_offset == 3 &&
15295 ud->fp_chop_len == 4) {
15296 result = 1;
15297 } else {
15298 result = 0;
15299 }
15300
15301 end:
15302 SigCleanSignatures(de_ctx);
15303 DetectEngineCtxFree(de_ctx);
15304 return result;
15305 }
15306
15307
15308 /**
15309 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
15310 */
DetectFastPatternTest549(void)15311 static int DetectFastPatternTest549(void)
15312 {
15313 SigMatch *sm = NULL;
15314 DetectEngineCtx *de_ctx = NULL;
15315 int result = 0;
15316
15317 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15318 goto end;
15319
15320 de_ctx->flags |= DE_QUIET;
15321 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15322 "(content:\"one\"; fast_pattern:only; http_user_agent; "
15323 "msg:\"Testing fast_pattern\"; sid:1;)");
15324 if (de_ctx->sig_list == NULL)
15325 goto end;
15326
15327 result = 0;
15328 sm = de_ctx->sig_list->sm_lists[g_http_ua_buffer_id];
15329 if (sm != NULL) {
15330 if ( ((DetectContentData *)sm->ctx)->flags &
15331 DETECT_CONTENT_FAST_PATTERN) {
15332 result = 1;
15333 } else {
15334 result = 0;
15335 }
15336 }
15337
15338
15339 end:
15340 SigCleanSignatures(de_ctx);
15341 DetectEngineCtxFree(de_ctx);
15342 return result;
15343 }
15344
15345 /**
15346 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
15347 */
DetectFastPatternTest550(void)15348 static int DetectFastPatternTest550(void)
15349 {
15350 SigMatch *sm = NULL;
15351 DetectEngineCtx *de_ctx = NULL;
15352 int result = 0;
15353
15354 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15355 goto end;
15356
15357 de_ctx->flags |= DE_QUIET;
15358 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15359 "(content:\"oneoneone\"; fast_pattern:3,4; http_user_agent; "
15360 "msg:\"Testing fast_pattern\"; sid:1;)");
15361 if (de_ctx->sig_list == NULL)
15362 goto end;
15363
15364 result = 0;
15365 sm = de_ctx->sig_list->sm_lists[g_http_ua_buffer_id];
15366 if (sm != NULL) {
15367 if ( ((DetectContentData *)sm->ctx)->flags &
15368 DETECT_CONTENT_FAST_PATTERN) {
15369 result = 1;
15370 } else {
15371 result = 0;
15372 }
15373 }
15374
15375 end:
15376 SigCleanSignatures(de_ctx);
15377 DetectEngineCtxFree(de_ctx);
15378 return result;
15379 }
15380
DetectFastPatternTest551(void)15381 static int DetectFastPatternTest551(void)
15382 {
15383 SigMatch *sm = NULL;
15384 DetectEngineCtx *de_ctx = NULL;
15385 int result = 0;
15386
15387 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15388 goto end;
15389
15390 de_ctx->flags |= DE_QUIET;
15391 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15392 "(content:\"one\"; fast_pattern:only; http_user_agent; sid:1;)");
15393 if (de_ctx->sig_list == NULL)
15394 goto end;
15395
15396 sm = de_ctx->sig_list->sm_lists[g_http_ua_buffer_id];
15397 if (sm == NULL) {
15398 goto end;
15399 }
15400 DetectContentData *ud = (DetectContentData *)sm->ctx;
15401 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
15402 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
15403 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
15404 ud->fp_chop_offset == 0 &&
15405 ud->fp_chop_len == 0) {
15406 result = 1;
15407 } else {
15408 result = 0;
15409 }
15410
15411 end:
15412 SigCleanSignatures(de_ctx);
15413 DetectEngineCtxFree(de_ctx);
15414 return result;
15415 }
15416
DetectFastPatternTest552(void)15417 static int DetectFastPatternTest552(void)
15418 {
15419 SigMatch *sm = NULL;
15420 DetectEngineCtx *de_ctx = NULL;
15421 int result = 0;
15422
15423 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15424 goto end;
15425
15426 de_ctx->flags |= DE_QUIET;
15427 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15428 "(content:\"oneoneone\"; fast_pattern:3,4; http_user_agent; sid:1;)");
15429 if (de_ctx->sig_list == NULL)
15430 goto end;
15431
15432 sm = de_ctx->sig_list->sm_lists[g_http_ua_buffer_id];
15433 if (sm == NULL) {
15434 goto end;
15435 }
15436
15437 DetectContentData *ud = (DetectContentData *)sm->ctx;
15438 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
15439 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
15440 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
15441 ud->fp_chop_offset == 3 &&
15442 ud->fp_chop_len == 4) {
15443 result = 1;
15444 } else {
15445 result = 0;
15446 }
15447
15448 end:
15449 SigCleanSignatures(de_ctx);
15450 DetectEngineCtxFree(de_ctx);
15451 return result;
15452 }
15453
DetectFastPatternTest553(void)15454 static int DetectFastPatternTest553(void)
15455 {
15456 DetectEngineCtx *de_ctx = NULL;
15457 int result = 0;
15458
15459 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15460 goto end;
15461
15462 de_ctx->flags |= DE_QUIET;
15463 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15464 "(content:\"one\"; http_user_agent; "
15465 "content:\"two\"; fast_pattern:only; http_user_agent; distance:10; sid:1;)");
15466 if (de_ctx->sig_list != NULL)
15467 goto end;
15468
15469 result = 1;
15470
15471 end:
15472 SigCleanSignatures(de_ctx);
15473 DetectEngineCtxFree(de_ctx);
15474 return result;
15475 }
15476
DetectFastPatternTest554(void)15477 static int DetectFastPatternTest554(void)
15478 {
15479 DetectEngineCtx *de_ctx = NULL;
15480 int result = 0;
15481
15482 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15483 goto end;
15484
15485 de_ctx->flags |= DE_QUIET;
15486 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15487 "(content:\"one\"; http_user_agent; "
15488 "content:\"two\"; distance:10; fast_pattern:only; http_user_agent; sid:1;)");
15489 if (de_ctx->sig_list != NULL)
15490 goto end;
15491
15492 result = 1;
15493
15494 end:
15495 SigCleanSignatures(de_ctx);
15496 DetectEngineCtxFree(de_ctx);
15497 return result;
15498 }
15499
DetectFastPatternTest555(void)15500 static int DetectFastPatternTest555(void)
15501 {
15502 DetectEngineCtx *de_ctx = NULL;
15503 int result = 0;
15504
15505 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15506 goto end;
15507
15508 de_ctx->flags |= DE_QUIET;
15509 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15510 "(content:\"one\"; http_user_agent; "
15511 "content:\"two\"; fast_pattern:only; http_user_agent; within:10; sid:1;)");
15512 if (de_ctx->sig_list != NULL)
15513 goto end;
15514
15515 result = 1;
15516
15517 end:
15518 SigCleanSignatures(de_ctx);
15519 DetectEngineCtxFree(de_ctx);
15520 return result;
15521 }
15522
DetectFastPatternTest556(void)15523 static int DetectFastPatternTest556(void)
15524 {
15525 DetectEngineCtx *de_ctx = NULL;
15526 int result = 0;
15527
15528 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15529 goto end;
15530
15531 de_ctx->flags |= DE_QUIET;
15532 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15533 "(content:\"one\"; http_user_agent; "
15534 "content:\"two\"; within:10; fast_pattern:only; http_user_agent; sid:1;)");
15535 if (de_ctx->sig_list != NULL)
15536 goto end;
15537
15538 result = 1;
15539
15540 end:
15541 SigCleanSignatures(de_ctx);
15542 DetectEngineCtxFree(de_ctx);
15543 return result;
15544 }
15545
DetectFastPatternTest557(void)15546 static int DetectFastPatternTest557(void)
15547 {
15548 DetectEngineCtx *de_ctx = NULL;
15549 int result = 0;
15550
15551 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15552 goto end;
15553
15554 de_ctx->flags |= DE_QUIET;
15555 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15556 "(content:\"one\"; http_user_agent; "
15557 "content:\"two\"; fast_pattern:only; http_user_agent; offset:10; sid:1;)");
15558 if (de_ctx->sig_list != NULL)
15559 goto end;
15560
15561 result = 1;
15562
15563 end:
15564 SigCleanSignatures(de_ctx);
15565 DetectEngineCtxFree(de_ctx);
15566 return result;
15567 }
15568
DetectFastPatternTest558(void)15569 static int DetectFastPatternTest558(void)
15570 {
15571 DetectEngineCtx *de_ctx = NULL;
15572 int result = 0;
15573
15574 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15575 goto end;
15576
15577 de_ctx->flags |= DE_QUIET;
15578 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15579 "(content:\"one\"; http_user_agent; "
15580 "content:\"two\"; offset:10; fast_pattern:only; http_user_agent; sid:1;)");
15581 if (de_ctx->sig_list != NULL)
15582 goto end;
15583
15584 result = 1;
15585
15586 end:
15587 SigCleanSignatures(de_ctx);
15588 DetectEngineCtxFree(de_ctx);
15589 return result;
15590 }
15591
DetectFastPatternTest559(void)15592 static int DetectFastPatternTest559(void)
15593 {
15594 DetectEngineCtx *de_ctx = NULL;
15595 int result = 0;
15596
15597 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15598 goto end;
15599
15600 de_ctx->flags |= DE_QUIET;
15601 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15602 "(content:\"one\"; http_user_agent; "
15603 "content:\"two\"; fast_pattern:only; http_user_agent; depth:10; sid:1;)");
15604 if (de_ctx->sig_list != NULL)
15605 goto end;
15606
15607 result = 1;
15608
15609 end:
15610 SigCleanSignatures(de_ctx);
15611 DetectEngineCtxFree(de_ctx);
15612 return result;
15613 }
15614
DetectFastPatternTest560(void)15615 static int DetectFastPatternTest560(void)
15616 {
15617 DetectEngineCtx *de_ctx = NULL;
15618 int result = 0;
15619
15620 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15621 goto end;
15622
15623 de_ctx->flags |= DE_QUIET;
15624 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15625 "(content:\"one\"; http_user_agent; "
15626 "content:\"two\"; depth:10; fast_pattern:only; http_user_agent; sid:1;)");
15627 if (de_ctx->sig_list != NULL)
15628 goto end;
15629
15630 result = 1;
15631
15632 end:
15633 SigCleanSignatures(de_ctx);
15634 DetectEngineCtxFree(de_ctx);
15635 return result;
15636 }
15637
DetectFastPatternTest561(void)15638 static int DetectFastPatternTest561(void)
15639 {
15640 DetectEngineCtx *de_ctx = NULL;
15641 int result = 0;
15642
15643 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15644 goto end;
15645
15646 de_ctx->flags |= DE_QUIET;
15647 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15648 "(content:\"one\"; http_user_agent; "
15649 "content:!\"two\"; fast_pattern:only; http_user_agent; sid:1;)");
15650 if (de_ctx->sig_list != NULL)
15651 goto end;
15652
15653 result = 1;
15654
15655 end:
15656 SigCleanSignatures(de_ctx);
15657 DetectEngineCtxFree(de_ctx);
15658 return result;
15659 }
15660
DetectFastPatternTest562(void)15661 static int DetectFastPatternTest562(void)
15662 {
15663 DetectEngineCtx *de_ctx = NULL;
15664 int result = 0;
15665
15666 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15667 goto end;
15668
15669 de_ctx->flags |= DE_QUIET;
15670 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15671 "(content:\" one\"; http_user_agent; "
15672 "content:\"two\"; http_user_agent; distance:30; "
15673 "content:\"two\"; fast_pattern:only; http_user_agent; sid:1;)");
15674 if (de_ctx->sig_list == NULL)
15675 goto end;
15676
15677 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->ctx;
15678 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
15679 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
15680 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
15681 ud->fp_chop_offset == 0 &&
15682 ud->fp_chop_len == 0) {
15683 result = 1;
15684 } else {
15685 result = 0;
15686 }
15687
15688 end:
15689 SigCleanSignatures(de_ctx);
15690 DetectEngineCtxFree(de_ctx);
15691 return result;
15692 }
15693
DetectFastPatternTest563(void)15694 static int DetectFastPatternTest563(void)
15695 {
15696 DetectEngineCtx *de_ctx = NULL;
15697 int result = 0;
15698
15699 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15700 goto end;
15701
15702 de_ctx->flags |= DE_QUIET;
15703 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15704 "(content:\"one\"; http_user_agent; "
15705 "content:\"two\"; http_user_agent; within:30; "
15706 "content:\"two\"; fast_pattern:only; http_user_agent; sid:1;)");
15707 if (de_ctx->sig_list == NULL)
15708 goto end;
15709 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->ctx;
15710 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
15711 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
15712 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
15713 ud->fp_chop_offset == 0 &&
15714 ud->fp_chop_len == 0) {
15715 result = 1;
15716 } else {
15717 result = 0;
15718 }
15719
15720 end:
15721 SigCleanSignatures(de_ctx);
15722 DetectEngineCtxFree(de_ctx);
15723 return result;
15724 }
15725
DetectFastPatternTest564(void)15726 static int DetectFastPatternTest564(void)
15727 {
15728 DetectEngineCtx *de_ctx = NULL;
15729 int result = 0;
15730
15731 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15732 goto end;
15733
15734 de_ctx->flags |= DE_QUIET;
15735 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15736 "(content:\"one\"; http_user_agent; "
15737 "content:\"two\"; http_user_agent; offset:30; "
15738 "content:\"two\"; fast_pattern:only; http_user_agent; sid:1;)");
15739 if (de_ctx->sig_list == NULL)
15740 goto end;
15741 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->ctx;
15742 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
15743 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
15744 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
15745 ud->fp_chop_offset == 0 &&
15746 ud->fp_chop_len == 0) {
15747 result = 1;
15748 } else {
15749 result = 0;
15750 }
15751
15752 end:
15753 SigCleanSignatures(de_ctx);
15754 DetectEngineCtxFree(de_ctx);
15755 return result;
15756 }
15757
DetectFastPatternTest565(void)15758 static int DetectFastPatternTest565(void)
15759 {
15760 DetectEngineCtx *de_ctx = NULL;
15761 int result = 0;
15762
15763 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15764 goto end;
15765
15766 de_ctx->flags |= DE_QUIET;
15767 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15768 "(content:\"one\"; http_user_agent; "
15769 "content:\"two\"; http_user_agent; depth:30; "
15770 "content:\"two\"; fast_pattern:only; http_user_agent; sid:1;)");
15771 if (de_ctx->sig_list == NULL)
15772 goto end;
15773 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->ctx;
15774 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
15775 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
15776 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
15777 ud->fp_chop_offset == 0 &&
15778 ud->fp_chop_len == 0) {
15779 result = 1;
15780 } else {
15781 result = 0;
15782 }
15783
15784 end:
15785 SigCleanSignatures(de_ctx);
15786 DetectEngineCtxFree(de_ctx);
15787 return result;
15788 }
15789
DetectFastPatternTest566(void)15790 static int DetectFastPatternTest566(void)
15791 {
15792 DetectEngineCtx *de_ctx = NULL;
15793 int result = 0;
15794
15795 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15796 goto end;
15797
15798 de_ctx->flags |= DE_QUIET;
15799 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15800 "(content:!\"one\"; fast_pattern; http_user_agent; "
15801 "content:\"two\"; http_user_agent; sid:1;)");
15802 if (de_ctx->sig_list == NULL)
15803 goto end;
15804 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->prev->ctx;
15805 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
15806 ud->flags & DETECT_CONTENT_NEGATED &&
15807 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
15808 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
15809 ud->fp_chop_offset == 0 &&
15810 ud->fp_chop_len == 0) {
15811 result = 1;
15812 } else {
15813 result = 0;
15814 }
15815
15816 end:
15817 SigCleanSignatures(de_ctx);
15818 DetectEngineCtxFree(de_ctx);
15819 return result;
15820 }
15821
DetectFastPatternTest567(void)15822 static int DetectFastPatternTest567(void)
15823 {
15824 DetectEngineCtx *de_ctx = NULL;
15825 int result = 0;
15826
15827 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15828 goto end;
15829
15830 de_ctx->flags |= DE_QUIET;
15831 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15832 "(content:\"two\"; http_user_agent; "
15833 "content:!\"one\"; fast_pattern; http_user_agent; distance:20; sid:1;)");
15834 if (de_ctx->sig_list != NULL)
15835 goto end;
15836
15837 result = 1;
15838
15839 end:
15840 SigCleanSignatures(de_ctx);
15841 DetectEngineCtxFree(de_ctx);
15842 return result;
15843 }
15844
DetectFastPatternTest568(void)15845 static int DetectFastPatternTest568(void)
15846 {
15847 DetectEngineCtx *de_ctx = NULL;
15848 int result = 0;
15849
15850 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15851 goto end;
15852
15853 de_ctx->flags |= DE_QUIET;
15854 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15855 "(content:\"two\"; http_user_agent; "
15856 "content:!\"one\"; fast_pattern; http_user_agent; within:20; sid:1;)");
15857 if (de_ctx->sig_list != NULL)
15858 goto end;
15859
15860 result = 1;
15861
15862 end:
15863 SigCleanSignatures(de_ctx);
15864 DetectEngineCtxFree(de_ctx);
15865 return result;
15866 }
15867
DetectFastPatternTest569(void)15868 static int DetectFastPatternTest569(void)
15869 {
15870 DetectEngineCtx *de_ctx = NULL;
15871 int result = 0;
15872
15873 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15874 goto end;
15875
15876 de_ctx->flags |= DE_QUIET;
15877 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15878 "(content:\"two\"; http_user_agent; "
15879 "content:!\"one\"; fast_pattern; http_user_agent; offset:20; sid:1;)");
15880 if (de_ctx->sig_list != NULL)
15881 goto end;
15882
15883 result = 1;
15884
15885 end:
15886 SigCleanSignatures(de_ctx);
15887 DetectEngineCtxFree(de_ctx);
15888 return result;
15889 }
15890
DetectFastPatternTest570(void)15891 static int DetectFastPatternTest570(void)
15892 {
15893 DetectEngineCtx *de_ctx = NULL;
15894 int result = 0;
15895
15896 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15897 goto end;
15898
15899 de_ctx->flags |= DE_QUIET;
15900 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15901 "(content:\"two\"; http_user_agent; "
15902 "content:!\"one\"; fast_pattern; http_user_agent; depth:20; sid:1;)");
15903 if (de_ctx->sig_list != NULL)
15904 goto end;
15905
15906 result = 1;
15907
15908 end:
15909 SigCleanSignatures(de_ctx);
15910 DetectEngineCtxFree(de_ctx);
15911 return result;
15912 }
15913
DetectFastPatternTest571(void)15914 static int DetectFastPatternTest571(void)
15915 {
15916 DetectEngineCtx *de_ctx = NULL;
15917 int result = 0;
15918
15919 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15920 goto end;
15921
15922 de_ctx->flags |= DE_QUIET;
15923 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15924 "(content:\"one\"; http_user_agent; "
15925 "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
15926 "content:\"three\"; http_user_agent; sid:1;)");
15927 if (de_ctx->sig_list == NULL)
15928 goto end;
15929 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->prev->ctx;
15930 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
15931 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
15932 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
15933 ud->fp_chop_offset == 3 &&
15934 ud->fp_chop_len == 4) {
15935 result = 1;
15936 } else {
15937 result = 0;
15938 }
15939
15940 end:
15941 SigCleanSignatures(de_ctx);
15942 DetectEngineCtxFree(de_ctx);
15943 return result;
15944 }
15945
DetectFastPatternTest572(void)15946 static int DetectFastPatternTest572(void)
15947 {
15948 DetectEngineCtx *de_ctx = NULL;
15949 int result = 0;
15950
15951 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15952 goto end;
15953
15954 de_ctx->flags |= DE_QUIET;
15955 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15956 "(content:\"one\"; http_user_agent; "
15957 "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
15958 "content:\"three\"; http_user_agent; distance:30; sid:1;)");
15959 if (de_ctx->sig_list == NULL)
15960 goto end;
15961 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->prev->ctx;
15962 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
15963 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
15964 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
15965 ud->fp_chop_offset == 3 &&
15966 ud->fp_chop_len == 4) {
15967 result = 1;
15968 } else {
15969 result = 0;
15970 }
15971
15972 end:
15973 SigCleanSignatures(de_ctx);
15974 DetectEngineCtxFree(de_ctx);
15975 return result;
15976 }
15977
DetectFastPatternTest573(void)15978 static int DetectFastPatternTest573(void)
15979 {
15980 DetectEngineCtx *de_ctx = NULL;
15981 int result = 0;
15982
15983 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
15984 goto end;
15985
15986 de_ctx->flags |= DE_QUIET;
15987 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
15988 "(content:\"one\"; http_user_agent; "
15989 "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
15990 "content:\"three\"; http_user_agent; within:30; sid:1;)");
15991 if (de_ctx->sig_list == NULL)
15992 goto end;
15993 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->prev->ctx;
15994 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
15995 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
15996 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
15997 ud->fp_chop_offset == 3 &&
15998 ud->fp_chop_len == 4) {
15999 result = 1;
16000 } else {
16001 result = 0;
16002 }
16003
16004 end:
16005 SigCleanSignatures(de_ctx);
16006 DetectEngineCtxFree(de_ctx);
16007 return result;
16008 }
16009
DetectFastPatternTest574(void)16010 static int DetectFastPatternTest574(void)
16011 {
16012 DetectEngineCtx *de_ctx = NULL;
16013 int result = 0;
16014
16015 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16016 goto end;
