55 static void DetectContentRegisterTests(
void);
84 uint8_t **pstr, uint16_t *plen)
89 slen = strlen(contentstr);
93 uint8_t buffer[slen + 1];
94 strlcpy((
char *)&buffer, contentstr, slen + 1);
106 uint8_t binstr[3] =
"";
108 uint16_t bin_count = 0;
110 for (i = 0, x = 0; i < slen; i++) {
116 SCLogError(
"Incomplete hex code in content - %s. Invalidating signature.",
124 }
else if(!escape &&
str[i] ==
'\\') {
128 if (isdigit((
unsigned char)
str[i]) ||
129 str[i] ==
'A' ||
str[i] ==
'a' ||
130 str[i] ==
'B' ||
str[i] ==
'b' ||
131 str[i] ==
'C' ||
str[i] ==
'c' ||
132 str[i] ==
'D' ||
str[i] ==
'd' ||
133 str[i] ==
'E' ||
str[i] ==
'e' ||
134 str[i] ==
'F' ||
str[i] ==
'f')
138 binstr[binpos] = (char)
str[i];
142 uint8_t c = strtol((
char *)binstr, (
char **) NULL, 16) & 0xFF;
148 }
else if (
str[i] ==
' ') {
151 else if (
str[i] !=
',') {
153 "content - %s, hex %c. Invalidating signature.",
171 }
else if (
str[i] ==
'"') {
172 SCLogError(
"Invalid unescaped double quote within content section.");
181 if (bin_count % 2 != 0) {
183 "%s - %s. Invalidating signature.",
184 keyword, contentstr);
198 memcpy(ptr,
str, slen);
200 *plen = (uint16_t)slen;
212 const char *contentstr)
215 uint8_t *content = NULL;
236 spm_global_thread_ctx);
254 const char *contentstr)
266 SCLogDebug(
"DetectContentData \"cd\" is NULL");
270 if (tmpstr != NULL) {
299 if (tmprstr != NULL) {
351 SCLogError(
"content string \"%s\" incompatible with %s transform", contentstr, tstr);
411 int max_offset = 0, total_len = 0;
413 for (; sm != NULL; sm = sm->
next) {
419 SCLogDebug(
"content_len %d; negated: %s; distance: %d, offset: %d, depth: %d",
431 if (max_size < check) {
442 max_offset =
MAX(max_offset, cd->
offset);
461 if (max_right_edge_i < 0) {
465 uint32_t max_right_edge = (uint32_t)max_right_edge_i;
468 if (min_dsize_required >= 0) {
469 SCLogDebug(
"min_dsize %d; max_right_edge %d", min_dsize_required, max_right_edge);
470 if ((uint32_t)min_dsize_required > max_right_edge) {
471 SCLogError(
"signature can't match as required content length %d exceeds dsize value %d",
472 min_dsize_required, max_right_edge);
495 #define VALIDATE(e) \
500 uint16_t offset_plus_pat = 0;
502 bool has_active_depth_chain =
false;
504 bool has_depth =
false;
505 bool has_ends_with =
false;
506 uint16_t ends_with_depth = 0;
508 for (
SigMatch *sm = sm_head; sm != NULL; sm = sm->
next) {
517 has_active_depth_chain =
false;
520 if (sm->prev == NULL) {
545 has_active_depth_chain =
false;
551 has_active_depth_chain =
true;
554 SCLogDebug(
"sm %p depth %u offset %u distance %d within %d", sm, cd->
depth,
563 has_active_depth_chain =
false;
567 SCLogDebug(
"no distance, reset offset_plus_pat & offset");
568 offset_plus_pat =
offset = 0;
571 SCLogDebug(
"stored: offset %u depth %u offset_plus_pat %u "
572 "has_active_depth_chain %s",
573 offset, depth, offset_plus_pat, has_active_depth_chain ?