16017
16018 de_ctx->flags |= DE_QUIET;
16019 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16020 "(content:\"one\"; http_user_agent; "
16021 "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
16022 "content:\"three\"; http_user_agent; offset:30; sid:1;)");
16023 if (de_ctx->sig_list == NULL)
16024 goto end;
16025 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->prev->ctx;
16026 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16027 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
16028 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
16029 ud->fp_chop_offset == 3 &&
16030 ud->fp_chop_len == 4) {
16031 result = 1;
16032 } else {
16033 result = 0;
16034 }
16035
16036 end:
16037 SigCleanSignatures(de_ctx);
16038 DetectEngineCtxFree(de_ctx);
16039 return result;
16040 }
16041
DetectFastPatternTest575(void)16042 static int DetectFastPatternTest575(void)
16043 {
16044 DetectEngineCtx *de_ctx = NULL;
16045 int result = 0;
16046
16047 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16048 goto end;
16049
16050 de_ctx->flags |= DE_QUIET;
16051 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16052 "(content:\"one\"; http_user_agent; "
16053 "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
16054 "content:\"three\"; http_user_agent; depth:30; sid:1;)");
16055 if (de_ctx->sig_list == NULL)
16056 goto end;
16057 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->prev->ctx;
16058 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16059 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
16060 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
16061 ud->fp_chop_offset == 3 &&
16062 ud->fp_chop_len == 4) {
16063 result = 1;
16064 } else {
16065 result = 0;
16066 }
16067
16068 end:
16069 SigCleanSignatures(de_ctx);
16070 DetectEngineCtxFree(de_ctx);
16071 return result;
16072 }
16073
DetectFastPatternTest576(void)16074 static int DetectFastPatternTest576(void)
16075 {
16076 DetectEngineCtx *de_ctx = NULL;
16077 int result = 0;
16078
16079 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16080 goto end;
16081
16082 de_ctx->flags |= DE_QUIET;
16083 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16084 "(content:\"one\"; http_user_agent; "
16085 "content:\"two\"; http_user_agent; distance:10; "
16086 "content:\"oneonethree\"; fast_pattern:3,4; http_user_agent; sid:1;)");
16087 if (de_ctx->sig_list == NULL)
16088 goto end;
16089 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->ctx;
16090 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16091 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
16092 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
16093 ud->fp_chop_offset == 3 &&
16094 ud->fp_chop_len == 4) {
16095 result = 1;
16096 } else {
16097 result = 0;
16098 }
16099
16100 end:
16101 SigCleanSignatures(de_ctx);
16102 DetectEngineCtxFree(de_ctx);
16103 return result;
16104 }
16105
DetectFastPatternTest577(void)16106 static int DetectFastPatternTest577(void)
16107 {
16108 DetectEngineCtx *de_ctx = NULL;
16109 int result = 0;
16110
16111 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16112 goto end;
16113
16114 de_ctx->flags |= DE_QUIET;
16115 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16116 "(content:\"one\"; http_user_agent; "
16117 "content:\"two\"; http_user_agent; within:10; "
16118 "content:\"oneonethree\"; fast_pattern:3,4; http_user_agent; sid:1;)");
16119 if (de_ctx->sig_list == NULL)
16120 goto end;
16121 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->ctx;
16122 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16123 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
16124 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
16125 ud->fp_chop_offset == 3 &&
16126 ud->fp_chop_len == 4) {
16127 result = 1;
16128 } else {
16129 result = 0;
16130 }
16131
16132 end:
16133 SigCleanSignatures(de_ctx);
16134 DetectEngineCtxFree(de_ctx);
16135 return result;
16136 }
16137
DetectFastPatternTest578(void)16138 static int DetectFastPatternTest578(void)
16139 {
16140 DetectEngineCtx *de_ctx = NULL;
16141 int result = 0;
16142
16143 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16144 goto end;
16145
16146 de_ctx->flags |= DE_QUIET;
16147 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16148 "(content:\"one\"; http_user_agent; "
16149 "content:\"two\"; http_user_agent; offset:10; "
16150 "content:\"oneonethree\"; fast_pattern:3,4; http_user_agent; sid:1;)");
16151 if (de_ctx->sig_list == NULL)
16152 goto end;
16153 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->ctx;
16154 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16155 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
16156 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
16157 ud->fp_chop_offset == 3 &&
16158 ud->fp_chop_len == 4) {
16159 result = 1;
16160 } else {
16161 result = 0;
16162 }
16163
16164 end:
16165 SigCleanSignatures(de_ctx);
16166 DetectEngineCtxFree(de_ctx);
16167 return result;
16168 }
16169
DetectFastPatternTest579(void)16170 static int DetectFastPatternTest579(void)
16171 {
16172 DetectEngineCtx *de_ctx = NULL;
16173 int result = 0;
16174
16175 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16176 goto end;
16177
16178 de_ctx->flags |= DE_QUIET;
16179 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16180 "(content:\"one\"; http_user_agent; "
16181 "content:\"two\"; http_user_agent; depth:10; "
16182 "content:\"oneonethree\"; fast_pattern:3,4; http_user_agent; sid:1;)");
16183 if (de_ctx->sig_list == NULL)
16184 goto end;
16185 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->ctx;
16186 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16187 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
16188 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
16189 ud->fp_chop_offset == 3 &&
16190 ud->fp_chop_len == 4) {
16191 result = 1;
16192 } else {
16193 result = 0;
16194 }
16195
16196
16197 result = 1;
16198
16199 end:
16200 SigCleanSignatures(de_ctx);
16201 DetectEngineCtxFree(de_ctx);
16202 return result;
16203 }
16204
DetectFastPatternTest580(void)16205 static int DetectFastPatternTest580(void)
16206 {
16207 DetectEngineCtx *de_ctx = NULL;
16208 int result = 0;
16209
16210 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16211 goto end;
16212
16213 de_ctx->flags |= DE_QUIET;
16214 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16215 "(content:\"one\"; http_user_agent; "
16216 "content:\"two\"; fast_pattern:65977,4; http_user_agent; "
16217 "content:\"three\"; http_user_agent; distance:10; sid:1;)");
16218 if (de_ctx->sig_list != NULL)
16219 goto end;
16220
16221 result = 1;
16222
16223 end:
16224 SigCleanSignatures(de_ctx);
16225 DetectEngineCtxFree(de_ctx);
16226 return result;
16227 }
16228
DetectFastPatternTest581(void)16229 static int DetectFastPatternTest581(void)
16230 {
16231 DetectEngineCtx *de_ctx = NULL;
16232 int result = 0;
16233
16234 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16235 goto end;
16236
16237 de_ctx->flags |= DE_QUIET;
16238 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16239 "(content:\"one\"; http_user_agent; "
16240 "content:\"oneonetwo\"; fast_pattern:3,65977; http_user_agent; "
16241 "content:\"three\"; distance:10; http_user_agent; sid:1;)");
16242 if (de_ctx->sig_list != NULL)
16243 goto end;
16244
16245 result = 1;
16246
16247 end:
16248 SigCleanSignatures(de_ctx);
16249 DetectEngineCtxFree(de_ctx);
16250 return result;
16251 }
16252
DetectFastPatternTest582(void)16253 static int DetectFastPatternTest582(void)
16254 {
16255 DetectEngineCtx *de_ctx = NULL;
16256 int result = 0;
16257
16258 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16259 goto end;
16260
16261 de_ctx->flags |= DE_QUIET;
16262 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16263 "(content:\"one\"; http_user_agent; "
16264 "content:\"two\"; fast_pattern:65534,4; http_user_agent; "
16265 "content:\"three\"; http_user_agent; distance:10; sid:1;)");
16266 if (de_ctx->sig_list != NULL)
16267 goto end;
16268
16269 result = 1;
16270
16271 end:
16272 SigCleanSignatures(de_ctx);
16273 DetectEngineCtxFree(de_ctx);
16274 return result;
16275 }
16276
DetectFastPatternTest583(void)16277 static int DetectFastPatternTest583(void)
16278 {
16279 DetectEngineCtx *de_ctx = NULL;
16280 int result = 0;
16281
16282 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16283 goto end;
16284
16285 de_ctx->flags |= DE_QUIET;
16286 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16287 "(content:\"one\"; http_user_agent; "
16288 "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
16289 "content:\"three\"; http_user_agent; sid:1;)");
16290 if (de_ctx->sig_list == NULL)
16291 goto end;
16292 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->prev->ctx;
16293 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16294 ud->flags & DETECT_CONTENT_NEGATED &&
16295 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
16296 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
16297 ud->fp_chop_offset == 3 &&
16298 ud->fp_chop_len == 4) {
16299 result = 1;
16300 } else {
16301 result = 0;
16302 }
16303
16304 end:
16305 SigCleanSignatures(de_ctx);
16306 DetectEngineCtxFree(de_ctx);
16307 return result;
16308 }
16309
DetectFastPatternTest584(void)16310 static int DetectFastPatternTest584(void)
16311 {
16312 DetectEngineCtx *de_ctx = NULL;
16313 int result = 0;
16314
16315 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16316 goto end;
16317
16318 de_ctx->flags |= DE_QUIET;
16319 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16320 "(content:\"one\"; http_user_agent; "
16321 "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; distance:10; "
16322 "content:\"three\"; http_user_agent; sid:1;)");
16323 if (de_ctx->sig_list != NULL)
16324 goto end;
16325
16326 result = 1;
16327
16328 end:
16329 SigCleanSignatures(de_ctx);
16330 DetectEngineCtxFree(de_ctx);
16331 return result;
16332 }
16333
DetectFastPatternTest585(void)16334 static int DetectFastPatternTest585(void)
16335 {
16336 DetectEngineCtx *de_ctx = NULL;
16337 int result = 0;
16338
16339 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16340 goto end;
16341
16342 de_ctx->flags |= DE_QUIET;
16343 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16344 "(content:\"one\"; http_user_agent; "
16345 "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; within:10; "
16346 "content:\"three\"; http_user_agent; sid:1;)");
16347 if (de_ctx->sig_list != NULL)
16348 goto end;
16349
16350 result = 1;
16351
16352 end:
16353 SigCleanSignatures(de_ctx);
16354 DetectEngineCtxFree(de_ctx);
16355 return result;
16356 }
16357
DetectFastPatternTest586(void)16358 static int DetectFastPatternTest586(void)
16359 {
16360 DetectEngineCtx *de_ctx = NULL;
16361 int result = 0;
16362
16363 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16364 goto end;
16365
16366 de_ctx->flags |= DE_QUIET;
16367 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16368 "(content:\"one\"; http_user_agent; "
16369 "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; offset:10; "
16370 "content:\"three\"; http_user_agent; sid:1;)");
16371 if (de_ctx->sig_list != NULL)
16372 goto end;
16373
16374 result = 1;
16375
16376 end:
16377 SigCleanSignatures(de_ctx);
16378 DetectEngineCtxFree(de_ctx);
16379 return result;
16380 }
16381
DetectFastPatternTest587(void)16382 static int DetectFastPatternTest587(void)
16383 {
16384 DetectEngineCtx *de_ctx = NULL;
16385 int result = 0;
16386
16387 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16388 goto end;
16389
16390 de_ctx->flags |= DE_QUIET;
16391 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16392 "(content:\"one\"; http_user_agent; "
16393 "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; depth:10; "
16394 "content:\"three\"; http_user_agent; sid:1;)");
16395 if (de_ctx->sig_list != NULL)
16396 goto end;
16397
16398 result = 1;
16399
16400 end:
16401 SigCleanSignatures(de_ctx);
16402 DetectEngineCtxFree(de_ctx);
16403 return result;
16404 }
16405
DetectFastPatternTest588(void)16406 static int DetectFastPatternTest588(void)
16407 {
16408 DetectEngineCtx *de_ctx = NULL;
16409 int result = 0;
16410
16411 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16412 goto end;
16413
16414 de_ctx->flags |= DE_QUIET;
16415 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16416 "(content:\"one\"; http_user_agent; "
16417 "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
16418 "content:\"three\"; http_user_agent; sid:1;)");
16419 if (de_ctx->sig_list == NULL)
16420 goto end;
16421 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_ua_buffer_id]->prev->ctx;
16422 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16423 ud->flags & DETECT_CONTENT_NEGATED &&
16424 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
16425 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
16426 ud->fp_chop_offset == 3 &&
16427 ud->fp_chop_len == 4) {
16428 result = 1;
16429 } else {
16430 result = 0;
16431 }
16432
16433 end:
16434 SigCleanSignatures(de_ctx);
16435 DetectEngineCtxFree(de_ctx);
16436 return result;
16437 }
16438
16439
16440 /* http_user_agent fast_pattern tests ^ */
16441 /* http_host fast_pattern tests v */
16442
16443
DetectFastPatternTest589(void)16444 static int DetectFastPatternTest589(void)
16445 {
16446 DetectEngineCtx *de_ctx = NULL;
16447 int result = 0;
16448
16449 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16450 goto end;
16451
16452 de_ctx->flags |= DE_QUIET;
16453 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16454 "(content:\"one\"; http_host; "
16455 "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; "
16456 "content:\"three\"; http_host; sid:1;)");
16457 if (de_ctx->sig_list == NULL)
16458 goto end;
16459 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
16460 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16461 ud->flags & DETECT_CONTENT_NEGATED &&
16462 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
16463 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
16464 ud->fp_chop_offset == 3 &&
16465 ud->fp_chop_len == 4) {
16466 result = 1;
16467 } else {
16468 result = 0;
16469 }
16470
16471 end:
16472 SigCleanSignatures(de_ctx);
16473 DetectEngineCtxFree(de_ctx);
16474 return result;
16475 }
16476
16477 /**
16478 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
16479 */
DetectFastPatternTest590(void)16480 static int DetectFastPatternTest590(void)
16481 {
16482 SigMatch *sm = NULL;
16483 DetectEngineCtx *de_ctx = NULL;
16484 int result = 0;
16485
16486 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16487 goto end;
16488
16489 de_ctx->flags |= DE_QUIET;
16490 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16491 "(content:\"one\"; fast_pattern:only; http_host; "
16492 "msg:\"Testing fast_pattern\"; sid:1;)");
16493 if (de_ctx->sig_list == NULL)
16494 goto end;
16495
16496 result = 0;
16497 sm = de_ctx->sig_list->sm_lists[g_http_host_buffer_id];
16498 if (sm != NULL) {
16499 if ( (((DetectContentData *)sm->ctx)->flags &
16500 DETECT_CONTENT_FAST_PATTERN)) {
16501 result = 1;
16502 } else {
16503 result = 0;
16504 }
16505 }
16506
16507
16508 end:
16509 SigCleanSignatures(de_ctx);
16510 DetectEngineCtxFree(de_ctx);
16511 return result;
16512 }
16513
16514 /**
16515 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
16516 */
DetectFastPatternTest591(void)16517 static int DetectFastPatternTest591(void)
16518 {
16519 SigMatch *sm = NULL;
16520 DetectEngineCtx *de_ctx = NULL;
16521 int result = 0;
16522
16523 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16524 goto end;
16525
16526 de_ctx->flags |= DE_QUIET;
16527 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16528 "(content:\"oneoneone\"; fast_pattern:3,4; http_host; "
16529 "msg:\"Testing fast_pattern\"; sid:1;)");
16530 if (de_ctx->sig_list == NULL)
16531 goto end;
16532
16533 result = 0;
16534 sm = de_ctx->sig_list->sm_lists[g_http_host_buffer_id];
16535 if (sm != NULL) {
16536 if ( (((DetectContentData *)sm->ctx)->flags &
16537 DETECT_CONTENT_FAST_PATTERN)) {
16538 result = 1;
16539 } else {
16540 result = 0;
16541 }
16542 }
16543
16544 end:
16545 SigCleanSignatures(de_ctx);
16546 DetectEngineCtxFree(de_ctx);
16547 return result;
16548 }
16549
DetectFastPatternTest592(void)16550 static int DetectFastPatternTest592(void)
16551 {
16552 SigMatch *sm = NULL;
16553 DetectEngineCtx *de_ctx = NULL;
16554 int result = 0;
16555
16556 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16557 goto end;
16558
16559 de_ctx->flags |= DE_QUIET;
16560 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16561 "(content:\"one\"; fast_pattern:only; http_host; sid:1;)");
16562 if (de_ctx->sig_list == NULL)
16563 goto end;
16564
16565 sm = de_ctx->sig_list->sm_lists[g_http_host_buffer_id];
16566 if (sm == NULL) {
16567 goto end;
16568 }
16569 DetectContentData *ud = (DetectContentData *)sm->ctx;
16570 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16571 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
16572 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
16573 ud->fp_chop_offset == 0 &&
16574 ud->fp_chop_len == 0) {
16575 result = 1;
16576 } else {
16577 result = 0;
16578 }
16579
16580 end:
16581 SigCleanSignatures(de_ctx);
16582 DetectEngineCtxFree(de_ctx);
16583 return result;
16584 }
16585
DetectFastPatternTest593(void)16586 static int DetectFastPatternTest593(void)
16587 {
16588 SigMatch *sm = NULL;
16589 DetectEngineCtx *de_ctx = NULL;
16590 int result = 0;
16591
16592 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16593 goto end;
16594
16595 de_ctx->flags |= DE_QUIET;
16596 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16597 "(content:\"oneoneone\"; fast_pattern:3,4; http_host; sid:1;)");
16598 if (de_ctx->sig_list == NULL)
16599 goto end;
16600
16601 sm = de_ctx->sig_list->sm_lists[g_http_host_buffer_id];
16602 if (sm == NULL) {
16603 goto end;
16604 }
16605
16606 DetectContentData *ud = (DetectContentData *)sm->ctx;
16607 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16608 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
16609 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
16610 ud->fp_chop_offset == 3 &&
16611 ud->fp_chop_len == 4) {
16612 result = 1;
16613 } else {
16614 result = 0;
16615 }
16616
16617 end:
16618 SigCleanSignatures(de_ctx);
16619 DetectEngineCtxFree(de_ctx);
16620 return result;
16621 }
16622
DetectFastPatternTest594(void)16623 static int DetectFastPatternTest594(void)
16624 {
16625 DetectEngineCtx *de_ctx = NULL;
16626 int result = 0;
16627
16628 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16629 goto end;
16630
16631 de_ctx->flags |= DE_QUIET;
16632 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16633 "(content:\"one\"; http_host; "
16634 "content:\"two\"; fast_pattern:only; http_host; distance:10; sid:1;)");
16635 if (de_ctx->sig_list != NULL)
16636 goto end;
16637
16638 result = 1;
16639
16640 end:
16641 SigCleanSignatures(de_ctx);
16642 DetectEngineCtxFree(de_ctx);
16643 return result;
16644 }
16645
DetectFastPatternTest595(void)16646 static int DetectFastPatternTest595(void)
16647 {
16648 DetectEngineCtx *de_ctx = NULL;
16649 int result = 0;
16650
16651 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16652 goto end;
16653
16654 de_ctx->flags |= DE_QUIET;
16655 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16656 "(content:\"one\"; http_host; "
16657 "content:\"two\"; distance:10; fast_pattern:only; http_host; sid:1;)");
16658 if (de_ctx->sig_list != NULL)
16659 goto end;
16660
16661 result = 1;
16662
16663 end:
16664 SigCleanSignatures(de_ctx);
16665 DetectEngineCtxFree(de_ctx);
16666 return result;
16667 }
16668
DetectFastPatternTest596(void)16669 static int DetectFastPatternTest596(void)
16670 {
16671 DetectEngineCtx *de_ctx = NULL;
16672 int result = 0;
16673
16674 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16675 goto end;
16676
16677 de_ctx->flags |= DE_QUIET;
16678 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16679 "(content:\"one\"; http_host; "
16680 "content:\"two\"; fast_pattern:only; http_host; within:10; sid:1;)");
16681 if (de_ctx->sig_list != NULL)
16682 goto end;
16683
16684 result = 1;
16685
16686 end:
16687 SigCleanSignatures(de_ctx);
16688 DetectEngineCtxFree(de_ctx);
16689 return result;
16690 }
16691
DetectFastPatternTest597(void)16692 static int DetectFastPatternTest597(void)
16693 {
16694 DetectEngineCtx *de_ctx = NULL;
16695 int result = 0;
16696
16697 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16698 goto end;
16699
16700 de_ctx->flags |= DE_QUIET;
16701 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16702 "(content:\"one\"; http_host; "
16703 "content:\"two\"; within:10; fast_pattern:only; http_host; sid:1;)");
16704 if (de_ctx->sig_list != NULL)
16705 goto end;
16706
16707 result = 1;
16708
16709 end:
16710 SigCleanSignatures(de_ctx);
16711 DetectEngineCtxFree(de_ctx);
16712 return result;
16713 }
16714
DetectFastPatternTest598(void)16715 static int DetectFastPatternTest598(void)
16716 {
16717 DetectEngineCtx *de_ctx = NULL;
16718 int result = 0;
16719
16720 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16721 goto end;
16722
16723 de_ctx->flags |= DE_QUIET;
16724 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16725 "(content:\"one\"; http_host; "
16726 "content:\"two\"; fast_pattern:only; http_host; offset:10; sid:1;)");
16727 if (de_ctx->sig_list != NULL)
16728 goto end;
16729
16730 result = 1;
16731
16732 end:
16733 SigCleanSignatures(de_ctx);
16734 DetectEngineCtxFree(de_ctx);
16735 return result;
16736 }
16737
DetectFastPatternTest599(void)16738 static int DetectFastPatternTest599(void)
16739 {
16740 DetectEngineCtx *de_ctx = NULL;
16741 int result = 0;
16742
16743 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16744 goto end;
16745
16746 de_ctx->flags |= DE_QUIET;
16747 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16748 "(content:\"one\"; http_host; "
16749 "content:\"two\"; offset:10; fast_pattern:only; http_host; sid:1;)");
16750 if (de_ctx->sig_list != NULL)
16751 goto end;
16752
16753 result = 1;
16754
16755 end:
16756 SigCleanSignatures(de_ctx);
16757 DetectEngineCtxFree(de_ctx);
16758 return result;
16759 }
16760
DetectFastPatternTest600(void)16761 static int DetectFastPatternTest600(void)
16762 {
16763 DetectEngineCtx *de_ctx = NULL;
16764 int result = 0;
16765
16766 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16767 goto end;
16768
16769 de_ctx->flags |= DE_QUIET;
16770 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16771 "(content:\"one\"; http_host; "
16772 "content:\"two\"; fast_pattern:only; http_host; depth:10; sid:1;)");
16773 if (de_ctx->sig_list != NULL)
16774 goto end;
16775
16776 result = 1;
16777
16778 end:
16779 SigCleanSignatures(de_ctx);
16780 DetectEngineCtxFree(de_ctx);
16781 return result;
16782 }
16783
DetectFastPatternTest601(void)16784 static int DetectFastPatternTest601(void)
16785 {
16786 DetectEngineCtx *de_ctx = NULL;
16787 int result = 0;
16788
16789 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16790 goto end;
16791
16792 de_ctx->flags |= DE_QUIET;
16793 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16794 "(content:\"one\"; http_host; "
16795 "content:\"two\"; depth:10; fast_pattern:only; http_host; sid:1;)");
16796 if (de_ctx->sig_list != NULL)
16797 goto end;
16798
16799 result = 1;
16800
16801 end:
16802 SigCleanSignatures(de_ctx);
16803 DetectEngineCtxFree(de_ctx);
16804 return result;
16805 }
16806
DetectFastPatternTest602(void)16807 static int DetectFastPatternTest602(void)
16808 {
16809 DetectEngineCtx *de_ctx = NULL;
16810 int result = 0;
16811
16812 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16813 goto end;
16814
16815 de_ctx->flags |= DE_QUIET;
16816 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16817 "(content:\"one\"; http_host; "
16818 "content:!\"two\"; fast_pattern:only; http_host; sid:1;)");
16819 if (de_ctx->sig_list != NULL)
16820 goto end;
16821
16822 result = 1;
16823
16824 end:
16825 SigCleanSignatures(de_ctx);
16826 DetectEngineCtxFree(de_ctx);
16827 return result;
16828 }
16829
DetectFastPatternTest603(void)16830 static int DetectFastPatternTest603(void)
16831 {
16832 DetectEngineCtx *de_ctx = NULL;
16833 int result = 0;
16834
16835 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16836 goto end;
16837
16838 de_ctx->flags |= DE_QUIET;
16839 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16840 "(content:\" one\"; http_host; "
16841 "content:\"two\"; http_host; distance:30; "
16842 "content:\"two\"; fast_pattern:only; http_host; sid:1;)");
16843 if (de_ctx->sig_list == NULL)
16844 goto end;
16845
16846 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
16847 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16848 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
16849 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
16850 ud->fp_chop_offset == 0 &&
16851 ud->fp_chop_len == 0) {
16852 result = 1;
16853 } else {
16854 result = 0;
16855 }
16856
16857 end:
16858 SigCleanSignatures(de_ctx);
16859 DetectEngineCtxFree(de_ctx);
16860 return result;
16861 }
16862
DetectFastPatternTest604(void)16863 static int DetectFastPatternTest604(void)
16864 {
16865 DetectEngineCtx *de_ctx = NULL;
16866 int result = 0;
16867
16868 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16869 goto end;
16870
16871 de_ctx->flags |= DE_QUIET;
16872 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16873 "(content:\"one\"; http_host; "
16874 "content:\"two\"; http_host; within:30; "
16875 "content:\"two\"; fast_pattern:only; http_host; sid:1;)");
16876 if (de_ctx->sig_list == NULL)
16877 goto end;
16878 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
16879 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16880 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
16881 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
16882 ud->fp_chop_offset == 0 &&
16883 ud->fp_chop_len == 0) {
16884 result = 1;
16885 } else {
16886 result = 0;
16887 }
16888
16889 end:
16890 SigCleanSignatures(de_ctx);
16891 DetectEngineCtxFree(de_ctx);
16892 return result;
16893 }
16894
DetectFastPatternTest605(void)16895 static int DetectFastPatternTest605(void)
16896 {
16897 DetectEngineCtx *de_ctx = NULL;
16898 int result = 0;
16899
16900 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16901 goto end;
16902
16903 de_ctx->flags |= DE_QUIET;
16904 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16905 "(content:\"one\"; http_host; "
16906 "content:\"two\"; http_host; offset:30; "
16907 "content:\"two\"; fast_pattern:only; http_host; sid:1;)");
16908 if (de_ctx->sig_list == NULL)
16909 goto end;
16910 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
16911 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16912 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
16913 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
16914 ud->fp_chop_offset == 0 &&
16915 ud->fp_chop_len == 0) {
16916 result = 1;
16917 } else {
16918 result = 0;
16919 }
16920
16921 end:
16922 SigCleanSignatures(de_ctx);
16923 DetectEngineCtxFree(de_ctx);
16924 return result;
16925 }
16926
DetectFastPatternTest606(void)16927 static int DetectFastPatternTest606(void)
16928 {
16929 DetectEngineCtx *de_ctx = NULL;
16930 int result = 0;
16931
16932 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16933 goto end;
16934
16935 de_ctx->flags |= DE_QUIET;
16936 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16937 "(content:\"one\"; http_host; "
16938 "content:\"two\"; http_host; depth:30; "
16939 "content:\"two\"; fast_pattern:only; http_host; sid:1;)");
16940 if (de_ctx->sig_list == NULL)
16941 goto end;
16942 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
16943 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16944 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
16945 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
16946 ud->fp_chop_offset == 0 &&
16947 ud->fp_chop_len == 0) {
16948 result = 1;
16949 } else {
16950 result = 0;
16951 }
16952
16953 end:
16954 SigCleanSignatures(de_ctx);
16955 DetectEngineCtxFree(de_ctx);
16956 return result;
16957 }
16958
DetectFastPatternTest607(void)16959 static int DetectFastPatternTest607(void)
16960 {
16961 DetectEngineCtx *de_ctx = NULL;
16962 int result = 0;
16963
16964 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16965 goto end;
16966
16967 de_ctx->flags |= DE_QUIET;
16968 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
16969 "(content:!\"one\"; fast_pattern; http_host; "
16970 "content:\"two\"; http_host; sid:1;)");
16971 if (de_ctx->sig_list == NULL)
16972 goto end;
16973 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
16974 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
16975 ud->flags & DETECT_CONTENT_NEGATED &&
16976 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
16977 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
16978 ud->fp_chop_offset == 0 &&
16979 ud->fp_chop_len == 0) {
16980 result = 1;
16981 } else {
16982 result = 0;
16983 }
16984
16985 end:
16986 SigCleanSignatures(de_ctx);
16987 DetectEngineCtxFree(de_ctx);
16988 return result;
16989 }
16990
DetectFastPatternTest608(void)16991 static int DetectFastPatternTest608(void)
16992 {
16993 DetectEngineCtx *de_ctx = NULL;
16994 int result = 0;
16995
16996 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
16997 goto end;
16998
16999 de_ctx->flags |= DE_QUIET;
17000 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17001 "(content:\"two\"; http_host; "
17002 "content:!\"one\"; fast_pattern; http_host; distance:20; sid:1;)");
17003 if (de_ctx->sig_list != NULL)
17004 goto end;
17005
17006 result = 1;
17007
17008 end:
17009 SigCleanSignatures(de_ctx);
17010 DetectEngineCtxFree(de_ctx);
17011 return result;
17012 }
17013
DetectFastPatternTest609(void)17014 static int DetectFastPatternTest609(void)
17015 {
17016 DetectEngineCtx *de_ctx = NULL;
17017 int result = 0;
17018
17019 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17020 goto end;
17021
17022 de_ctx->flags |= DE_QUIET;
17023 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17024 "(content:\"two\"; http_host; "
17025 "content:!\"one\"; fast_pattern; http_host; within:20; sid:1;)");
17026 if (de_ctx->sig_list != NULL)
17027 goto end;
17028
17029 result = 1;
17030
17031 end:
17032 SigCleanSignatures(de_ctx);
17033 DetectEngineCtxFree(de_ctx);
17034 return result;
17035 }
17036
DetectFastPatternTest610(void)17037 static int DetectFastPatternTest610(void)
17038 {
17039 DetectEngineCtx *de_ctx = NULL;
17040 int result = 0;
17041
17042 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17043 goto end;
17044
17045 de_ctx->flags |= DE_QUIET;
17046 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17047 "(content:\"two\"; http_host; "
17048 "content:!\"one\"; fast_pattern; http_host; offset:20; sid:1;)");
17049 if (de_ctx->sig_list != NULL)
17050 goto end;
17051
17052 result = 1;
17053
17054 end:
17055 SigCleanSignatures(de_ctx);
17056 DetectEngineCtxFree(de_ctx);
17057 return result;
17058 }
17059
DetectFastPatternTest611(void)17060 static int DetectFastPatternTest611(void)
17061 {
17062 DetectEngineCtx *de_ctx = NULL;
17063 int result = 0;
17064
17065 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17066 goto end;
17067
17068 de_ctx->flags |= DE_QUIET;
17069 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17070 "(content:\"two\"; http_host; "
17071 "content:!\"one\"; fast_pattern; http_host; depth:20; sid:1;)");
17072 if (de_ctx->sig_list != NULL)
17073 goto end;
17074
17075 result = 1;
17076
17077 end:
17078 SigCleanSignatures(de_ctx);
17079 DetectEngineCtxFree(de_ctx);
17080 return result;
17081 }
17082
DetectFastPatternTest612(void)17083 static int DetectFastPatternTest612(void)
17084 {
17085 DetectEngineCtx *de_ctx = NULL;
17086 int result = 0;
17087
17088 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17089 goto end;
17090
17091 de_ctx->flags |= DE_QUIET;
17092 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17093 "(content:\"one\"; http_host; "
17094 "content:\"oneonetwo\"; fast_pattern:3,4; http_host; "
17095 "content:\"three\"; http_host; sid:1;)");
17096 if (de_ctx->sig_list == NULL)
17097 goto end;
17098 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
17099 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
17100 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
17101 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
17102 ud->fp_chop_offset == 3 &&
17103 ud->fp_chop_len == 4) {
17104 result = 1;
17105 } else {
17106 result = 0;
17107 }
17108
17109 end:
17110 SigCleanSignatures(de_ctx);
17111 DetectEngineCtxFree(de_ctx);
17112 return result;
17113 }
17114
DetectFastPatternTest613(void)17115 static int DetectFastPatternTest613(void)
17116 {
17117 DetectEngineCtx *de_ctx = NULL;
17118 int result = 0;
17119
17120 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17121 goto end;
17122
17123 de_ctx->flags |= DE_QUIET;
17124 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17125 "(content:\"one\"; http_host; "
17126 "content:\"oneonetwo\"; fast_pattern:3,4; http_host; "
17127 "content:\"three\"; http_host; distance:30; sid:1;)");
17128 if (de_ctx->sig_list == NULL)
17129 goto end;
17130 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
17131 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
17132 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
17133 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
17134 ud->fp_chop_offset == 3 &&
17135 ud->fp_chop_len == 4) {
17136 result = 1;
17137 } else {
17138 result = 0;
17139 }
17140
17141 end:
17142 SigCleanSignatures(de_ctx);
17143 DetectEngineCtxFree(de_ctx);
17144 return result;
17145 }
17146
DetectFastPatternTest614(void)17147 static int DetectFastPatternTest614(void)
17148 {
17149 DetectEngineCtx *de_ctx = NULL;
17150 int result = 0;
17151
17152 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17153 goto end;
17154
17155 de_ctx->flags |= DE_QUIET;
17156 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17157 "(content:\"one\"; http_host; "
17158 "content:\"oneonetwo\"; fast_pattern:3,4; http_host; "
17159 "content:\"three\"; http_host; within:30; sid:1;)");
17160 if (de_ctx->sig_list == NULL)
17161 goto end;
17162 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
17163 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
17164 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
17165 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
17166 ud->fp_chop_offset == 3 &&
17167 ud->fp_chop_len == 4) {
17168 result = 1;
17169 } else {
17170 result = 0;
17171 }
17172
17173 end:
17174 SigCleanSignatures(de_ctx);
17175 DetectEngineCtxFree(de_ctx);
17176 return result;
17177 }
17178
DetectFastPatternTest615(void)17179 static int DetectFastPatternTest615(void)
17180 {
17181 DetectEngineCtx *de_ctx = NULL;
17182 int result = 0;
17183
17184 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17185 goto end;
17186
17187 de_ctx->flags |= DE_QUIET;
17188 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17189 "(content:\"one\"; http_host; "
17190 "content:\"oneonetwo\"; fast_pattern:3,4; http_host; "
17191 "content:\"three\"; http_host; offset:30; sid:1;)");
17192 if (de_ctx->sig_list == NULL)
17193 goto end;
17194 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
17195 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
17196 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
17197 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
17198 ud->fp_chop_offset == 3 &&
17199 ud->fp_chop_len == 4) {
17200 result = 1;
17201 } else {
17202 result = 0;
17203 }
17204
17205 end:
17206 SigCleanSignatures(de_ctx);
17207 DetectEngineCtxFree(de_ctx);
17208 return result;
17209 }
17210
DetectFastPatternTest616(void)17211 static int DetectFastPatternTest616(void)
17212 {
17213 DetectEngineCtx *de_ctx = NULL;
17214 int result = 0;
17215
17216 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17217 goto end;
17218
17219 de_ctx->flags |= DE_QUIET;
17220 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17221 "(content:\"one\"; http_host; "
17222 "content:\"oneonetwo\"; fast_pattern:3,4; http_host; "
17223 "content:\"three\"; http_host; depth:30; sid:1;)");
17224 if (de_ctx->sig_list == NULL)
17225 goto end;
17226 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
17227 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
17228 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
17229 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
17230 ud->fp_chop_offset == 3 &&
17231 ud->fp_chop_len == 4) {
17232 result = 1;
17233 } else {
17234 result = 0;
17235 }
17236
17237 end:
17238 SigCleanSignatures(de_ctx);
17239 DetectEngineCtxFree(de_ctx);
17240 return result;
17241 }
17242
DetectFastPatternTest617(void)17243 static int DetectFastPatternTest617(void)
17244 {
17245 DetectEngineCtx *de_ctx = NULL;
17246 int result = 0;
17247
17248 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17249 goto end;
17250
17251 de_ctx->flags |= DE_QUIET;
17252 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17253 "(content:\"one\"; http_host; "
17254 "content:\"two\"; http_host; distance:10; "
17255 "content:\"oneonethree\"; fast_pattern:3,4; http_host; sid:1;)");
17256 if (de_ctx->sig_list == NULL)
17257 goto end;
17258 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
17259 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
17260 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
17261 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
17262 ud->fp_chop_offset == 3 &&
17263 ud->fp_chop_len == 4) {
17264 result = 1;
17265 } else {
17266 result = 0;
17267 }
17268
17269 end:
17270 SigCleanSignatures(de_ctx);
17271 DetectEngineCtxFree(de_ctx);
17272 return result;
17273 }
17274
DetectFastPatternTest618(void)17275 static int DetectFastPatternTest618(void)
17276 {
17277 DetectEngineCtx *de_ctx = NULL;
17278 int result = 0;
17279
17280 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17281 goto end;
17282
17283 de_ctx->flags |= DE_QUIET;
17284 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17285 "(content:\"one\"; http_host; "
17286 "content:\"two\"; http_host; within:10; "
17287 "content:\"oneonethree\"; fast_pattern:3,4; http_host; sid:1;)");
17288 if (de_ctx->sig_list == NULL)
17289 goto end;
17290 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
17291 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
17292 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
17293 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
17294 ud->fp_chop_offset == 3 &&
17295 ud->fp_chop_len == 4) {
17296 result = 1;
17297 } else {
17298 result = 0;
17299 }
17300
17301 end:
17302 SigCleanSignatures(de_ctx);
17303 DetectEngineCtxFree(de_ctx);
17304 return result;
17305 }
17306
DetectFastPatternTest619(void)17307 static int DetectFastPatternTest619(void)
17308 {
17309 DetectEngineCtx *de_ctx = NULL;
17310 int result = 0;
17311
17312 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17313 goto end;
17314
17315 de_ctx->flags |= DE_QUIET;
17316 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17317 "(content:\"one\"; http_host; "
17318 "content:\"two\"; http_host; offset:10; "
17319 "content:\"oneonethree\"; fast_pattern:3,4; http_host; sid:1;)");
17320 if (de_ctx->sig_list == NULL)
17321 goto end;
17322 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
17323 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
17324 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
17325 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
17326 ud->fp_chop_offset == 3 &&
17327 ud->fp_chop_len == 4) {
17328 result = 1;
17329 } else {
17330 result = 0;
17331 }
17332
17333 end:
17334 SigCleanSignatures(de_ctx);
17335 DetectEngineCtxFree(de_ctx);
17336 return result;
17337 }
17338
DetectFastPatternTest620(void)17339 static int DetectFastPatternTest620(void)
17340 {
17341 DetectEngineCtx *de_ctx = NULL;
17342 int result = 0;
17343
17344 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17345 goto end;
17346
17347 de_ctx->flags |= DE_QUIET;
17348 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17349 "(content:\"one\"; http_host; "
17350 "content:\"two\"; http_host; depth:10; "
17351 "content:\"oneonethree\"; fast_pattern:3,4; http_host; sid:1;)");
17352 if (de_ctx->sig_list == NULL)
17353 goto end;
17354 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
17355 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
17356 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
17357 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
17358 ud->fp_chop_offset == 3 &&
17359 ud->fp_chop_len == 4) {
17360 result = 1;
17361 } else {
17362 result = 0;
17363 }
17364
17365
17366 result = 1;
17367
17368 end:
17369 SigCleanSignatures(de_ctx);
17370 DetectEngineCtxFree(de_ctx);
17371 return result;
17372 }
17373
DetectFastPatternTest621(void)17374 static int DetectFastPatternTest621(void)
17375 {
17376 DetectEngineCtx *de_ctx = NULL;
17377 int result = 0;
17378
17379 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17380 goto end;
17381
17382 de_ctx->flags |= DE_QUIET;
17383 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17384 "(content:\"one\"; http_host; "
17385 "content:\"two\"; fast_pattern:65977,4; http_host; "
17386 "content:\"three\"; http_host; distance:10; sid:1;)");
17387 if (de_ctx->sig_list != NULL)
17388 goto end;
17389
17390 result = 1;
17391
17392 end:
17393 SigCleanSignatures(de_ctx);
17394 DetectEngineCtxFree(de_ctx);
17395 return result;
17396 }
17397
DetectFastPatternTest622(void)17398 static int DetectFastPatternTest622(void)
17399 {
17400 DetectEngineCtx *de_ctx = NULL;
17401 int result = 0;
17402
17403 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17404 goto end;
17405
17406 de_ctx->flags |= DE_QUIET;
17407 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17408 "(content:\"one\"; http_host; "
17409 "content:\"oneonetwo\"; fast_pattern:3,65977; http_host; "
17410 "content:\"three\"; distance:10; http_host; sid:1;)");
17411 if (de_ctx->sig_list != NULL)
17412 goto end;
17413
17414 result = 1;
17415
17416 end:
17417 SigCleanSignatures(de_ctx);
17418 DetectEngineCtxFree(de_ctx);
17419 return result;
17420 }
17421
DetectFastPatternTest623(void)17422 static int DetectFastPatternTest623(void)
17423 {
17424 DetectEngineCtx *de_ctx = NULL;
17425 int result = 0;
17426
17427 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17428 goto end;
17429