"true" :
"false");
581 if (abs(cd->
distance) > offset_plus_pat)
590 if (has_active_depth_chain) {
592 if (depth && depth > offset_plus_pat) {
597 "distance to add: %u. depth + dist %u", dist, depth + dist);
601 depth + cd->
within + dist <= UINT16_MAX);
602 depth = cd->
depth = (uint16_t)(depth + cd->
within + dist);
610 if (cd->
depth == 0 && depth != 0) {
615 offset_plus_pat + cd->
distance <= UINT16_MAX);
621 depth + cd->
within <= UINT16_MAX);
622 depth = cd->
depth = (uint16_t)(cd->
within + depth);
626 has_ends_with =
true;
627 if (ends_with_depth == 0)
628 ends_with_depth = depth;
629 ends_with_depth =
MIN(ends_with_depth, depth);
637 cd->
offset = offset_plus_pat;
666 has_ends_with =
true;
667 if (ends_with_depth == 0)
668 ends_with_depth = depth;
669 ends_with_depth =
MIN(ends_with_depth, depth);
673 has_active_depth_chain =
false;
684 SCLogDebug(
"non-anchored PCRE not supported, reset offset_plus_pat & offset");
685 offset_plus_pat =
offset = depth = 0;
687 has_active_depth_chain =
false;
691 SCLogDebug(
"keyword not supported, reset offset_plus_pat & offset");
692 offset_plus_pat =
offset = depth = 0;
693 has_active_depth_chain =
false;
698 if (has_depth && has_ends_with) {
699 for (
SigMatch *sm = sm_head; sm != NULL; sm = sm->
next) {
704 cd->
depth = ends_with_depth;
724 static inline bool NeedsAsHex(uint8_t c)
748 if (NeedsAsHex(cd->
content[i])) {
750 snprintf(hex_str,
sizeof(hex_str),
"%s%02X", !hex ?
"|" :
" ", cd->
content[i]);
755 snprintf(p_str,
sizeof(p_str),
"%s%c", hex ?
"|" :
"", cd->
content[i]);
768 SCLogError(
"can't use multiple nocase modifiers with the same content");
792 static bool TestLastContent(
const Signature *s, uint16_t o, uint16_t d)
808 if (d != cd->
depth) {
815 #define TEST_RUN(sig, o, d) \
817 SCLogDebug("TEST_RUN start: '%s'", (sig)); \
818 DetectEngineCtx *de_ctx = DetectEngineCtxInit(); \
819 FAIL_IF_NULL(de_ctx); \
820 de_ctx->flags |= DE_QUIET; \
822 snprintf(rule, sizeof(rule), "alert tcp any any -> any any (%s sid:1; rev:1;)", (sig)); \
823 Signature *s = DetectEngineAppendSig(de_ctx, rule); \
825 SigPrepareStage1(de_ctx); \
826 bool res = TestLastContent(s, (o), (d)); \
827 FAIL_IF(res == false); \
828 DetectEngineCtxFree(de_ctx); \
835 static int DetectContentDepthTest01(
void)
838 TEST_RUN(
"content:\"abc\"; offset:1; depth:3;", 1, 4);
840 TEST_RUN(
"dsize:10; content:\"abc\";", 0, 10);
841 TEST_RUN(
"dsize:<10; content:\"abc\";", 0, 10);
842 TEST_RUN(
"dsize:5<>10; content:\"abc\";", 0, 10);
845 TEST_RUN(
"content:\"abc\"; depth:3; content:\"xyz\"; distance:0; within:3; ", 3, 6);
847 TEST_RUN(
"content:\"abc\"; offset:3; depth:3; content:\"xyz\"; distance:0; within:3; ", 6, 9);
848 TEST_RUN(
"content:\"abc\"; depth:6; content:\"xyz\"; distance:0; within:3; ", 3, 9);
851 TEST_RUN(
"content:\"abc\"; depth:3; content:\"klm\"; distance:0; within:3; content:\"xyz\"; distance:0; within:3; ", 6, 9);
853 TEST_RUN(
"content:\"abc\"; depth:3; content:\"klm\"; content:\"xyz\"; distance:0; within:3; ", 3, 0);
855 TEST_RUN(
"content:\"abc\"; depth:3; pcre:/\"klm\"/; content:\"xyz\"; distance:0; within:3; ", 0, 0);
857 TEST_RUN(
"content:\"abc\"; depth:3; pcre:/\"klm\"/R; content:\"xyz\"; distance:0; within:3; ", 3, 0);
858 TEST_RUN(
"content:\"abc\"; offset:3; depth:3; pcre:/\"klm\"/R; content:\"xyz\"; distance:0; within:3; ", 6, 0);
860 TEST_RUN(
"content:\"abc\"; depth:3; content:\"klm\"; within:3; content:\"xyz\"; within:3; ", 0, 9);
862 TEST_RUN(