17430 de_ctx->flags |= DE_QUIET;
17431 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17432 "(content:\"one\"; http_host; "
17433 "content:\"two\"; fast_pattern:65534,4; http_host; "
17434 "content:\"three\"; http_host; distance:10; sid:1;)");
17435 if (de_ctx->sig_list != NULL)
17436 goto end;
17437
17438 result = 1;
17439
17440 end:
17441 SigCleanSignatures(de_ctx);
17442 DetectEngineCtxFree(de_ctx);
17443 return result;
17444 }
17445
DetectFastPatternTest624(void)17446 static int DetectFastPatternTest624(void)
17447 {
17448 DetectEngineCtx *de_ctx = NULL;
17449 int result = 0;
17450
17451 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17452 goto end;
17453
17454 de_ctx->flags |= DE_QUIET;
17455 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17456 "(content:\"one\"; http_host; "
17457 "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; "
17458 "content:\"three\"; http_host; sid:1;)");
17459 if (de_ctx->sig_list == NULL)
17460 goto end;
17461 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
17462 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
17463 ud->flags & DETECT_CONTENT_NEGATED &&
17464 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
17465 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
17466 ud->fp_chop_offset == 3 &&
17467 ud->fp_chop_len == 4) {
17468 result = 1;
17469 } else {
17470 result = 0;
17471 }
17472
17473 end:
17474 SigCleanSignatures(de_ctx);
17475 DetectEngineCtxFree(de_ctx);
17476 return result;
17477 }
17478
DetectFastPatternTest625(void)17479 static int DetectFastPatternTest625(void)
17480 {
17481 DetectEngineCtx *de_ctx = NULL;
17482 int result = 0;
17483
17484 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17485 goto end;
17486
17487 de_ctx->flags |= DE_QUIET;
17488 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17489 "(content:\"one\"; http_host; "
17490 "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; distance:10; "
17491 "content:\"three\"; http_host; sid:1;)");
17492 if (de_ctx->sig_list != NULL)
17493 goto end;
17494
17495 result = 1;
17496
17497 end:
17498 SigCleanSignatures(de_ctx);
17499 DetectEngineCtxFree(de_ctx);
17500 return result;
17501 }
17502
DetectFastPatternTest626(void)17503 static int DetectFastPatternTest626(void)
17504 {
17505 DetectEngineCtx *de_ctx = NULL;
17506 int result = 0;
17507
17508 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17509 goto end;
17510
17511 de_ctx->flags |= DE_QUIET;
17512 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17513 "(content:\"one\"; http_host; "
17514 "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; within:10; "
17515 "content:\"three\"; http_host; sid:1;)");
17516 if (de_ctx->sig_list != NULL)
17517 goto end;
17518
17519 result = 1;
17520
17521 end:
17522 SigCleanSignatures(de_ctx);
17523 DetectEngineCtxFree(de_ctx);
17524 return result;
17525 }
17526
DetectFastPatternTest627(void)17527 static int DetectFastPatternTest627(void)
17528 {
17529 DetectEngineCtx *de_ctx = NULL;
17530 int result = 0;
17531
17532 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17533 goto end;
17534
17535 de_ctx->flags |= DE_QUIET;
17536 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17537 "(content:\"one\"; http_host; "
17538 "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; offset:10; "
17539 "content:\"three\"; http_host; sid:1;)");
17540 if (de_ctx->sig_list != NULL)
17541 goto end;
17542
17543 result = 1;
17544
17545 end:
17546 SigCleanSignatures(de_ctx);
17547 DetectEngineCtxFree(de_ctx);
17548 return result;
17549 }
17550
DetectFastPatternTest628(void)17551 static int DetectFastPatternTest628(void)
17552 {
17553 DetectEngineCtx *de_ctx = NULL;
17554 int result = 0;
17555
17556 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17557 goto end;
17558
17559 de_ctx->flags |= DE_QUIET;
17560 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17561 "(content:\"one\"; http_host; "
17562 "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; depth:10; "
17563 "content:\"three\"; http_host; sid:1;)");
17564 if (de_ctx->sig_list != NULL)
17565 goto end;
17566
17567 result = 1;
17568
17569 end:
17570 SigCleanSignatures(de_ctx);
17571 DetectEngineCtxFree(de_ctx);
17572 return result;
17573 }
17574
DetectFastPatternTest629(void)17575 static int DetectFastPatternTest629(void)
17576 {
17577 DetectEngineCtx *de_ctx = NULL;
17578 int result = 0;
17579
17580 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17581 goto end;
17582
17583 de_ctx->flags |= DE_QUIET;
17584 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17585 "(content:\"one\"; http_host; "
17586 "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; "
17587 "content:\"three\"; http_host; sid:1;)");
17588 if (de_ctx->sig_list == NULL)
17589 goto end;
17590 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
17591 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
17592 ud->flags & DETECT_CONTENT_NEGATED &&
17593 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
17594 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
17595 ud->fp_chop_offset == 3 &&
17596 ud->fp_chop_len == 4) {
17597 result = 1;
17598 } else {
17599 result = 0;
17600 }
17601
17602 end:
17603 SigCleanSignatures(de_ctx);
17604 DetectEngineCtxFree(de_ctx);
17605 return result;
17606 }
17607
17608
17609 /* http_host fast_pattern tests ^ */
17610 /* http_rawhost fast_pattern tests v */
17611
17612
DetectFastPatternTest630(void)17613 static int DetectFastPatternTest630(void)
17614 {
17615 DetectEngineCtx *de_ctx = NULL;
17616 int result = 0;
17617
17618 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17619 goto end;
17620
17621 de_ctx->flags |= DE_QUIET;
17622 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17623 "(content:\"one\"; http_raw_host; nocase; "
17624 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
17625 "content:\"three\"; http_raw_host; nocase; sid:1;)");
17626 if (de_ctx->sig_list == NULL)
17627 goto end;
17628 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->prev->ctx;
17629 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
17630 ud->flags & DETECT_CONTENT_NEGATED &&
17631 ud->flags & DETECT_CONTENT_NOCASE &&
17632 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
17633 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
17634 ud->fp_chop_offset == 3 &&
17635 ud->fp_chop_len == 4) {
17636 result = 1;
17637 } else {
17638 result = 0;
17639 }
17640
17641 end:
17642 SigCleanSignatures(de_ctx);
17643 DetectEngineCtxFree(de_ctx);
17644 return result;
17645 }
17646
17647 /**
17648 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
17649 */
DetectFastPatternTest631(void)17650 static int DetectFastPatternTest631(void)
17651 {
17652 SigMatch *sm = NULL;
17653 DetectEngineCtx *de_ctx = NULL;
17654 int result = 0;
17655
17656 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17657 goto end;
17658
17659 de_ctx->flags |= DE_QUIET;
17660 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17661 "(content:\"one\"; fast_pattern:only; http_raw_host; nocase; "
17662 "msg:\"Testing fast_pattern\"; sid:1;)");
17663 if (de_ctx->sig_list == NULL)
17664 goto end;
17665
17666 result = 0;
17667 sm = de_ctx->sig_list->sm_lists[g_http_raw_host_buffer_id];
17668 if (sm != NULL) {
17669 if ( (((DetectContentData *)sm->ctx)->flags &
17670 DETECT_CONTENT_FAST_PATTERN) &&
17671 (((DetectContentData *)sm->ctx)->flags &
17672 DETECT_CONTENT_NOCASE)) {
17673 result = 1;
17674 } else {
17675 result = 0;
17676 }
17677 }
17678
17679
17680 end:
17681 SigCleanSignatures(de_ctx);
17682 DetectEngineCtxFree(de_ctx);
17683 return result;
17684 }
17685
17686 /**
17687 * \test Checks if a fast_pattern is registered in a Signature for uricontent.
17688 */
DetectFastPatternTest632(void)17689 static int DetectFastPatternTest632(void)
17690 {
17691 SigMatch *sm = NULL;
17692 DetectEngineCtx *de_ctx = NULL;
17693 int result = 0;
17694
17695 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17696 goto end;
17697
17698 de_ctx->flags |= DE_QUIET;
17699 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17700 "(content:\"oneoneone\"; fast_pattern:3,4; http_raw_host; nocase; "
17701 "msg:\"Testing fast_pattern\"; sid:1;)");
17702 if (de_ctx->sig_list == NULL)
17703 goto end;
17704
17705 result = 0;
17706 sm = de_ctx->sig_list->sm_lists[g_http_raw_host_buffer_id];
17707 if (sm != NULL) {
17708 if ( (((DetectContentData *)sm->ctx)->flags &
17709 DETECT_CONTENT_FAST_PATTERN) &&
17710 (((DetectContentData *)sm->ctx)->flags &
17711 DETECT_CONTENT_NOCASE)) {
17712 result = 1;
17713 } else {
17714 result = 0;
17715 }
17716 }
17717
17718 end:
17719 SigCleanSignatures(de_ctx);
17720 DetectEngineCtxFree(de_ctx);
17721 return result;
17722 }
17723
DetectFastPatternTest633(void)17724 static int DetectFastPatternTest633(void)
17725 {
17726 SigMatch *sm = NULL;
17727 DetectEngineCtx *de_ctx = NULL;
17728 int result = 0;
17729
17730 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17731 goto end;
17732
17733 de_ctx->flags |= DE_QUIET;
17734 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17735 "(content:\"one\"; fast_pattern:only; http_raw_host; nocase; sid:1;)");
17736 if (de_ctx->sig_list == NULL)
17737 goto end;
17738
17739 sm = de_ctx->sig_list->sm_lists[g_http_raw_host_buffer_id];
17740 if (sm == NULL) {
17741 goto end;
17742 }
17743 DetectContentData *ud = (DetectContentData *)sm->ctx;
17744 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
17745 ud->flags & DETECT_CONTENT_NOCASE &&
17746 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
17747 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
17748 ud->fp_chop_offset == 0 &&
17749 ud->fp_chop_len == 0) {
17750 result = 1;
17751 } else {
17752 result = 0;
17753 }
17754
17755 end:
17756 SigCleanSignatures(de_ctx);
17757 DetectEngineCtxFree(de_ctx);
17758 return result;
17759 }
17760
DetectFastPatternTest634(void)17761 static int DetectFastPatternTest634(void)
17762 {
17763 SigMatch *sm = NULL;
17764 DetectEngineCtx *de_ctx = NULL;
17765 int result = 0;
17766
17767 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17768 goto end;
17769
17770 de_ctx->flags |= DE_QUIET;
17771 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17772 "(content:\"oneoneone\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)");
17773 if (de_ctx->sig_list == NULL)
17774 goto end;
17775
17776 sm = de_ctx->sig_list->sm_lists[g_http_raw_host_buffer_id];
17777 if (sm == NULL) {
17778 goto end;
17779 }
17780
17781 DetectContentData *ud = (DetectContentData *)sm->ctx;
17782 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
17783 ud->flags & DETECT_CONTENT_NOCASE &&
17784 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
17785 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
17786 ud->fp_chop_offset == 3 &&
17787 ud->fp_chop_len == 4) {
17788 result = 1;
17789 } else {
17790 result = 0;
17791 }
17792
17793 end:
17794 SigCleanSignatures(de_ctx);
17795 DetectEngineCtxFree(de_ctx);
17796 return result;
17797 }
17798
DetectFastPatternTest635(void)17799 static int DetectFastPatternTest635(void)
17800 {
17801 DetectEngineCtx *de_ctx = NULL;
17802 int result = 0;
17803
17804 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17805 goto end;
17806
17807 de_ctx->flags |= DE_QUIET;
17808 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17809 "(content:\"one\"; http_raw_host; nocase; "
17810 "content:\"two\"; fast_pattern:only; http_raw_host; distance:10; nocase; sid:1;)");
17811 if (de_ctx->sig_list != NULL)
17812 goto end;
17813
17814 result = 1;
17815
17816 end:
17817 SigCleanSignatures(de_ctx);
17818 DetectEngineCtxFree(de_ctx);
17819 return result;
17820 }
17821
DetectFastPatternTest636(void)17822 static int DetectFastPatternTest636(void)
17823 {
17824 DetectEngineCtx *de_ctx = NULL;
17825 int result = 0;
17826
17827 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17828 goto end;
17829
17830 de_ctx->flags |= DE_QUIET;
17831 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17832 "(content:\"one\"; http_raw_host; nocase; "
17833 "content:\"two\"; distance:10; fast_pattern:only; http_raw_host; nocase; sid:1;)");
17834 if (de_ctx->sig_list != NULL)
17835 goto end;
17836
17837 result = 1;
17838
17839 end:
17840 SigCleanSignatures(de_ctx);
17841 DetectEngineCtxFree(de_ctx);
17842 return result;
17843 }
17844
DetectFastPatternTest637(void)17845 static int DetectFastPatternTest637(void)
17846 {
17847 DetectEngineCtx *de_ctx = NULL;
17848 int result = 0;
17849
17850 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17851 goto end;
17852
17853 de_ctx->flags |= DE_QUIET;
17854 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17855 "(content:\"one\"; http_raw_host; nocase; "
17856 "content:\"two\"; fast_pattern:only; http_raw_host; within:10; nocase; sid:1;)");
17857 if (de_ctx->sig_list != NULL)
17858 goto end;
17859
17860 result = 1;
17861
17862 end:
17863 SigCleanSignatures(de_ctx);
17864 DetectEngineCtxFree(de_ctx);
17865 return result;
17866 }
17867
DetectFastPatternTest638(void)17868 static int DetectFastPatternTest638(void)
17869 {
17870 DetectEngineCtx *de_ctx = NULL;
17871 int result = 0;
17872
17873 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17874 goto end;
17875
17876 de_ctx->flags |= DE_QUIET;
17877 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17878 "(content:\"one\"; http_raw_host; nocase; "
17879 "content:\"two\"; within:10; fast_pattern:only; http_raw_host; nocase; sid:1;)");
17880 if (de_ctx->sig_list != NULL)
17881 goto end;
17882
17883 result = 1;
17884
17885 end:
17886 SigCleanSignatures(de_ctx);
17887 DetectEngineCtxFree(de_ctx);
17888 return result;
17889 }
17890
DetectFastPatternTest639(void)17891 static int DetectFastPatternTest639(void)
17892 {
17893 DetectEngineCtx *de_ctx = NULL;
17894 int result = 0;
17895
17896 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17897 goto end;
17898
17899 de_ctx->flags |= DE_QUIET;
17900 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17901 "(content:\"one\"; http_raw_host; nocase; "
17902 "content:\"two\"; fast_pattern:only; http_raw_host; offset:10; nocase; sid:1;)");
17903 if (de_ctx->sig_list != NULL)
17904 goto end;
17905
17906 result = 1;
17907
17908 end:
17909 SigCleanSignatures(de_ctx);
17910 DetectEngineCtxFree(de_ctx);
17911 return result;
17912 }
17913
DetectFastPatternTest640(void)17914 static int DetectFastPatternTest640(void)
17915 {
17916 DetectEngineCtx *de_ctx = NULL;
17917 int result = 0;
17918
17919 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17920 goto end;
17921
17922 de_ctx->flags |= DE_QUIET;
17923 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17924 "(content:\"one\"; http_raw_host; nocase; "
17925 "content:\"two\"; offset:10; fast_pattern:only; http_raw_host; nocase; sid:1;)");
17926 if (de_ctx->sig_list != NULL)
17927 goto end;
17928
17929 result = 1;
17930
17931 end:
17932 SigCleanSignatures(de_ctx);
17933 DetectEngineCtxFree(de_ctx);
17934 return result;
17935 }
17936
DetectFastPatternTest641(void)17937 static int DetectFastPatternTest641(void)
17938 {
17939 DetectEngineCtx *de_ctx = NULL;
17940 int result = 0;
17941
17942 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17943 goto end;
17944
17945 de_ctx->flags |= DE_QUIET;
17946 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17947 "(content:\"one\"; http_raw_host; nocase; "
17948 "content:\"two\"; fast_pattern:only; http_raw_host; depth:10; nocase; sid:1;)");
17949 if (de_ctx->sig_list != NULL)
17950 goto end;
17951
17952 result = 1;
17953
17954 end:
17955 SigCleanSignatures(de_ctx);
17956 DetectEngineCtxFree(de_ctx);
17957 return result;
17958 }
17959
DetectFastPatternTest642(void)17960 static int DetectFastPatternTest642(void)
17961 {
17962 DetectEngineCtx *de_ctx = NULL;
17963 int result = 0;
17964
17965 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17966 goto end;
17967
17968 de_ctx->flags |= DE_QUIET;
17969 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17970 "(content:\"one\"; http_raw_host; nocase; "
17971 "content:\"two\"; depth:10; fast_pattern:only; http_raw_host; nocase; sid:1;)");
17972 if (de_ctx->sig_list != NULL)
17973 goto end;
17974
17975 result = 1;
17976
17977 end:
17978 SigCleanSignatures(de_ctx);
17979 DetectEngineCtxFree(de_ctx);
17980 return result;
17981 }
17982
DetectFastPatternTest643(void)17983 static int DetectFastPatternTest643(void)
17984 {
17985 DetectEngineCtx *de_ctx = NULL;
17986 int result = 0;
17987
17988 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
17989 goto end;
17990
17991 de_ctx->flags |= DE_QUIET;
17992 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
17993 "(content:\"one\"; http_raw_host; nocase; "
17994 "content:!\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)");
17995 if (de_ctx->sig_list != NULL)
17996 goto end;
17997
17998 result = 1;
17999
18000 end:
18001 SigCleanSignatures(de_ctx);
18002 DetectEngineCtxFree(de_ctx);
18003 return result;
18004 }
18005
DetectFastPatternTest644(void)18006 static int DetectFastPatternTest644(void)
18007 {
18008 DetectEngineCtx *de_ctx = NULL;
18009 int result = 0;
18010
18011 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18012 goto end;
18013
18014 de_ctx->flags |= DE_QUIET;
18015 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18016 "(content:\" one\"; http_raw_host; nocase; "
18017 "content:\"two\"; http_raw_host; distance:30; nocase; "
18018 "content:\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)");
18019 if (de_ctx->sig_list == NULL)
18020 goto end;
18021
18022 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->ctx;
18023 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18024 ud->flags & DETECT_CONTENT_NOCASE &&
18025 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
18026 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
18027 ud->fp_chop_offset == 0 &&
18028 ud->fp_chop_len == 0) {
18029 result = 1;
18030 } else {
18031 result = 0;
18032 }
18033
18034 end:
18035 SigCleanSignatures(de_ctx);
18036 DetectEngineCtxFree(de_ctx);
18037 return result;
18038 }
18039
DetectFastPatternTest645(void)18040 static int DetectFastPatternTest645(void)
18041 {
18042 DetectEngineCtx *de_ctx = NULL;
18043 int result = 0;
18044
18045 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18046 goto end;
18047
18048 de_ctx->flags |= DE_QUIET;
18049 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18050 "(content:\"one\"; http_raw_host; nocase; "
18051 "content:\"two\"; http_raw_host; within:30; nocase; "
18052 "content:\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)");
18053 if (de_ctx->sig_list == NULL)
18054 goto end;
18055 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->ctx;
18056 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18057 ud->flags & DETECT_CONTENT_NOCASE &&
18058 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
18059 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
18060 ud->fp_chop_offset == 0 &&
18061 ud->fp_chop_len == 0) {
18062 result = 1;
18063 } else {
18064 result = 0;
18065 }
18066
18067 end:
18068 SigCleanSignatures(de_ctx);
18069 DetectEngineCtxFree(de_ctx);
18070 return result;
18071 }
18072
DetectFastPatternTest646(void)18073 static int DetectFastPatternTest646(void)
18074 {
18075 DetectEngineCtx *de_ctx = NULL;
18076 int result = 0;
18077
18078 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18079 goto end;
18080
18081 de_ctx->flags |= DE_QUIET;
18082 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18083 "(content:\"one\"; http_raw_host; nocase; "
18084 "content:\"two\"; http_raw_host; offset:30; nocase; "
18085 "content:\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)");
18086 if (de_ctx->sig_list == NULL)
18087 goto end;
18088 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->ctx;
18089 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18090 ud->flags & DETECT_CONTENT_NOCASE &&
18091 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
18092 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
18093 ud->fp_chop_offset == 0 &&
18094 ud->fp_chop_len == 0) {
18095 result = 1;
18096 } else {
18097 result = 0;
18098 }
18099
18100 end:
18101 SigCleanSignatures(de_ctx);
18102 DetectEngineCtxFree(de_ctx);
18103 return result;
18104 }
18105
DetectFastPatternTest647(void)18106 static int DetectFastPatternTest647(void)
18107 {
18108 DetectEngineCtx *de_ctx = NULL;
18109 int result = 0;
18110
18111 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18112 goto end;
18113
18114 de_ctx->flags |= DE_QUIET;
18115 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18116 "(content:\"one\"; http_raw_host; nocase; "
18117 "content:\"two\"; http_raw_host; depth:30; nocase; "
18118 "content:\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)");
18119 if (de_ctx->sig_list == NULL)
18120 goto end;
18121 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->ctx;
18122 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18123 ud->flags & DETECT_CONTENT_NOCASE &&
18124 ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
18125 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
18126 ud->fp_chop_offset == 0 &&
18127 ud->fp_chop_len == 0) {
18128 result = 1;
18129 } else {
18130 result = 0;
18131 }
18132
18133 end:
18134 SigCleanSignatures(de_ctx);
18135 DetectEngineCtxFree(de_ctx);