"content:\"abc\"; depth:3; content:\"klm\"; distance:0; content:\"xyz\"; distance:0; ", 6, 0);
865 TEST_RUN(
"content:\"abc\"; depth:6; isdataat:!1,relative; content:\"klm\";", 0, 6);
866 TEST_RUN(
"content:\"abc\"; depth:3; content:\"klm\"; within:3; content:\"xyz\"; within:3; isdataat:!1,relative; content:\"def\"; ", 0, 9);
868 TEST_RUN(
"content:\"|03|\"; depth:1; content:\"|e0|\"; distance:4; within:1;", 5, 6);
869 TEST_RUN(
"content:\"|03|\"; depth:1; content:\"|e0|\"; distance:4; within:1; content:\"Cookie|3a|\"; distance:5; within:7;", 11, 18);
871 TEST_RUN(
"content:\"this\"; content:\"is\"; within:6; content:\"big\"; within:8; content:\"string\"; within:8;", 0, 0);
873 TEST_RUN(
"dsize:<80; content:!\"|00 22 02 00|\"; depth: 4; content:\"|00 00 04|\"; distance:8; within:3; content:\"|00 00 00 00 00|\"; distance:6; within:5;", 17, 80);
874 TEST_RUN(
"content:!\"|00 22 02 00|\"; depth: 4; content:\"|00 00 04|\"; distance:8; within:3; content:\"|00 00 00 00 00|\"; distance:6; within:5;", 17, 0);
876 TEST_RUN(
"content:\"|0d 0a 0d 0a|\"; content:\"code=\"; distance:0;", 4, 0);
877 TEST_RUN(
"content:\"|0d 0a 0d 0a|\"; content:\"code=\"; distance:0; content:\"xploit.class\"; distance:2; within:18;", 11, 0);
879 TEST_RUN(
"content:\"|16 03|\"; depth:2; content:\"|55 04 0a|\"; distance:0;", 2, 0);
880 TEST_RUN(
"content:\"|16 03|\"; depth:2; content:\"|55 04 0a|\"; distance:0; content:\"|0d|LogMeIn, Inc.\"; distance:1; within:14;", 6, 0);
881 TEST_RUN(
"content:\"|16 03|\"; depth:2; content:\"|55 04 0a|\"; distance:0; content:\"|0d|LogMeIn, Inc.\"; distance:1; within:14; content:\".app\";", 0, 0);
883 TEST_RUN(
"content:\"=\"; offset:4; depth:9;", 4, 13);
886 TEST_RUN(
"content:\"=\"; offset:4; depth:9; content:\"=&\"; distance:55; within:2;", 60, 70);
889 TEST_RUN(
"content:\"0123456789\"; content:\"abcdef\"; distance:1048576;", 0, 0);
892 TEST_RUN(
"content:\"SMB\"; depth:8; content:\"|09 00|\"; distance:8; within:2;", 11, 18);
893 TEST_RUN(
"content:\"SMB\"; depth:8; content:\"|09 00|\"; distance:8; within:2; content:\"|05 "
894 "00 00|\"; distance:0;",
896 TEST_RUN(
"content:\"SMB\"; depth:8; content:\"|09 00|\"; distance:8; within:2; content:\"|05 "
897 "00 00|\"; distance:0; content:\"|0c 00|\"; distance:19; within:2;",
899 TEST_RUN(
"content:\"SMB\"; depth:8; content:\"|09 00|\"; distance:8; within:2; content:\"|05 "
900 "00 00|\"; distance:0; content:\"|0c 00|\"; distance:19; within:2; content:\"|15 00 "
901 "00 00|\"; distance:20; within:4;",
912 static void DetectContentPrintAll(
SigMatch *sm)
924 for (; first_sm != NULL; first_sm = first_sm->
next) {
926 SCLogDebug(
"Printing SigMatch DETECT_CONTENT %d", ++i);
934 static int g_file_data_buffer_id = 0;
935 static int g_dce_stub_data_buffer_id = 0;
940 static int DetectContentParseTest01 (
void)
944 const char *teststring =
"abc\\:def";
945 const char *teststringparsed =
"abc:def";
949 FAIL_IF(spm_global_thread_ctx == NULL);
953 if (memcmp(cd->
content, teststringparsed, strlen(teststringparsed)) != 0) {
954 SCLogDebug(
"expected %s got ", teststringparsed);
961 SCLogDebug(
"expected %s got NULL: ", teststringparsed);
971 static int DetectContentParseTest02 (
void)
975 const char *teststring =
"abc\\;def";
976 const char *teststringparsed =
"abc;def";
980 FAIL_IF(spm_global_thread_ctx == NULL);
984 if (memcmp(cd->
content, teststringparsed, strlen(teststringparsed)) != 0) {
985 SCLogDebug(
"expected %s got ", teststringparsed);
992 SCLogDebug(
"expected %s got NULL: ", teststringparsed);
1002 static int DetectContentParseTest03 (