18136 return result;
18137 }
18138
DetectFastPatternTest648(void)18139 static int DetectFastPatternTest648(void)
18140 {
18141 DetectEngineCtx *de_ctx = NULL;
18142 int result = 0;
18143
18144 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18145 goto end;
18146
18147 de_ctx->flags |= DE_QUIET;
18148 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18149 "(content:!\"one\"; fast_pattern; http_raw_host; nocase; "
18150 "content:\"two\"; http_raw_host; nocase; sid:1;)");
18151 if (de_ctx->sig_list == NULL)
18152 goto end;
18153 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->prev->ctx;
18154 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18155 ud->flags & DETECT_CONTENT_NOCASE &&
18156 ud->flags & DETECT_CONTENT_NEGATED &&
18157 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
18158 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
18159 ud->fp_chop_offset == 0 &&
18160 ud->fp_chop_len == 0) {
18161 result = 1;
18162 } else {
18163 result = 0;
18164 }
18165
18166 end:
18167 SigCleanSignatures(de_ctx);
18168 DetectEngineCtxFree(de_ctx);
18169 return result;
18170 }
18171
DetectFastPatternTest649(void)18172 static int DetectFastPatternTest649(void)
18173 {
18174 DetectEngineCtx *de_ctx = NULL;
18175 int result = 0;
18176
18177 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18178 goto end;
18179
18180 de_ctx->flags |= DE_QUIET;
18181 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18182 "(content:\"two\"; http_raw_host; nocase; "
18183 "content:!\"one\"; fast_pattern; http_raw_host; distance:20; nocase; sid:1;)");
18184 if (de_ctx->sig_list != NULL)
18185 goto end;
18186
18187 result = 1;
18188
18189 end:
18190 SigCleanSignatures(de_ctx);
18191 DetectEngineCtxFree(de_ctx);
18192 return result;
18193 }
18194
DetectFastPatternTest650(void)18195 static int DetectFastPatternTest650(void)
18196 {
18197 DetectEngineCtx *de_ctx = NULL;
18198 int result = 0;
18199
18200 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18201 goto end;
18202
18203 de_ctx->flags |= DE_QUIET;
18204 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18205 "(content:\"two\"; http_raw_host; nocase; "
18206 "content:!\"one\"; fast_pattern; http_raw_host; within:20; nocase; sid:1;)");
18207 if (de_ctx->sig_list != NULL)
18208 goto end;
18209
18210 result = 1;
18211
18212 end:
18213 SigCleanSignatures(de_ctx);
18214 DetectEngineCtxFree(de_ctx);
18215 return result;
18216 }
18217
DetectFastPatternTest651(void)18218 static int DetectFastPatternTest651(void)
18219 {
18220 DetectEngineCtx *de_ctx = NULL;
18221 int result = 0;
18222
18223 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18224 goto end;
18225
18226 de_ctx->flags |= DE_QUIET;
18227 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18228 "(content:\"two\"; http_raw_host; nocase; "
18229 "content:!\"one\"; fast_pattern; http_raw_host; offset:20; nocase; sid:1;)");
18230 if (de_ctx->sig_list != NULL)
18231 goto end;
18232
18233 result = 1;
18234
18235 end:
18236 SigCleanSignatures(de_ctx);
18237 DetectEngineCtxFree(de_ctx);
18238 return result;
18239 }
18240
DetectFastPatternTest652(void)18241 static int DetectFastPatternTest652(void)
18242 {
18243 DetectEngineCtx *de_ctx = NULL;
18244 int result = 0;
18245
18246 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18247 goto end;
18248
18249 de_ctx->flags |= DE_QUIET;
18250 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18251 "(content:\"two\"; http_raw_host; nocase; "
18252 "content:!\"one\"; fast_pattern; http_raw_host; depth:20; nocase; sid:1;)");
18253 if (de_ctx->sig_list != NULL)
18254 goto end;
18255
18256 result = 1;
18257
18258 end:
18259 SigCleanSignatures(de_ctx);
18260 DetectEngineCtxFree(de_ctx);
18261 return result;
18262 }
18263
DetectFastPatternTest653(void)18264 static int DetectFastPatternTest653(void)
18265 {
18266 DetectEngineCtx *de_ctx = NULL;
18267 int result = 0;
18268
18269 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18270 goto end;
18271
18272 de_ctx->flags |= DE_QUIET;
18273 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18274 "(content:\"one\"; http_raw_host; nocase; "
18275 "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
18276 "content:\"three\"; http_raw_host; nocase; sid:1;)");
18277 if (de_ctx->sig_list == NULL)
18278 goto end;
18279 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->prev->ctx;
18280 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18281 ud->flags & DETECT_CONTENT_NOCASE &&
18282 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
18283 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
18284 ud->fp_chop_offset == 3 &&
18285 ud->fp_chop_len == 4) {
18286 result = 1;
18287 } else {
18288 result = 0;
18289 }
18290
18291 end:
18292 SigCleanSignatures(de_ctx);
18293 DetectEngineCtxFree(de_ctx);
18294 return result;
18295 }
18296
DetectFastPatternTest654(void)18297 static int DetectFastPatternTest654(void)
18298 {
18299 DetectEngineCtx *de_ctx = NULL;
18300 int result = 0;
18301
18302 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18303 goto end;
18304
18305 de_ctx->flags |= DE_QUIET;
18306 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18307 "(content:\"one\"; http_raw_host; nocase; "
18308 "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
18309 "content:\"three\"; http_raw_host; distance:30; nocase; sid:1;)");
18310 if (de_ctx->sig_list == NULL)
18311 goto end;
18312 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->prev->ctx;
18313 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18314 ud->flags & DETECT_CONTENT_NOCASE &&
18315 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
18316 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
18317 ud->fp_chop_offset == 3 &&
18318 ud->fp_chop_len == 4) {
18319 result = 1;
18320 } else {
18321 result = 0;
18322 }
18323
18324 end:
18325 SigCleanSignatures(de_ctx);
18326 DetectEngineCtxFree(de_ctx);
18327 return result;
18328 }
18329
DetectFastPatternTest655(void)18330 static int DetectFastPatternTest655(void)
18331 {
18332 DetectEngineCtx *de_ctx = NULL;
18333 int result = 0;
18334
18335 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18336 goto end;
18337
18338 de_ctx->flags |= DE_QUIET;
18339 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18340 "(content:\"one\"; http_raw_host; nocase; "
18341 "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
18342 "content:\"three\"; http_raw_host; within:30; nocase; sid:1;)");
18343 if (de_ctx->sig_list == NULL)
18344 goto end;
18345 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->prev->ctx;
18346 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18347 ud->flags & DETECT_CONTENT_NOCASE &&
18348 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
18349 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
18350 ud->fp_chop_offset == 3 &&
18351 ud->fp_chop_len == 4) {
18352 result = 1;
18353 } else {
18354 result = 0;
18355 }
18356
18357 end:
18358 SigCleanSignatures(de_ctx);
18359 DetectEngineCtxFree(de_ctx);
18360 return result;
18361 }
18362
DetectFastPatternTest656(void)18363 static int DetectFastPatternTest656(void)
18364 {
18365 DetectEngineCtx *de_ctx = NULL;
18366 int result = 0;
18367
18368 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18369 goto end;
18370
18371 de_ctx->flags |= DE_QUIET;
18372 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18373 "(content:\"one\"; http_raw_host; nocase; "
18374 "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
18375 "content:\"three\"; http_raw_host; offset:30; nocase; sid:1;)");
18376 if (de_ctx->sig_list == NULL)
18377 goto end;
18378 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->prev->ctx;
18379 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18380 ud->flags & DETECT_CONTENT_NOCASE &&
18381 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
18382 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
18383 ud->fp_chop_offset == 3 &&
18384 ud->fp_chop_len == 4) {
18385 result = 1;
18386 } else {
18387 result = 0;
18388 }
18389
18390 end:
18391 SigCleanSignatures(de_ctx);
18392 DetectEngineCtxFree(de_ctx);
18393 return result;
18394 }
18395
DetectFastPatternTest657(void)18396 static int DetectFastPatternTest657(void)
18397 {
18398 DetectEngineCtx *de_ctx = NULL;
18399 int result = 0;
18400
18401 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18402 goto end;
18403
18404 de_ctx->flags |= DE_QUIET;
18405 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18406 "(content:\"one\"; http_raw_host; nocase; "
18407 "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
18408 "content:\"three\"; http_raw_host; depth:30; nocase; sid:1;)");
18409 if (de_ctx->sig_list == NULL)
18410 goto end;
18411 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->prev->ctx;
18412 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18413 ud->flags & DETECT_CONTENT_NOCASE &&
18414 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
18415 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
18416 ud->fp_chop_offset == 3 &&
18417 ud->fp_chop_len == 4) {
18418 result = 1;
18419 } else {
18420 result = 0;
18421 }
18422
18423 end:
18424 SigCleanSignatures(de_ctx);
18425 DetectEngineCtxFree(de_ctx);
18426 return result;
18427 }
18428
DetectFastPatternTest658(void)18429 static int DetectFastPatternTest658(void)
18430 {
18431 DetectEngineCtx *de_ctx = NULL;
18432 int result = 0;
18433
18434 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18435 goto end;
18436
18437 de_ctx->flags |= DE_QUIET;
18438 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18439 "(content:\"one\"; http_raw_host; nocase; "
18440 "content:\"two\"; http_raw_host; distance:10; nocase; "
18441 "content:\"oneonethree\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)");
18442 if (de_ctx->sig_list == NULL)
18443 goto end;
18444 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->ctx;
18445 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18446 ud->flags & DETECT_CONTENT_NOCASE &&
18447 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
18448 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
18449 ud->fp_chop_offset == 3 &&
18450 ud->fp_chop_len == 4) {
18451 result = 1;
18452 } else {
18453 result = 0;
18454 }
18455
18456 end:
18457 SigCleanSignatures(de_ctx);
18458 DetectEngineCtxFree(de_ctx);
18459 return result;
18460 }
18461
DetectFastPatternTest659(void)18462 static int DetectFastPatternTest659(void)
18463 {
18464 DetectEngineCtx *de_ctx = NULL;
18465 int result = 0;
18466
18467 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18468 goto end;
18469
18470 de_ctx->flags |= DE_QUIET;
18471 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18472 "(content:\"one\"; http_raw_host; nocase; "
18473 "content:\"two\"; http_raw_host; within:10; nocase; "
18474 "content:\"oneonethree\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)");
18475 if (de_ctx->sig_list == NULL)
18476 goto end;
18477 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->ctx;
18478 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18479 ud->flags & DETECT_CONTENT_NOCASE &&
18480 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
18481 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
18482 ud->fp_chop_offset == 3 &&
18483 ud->fp_chop_len == 4) {
18484 result = 1;
18485 } else {
18486 result = 0;
18487 }
18488
18489 end:
18490 SigCleanSignatures(de_ctx);
18491 DetectEngineCtxFree(de_ctx);
18492 return result;
18493 }
18494
DetectFastPatternTest660(void)18495 static int DetectFastPatternTest660(void)
18496 {
18497 DetectEngineCtx *de_ctx = NULL;
18498 int result = 0;
18499
18500 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18501 goto end;
18502
18503 de_ctx->flags |= DE_QUIET;
18504 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18505 "(content:\"one\"; http_raw_host; nocase; "
18506 "content:\"two\"; http_raw_host; offset:10; nocase; "
18507 "content:\"oneonethree\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)");
18508 if (de_ctx->sig_list == NULL)
18509 goto end;
18510 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->ctx;
18511 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18512 ud->flags & DETECT_CONTENT_NOCASE &&
18513 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
18514 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
18515 ud->fp_chop_offset == 3 &&
18516 ud->fp_chop_len == 4) {
18517 result = 1;
18518 } else {
18519 result = 0;
18520 }
18521
18522 end:
18523 SigCleanSignatures(de_ctx);
18524 DetectEngineCtxFree(de_ctx);
18525 return result;
18526 }
18527
DetectFastPatternTest661(void)18528 static int DetectFastPatternTest661(void)
18529 {
18530 DetectEngineCtx *de_ctx = NULL;
18531 int result = 0;
18532
18533 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18534 goto end;
18535
18536 de_ctx->flags |= DE_QUIET;
18537 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18538 "(content:\"one\"; http_raw_host; nocase; "
18539 "content:\"two\"; http_raw_host; depth:10; nocase; "
18540 "content:\"oneonethree\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)");
18541 if (de_ctx->sig_list == NULL)
18542 goto end;
18543 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->ctx;
18544 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18545 ud->flags & DETECT_CONTENT_NOCASE &&
18546 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
18547 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
18548 ud->fp_chop_offset == 3 &&
18549 ud->fp_chop_len == 4) {
18550 result = 1;
18551 } else {
18552 result = 0;
18553 }
18554
18555
18556 result = 1;
18557
18558 end:
18559 SigCleanSignatures(de_ctx);
18560 DetectEngineCtxFree(de_ctx);
18561 return result;
18562 }
18563
DetectFastPatternTest662(void)18564 static int DetectFastPatternTest662(void)
18565 {
18566 DetectEngineCtx *de_ctx = NULL;
18567 int result = 0;
18568
18569 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18570 goto end;
18571
18572 de_ctx->flags |= DE_QUIET;
18573 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18574 "(content:\"one\"; http_raw_host; nocase; "
18575 "content:\"two\"; fast_pattern:65977,4; http_raw_host; nocase; "
18576 "content:\"three\"; http_raw_host; distance:10; nocase; sid:1;)");
18577 if (de_ctx->sig_list != NULL)
18578 goto end;
18579
18580 result = 1;
18581
18582 end:
18583 SigCleanSignatures(de_ctx);
18584 DetectEngineCtxFree(de_ctx);
18585 return result;
18586 }
18587
DetectFastPatternTest663(void)18588 static int DetectFastPatternTest663(void)
18589 {
18590 DetectEngineCtx *de_ctx = NULL;
18591 int result = 0;
18592
18593 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18594 goto end;
18595
18596 de_ctx->flags |= DE_QUIET;
18597 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18598 "(content:\"one\"; http_raw_host; nocase; "
18599 "content:\"oneonetwo\"; fast_pattern:3,65977; http_raw_host; nocase; "
18600 "content:\"three\"; distance:10; http_raw_host; nocase; sid:1;)");
18601 if (de_ctx->sig_list != NULL)
18602 goto end;
18603
18604 result = 1;
18605
18606 end:
18607 SigCleanSignatures(de_ctx);
18608 DetectEngineCtxFree(de_ctx);
18609 return result;
18610 }
18611
DetectFastPatternTest664(void)18612 static int DetectFastPatternTest664(void)
18613 {
18614 DetectEngineCtx *de_ctx = NULL;
18615 int result = 0;
18616
18617 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18618 goto end;
18619
18620 de_ctx->flags |= DE_QUIET;
18621 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18622 "(content:\"one\"; http_raw_host; nocase; "
18623 "content:\"two\"; fast_pattern:65534,4; http_raw_host; nocase; "
18624 "content:\"three\"; http_raw_host; distance:10; nocase; sid:1;)");
18625 if (de_ctx->sig_list != NULL)
18626 goto end;
18627
18628 result = 1;
18629
18630 end:
18631 SigCleanSignatures(de_ctx);
18632 DetectEngineCtxFree(de_ctx);
18633 return result;
18634 }
18635
DetectFastPatternTest665(void)18636 static int DetectFastPatternTest665(void)
18637 {
18638 DetectEngineCtx *de_ctx = NULL;
18639 int result = 0;
18640
18641 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18642 goto end;
18643
18644 de_ctx->flags |= DE_QUIET;
18645 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18646 "(content:\"one\"; http_raw_host; nocase; "
18647 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
18648 "content:\"three\"; http_raw_host; nocase; sid:1;)");
18649 if (de_ctx->sig_list == NULL)
18650 goto end;
18651 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->prev->ctx;
18652 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18653 ud->flags & DETECT_CONTENT_NOCASE &&
18654 ud->flags & DETECT_CONTENT_NEGATED &&
18655 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
18656 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
18657 ud->fp_chop_offset == 3 &&
18658 ud->fp_chop_len == 4) {
18659 result = 1;
18660 } else {
18661 result = 0;
18662 }
18663
18664 end:
18665 SigCleanSignatures(de_ctx);
18666 DetectEngineCtxFree(de_ctx);
18667 return result;
18668 }
18669
DetectFastPatternTest666(void)18670 static int DetectFastPatternTest666(void)
18671 {
18672 DetectEngineCtx *de_ctx = NULL;
18673 int result = 0;
18674
18675 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18676 goto end;
18677
18678 de_ctx->flags |= DE_QUIET;
18679 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18680 "(content:\"one\"; http_raw_host; nocase; "
18681 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; distance:10; nocase; "
18682 "content:\"three\"; http_raw_host; nocase; sid:1;)");
18683 if (de_ctx->sig_list != NULL)
18684 goto end;
18685
18686 result = 1;
18687
18688 end:
18689 SigCleanSignatures(de_ctx);
18690 DetectEngineCtxFree(de_ctx);
18691 return result;
18692 }
18693
DetectFastPatternTest667(void)18694 static int DetectFastPatternTest667(void)
18695 {
18696 DetectEngineCtx *de_ctx = NULL;
18697 int result = 0;
18698
18699 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18700 goto end;
18701
18702 de_ctx->flags |= DE_QUIET;
18703 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18704 "(content:\"one\"; http_raw_host; nocase; "
18705 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; within:10; nocase; "
18706 "content:\"three\"; http_raw_host; nocase; sid:1;)");
18707 if (de_ctx->sig_list != NULL)
18708 goto end;
18709
18710 result = 1;
18711
18712 end:
18713 SigCleanSignatures(de_ctx);
18714 DetectEngineCtxFree(de_ctx);
18715 return result;
18716 }
18717
DetectFastPatternTest668(void)18718 static int DetectFastPatternTest668(void)
18719 {
18720 DetectEngineCtx *de_ctx = NULL;
18721 int result = 0;
18722
18723 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18724 goto end;
18725
18726 de_ctx->flags |= DE_QUIET;
18727 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18728 "(content:\"one\"; http_raw_host; nocase; "
18729 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; offset:10; nocase; "
18730 "content:\"three\"; http_raw_host; nocase; sid:1;)");
18731 if (de_ctx->sig_list != NULL)
18732 goto end;
18733
18734 result = 1;
18735
18736 end:
18737 SigCleanSignatures(de_ctx);
18738 DetectEngineCtxFree(de_ctx);
18739 return result;
18740 }
18741
DetectFastPatternTest669(void)18742 static int DetectFastPatternTest669(void)
18743 {
18744 DetectEngineCtx *de_ctx = NULL;
18745 int result = 0;
18746
18747 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18748 goto end;
18749
18750 de_ctx->flags |= DE_QUIET;
18751 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18752 "(content:\"one\"; http_raw_host; nocase; "
18753 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; depth:10; nocase; "
18754 "content:\"three\"; http_raw_host; nocase; sid:1;)");
18755 if (de_ctx->sig_list != NULL)
18756 goto end;
18757
18758 result = 1;
18759
18760 end:
18761 SigCleanSignatures(de_ctx);
18762 DetectEngineCtxFree(de_ctx);
18763 return result;
18764 }
18765
DetectFastPatternTest670(void)18766 static int DetectFastPatternTest670(void)
18767 {
18768 DetectEngineCtx *de_ctx = NULL;
18769 int result = 0;
18770
18771 if ( (de_ctx = DetectEngineCtxInit()) == NULL)
18772 goto end;
18773
18774 de_ctx->flags |= DE_QUIET;
18775 de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
18776 "(content:\"one\"; http_raw_host; nocase; "
18777 "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
18778 "content:\"three\"; http_raw_host; nocase; sid:1;)");
18779 if (de_ctx->sig_list == NULL)
18780 goto end;
18781 DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_raw_host_buffer_id]->prev->ctx;
18782 if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
18783 ud->flags & DETECT_CONTENT_NOCASE &&
18784 ud->flags & DETECT_CONTENT_NEGATED &&
18785 !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
18786 ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
18787 ud->fp_chop_offset == 3 &&
18788 ud->fp_chop_len == 4) {
18789 result = 1;
18790 } else {
18791 result = 0;
18792 }
18793
18794 end:
18795 SigCleanSignatures(de_ctx);
18796 DetectEngineCtxFree(de_ctx);
18797 return result;
18798 }
18799
18800
18801 /**
18802 * Unittest to check
18803 * - if we assign different content_ids to duplicate patterns, but one of the
18804 * patterns has a fast_pattern chop set.
18805 * - if 2 unique patterns get unique ids.
18806 * - if 2 duplicate patterns, with no chop set get unique ids.
18807 */
DetectFastPatternTest671(void)18808 static int DetectFastPatternTest671(void)
18809 {
18810 int no_of_sigs = 6;
18811 const char *sigs[no_of_sigs];
18812 Signature *s[no_of_sigs];
18813 DetectEngineCtx *de_ctx = NULL;
18814 DetectContentData *cd = NULL;
18815 SigMatchData *smd = NULL;
18816 int i = 0;
18817
18818 sigs[0] = "alert tcp any any -> any any "
18819 "(content:\"onetwothreefour\"; sid:1;)";
18820 sigs[1] = "alert tcp any any -> any any "
18821 "(content:\"onetwothreefour\"; sid:2;)";
18822 sigs[2] = "alert tcp any any -> any any "
18823 "(content:\"uniquepattern\"; sid:3;)";
18824 sigs[3] = "alert tcp any any -> any any "
18825 "(content:\"onetwothreefour\"; fast_pattern:3,5; sid:4;)";
18826 sigs[4] = "alert tcp any any -> any any "
18827 "(content:\"twoth\"; sid:5;)";
18828 sigs[5] = "alert tcp any any -> any any "
18829 "(content:\"onetwothreefour\"; fast_pattern:0,15; sid:6;)";
18830
18831 de_ctx = DetectEngineCtxInit();
18832 FAIL_IF_NULL(de_ctx);
18833 de_ctx->flags |= DE_QUIET;
18834
18835 for (i = 0; i < no_of_sigs; i++) {
18836 s[i] = DetectEngineAppendSig(de_ctx, sigs[i]);
18837 FAIL_IF_NULL(s[i]);
18838 }
18839
18840 SigGroupBuild(de_ctx);
18841
18842 smd = s[0]->sm_arrays[DETECT_SM_LIST_PMATCH];
18843 cd = (DetectContentData *)smd->ctx;
18844 FAIL_IF(cd->id != 0);
18845
18846 smd = s[1]->sm_arrays[DETECT_SM_LIST_PMATCH];
18847 cd = (DetectContentData *)smd->ctx;
18848 FAIL_IF(cd->id != 0);
18849
18850 smd = s[2]->sm_arrays[DETECT_SM_LIST_PMATCH];
18851 cd = (DetectContentData *)smd->ctx;
18852 FAIL_IF(cd->id != 2);
18853
18854 smd = s[3]->sm_arrays[DETECT_SM_LIST_PMATCH];
18855 cd = (DetectContentData *)smd->ctx;
18856 FAIL_IF(cd->id != 1);
18857
18858 smd = s[4]->sm_arrays[DETECT_SM_LIST_PMATCH];
18859 cd = (DetectContentData *)smd->ctx;
18860 FAIL_IF(cd->id != 1);
18861
18862 smd = s[5]->sm_arrays[DETECT_SM_LIST_PMATCH];
18863 cd = (DetectContentData *)smd->ctx;
18864 FAIL_IF(cd->id != 0);
18865
18866 DetectEngineCtxFree(de_ctx);
18867 PASS;
18868 }
18869
DetectFastPatternRegisterTests(void)18870 static void DetectFastPatternRegisterTests(void)
18871 {
18872 g_file_data_buffer_id = DetectBufferTypeGetByName("file_data");
18873 g_http_method_buffer_id = DetectBufferTypeGetByName("http_method");
18874 g_http_uri_buffer_id = DetectBufferTypeGetByName("http_uri");
18875 g_http_ua_buffer_id = DetectBufferTypeGetByName("http_user_agent");
18876 g_http_cookie_buffer_id = DetectBufferTypeGetByName("http_cookie");
18877 g_http_host_buffer_id = DetectBufferTypeGetByName("http_host");
18878 g_http_raw_host_buffer_id = DetectBufferTypeGetByName("http_raw_host");
18879 g_http_stat_code_buffer_id = DetectBufferTypeGetByName("http_stat_code");
18880 g_http_stat_msg_buffer_id = DetectBufferTypeGetByName("http_stat_msg");
18881 g_http_header_buffer_id = DetectBufferTypeGetByName("http_header");
18882 g_http_raw_header_buffer_id = DetectBufferTypeGetByName("http_raw_header");
18883 g_http_client_body_buffer_id = DetectBufferTypeGetByName("http_client_body");
18884 g_http_raw_uri_buffer_id = DetectBufferTypeGetByName("http_raw_uri");
18885
18886 UtRegisterTest("DetectFastPatternTest01", DetectFastPatternTest01);
18887 UtRegisterTest("DetectFastPatternTest02", DetectFastPatternTest02);
18888 UtRegisterTest("DetectFastPatternTest03", DetectFastPatternTest03);
18889 UtRegisterTest("DetectFastPatternTest04", DetectFastPatternTest04);
18890 UtRegisterTest("DetectFastPatternTest14", DetectFastPatternTest14);
18891 UtRegisterTest("DetectFastPatternTest15", DetectFastPatternTest15);
18892 UtRegisterTest("DetectFastPatternTest16", DetectFastPatternTest16);
18893 UtRegisterTest("DetectFastPatternTest17", DetectFastPatternTest17);
18894 UtRegisterTest("DetectFastPatternTest18", DetectFastPatternTest18);
18895 UtRegisterTest("DetectFastPatternTest19", DetectFastPatternTest19);
18896 UtRegisterTest("DetectFastPatternTest20", DetectFastPatternTest20);
18897 UtRegisterTest("DetectFastPatternTest21", DetectFastPatternTest21);
18898 UtRegisterTest("DetectFastPatternTest22", DetectFastPatternTest22);
18899 UtRegisterTest("DetectFastPatternTest23", DetectFastPatternTest23);
18900 UtRegisterTest("DetectFastPatternTest24", DetectFastPatternTest24);
18901 UtRegisterTest("DetectFastPatternTest25", DetectFastPatternTest25);
18902 UtRegisterTest("DetectFastPatternTest26", DetectFastPatternTest26);
18903 UtRegisterTest("DetectFastPatternTest27", DetectFastPatternTest27);
18904 UtRegisterTest("DetectFastPatternTest28", DetectFastPatternTest28);
18905 UtRegisterTest("DetectFastPatternTest29", DetectFastPatternTest29);
18906 UtRegisterTest("DetectFastPatternTest30", DetectFastPatternTest30);
18907 UtRegisterTest("DetectFastPatternTest31", DetectFastPatternTest31);
18908 UtRegisterTest("DetectFastPatternTest32", DetectFastPatternTest32);
18909 UtRegisterTest("DetectFastPatternTest33", DetectFastPatternTest33);
18910 UtRegisterTest("DetectFastPatternTest34", DetectFastPatternTest34);
18911 UtRegisterTest("DetectFastPatternTest35", DetectFastPatternTest35);
18912 UtRegisterTest("DetectFastPatternTest36", DetectFastPatternTest36);
18913 UtRegisterTest("DetectFastPatternTest37", DetectFastPatternTest37);
18914 UtRegisterTest("DetectFastPatternTest38", DetectFastPatternTest38);
18915 UtRegisterTest("DetectFastPatternTest39", DetectFastPatternTest39);
18916 UtRegisterTest("DetectFastPatternTest40", DetectFastPatternTest40);
18917 UtRegisterTest("DetectFastPatternTest41", DetectFastPatternTest41);
18918 UtRegisterTest("DetectFastPatternTest42", DetectFastPatternTest42);
18919 UtRegisterTest("DetectFastPatternTest43", DetectFastPatternTest43);
18920 UtRegisterTest("DetectFastPatternTest44", DetectFastPatternTest44);
18921 UtRegisterTest("DetectFastPatternTest45", DetectFastPatternTest45);
18922 UtRegisterTest("DetectFastPatternTest46", DetectFastPatternTest46);
18923 UtRegisterTest("DetectFastPatternTest47", DetectFastPatternTest47);
18924 UtRegisterTest("DetectFastPatternTest48", DetectFastPatternTest48);
18925 UtRegisterTest("DetectFastPatternTest49", DetectFastPatternTest49);
18926 UtRegisterTest("DetectFastPatternTest50", DetectFastPatternTest50);
18927 UtRegisterTest("DetectFastPatternTest51", DetectFastPatternTest51);
18928 UtRegisterTest("DetectFastPatternTest52", DetectFastPatternTest52);
18929 UtRegisterTest("DetectFastPatternTest53", DetectFastPatternTest53);
18930 /* content fast_pattern tests ^ */
18931 /* uricontent fast_pattern tests v */
18932 UtRegisterTest("DetectFastPatternTest54", DetectFastPatternTest54);
18933 UtRegisterTest("DetectFastPatternTest55", DetectFastPatternTest55);
18934 UtRegisterTest("DetectFastPatternTest56", DetectFastPatternTest56);
18935 UtRegisterTest("DetectFastPatternTest57", DetectFastPatternTest57);
18936 UtRegisterTest("DetectFastPatternTest58", DetectFastPatternTest58);
18937 UtRegisterTest("DetectFastPatternTest59", DetectFastPatternTest59);
18938 UtRegisterTest("DetectFastPatternTest60", DetectFastPatternTest60);
18939 UtRegisterTest("DetectFastPatternTest61", DetectFastPatternTest61);
18940 UtRegisterTest("DetectFastPatternTest62", DetectFastPatternTest62);
18941 UtRegisterTest("DetectFastPatternTest63", DetectFastPatternTest63);
18942 UtRegisterTest("DetectFastPatternTest64", DetectFastPatternTest64);
18943 UtRegisterTest("DetectFastPatternTest65", DetectFastPatternTest65);
18944 UtRegisterTest("DetectFastPatternTest66", DetectFastPatternTest66);
18945 UtRegisterTest("DetectFastPatternTest67", DetectFastPatternTest67);
18946 UtRegisterTest("DetectFastPatternTest68", DetectFastPatternTest68);
18947 UtRegisterTest("DetectFastPatternTest69", DetectFastPatternTest69);
18948 UtRegisterTest("DetectFastPatternTest70", DetectFastPatternTest70);
18949 UtRegisterTest("DetectFastPatternTest71", DetectFastPatternTest71);
18950 UtRegisterTest("DetectFastPatternTest72", DetectFastPatternTest72);
18951 UtRegisterTest("DetectFastPatternTest73", DetectFastPatternTest73);
18952 UtRegisterTest("DetectFastPatternTest74", DetectFastPatternTest74);
18953 UtRegisterTest("DetectFastPatternTest75", DetectFastPatternTest75);
18954 UtRegisterTest("DetectFastPatternTest76", DetectFastPatternTest76);
18955 UtRegisterTest("DetectFastPatternTest77", DetectFastPatternTest77);
18956 UtRegisterTest("DetectFastPatternTest78", DetectFastPatternTest78);
18957 UtRegisterTest("DetectFastPatternTest79", DetectFastPatternTest79);
18958 UtRegisterTest("DetectFastPatternTest80", DetectFastPatternTest80);
18959 UtRegisterTest("DetectFastPatternTest81", DetectFastPatternTest81);
18960 UtRegisterTest("DetectFastPatternTest82", DetectFastPatternTest82);
18961 UtRegisterTest("DetectFastPatternTest83", DetectFastPatternTest83);
18962 UtRegisterTest("DetectFastPatternTest84", DetectFastPatternTest84);
18963 UtRegisterTest("DetectFastPatternTest85", DetectFastPatternTest85);
18964 UtRegisterTest("DetectFastPatternTest86", DetectFastPatternTest86);
18965 UtRegisterTest("DetectFastPatternTest87", DetectFastPatternTest87);
18966 UtRegisterTest("DetectFastPatternTest88", DetectFastPatternTest88);
18967 UtRegisterTest("DetectFastPatternTest89", DetectFastPatternTest89);
18968 UtRegisterTest("DetectFastPatternTest90", DetectFastPatternTest90);
18969 UtRegisterTest("DetectFastPatternTest91", DetectFastPatternTest91);
18970 UtRegisterTest("DetectFastPatternTest92", DetectFastPatternTest92);
18971 /* uricontent fast_pattern tests ^ */
18972 /* http_uri fast_pattern tests v */
18973 UtRegisterTest("DetectFastPatternTest93", DetectFastPatternTest93);
18974 UtRegisterTest("DetectFastPatternTest94", DetectFastPatternTest94);
18975 UtRegisterTest("DetectFastPatternTest95", DetectFastPatternTest95);
18976 UtRegisterTest("DetectFastPatternTest96", DetectFastPatternTest96);
18977 UtRegisterTest("DetectFastPatternTest97", DetectFastPatternTest97);
18978 UtRegisterTest("DetectFastPatternTest98", DetectFastPatternTest98);
18979 UtRegisterTest("DetectFastPatternTest99", DetectFastPatternTest99);
18980 UtRegisterTest("DetectFastPatternTest100", DetectFastPatternTest100);
18981 UtRegisterTest("DetectFastPatternTest101", DetectFastPatternTest101);
18982 UtRegisterTest("DetectFastPatternTest102", DetectFastPatternTest102);
18983 UtRegisterTest("DetectFastPatternTest103", DetectFastPatternTest103);
18984 UtRegisterTest("DetectFastPatternTest104", DetectFastPatternTest104);
18985 UtRegisterTest("DetectFastPatternTest105", DetectFastPatternTest105);
18986 UtRegisterTest("DetectFastPatternTest106", DetectFastPatternTest106);
18987 UtRegisterTest("DetectFastPatternTest107", DetectFastPatternTest107);
18988 UtRegisterTest("DetectFastPatternTest108", DetectFastPatternTest108);
18989 UtRegisterTest("DetectFastPatternTest109", DetectFastPatternTest109);
18990 UtRegisterTest("DetectFastPatternTest110", DetectFastPatternTest110);
18991 UtRegisterTest("DetectFastPatternTest111", DetectFastPatternTest111);
18992 UtRegisterTest("DetectFastPatternTest112", DetectFastPatternTest112);
18993 UtRegisterTest("DetectFastPatternTest113", DetectFastPatternTest113);
18994 UtRegisterTest("DetectFastPatternTest114", DetectFastPatternTest114);
18995 UtRegisterTest("DetectFastPatternTest115", DetectFastPatternTest115);
18996 UtRegisterTest("DetectFastPatternTest116", DetectFastPatternTest116);
18997 UtRegisterTest("DetectFastPatternTest117", DetectFastPatternTest117);
18998 UtRegisterTest("DetectFastPatternTest118", DetectFastPatternTest118);
18999 UtRegisterTest("DetectFastPatternTest119", DetectFastPatternTest119);
19000 UtRegisterTest("DetectFastPatternTest120", DetectFastPatternTest120);
19001 UtRegisterTest("DetectFastPatternTest121", DetectFastPatternTest121);
19002 UtRegisterTest("DetectFastPatternTest122", DetectFastPatternTest122);
19003 UtRegisterTest("DetectFastPatternTest123", DetectFastPatternTest123);
19004 UtRegisterTest("DetectFastPatternTest124", DetectFastPatternTest124);
19005 UtRegisterTest("DetectFastPatternTest125", DetectFastPatternTest125);
19006 UtRegisterTest("DetectFastPatternTest126", DetectFastPatternTest126);
19007 UtRegisterTest("DetectFastPatternTest127", DetectFastPatternTest127);
19008 UtRegisterTest("DetectFastPatternTest128", DetectFastPatternTest128);
19009 UtRegisterTest("DetectFastPatternTest129", DetectFastPatternTest129);
19010 UtRegisterTest("DetectFastPatternTest130", DetectFastPatternTest130);
19011 UtRegisterTest("DetectFastPatternTest131", DetectFastPatternTest131);
19012 UtRegisterTest("DetectFastPatternTest132", DetectFastPatternTest132);
19013 UtRegisterTest("DetectFastPatternTest133", DetectFastPatternTest133);
19014 /* http_uri fast_pattern tests ^ */
19015 /* http_client_body fast_pattern tests v */
19016 UtRegisterTest("DetectFastPatternTest134", DetectFastPatternTest134);
19017 UtRegisterTest("DetectFastPatternTest135", DetectFastPatternTest135);
19018 UtRegisterTest("DetectFastPatternTest136", DetectFastPatternTest136);
19019 UtRegisterTest("DetectFastPatternTest137", DetectFastPatternTest137);
19020 UtRegisterTest("DetectFastPatternTest138", DetectFastPatternTest138);
19021 UtRegisterTest("DetectFastPatternTest139", DetectFastPatternTest139);
19022 UtRegisterTest("DetectFastPatternTest140", DetectFastPatternTest140);
19023 UtRegisterTest("DetectFastPatternTest141", DetectFastPatternTest141);
19024 UtRegisterTest("DetectFastPatternTest142", DetectFastPatternTest142);
19025 UtRegisterTest("DetectFastPatternTest143", DetectFastPatternTest143);
19026 UtRegisterTest("DetectFastPatternTest144", DetectFastPatternTest144);
19027 UtRegisterTest("DetectFastPatternTest145", DetectFastPatternTest145);
19028 UtRegisterTest("DetectFastPatternTest146", DetectFastPatternTest146);
19029 UtRegisterTest("DetectFastPatternTest147", DetectFastPatternTest147);
19030 UtRegisterTest("DetectFastPatternTest148", DetectFastPatternTest148);
19031 UtRegisterTest("DetectFastPatternTest149", DetectFastPatternTest149);
19032 UtRegisterTest("DetectFastPatternTest150", DetectFastPatternTest150);
19033 UtRegisterTest("DetectFastPatternTest151", DetectFastPatternTest151);
19034 UtRegisterTest("DetectFastPatternTest152", DetectFastPatternTest152);
19035 UtRegisterTest("DetectFastPatternTest153", DetectFastPatternTest153);
19036 UtRegisterTest("DetectFastPatternTest154", DetectFastPatternTest154);
19037 UtRegisterTest("DetectFastPatternTest155", DetectFastPatternTest155);
19038 UtRegisterTest("DetectFastPatternTest156", DetectFastPatternTest156);
19039 UtRegisterTest("DetectFastPatternTest157", DetectFastPatternTest157);
19040 UtRegisterTest("DetectFastPatternTest158", DetectFastPatternTest158);
19041 UtRegisterTest("DetectFastPatternTest159", DetectFastPatternTest159);
19042 UtRegisterTest("DetectFastPatternTest160", DetectFastPatternTest160);
19043 UtRegisterTest("DetectFastPatternTest161", DetectFastPatternTest161);
19044 UtRegisterTest("DetectFastPatternTest162", DetectFastPatternTest162);
19045 UtRegisterTest("DetectFastPatternTest163", DetectFastPatternTest163);
19046 UtRegisterTest("DetectFastPatternTest164", DetectFastPatternTest164);
19047 UtRegisterTest("DetectFastPatternTest165", DetectFastPatternTest165);
19048 UtRegisterTest("DetectFastPatternTest166", DetectFastPatternTest166);
19049 UtRegisterTest("DetectFastPatternTest167", DetectFastPatternTest167);
19050 UtRegisterTest("DetectFastPatternTest168", DetectFastPatternTest168);
19051 UtRegisterTest("DetectFastPatternTest169", DetectFastPatternTest169);
19052 UtRegisterTest("DetectFastPatternTest170", DetectFastPatternTest170);
19053 UtRegisterTest("DetectFastPatternTest171", DetectFastPatternTest171);
19054 UtRegisterTest("DetectFastPatternTest172", DetectFastPatternTest172);
19055 UtRegisterTest("DetectFastPatternTest173", DetectFastPatternTest173);
19056 UtRegisterTest("DetectFastPatternTest174", DetectFastPatternTest174);
19057 /* http_client_body fast_pattern tests ^ */
19058 /* content fast_pattern tests v */
19059 UtRegisterTest("DetectFastPatternTest175", DetectFastPatternTest175);
19060 UtRegisterTest("DetectFastPatternTest176", DetectFastPatternTest176);
19061 UtRegisterTest("DetectFastPatternTest177", DetectFastPatternTest177);
19062 UtRegisterTest("DetectFastPatternTest178", DetectFastPatternTest178);
19063 /* content fast_pattern tests ^ */
19064 /* http_header fast_pattern tests v */
19065 UtRegisterTest("DetectFastPatternTest179", DetectFastPatternTest179);
19066 UtRegisterTest("DetectFastPatternTest180", DetectFastPatternTest180);
19067 UtRegisterTest("DetectFastPatternTest181", DetectFastPatternTest181);
19068 UtRegisterTest("DetectFastPatternTest182", DetectFastPatternTest182);
19069 UtRegisterTest("DetectFastPatternTest183", DetectFastPatternTest183);
19070 UtRegisterTest("DetectFastPatternTest184", DetectFastPatternTest184);
19071 UtRegisterTest("DetectFastPatternTest185", DetectFastPatternTest185);
19072 UtRegisterTest("DetectFastPatternTest186", DetectFastPatternTest186);
19073 UtRegisterTest("DetectFastPatternTest187", DetectFastPatternTest187);
19074 UtRegisterTest("DetectFastPatternTest188", DetectFastPatternTest188);
19075 UtRegisterTest("DetectFastPatternTest189", DetectFastPatternTest189);
19076 UtRegisterTest("DetectFastPatternTest190", DetectFastPatternTest190);
19077 UtRegisterTest("DetectFastPatternTest191", DetectFastPatternTest191);
19078 UtRegisterTest("DetectFastPatternTest192", DetectFastPatternTest192);
19079 UtRegisterTest("DetectFastPatternTest193", DetectFastPatternTest193);
19080 UtRegisterTest("DetectFastPatternTest194", DetectFastPatternTest194);
19081 UtRegisterTest("DetectFastPatternTest195", DetectFastPatternTest195);
19082 UtRegisterTest("DetectFastPatternTest196", DetectFastPatternTest196);
19083 UtRegisterTest("DetectFastPatternTest197", DetectFastPatternTest197);
19084 UtRegisterTest("DetectFastPatternTest198", DetectFastPatternTest198);
19085 UtRegisterTest("DetectFastPatternTest199", DetectFastPatternTest199);
19086 UtRegisterTest("DetectFastPatternTest200", DetectFastPatternTest200);
19087 UtRegisterTest("DetectFastPatternTest201", DetectFastPatternTest201);
19088 UtRegisterTest("DetectFastPatternTest202", DetectFastPatternTest202);
19089 UtRegisterTest("DetectFastPatternTest203", DetectFastPatternTest203);
19090 UtRegisterTest("DetectFastPatternTest204", DetectFastPatternTest204);
19091 UtRegisterTest("DetectFastPatternTest205", DetectFastPatternTest205);
19092 UtRegisterTest("DetectFastPatternTest206", DetectFastPatternTest206);