void)
1006 const char *teststring =
"abc\\\"def";
1007 const char *teststringparsed =
"abc\"def";
1011 FAIL_IF(spm_global_thread_ctx == NULL);
1015 if (memcmp(cd->
content, teststringparsed, strlen(teststringparsed)) != 0) {
1016 SCLogDebug(
"expected %s got ", teststringparsed);
1023 SCLogDebug(
"expected %s got NULL: ", teststringparsed);
1033 static int DetectContentParseTest04 (
void)
1037 const char *teststring =
"abc\\\\def";
1038 const char *teststringparsed =
"abc\\def";
1042 FAIL_IF(spm_global_thread_ctx == NULL);
1047 if (memcmp(cd->
content, teststringparsed,
len) != 0) {
1048 SCLogDebug(
"expected %s got ", teststringparsed);
1055 SCLogDebug(
"expected %s got NULL: ", teststringparsed);
1065 static int DetectContentParseTest05 (
void)
1069 const char *teststring =
"abc\\def";
1073 FAIL_IF(spm_global_thread_ctx == NULL);
1090 static int DetectContentParseTest06 (
void)
1094 const char *teststring =
"a|42|c|44|e|46|";
1095 const char *teststringparsed =
"abcdef";
1099 FAIL_IF(spm_global_thread_ctx == NULL);
1104 if (memcmp(cd->
content, teststringparsed,
len) != 0) {
1105 SCLogDebug(
"expected %s got ", teststringparsed);
1112 SCLogDebug(
"expected %s got NULL: ", teststringparsed);
1122 static int DetectContentParseTest07 (
void)
1126 const char *teststring =
"";
1130 FAIL_IF(spm_global_thread_ctx == NULL);
1145 static int DetectContentParseTest08 (
void)
1149 const char *teststring =
"";
1153 FAIL_IF(spm_global_thread_ctx == NULL);
1174 static int DetectContentLongPatternMatchTest(uint8_t *raw_eth_pkt, uint16_t pktsize,
const char *sig,
1184 memset(&th_v, 0,
sizeof(th_v));
1203 SCLogDebug(
"---DetectContentLongPatternMatchTest---");
1223 static int DetectContentLongPatternMatchTestWrp(
const char *sig, uint32_t sid)
1230 uint8_t raw_eth_pkt[] = {
1231 0xff,0xff,0xff,0xff,0xff,0xff,0x00,0x00,
1232 0x00,0x00,0x00,0x00,0x08,0x00,0x45,0x00,
1233 0x00,0x85,0x00,0x01,0x00,0x00,0x40,0x06,
1234 0x7c,0x70,0x7f,0x00,0x00,0x01,0x7f,0x00,
1235 0x00,0x01,0x00,0x14,0x00,0x50,0x00,0x00,
1236 0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x02,
1237 0x20,0x00,0xc9,0xad,0x00,0x00,0x48,0x69,
1238 0x2c,0x20,0x74,0x68,0x69,0x73,0x20,0x69,
1239 0x73,0x20,0x61,0x20,0x62,0x69,0x67,0x20,
1240 0x74,0x65,0x73,0x74,0x20,0x74,0x6f,0x20,
1241 0x63,0x68,0x65,0x63,0x6b,0x20,0x63,0x6f,
1242 0x6e,0x74,0x65,0x6e,0x74,0x20,0x6d,0x61,
1243 0x74,0x63,0x68,0x65,0x73,0x20,0x6f,0x66,
1244 0x20,0x73,0x70,0x6c,0x69,0x74,0x74,0x65,
1245 0x64,0x20,0x70,0x61,0x74,0x74,0x65,0x72,
1246 0x6e,0x73,0x20,0x62,0x65,0x74,0x77,0x65,
1247 0x65,0x6e,0x20,0x6d,0x75,0x6c,0x74,0x69,
1248 0x70,0x6c,0x65,0x20,0x63,0x68,0x75,0x6e,
1251 return DetectContentLongPatternMatchTest(raw_eth_pkt, (uint16_t)
sizeof(raw_eth_pkt),
1258 static int DetectContentLongPatternMatchTest01(
void)
1260 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
1261 " content:\"Hi, this is a big test\"; sid:1;)";
1262 return DetectContentLongPatternMatchTestWrp(sig, 1);
1268 static int DetectContentLongPatternMatchTest02(
void)
1270 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
1271 " content:\"Hi, this is a big test to check content matches of"
1272 " splitted patterns between multiple chunks!\"; sid:1;)";
1273 return DetectContentLongPatternMatchTestWrp(sig, 1);
1280 static int DetectContentLongPatternMatchTest03(
void)
1283 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
1284 " content:\"Hi, this is a big test to check content matches of"