19093 UtRegisterTest("DetectFastPatternTest207", DetectFastPatternTest207);
19094 UtRegisterTest("DetectFastPatternTest208", DetectFastPatternTest208);
19095 UtRegisterTest("DetectFastPatternTest209", DetectFastPatternTest209);
19096 UtRegisterTest("DetectFastPatternTest210", DetectFastPatternTest210);
19097 UtRegisterTest("DetectFastPatternTest211", DetectFastPatternTest211);
19098 UtRegisterTest("DetectFastPatternTest212", DetectFastPatternTest212);
19099 UtRegisterTest("DetectFastPatternTest213", DetectFastPatternTest213);
19100 UtRegisterTest("DetectFastPatternTest214", DetectFastPatternTest214);
19101 UtRegisterTest("DetectFastPatternTest215", DetectFastPatternTest215);
19102 UtRegisterTest("DetectFastPatternTest216", DetectFastPatternTest216);
19103 UtRegisterTest("DetectFastPatternTest217", DetectFastPatternTest217);
19104 UtRegisterTest("DetectFastPatternTest218", DetectFastPatternTest218);
19105 UtRegisterTest("DetectFastPatternTest219", DetectFastPatternTest219);
19106 /* http_header fast_pattern tests ^ */
19107 /* http_raw_header fast_pattern tests v */
19108 UtRegisterTest("DetectFastPatternTest220", DetectFastPatternTest220);
19109 UtRegisterTest("DetectFastPatternTest221", DetectFastPatternTest221);
19110 UtRegisterTest("DetectFastPatternTest222", DetectFastPatternTest222);
19111 UtRegisterTest("DetectFastPatternTest223", DetectFastPatternTest223);
19112 UtRegisterTest("DetectFastPatternTest224", DetectFastPatternTest224);
19113 UtRegisterTest("DetectFastPatternTest225", DetectFastPatternTest225);
19114 UtRegisterTest("DetectFastPatternTest226", DetectFastPatternTest226);
19115 UtRegisterTest("DetectFastPatternTest227", DetectFastPatternTest227);
19116 UtRegisterTest("DetectFastPatternTest228", DetectFastPatternTest228);
19117 UtRegisterTest("DetectFastPatternTest229", DetectFastPatternTest229);
19118 UtRegisterTest("DetectFastPatternTest230", DetectFastPatternTest230);
19119 UtRegisterTest("DetectFastPatternTest231", DetectFastPatternTest231);
19120 UtRegisterTest("DetectFastPatternTest232", DetectFastPatternTest232);
19121 UtRegisterTest("DetectFastPatternTest233", DetectFastPatternTest233);
19122 UtRegisterTest("DetectFastPatternTest234", DetectFastPatternTest234);
19123 UtRegisterTest("DetectFastPatternTest235", DetectFastPatternTest235);
19124 UtRegisterTest("DetectFastPatternTest236", DetectFastPatternTest236);
19125 UtRegisterTest("DetectFastPatternTest237", DetectFastPatternTest237);
19126 UtRegisterTest("DetectFastPatternTest238", DetectFastPatternTest238);
19127 UtRegisterTest("DetectFastPatternTest239", DetectFastPatternTest239);
19128 UtRegisterTest("DetectFastPatternTest240", DetectFastPatternTest240);
19129 UtRegisterTest("DetectFastPatternTest241", DetectFastPatternTest241);
19130 UtRegisterTest("DetectFastPatternTest242", DetectFastPatternTest242);
19131 UtRegisterTest("DetectFastPatternTest243", DetectFastPatternTest243);
19132 UtRegisterTest("DetectFastPatternTest244", DetectFastPatternTest244);
19133 UtRegisterTest("DetectFastPatternTest245", DetectFastPatternTest245);
19134 UtRegisterTest("DetectFastPatternTest246", DetectFastPatternTest246);
19135 UtRegisterTest("DetectFastPatternTest247", DetectFastPatternTest247);
19136 UtRegisterTest("DetectFastPatternTest248", DetectFastPatternTest248);
19137 UtRegisterTest("DetectFastPatternTest249", DetectFastPatternTest249);
19138 UtRegisterTest("DetectFastPatternTest250", DetectFastPatternTest250);
19139 UtRegisterTest("DetectFastPatternTest251", DetectFastPatternTest251);
19140 UtRegisterTest("DetectFastPatternTest252", DetectFastPatternTest252);
19141 UtRegisterTest("DetectFastPatternTest253", DetectFastPatternTest253);
19142 UtRegisterTest("DetectFastPatternTest254", DetectFastPatternTest254);
19143 UtRegisterTest("DetectFastPatternTest255", DetectFastPatternTest255);
19144 UtRegisterTest("DetectFastPatternTest256", DetectFastPatternTest256);
19145 UtRegisterTest("DetectFastPatternTest257", DetectFastPatternTest257);
19146 UtRegisterTest("DetectFastPatternTest258", DetectFastPatternTest258);
19147 UtRegisterTest("DetectFastPatternTest259", DetectFastPatternTest259);
19148 UtRegisterTest("DetectFastPatternTest260", DetectFastPatternTest260);
19149 /* http_raw_header fast_pattern tests ^ */
19150 /* http_method fast_pattern tests v */
19151 UtRegisterTest("DetectFastPatternTest261", DetectFastPatternTest261);
19152 UtRegisterTest("DetectFastPatternTest262", DetectFastPatternTest262);
19153 UtRegisterTest("DetectFastPatternTest263", DetectFastPatternTest263);
19154 UtRegisterTest("DetectFastPatternTest264", DetectFastPatternTest264);
19155 UtRegisterTest("DetectFastPatternTest265", DetectFastPatternTest265);
19156 UtRegisterTest("DetectFastPatternTest266", DetectFastPatternTest266);
19157 UtRegisterTest("DetectFastPatternTest267", DetectFastPatternTest267);
19158 UtRegisterTest("DetectFastPatternTest268", DetectFastPatternTest268);
19159 UtRegisterTest("DetectFastPatternTest269", DetectFastPatternTest269);
19160 UtRegisterTest("DetectFastPatternTest270", DetectFastPatternTest270);
19161 UtRegisterTest("DetectFastPatternTest271", DetectFastPatternTest271);
19162 UtRegisterTest("DetectFastPatternTest272", DetectFastPatternTest272);
19163 UtRegisterTest("DetectFastPatternTest273", DetectFastPatternTest273);
19164 UtRegisterTest("DetectFastPatternTest274", DetectFastPatternTest274);
19165 UtRegisterTest("DetectFastPatternTest275", DetectFastPatternTest275);
19166 UtRegisterTest("DetectFastPatternTest276", DetectFastPatternTest276);
19167 UtRegisterTest("DetectFastPatternTest277", DetectFastPatternTest277);
19168 UtRegisterTest("DetectFastPatternTest278", DetectFastPatternTest278);
19169 UtRegisterTest("DetectFastPatternTest279", DetectFastPatternTest279);
19170 UtRegisterTest("DetectFastPatternTest280", DetectFastPatternTest280);
19171 UtRegisterTest("DetectFastPatternTest281", DetectFastPatternTest281);
19172 UtRegisterTest("DetectFastPatternTest282", DetectFastPatternTest282);
19173 UtRegisterTest("DetectFastPatternTest283", DetectFastPatternTest283);
19174 UtRegisterTest("DetectFastPatternTest284", DetectFastPatternTest284);
19175 UtRegisterTest("DetectFastPatternTest285", DetectFastPatternTest285);
19176 UtRegisterTest("DetectFastPatternTest286", DetectFastPatternTest286);
19177 UtRegisterTest("DetectFastPatternTest287", DetectFastPatternTest287);
19178 UtRegisterTest("DetectFastPatternTest288", DetectFastPatternTest288);
19179 UtRegisterTest("DetectFastPatternTest289", DetectFastPatternTest289);
19180 UtRegisterTest("DetectFastPatternTest290", DetectFastPatternTest290);
19181 UtRegisterTest("DetectFastPatternTest291", DetectFastPatternTest291);
19182 UtRegisterTest("DetectFastPatternTest292", DetectFastPatternTest292);
19183 UtRegisterTest("DetectFastPatternTest293", DetectFastPatternTest293);
19184 UtRegisterTest("DetectFastPatternTest294", DetectFastPatternTest294);
19185 UtRegisterTest("DetectFastPatternTest295", DetectFastPatternTest295);
19186 UtRegisterTest("DetectFastPatternTest296", DetectFastPatternTest296);
19187 UtRegisterTest("DetectFastPatternTest297", DetectFastPatternTest297);
19188 UtRegisterTest("DetectFastPatternTest298", DetectFastPatternTest298);
19189 UtRegisterTest("DetectFastPatternTest299", DetectFastPatternTest299);
19190 UtRegisterTest("DetectFastPatternTest300", DetectFastPatternTest300);
19191 UtRegisterTest("DetectFastPatternTest301", DetectFastPatternTest301);
19192 /* http_method fast_pattern tests ^ */
19193 /* http_cookie fast_pattern tests v */
19194 UtRegisterTest("DetectFastPatternTest302", DetectFastPatternTest302);
19195 UtRegisterTest("DetectFastPatternTest303", DetectFastPatternTest303);
19196 UtRegisterTest("DetectFastPatternTest304", DetectFastPatternTest304);
19197 UtRegisterTest("DetectFastPatternTest305", DetectFastPatternTest305);
19198 UtRegisterTest("DetectFastPatternTest306", DetectFastPatternTest306);
19199 UtRegisterTest("DetectFastPatternTest307", DetectFastPatternTest307);
19200 UtRegisterTest("DetectFastPatternTest308", DetectFastPatternTest308);
19201 UtRegisterTest("DetectFastPatternTest309", DetectFastPatternTest309);
19202 UtRegisterTest("DetectFastPatternTest310", DetectFastPatternTest310);
19203 UtRegisterTest("DetectFastPatternTest311", DetectFastPatternTest311);
19204 UtRegisterTest("DetectFastPatternTest312", DetectFastPatternTest312);
19205 UtRegisterTest("DetectFastPatternTest313", DetectFastPatternTest313);
19206 UtRegisterTest("DetectFastPatternTest314", DetectFastPatternTest314);
19207 UtRegisterTest("DetectFastPatternTest315", DetectFastPatternTest315);
19208 UtRegisterTest("DetectFastPatternTest316", DetectFastPatternTest316);
19209 UtRegisterTest("DetectFastPatternTest317", DetectFastPatternTest317);
19210 UtRegisterTest("DetectFastPatternTest318", DetectFastPatternTest318);
19211 UtRegisterTest("DetectFastPatternTest319", DetectFastPatternTest319);
19212 UtRegisterTest("DetectFastPatternTest320", DetectFastPatternTest320);
19213 UtRegisterTest("DetectFastPatternTest321", DetectFastPatternTest321);
19214 UtRegisterTest("DetectFastPatternTest322", DetectFastPatternTest322);
19215 UtRegisterTest("DetectFastPatternTest323", DetectFastPatternTest323);
19216 UtRegisterTest("DetectFastPatternTest324", DetectFastPatternTest324);
19217 UtRegisterTest("DetectFastPatternTest325", DetectFastPatternTest325);
19218 UtRegisterTest("DetectFastPatternTest326", DetectFastPatternTest326);
19219 UtRegisterTest("DetectFastPatternTest327", DetectFastPatternTest327);
19220 UtRegisterTest("DetectFastPatternTest328", DetectFastPatternTest328);
19221 UtRegisterTest("DetectFastPatternTest329", DetectFastPatternTest329);
19222 UtRegisterTest("DetectFastPatternTest330", DetectFastPatternTest330);
19223 UtRegisterTest("DetectFastPatternTest331", DetectFastPatternTest331);
19224 UtRegisterTest("DetectFastPatternTest332", DetectFastPatternTest332);
19225 UtRegisterTest("DetectFastPatternTest333", DetectFastPatternTest333);
19226 UtRegisterTest("DetectFastPatternTest334", DetectFastPatternTest334);
19227 UtRegisterTest("DetectFastPatternTest335", DetectFastPatternTest335);
19228 UtRegisterTest("DetectFastPatternTest336", DetectFastPatternTest336);
19229 UtRegisterTest("DetectFastPatternTest337", DetectFastPatternTest337);
19230 UtRegisterTest("DetectFastPatternTest338", DetectFastPatternTest338);
19231 UtRegisterTest("DetectFastPatternTest339", DetectFastPatternTest339);
19232 UtRegisterTest("DetectFastPatternTest340", DetectFastPatternTest340);
19233 UtRegisterTest("DetectFastPatternTest341", DetectFastPatternTest341);
19234 UtRegisterTest("DetectFastPatternTest342", DetectFastPatternTest342);
19235 /* http_cookie fast_pattern tests ^ */
19236 /* http_raw_uri fast_pattern tests v */
19237 UtRegisterTest("DetectFastPatternTest343", DetectFastPatternTest343);
19238 UtRegisterTest("DetectFastPatternTest344", DetectFastPatternTest344);
19239 UtRegisterTest("DetectFastPatternTest345", DetectFastPatternTest345);
19240 UtRegisterTest("DetectFastPatternTest346", DetectFastPatternTest346);
19241 UtRegisterTest("DetectFastPatternTest347", DetectFastPatternTest347);
19242 UtRegisterTest("DetectFastPatternTest348", DetectFastPatternTest348);
19243 UtRegisterTest("DetectFastPatternTest349", DetectFastPatternTest349);
19244 UtRegisterTest("DetectFastPatternTest350", DetectFastPatternTest350);
19245 UtRegisterTest("DetectFastPatternTest351", DetectFastPatternTest351);
19246 UtRegisterTest("DetectFastPatternTest352", DetectFastPatternTest352);
19247 UtRegisterTest("DetectFastPatternTest353", DetectFastPatternTest353);
19248 UtRegisterTest("DetectFastPatternTest354", DetectFastPatternTest354);
19249 UtRegisterTest("DetectFastPatternTest355", DetectFastPatternTest355);
19250 UtRegisterTest("DetectFastPatternTest356", DetectFastPatternTest356);
19251 UtRegisterTest("DetectFastPatternTest357", DetectFastPatternTest357);
19252 UtRegisterTest("DetectFastPatternTest358", DetectFastPatternTest358);
19253 UtRegisterTest("DetectFastPatternTest359", DetectFastPatternTest359);
19254 UtRegisterTest("DetectFastPatternTest360", DetectFastPatternTest360);
19255 UtRegisterTest("DetectFastPatternTest361", DetectFastPatternTest361);
19256 UtRegisterTest("DetectFastPatternTest362", DetectFastPatternTest362);
19257 UtRegisterTest("DetectFastPatternTest363", DetectFastPatternTest363);
19258 UtRegisterTest("DetectFastPatternTest364", DetectFastPatternTest364);
19259 UtRegisterTest("DetectFastPatternTest365", DetectFastPatternTest365);
19260 UtRegisterTest("DetectFastPatternTest366", DetectFastPatternTest366);
19261 UtRegisterTest("DetectFastPatternTest367", DetectFastPatternTest367);
19262 UtRegisterTest("DetectFastPatternTest368", DetectFastPatternTest368);
19263 UtRegisterTest("DetectFastPatternTest369", DetectFastPatternTest369);
19264 UtRegisterTest("DetectFastPatternTest370", DetectFastPatternTest370);
19265 UtRegisterTest("DetectFastPatternTest371", DetectFastPatternTest371);
19266 UtRegisterTest("DetectFastPatternTest372", DetectFastPatternTest372);
19267 UtRegisterTest("DetectFastPatternTest373", DetectFastPatternTest373);
19268 UtRegisterTest("DetectFastPatternTest374", DetectFastPatternTest374);
19269 UtRegisterTest("DetectFastPatternTest375", DetectFastPatternTest375);
19270 UtRegisterTest("DetectFastPatternTest376", DetectFastPatternTest376);
19271 UtRegisterTest("DetectFastPatternTest377", DetectFastPatternTest377);
19272 UtRegisterTest("DetectFastPatternTest378", DetectFastPatternTest378);
19273 UtRegisterTest("DetectFastPatternTest379", DetectFastPatternTest379);
19274 UtRegisterTest("DetectFastPatternTest380", DetectFastPatternTest380);
19275 UtRegisterTest("DetectFastPatternTest381", DetectFastPatternTest381);
19276 UtRegisterTest("DetectFastPatternTest382", DetectFastPatternTest382);
19277 UtRegisterTest("DetectFastPatternTest383", DetectFastPatternTest383);
19278 /* http_raw_uri fast_pattern tests ^ */
19279 /* http_stat_msg fast_pattern tests v */
19280 UtRegisterTest("DetectFastPatternTest384", DetectFastPatternTest384);
19281 UtRegisterTest("DetectFastPatternTest385", DetectFastPatternTest385);
19282 UtRegisterTest("DetectFastPatternTest386", DetectFastPatternTest386);
19283 UtRegisterTest("DetectFastPatternTest387", DetectFastPatternTest387);
19284 UtRegisterTest("DetectFastPatternTest388", DetectFastPatternTest388);
19285 UtRegisterTest("DetectFastPatternTest389", DetectFastPatternTest389);
19286 UtRegisterTest("DetectFastPatternTest390", DetectFastPatternTest390);
19287 UtRegisterTest("DetectFastPatternTest391", DetectFastPatternTest391);
19288 UtRegisterTest("DetectFastPatternTest392", DetectFastPatternTest392);
19289 UtRegisterTest("DetectFastPatternTest393", DetectFastPatternTest393);
19290 UtRegisterTest("DetectFastPatternTest394", DetectFastPatternTest394);
19291 UtRegisterTest("DetectFastPatternTest395", DetectFastPatternTest395);
19292 UtRegisterTest("DetectFastPatternTest396", DetectFastPatternTest396);
19293 UtRegisterTest("DetectFastPatternTest397", DetectFastPatternTest397);
19294 UtRegisterTest("DetectFastPatternTest398", DetectFastPatternTest398);
19295 UtRegisterTest("DetectFastPatternTest399", DetectFastPatternTest399);
19296 UtRegisterTest("DetectFastPatternTest400", DetectFastPatternTest400);
19297 UtRegisterTest("DetectFastPatternTest401", DetectFastPatternTest401);
19298 UtRegisterTest("DetectFastPatternTest402", DetectFastPatternTest402);
19299 UtRegisterTest("DetectFastPatternTest403", DetectFastPatternTest403);
19300 UtRegisterTest("DetectFastPatternTest404", DetectFastPatternTest404);
19301 UtRegisterTest("DetectFastPatternTest405", DetectFastPatternTest405);
19302 UtRegisterTest("DetectFastPatternTest406", DetectFastPatternTest406);
19303 UtRegisterTest("DetectFastPatternTest407", DetectFastPatternTest407);
19304 UtRegisterTest("DetectFastPatternTest408", DetectFastPatternTest408);
19305 UtRegisterTest("DetectFastPatternTest409", DetectFastPatternTest409);
19306 UtRegisterTest("DetectFastPatternTest410", DetectFastPatternTest410);
19307 UtRegisterTest("DetectFastPatternTest411", DetectFastPatternTest411);
19308 UtRegisterTest("DetectFastPatternTest412", DetectFastPatternTest412);
19309 UtRegisterTest("DetectFastPatternTest413", DetectFastPatternTest413);
19310 UtRegisterTest("DetectFastPatternTest414", DetectFastPatternTest414);
19311 UtRegisterTest("DetectFastPatternTest415", DetectFastPatternTest415);
19312 UtRegisterTest("DetectFastPatternTest416", DetectFastPatternTest416);
19313 UtRegisterTest("DetectFastPatternTest417", DetectFastPatternTest417);
19314 UtRegisterTest("DetectFastPatternTest418", DetectFastPatternTest418);
19315 UtRegisterTest("DetectFastPatternTest419", DetectFastPatternTest419);
19316 UtRegisterTest("DetectFastPatternTest420", DetectFastPatternTest420);
19317 UtRegisterTest("DetectFastPatternTest421", DetectFastPatternTest421);
19318 UtRegisterTest("DetectFastPatternTest422", DetectFastPatternTest422);
19319 UtRegisterTest("DetectFastPatternTest423", DetectFastPatternTest423);
19320 UtRegisterTest("DetectFastPatternTest424", DetectFastPatternTest424);
19321 /* http_stat_msg fast_pattern tests ^ */
19322 /* http_stat_code fast_pattern tests v */
19323 UtRegisterTest("DetectFastPatternTest425", DetectFastPatternTest425);
19324 UtRegisterTest("DetectFastPatternTest426", DetectFastPatternTest426);
19325 UtRegisterTest("DetectFastPatternTest427", DetectFastPatternTest427);
19326 UtRegisterTest("DetectFastPatternTest428", DetectFastPatternTest428);
19327 UtRegisterTest("DetectFastPatternTest429", DetectFastPatternTest429);
19328 UtRegisterTest("DetectFastPatternTest430", DetectFastPatternTest430);
19329 UtRegisterTest("DetectFastPatternTest431", DetectFastPatternTest431);
19330 UtRegisterTest("DetectFastPatternTest432", DetectFastPatternTest432);
19331 UtRegisterTest("DetectFastPatternTest433", DetectFastPatternTest433);
19332 UtRegisterTest("DetectFastPatternTest434", DetectFastPatternTest434);
19333 UtRegisterTest("DetectFastPatternTest435", DetectFastPatternTest435);
19334 UtRegisterTest("DetectFastPatternTest436", DetectFastPatternTest436);
19335 UtRegisterTest("DetectFastPatternTest437", DetectFastPatternTest437);
19336 UtRegisterTest("DetectFastPatternTest438", DetectFastPatternTest438);
19337 UtRegisterTest("DetectFastPatternTest439", DetectFastPatternTest439);
19338 UtRegisterTest("DetectFastPatternTest440", DetectFastPatternTest440);