1285 " splitted patterns between multiple splitted chunks!\"; sid:1;)";
1286 return (DetectContentLongPatternMatchTestWrp(sig, 1) == 0) ? 1: 0;
1292 static int DetectContentLongPatternMatchTest04(
void)
1294 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\"; "
1295 " content:\"Hi, this is\"; depth:15 ;content:\"a big test\"; "
1296 " within:15; content:\"to check content matches of\"; "
1297 " within:30; content:\"splitted patterns\"; distance:1; "
1300 return DetectContentLongPatternMatchTestWrp(sig, 1);
1308 static int DetectContentLongPatternMatchTest05(
void)
1310 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\"; "
1311 " content:\"Hi, this is a big\"; depth:17; "
1312 " isdataat:30, relative; "
1313 " content:\"test\"; within: 5; distance:1; "
1314 " isdataat:15, relative; "
1315 " content:\"of splitted\"; within:37; distance:15; "
1316 " isdataat:20,relative; "
1317 " content:\"patterns\"; within:9; distance:1; "
1318 " isdataat:10, relative; "
1320 return DetectContentLongPatternMatchTestWrp(sig, 1);
1328 static int DetectContentLongPatternMatchTest06(
void)
1330 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\"; "
1331 " content:\"Hi, this is a big test to check cont\"; depth:36;"
1332 " content:\"ent matches\"; within:11; distance:0; "
1333 " content:\"of splitted patterns between multiple\"; "
1334 " within:38; distance:1; "
1335 " content:\"chunks!\"; within: 8; distance:1; "
1337 return DetectContentLongPatternMatchTestWrp(sig, 1);
1344 static int DetectContentLongPatternMatchTest07(
void)
1346 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\"; "
1347 " content:\"chunks!\"; "
1348 " content:\"content matches\"; offset:32; depth:47; "
1349 " content:\"of splitted patterns between multiple\"; "
1350 " content:\"Hi, this is a big\"; offset:0; depth:17; "
1352 return DetectContentLongPatternMatchTestWrp(sig, 1);
1359 static int DetectContentLongPatternMatchTest08(
void)
1361 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\"; "
1362 " content:\"ent matches\"; "
1363 " content:\"of splitted patterns between multiple\"; "
1364 " within:38; distance:1; "
1365 " content:\"chunks!\"; within: 8; distance:1; "
1366 " content:\"Hi, this is a big test to check cont\"; depth:36;"
1368 return DetectContentLongPatternMatchTestWrp(sig, 1);
1375 static int DetectContentLongPatternMatchTest09(
void)
1377 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\"; "
1378 " content:\"ent matches\"; "
1379 " content:\"of splitted patterns between multiple\"; "
1380 " offset:47; depth:85; "
1381 " content:\"chunks!\"; within: 8; distance:1; "
1382 " content:\"Hi, this is a big test to chec\"; depth:36;"
1383 " content:\"k cont\"; distance:0; within:6;"
1385 return DetectContentLongPatternMatchTestWrp(sig, 1);
1391 static int DetectContentLongPatternMatchTest10(
void)
1393 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\"; "
1394 " content:\"Hi, this is a big test to check \"; "
1395 " content:\"con\"; "
1397 return DetectContentLongPatternMatchTestWrp(sig, 1);
1403 static int DetectContentLongPatternMatchTest11(
void)
1405 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\"; "
1409 return DetectContentLongPatternMatchTestWrp(sig, 1);
1412 static int DetectContentParseTest09(
void)
1415 const char *teststring =
"boo";
1419 FAIL_IF(spm_global_thread_ctx == NULL);
1432 static int DetectContentParseTest17(
void)
1435 const char *sigstr =
"alert tcp any any -> any any (msg:\"Dummy\"; "
1436 "content:\"one\"; content:\"two\"; within:2; sid:1;)";