19339 UtRegisterTest("DetectFastPatternTest441", DetectFastPatternTest441);
19340 UtRegisterTest("DetectFastPatternTest442", DetectFastPatternTest442);
19341 UtRegisterTest("DetectFastPatternTest443", DetectFastPatternTest443);
19342 UtRegisterTest("DetectFastPatternTest444", DetectFastPatternTest444);
19343 UtRegisterTest("DetectFastPatternTest445", DetectFastPatternTest445);
19344 UtRegisterTest("DetectFastPatternTest446", DetectFastPatternTest446);
19345 UtRegisterTest("DetectFastPatternTest447", DetectFastPatternTest447);
19346 UtRegisterTest("DetectFastPatternTest448", DetectFastPatternTest448);
19347 UtRegisterTest("DetectFastPatternTest449", DetectFastPatternTest449);
19348 UtRegisterTest("DetectFastPatternTest450", DetectFastPatternTest450);
19349 UtRegisterTest("DetectFastPatternTest451", DetectFastPatternTest451);
19350 UtRegisterTest("DetectFastPatternTest452", DetectFastPatternTest452);
19351 UtRegisterTest("DetectFastPatternTest453", DetectFastPatternTest453);
19352 UtRegisterTest("DetectFastPatternTest454", DetectFastPatternTest454);
19353 UtRegisterTest("DetectFastPatternTest455", DetectFastPatternTest455);
19354 UtRegisterTest("DetectFastPatternTest456", DetectFastPatternTest456);
19355 UtRegisterTest("DetectFastPatternTest457", DetectFastPatternTest457);
19356 UtRegisterTest("DetectFastPatternTest458", DetectFastPatternTest458);
19357 UtRegisterTest("DetectFastPatternTest459", DetectFastPatternTest459);
19358 UtRegisterTest("DetectFastPatternTest460", DetectFastPatternTest460);
19359 UtRegisterTest("DetectFastPatternTest461", DetectFastPatternTest461);
19360 UtRegisterTest("DetectFastPatternTest462", DetectFastPatternTest462);
19361 UtRegisterTest("DetectFastPatternTest463", DetectFastPatternTest463);
19362 UtRegisterTest("DetectFastPatternTest464", DetectFastPatternTest464);
19363 UtRegisterTest("DetectFastPatternTest465", DetectFastPatternTest465);
19364 /* http_stat_code fast_pattern tests ^ */
19365 /* http_server_body fast_pattern tests v */
19366 UtRegisterTest("DetectFastPatternTest466", DetectFastPatternTest466);
19367 UtRegisterTest("DetectFastPatternTest467", DetectFastPatternTest467);
19368 UtRegisterTest("DetectFastPatternTest468", DetectFastPatternTest468);
19369 UtRegisterTest("DetectFastPatternTest469", DetectFastPatternTest469);
19370 UtRegisterTest("DetectFastPatternTest470", DetectFastPatternTest470);
19371 UtRegisterTest("DetectFastPatternTest471", DetectFastPatternTest471);
19372 UtRegisterTest("DetectFastPatternTest472", DetectFastPatternTest472);
19373 UtRegisterTest("DetectFastPatternTest473", DetectFastPatternTest473);
19374 UtRegisterTest("DetectFastPatternTest474", DetectFastPatternTest474);
19375 UtRegisterTest("DetectFastPatternTest475", DetectFastPatternTest475);
19376 UtRegisterTest("DetectFastPatternTest476", DetectFastPatternTest476);
19377 UtRegisterTest("DetectFastPatternTest477", DetectFastPatternTest477);
19378 UtRegisterTest("DetectFastPatternTest478", DetectFastPatternTest478);
19379 UtRegisterTest("DetectFastPatternTest479", DetectFastPatternTest479);
19380 UtRegisterTest("DetectFastPatternTest480", DetectFastPatternTest480);
19381 UtRegisterTest("DetectFastPatternTest481", DetectFastPatternTest481);
19382 UtRegisterTest("DetectFastPatternTest482", DetectFastPatternTest482);
19383 UtRegisterTest("DetectFastPatternTest483", DetectFastPatternTest483);
19384 UtRegisterTest("DetectFastPatternTest484", DetectFastPatternTest484);
19385 UtRegisterTest("DetectFastPatternTest485", DetectFastPatternTest485);
19386 UtRegisterTest("DetectFastPatternTest486", DetectFastPatternTest486);
19387 UtRegisterTest("DetectFastPatternTest487", DetectFastPatternTest487);
19388 UtRegisterTest("DetectFastPatternTest488", DetectFastPatternTest488);
19389 UtRegisterTest("DetectFastPatternTest489", DetectFastPatternTest489);
19390 UtRegisterTest("DetectFastPatternTest490", DetectFastPatternTest490);
19391 UtRegisterTest("DetectFastPatternTest491", DetectFastPatternTest491);
19392 UtRegisterTest("DetectFastPatternTest492", DetectFastPatternTest492);
19393 UtRegisterTest("DetectFastPatternTest493", DetectFastPatternTest493);
19394 UtRegisterTest("DetectFastPatternTest494", DetectFastPatternTest494);
19395 UtRegisterTest("DetectFastPatternTest495", DetectFastPatternTest495);
19396 UtRegisterTest("DetectFastPatternTest496", DetectFastPatternTest496);
19397 UtRegisterTest("DetectFastPatternTest497", DetectFastPatternTest497);
19398 UtRegisterTest("DetectFastPatternTest498", DetectFastPatternTest498);
19399 UtRegisterTest("DetectFastPatternTest499", DetectFastPatternTest499);
19400 UtRegisterTest("DetectFastPatternTest500", DetectFastPatternTest500);
19401 UtRegisterTest("DetectFastPatternTest501", DetectFastPatternTest501);
19402 UtRegisterTest("DetectFastPatternTest502", DetectFastPatternTest502);
19403 UtRegisterTest("DetectFastPatternTest503", DetectFastPatternTest503);
19404 UtRegisterTest("DetectFastPatternTest504", DetectFastPatternTest504);
19405 UtRegisterTest("DetectFastPatternTest505", DetectFastPatternTest505);
19406 UtRegisterTest("DetectFastPatternTest506", DetectFastPatternTest506);
19407 /* http_server_body fast_pattern tests ^ */
19408 /* file_data fast_pattern tests v */
19409 UtRegisterTest("DetectFastPatternTest507", DetectFastPatternTest507);
19410 UtRegisterTest("DetectFastPatternTest508", DetectFastPatternTest508);
19411 UtRegisterTest("DetectFastPatternTest509", DetectFastPatternTest509);
19412 UtRegisterTest("DetectFastPatternTest510", DetectFastPatternTest510);
19413 UtRegisterTest("DetectFastPatternTest511", DetectFastPatternTest511);
19414 UtRegisterTest("DetectFastPatternTest512", DetectFastPatternTest512);
19415 UtRegisterTest("DetectFastPatternTest513", DetectFastPatternTest513);
19416 UtRegisterTest("DetectFastPatternTest514", DetectFastPatternTest514);
19417 UtRegisterTest("DetectFastPatternTest515", DetectFastPatternTest515);
19418 UtRegisterTest("DetectFastPatternTest516", DetectFastPatternTest516);
19419 UtRegisterTest("DetectFastPatternTest517", DetectFastPatternTest517);
19420 UtRegisterTest("DetectFastPatternTest518", DetectFastPatternTest518);
19421 UtRegisterTest("DetectFastPatternTest519", DetectFastPatternTest519);
19422 UtRegisterTest("DetectFastPatternTest520", DetectFastPatternTest520);
19423 UtRegisterTest("DetectFastPatternTest521", DetectFastPatternTest521);
19424 UtRegisterTest("DetectFastPatternTest522", DetectFastPatternTest522);
19425 UtRegisterTest("DetectFastPatternTest523", DetectFastPatternTest523);
19426 UtRegisterTest("DetectFastPatternTest524", DetectFastPatternTest524);
19427 UtRegisterTest("DetectFastPatternTest525", DetectFastPatternTest525);
19428 UtRegisterTest("DetectFastPatternTest526", DetectFastPatternTest526);
19429 UtRegisterTest("DetectFastPatternTest527", DetectFastPatternTest527);
19430 UtRegisterTest("DetectFastPatternTest528", DetectFastPatternTest528);
19431 UtRegisterTest("DetectFastPatternTest529", DetectFastPatternTest529);
19432 UtRegisterTest("DetectFastPatternTest530", DetectFastPatternTest530);
19433 UtRegisterTest("DetectFastPatternTest531", DetectFastPatternTest531);
19434 UtRegisterTest("DetectFastPatternTest532", DetectFastPatternTest532);
19435 UtRegisterTest("DetectFastPatternTest533", DetectFastPatternTest533);
19436 UtRegisterTest("DetectFastPatternTest534", DetectFastPatternTest534);
19437 UtRegisterTest("DetectFastPatternTest535", DetectFastPatternTest535);
19438 UtRegisterTest("DetectFastPatternTest536", DetectFastPatternTest536);
19439 UtRegisterTest("DetectFastPatternTest537", DetectFastPatternTest537);
19440 UtRegisterTest("DetectFastPatternTest538", DetectFastPatternTest538);
19441 UtRegisterTest("DetectFastPatternTest539", DetectFastPatternTest539);
19442 UtRegisterTest("DetectFastPatternTest540", DetectFastPatternTest540);
19443 UtRegisterTest("DetectFastPatternTest541", DetectFastPatternTest541);
19444 UtRegisterTest("DetectFastPatternTest542", DetectFastPatternTest542);
19445 UtRegisterTest("DetectFastPatternTest543", DetectFastPatternTest543);
19446 UtRegisterTest("DetectFastPatternTest544", DetectFastPatternTest544);
19447 UtRegisterTest("DetectFastPatternTest545", DetectFastPatternTest545);
19448 UtRegisterTest("DetectFastPatternTest546", DetectFastPatternTest546);
19449 UtRegisterTest("DetectFastPatternTest547", DetectFastPatternTest547);
19450 /* file_data fast_pattern tests ^ */
19451 /* http_user_agent fast_pattern tests v */
19452 UtRegisterTest("DetectFastPatternTest548", DetectFastPatternTest548);
19453 UtRegisterTest("DetectFastPatternTest549", DetectFastPatternTest549);
19454 UtRegisterTest("DetectFastPatternTest550", DetectFastPatternTest550);
19455 UtRegisterTest("DetectFastPatternTest551", DetectFastPatternTest551);
19456 UtRegisterTest("DetectFastPatternTest552", DetectFastPatternTest552);
19457 UtRegisterTest("DetectFastPatternTest553", DetectFastPatternTest553);
19458 UtRegisterTest("DetectFastPatternTest554", DetectFastPatternTest554);
19459 UtRegisterTest("DetectFastPatternTest555", DetectFastPatternTest555);
19460 UtRegisterTest("DetectFastPatternTest556", DetectFastPatternTest556);
19461 UtRegisterTest("DetectFastPatternTest557", DetectFastPatternTest557);
19462 UtRegisterTest("DetectFastPatternTest558", DetectFastPatternTest558);
19463 UtRegisterTest("DetectFastPatternTest559", DetectFastPatternTest559);
19464 UtRegisterTest("DetectFastPatternTest560", DetectFastPatternTest560);
19465 UtRegisterTest("DetectFastPatternTest561", DetectFastPatternTest561);
19466 UtRegisterTest("DetectFastPatternTest562", DetectFastPatternTest562);
19467 UtRegisterTest("DetectFastPatternTest563", DetectFastPatternTest563);
19468 UtRegisterTest("DetectFastPatternTest564", DetectFastPatternTest564);
19469 UtRegisterTest("DetectFastPatternTest565", DetectFastPatternTest565);
19470 UtRegisterTest("DetectFastPatternTest566", DetectFastPatternTest566);
19471 UtRegisterTest("DetectFastPatternTest567", DetectFastPatternTest567);
19472 UtRegisterTest("DetectFastPatternTest568", DetectFastPatternTest568);
19473 UtRegisterTest("DetectFastPatternTest569", DetectFastPatternTest569);
19474 UtRegisterTest("DetectFastPatternTest570", DetectFastPatternTest570);
19475 UtRegisterTest("DetectFastPatternTest571", DetectFastPatternTest571);
19476 UtRegisterTest("DetectFastPatternTest572", DetectFastPatternTest572);
19477 UtRegisterTest("DetectFastPatternTest573", DetectFastPatternTest573);
19478 UtRegisterTest("DetectFastPatternTest574", DetectFastPatternTest574);
19479 UtRegisterTest("DetectFastPatternTest575", DetectFastPatternTest575);
19480 UtRegisterTest("DetectFastPatternTest576", DetectFastPatternTest576);
19481 UtRegisterTest("DetectFastPatternTest577", DetectFastPatternTest577);
19482 UtRegisterTest("DetectFastPatternTest578", DetectFastPatternTest578);
19483 UtRegisterTest("DetectFastPatternTest579", DetectFastPatternTest579);
19484 UtRegisterTest("DetectFastPatternTest580", DetectFastPatternTest580);
19485 UtRegisterTest("DetectFastPatternTest581", DetectFastPatternTest581);
19486 UtRegisterTest("DetectFastPatternTest582", DetectFastPatternTest582);
19487 UtRegisterTest("DetectFastPatternTest583", DetectFastPatternTest583);
19488 UtRegisterTest("DetectFastPatternTest584", DetectFastPatternTest584);
19489 UtRegisterTest("DetectFastPatternTest585", DetectFastPatternTest585);
19490 UtRegisterTest("DetectFastPatternTest586", DetectFastPatternTest586);
19491 UtRegisterTest("DetectFastPatternTest587", DetectFastPatternTest587);
19492 UtRegisterTest("DetectFastPatternTest588", DetectFastPatternTest588);
19493 /* http_user_agent fast_pattern tests ^ */
19494 /* http_host fast_pattern tests v */
19495 UtRegisterTest("DetectFastPatternTest589", DetectFastPatternTest589);
19496 UtRegisterTest("DetectFastPatternTest590", DetectFastPatternTest590);
19497 UtRegisterTest("DetectFastPatternTest591", DetectFastPatternTest591);
19498 UtRegisterTest("DetectFastPatternTest592", DetectFastPatternTest592);
19499 UtRegisterTest("DetectFastPatternTest593", DetectFastPatternTest593);
19500 UtRegisterTest("DetectFastPatternTest594", DetectFastPatternTest594);
19501 UtRegisterTest("DetectFastPatternTest595", DetectFastPatternTest595);
19502 UtRegisterTest("DetectFastPatternTest596", DetectFastPatternTest596);
19503 UtRegisterTest("DetectFastPatternTest597", DetectFastPatternTest597);
19504 UtRegisterTest("DetectFastPatternTest598", DetectFastPatternTest598);
19505 UtRegisterTest("DetectFastPatternTest599", DetectFastPatternTest599);
19506 UtRegisterTest("DetectFastPatternTest600", DetectFastPatternTest600);
19507 UtRegisterTest("DetectFastPatternTest601", DetectFastPatternTest601);
19508 UtRegisterTest("DetectFastPatternTest602", DetectFastPatternTest602);
19509 UtRegisterTest("DetectFastPatternTest603", DetectFastPatternTest603);
19510 UtRegisterTest("DetectFastPatternTest604", DetectFastPatternTest604);
19511 UtRegisterTest("DetectFastPatternTest605", DetectFastPatternTest605);
19512 UtRegisterTest("DetectFastPatternTest606", DetectFastPatternTest606);
19513 UtRegisterTest("DetectFastPatternTest607", DetectFastPatternTest607);
19514 UtRegisterTest("DetectFastPatternTest608", DetectFastPatternTest608);
19515 UtRegisterTest("DetectFastPatternTest609", DetectFastPatternTest609);
19516 UtRegisterTest("DetectFastPatternTest610", DetectFastPatternTest610);
19517 UtRegisterTest("DetectFastPatternTest611", DetectFastPatternTest611);
19518 UtRegisterTest("DetectFastPatternTest612", DetectFastPatternTest612);
19519 UtRegisterTest("DetectFastPatternTest613", DetectFastPatternTest613);
19520 UtRegisterTest("DetectFastPatternTest614", DetectFastPatternTest614);
19521 UtRegisterTest("DetectFastPatternTest615", DetectFastPatternTest615);
19522 UtRegisterTest("DetectFastPatternTest616", DetectFastPatternTest616);
19523 UtRegisterTest("DetectFastPatternTest617", DetectFastPatternTest617);
19524 UtRegisterTest("DetectFastPatternTest618", DetectFastPatternTest618);
19525 UtRegisterTest("DetectFastPatternTest619", DetectFastPatternTest619);
19526 UtRegisterTest("DetectFastPatternTest620", DetectFastPatternTest620);
19527 UtRegisterTest("DetectFastPatternTest621", DetectFastPatternTest621);
19528 UtRegisterTest("DetectFastPatternTest622", DetectFastPatternTest622);
19529 UtRegisterTest("DetectFastPatternTest623", DetectFastPatternTest623);
19530 UtRegisterTest("DetectFastPatternTest624", DetectFastPatternTest624);
19531 UtRegisterTest("DetectFastPatternTest625", DetectFastPatternTest625);
19532 UtRegisterTest("DetectFastPatternTest626", DetectFastPatternTest626);
19533 UtRegisterTest("DetectFastPatternTest627", DetectFastPatternTest627);
19534 UtRegisterTest("DetectFastPatternTest628", DetectFastPatternTest628);
19535 UtRegisterTest("DetectFastPatternTest629", DetectFastPatternTest629);
19536 /* http_host fast_pattern tests ^ */
19537 /* http_rawhost fast_pattern tests v */
19538 UtRegisterTest("DetectFastPatternTest630", DetectFastPatternTest630);
19539 UtRegisterTest("DetectFastPatternTest631", DetectFastPatternTest631);
19540 UtRegisterTest("DetectFastPatternTest632", DetectFastPatternTest632);
19541 UtRegisterTest("DetectFastPatternTest633", DetectFastPatternTest633);
19542 UtRegisterTest("DetectFastPatternTest634", DetectFastPatternTest634);
19543 UtRegisterTest("DetectFastPatternTest635", DetectFastPatternTest635);
19544 UtRegisterTest("DetectFastPatternTest636", DetectFastPatternTest636);
19545 UtRegisterTest("DetectFastPatternTest637", DetectFastPatternTest637);
19546 UtRegisterTest("DetectFastPatternTest638", DetectFastPatternTest638);
19547 UtRegisterTest("DetectFastPatternTest639", DetectFastPatternTest639);
19548 UtRegisterTest("DetectFastPatternTest640", DetectFastPatternTest640);
19549 UtRegisterTest("DetectFastPatternTest641", DetectFastPatternTest641);
19550 UtRegisterTest("DetectFastPatternTest642", DetectFastPatternTest642);
19551 UtRegisterTest("DetectFastPatternTest643", DetectFastPatternTest643);
19552 UtRegisterTest("DetectFastPatternTest644", DetectFastPatternTest644);
19553 UtRegisterTest("DetectFastPatternTest645", DetectFastPatternTest645);
19554 UtRegisterTest("DetectFastPatternTest646", DetectFastPatternTest646);
19555 UtRegisterTest("DetectFastPatternTest647", DetectFastPatternTest647);
19556 UtRegisterTest("DetectFastPatternTest648", DetectFastPatternTest648);
19557 UtRegisterTest("DetectFastPatternTest649", DetectFastPatternTest649);
19558 UtRegisterTest("DetectFastPatternTest650", DetectFastPatternTest650);
19559 UtRegisterTest("DetectFastPatternTest651", DetectFastPatternTest651);
19560 UtRegisterTest("DetectFastPatternTest652", DetectFastPatternTest652);
19561 UtRegisterTest("DetectFastPatternTest653", DetectFastPatternTest653);
19562 UtRegisterTest("DetectFastPatternTest654", DetectFastPatternTest654);
19563 UtRegisterTest("DetectFastPatternTest655", DetectFastPatternTest655);
19564 UtRegisterTest("DetectFastPatternTest656", DetectFastPatternTest656);
19565 UtRegisterTest("DetectFastPatternTest657", DetectFastPatternTest657);
19566 UtRegisterTest("DetectFastPatternTest658", DetectFastPatternTest658);
19567 UtRegisterTest("DetectFastPatternTest659", DetectFastPatternTest659);
19568 UtRegisterTest("DetectFastPatternTest660", DetectFastPatternTest660);
19569 UtRegisterTest("DetectFastPatternTest661", DetectFastPatternTest661);
19570 UtRegisterTest("DetectFastPatternTest662", DetectFastPatternTest662);
19571 UtRegisterTest("DetectFastPatternTest663", DetectFastPatternTest663);
19572 UtRegisterTest("DetectFastPatternTest664", DetectFastPatternTest664);
19573 UtRegisterTest("DetectFastPatternTest665", DetectFastPatternTest665);
19574 UtRegisterTest("DetectFastPatternTest666", DetectFastPatternTest666);
19575 UtRegisterTest("DetectFastPatternTest667", DetectFastPatternTest667);
19576 UtRegisterTest("DetectFastPatternTest668", DetectFastPatternTest668);
19577 UtRegisterTest("DetectFastPatternTest669", DetectFastPatternTest669);
19578 UtRegisterTest("DetectFastPatternTest670", DetectFastPatternTest670);
19579
19580 /* Unittest to check
19581 * - if we assign different content_ids to duplicate patterns, but one of the
19582 * patterns has a fast_pattern chop set.
19583 * - if 2 unique patterns get unique ids.
19584 * - if 2 duplicate patterns, with no chop set get unique ids.
19585 */
19586 UtRegisterTest("DetectFastPatternTest671", DetectFastPatternTest671);
19587 }
19588 #endif
19589