1458 static int DetectContentParseTest18(
void)
1486 static int DetectContentParseTest19(
void)
1495 "(msg:\"Testing dce iface, stub_data with content\"; "
1496 "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; "
1498 "content:\"one\"; distance:0; sid:1;)");
1510 "alert tcp any any -> any any "
1511 "(msg:\"Testing dce iface, stub_data with contents & distance, within\"; "
1512 "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; "
1514 "content:\"one\"; distance:0; content:\"two\"; within:10; sid:2;)");
1529 "alert tcp any any -> any any "
1530 "(msg:\"Testing dce iface, stub with contents, distance, within\"; "
1531 "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; "
1533 "content:\"one\"; distance:0; "
1534 "content:\"two\"; within:10; distance:2; sid:3;)");
1549 "(msg:\"Testing content\"; "
1550 "content:\"one\"; sid:4;)");
1562 static int DetectContentParseTest20(
void)
1573 "alert udp any any -> any any "
1574 "(msg:\"test\"; content:\"\"; sid:238012;)");
1591 static int DetectContentParseTest21(
void)
1602 "alert udp any any -> any any "
1603 "(msg:\"test\"; content:\"; sid:238012;)");
1620 static int DetectContentParseTest22(
void)
1631 "alert udp any any -> any any "
1632 "(msg:\"test\"; content:\"boo; sid:238012;)");
1649 static int DetectContentParseTest23(
void)
1660 "alert udp any any -> any any "
1661 "(msg:\"test\"; content:boo\"; sid:238012;)");
1678 static int DetectContentParseTest24(
void)
1691 "alert udp any any -> any any "
1692 "(msg:\"test\"; content: !\"boo\"; sid:238012;)");
1694 printf(
"de_ctx->sig_list == NULL: ");
1701 printf(
"de_ctx->pmatch_tail == NULL || de_ctx->pmatch_tail->ctx == NULL: ");
1720 static int DetectContentParseTest25(
void)
1731 "alert udp any any -> any any "
1732 "(msg:\"test\"; content:\"|\"; sid:1;)");
1749 static int DetectContentParseTest26(
void)
1760 "alert udp any any -> any any "
1761 "(msg:\"test\"; content:\"|af\"; sid:1;)");
1778 static int DetectContentParseTest27(
void)
1789 "alert udp any any -> any any "
1790 "(msg:\"test\"; content:\"af|\"; sid:1;)");
1807 static int DetectContentParseTest28(
void)
1818 "alert udp any any -> any any "
1819 "(msg:\"test\"; content:\"|af|\"; sid:1;)");
1836 static int DetectContentParseTest29(
void)
1847 "alert udp any any -> any any "
1848 "(msg:\"test\"; content:\"aast|\"; sid:1;)");
1865 static int DetectContentParseTest30(
void)
1876 "alert udp any any -> any any "
1877 "(msg:\"test\"; content:\"aast|af\"; sid:1;)");
1894 static int DetectContentParseTest31(
void)
1905 "alert udp any any -> any any "
1906 "(msg:\"test\"; content:\"aast|af|\"; sid:1;)");
1923 static int DetectContentParseTest32(
void)
1934 "alert udp any any -> any any "
1935 "(msg:\"test\"; content:\"|af|asdf\"; sid:1;)");
1952 static int DetectContentParseTest33(
void)
1963 "alert udp any any -> any any "
1964 "(msg:\"test\"; content:\"|af|af|\"; sid:1;)");
1981 static int DetectContentParseTest34(
void)
1992 "alert udp any any -> any any "
1993 "(msg:\"test\"; content:\"|af|af|af\"; sid:1;)");
2010 static int DetectContentParseTest35(
void)
2021 "alert udp any any -> any any "
2022 "(msg:\"test\"; content:\"|af|af|af|\"; sid:1;)");
2036 static int SigTestPositiveTestContent(
const char *rule, uint8_t *buf)
2038 uint16_t buflen = strlen((
char *)buf);
2042 memset(&th_v, 0,
sizeof(th_v));
2068 static int DetectContentParseTest41(
void)
2073 char *teststring =
SCMalloc(
sizeof(
char) * (patlen + 1));
2077 for (
int i = 0; i < patlen; idx++, i++) {
2078 teststring[idx] =
'a';
2080 teststring[idx++] =
'\0';
2084 FAIL_IF(spm_global_thread_ctx == NULL);
2101 static int DetectContentParseTest42(
void)
2106 char *teststring =
SCMalloc(
sizeof(
char) * (patlen + 1));
2110 for (
int i = 0; i < patlen; idx++, i++) {
2111 teststring[idx] =
'a';
2113 teststring[idx++] =
'\0';
2117 FAIL_IF(spm_global_thread_ctx == NULL);
2131 static int DetectContentParseTest43(
void)
2136 char *teststring =
SCMalloc(
sizeof(
char) * (patlen + 1));
2140 teststring[idx++] =
'|';
2141 teststring[idx++] =
'4';
2142 teststring[idx++] =
'6';
2143 teststring[idx++] =
'|';
2144 for (
int i = 0; i < (patlen - 4); idx++, i++) {
2145 teststring[idx] =
'a';
2147 teststring[idx++] =
'\0';
2151 FAIL_IF(spm_global_thread_ctx == NULL);
2168 static int DetectContentParseTest44(
void)
2173 char *teststring =
SCMalloc(
sizeof(
char) * (patlen + 1));
2177 teststring[idx++] =
'|';
2178 teststring[idx++] =
'4';
2179 teststring[idx++] =
'6';
2180 teststring[idx++] =
'|';
2181 for (
int i = 0; i < (patlen - 4); idx++, i++) {
2182 teststring[idx] =
'a';
2184 teststring[idx++] =
'\0';
2188 FAIL_IF(spm_global_thread_ctx == NULL);
2205 static int DetectContentParseTest45(
void)
2214 "alert tcp any any -> any any "
2215 "(msg:\"test\"; content:\"|ff|\" content:\"TEST\"; sid:1;)");
2223 static int SigTestNegativeTestContent(
const char *rule, uint8_t *buf)
2225 uint16_t buflen = strlen((
char *)buf);
2230 memset(&th_v, 0,
sizeof(th_v));
2255 if (det_ctx != NULL) {
2271 static int SigTest41TestNegatedContent(
void)
2273 return SigTestPositiveTestContent(
"alert tcp any any -> any any "
2274 "(msg:\"HTTP URI cap\"; content:!\"GES\"; sid:1;)",
2276 (uint8_t *)
"GET /one/ HTTP/1.1\r\n Host: one.example.org\r\n\r\n\r\n"
2277 "GET /two/ HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n");
2285 static int SigTest41aTestNegatedContent(
void)
2287 (void)SigTestPositiveTestContent(
"alert tcp any any -> any any (msg:\"HTTP URI cap\"; flow:to_server; content:\"GET\"; sid:1;)", (uint8_t *)
"GET /one/ HTTP/1.1\r\n Host: one.example.org\r\n\r\n\r\nGET /two/ HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n");
2296 static int SigTest42TestNegatedContent(
void)
2298 return SigTestPositiveTestContent(
2299 "alert tcp any any -> any any (content:!\"eeeeeeeeeee\"; depth:22; offset:35; sid:1;)",
2300 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff gggggggg hhhhhhhh");
2310 static int SigTest43TestNegatedContent(
void)
2312 return SigTestNegativeTestContent(
2313 "alert tcp any any -> any any (content:!\"eeeeeeeeeee\"; depth:34; offset:23; sid:1;)",
2314 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff gggggggg hhhhhhhh");
2322 static int SigTest44TestNegatedContent(
void)
2324 return SigTestPositiveTestContent(
2325 "alert tcp any any -> any any (content:!\"eeeeeeeeeee\"; offset:40; depth:35; sid:1;)",
2326 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff gggggggg hhhhhhhh");
2333 static int SigTest45TestNegatedContent(
void)
2335 return SigTestPositiveTestContent(
"alert tcp any any -> any any (content:\"aaa\"; depth:5; "
2336 "content:!\"eeeeeeeeeee\"; depth:23; sid:1;)",
2337 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff gggggggg hhhhhhhh");
2344 static int SigTest46TestNegatedContent(
void)
2346 return SigTestNegativeTestContent(
"alert tcp any any -> any any (content:\"aaaE\"; "
2347 "content:!\"eeeeeeeeeee\"; depth:23; sid:1;)",
2348 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff gggggggg hhhhhhhh");
2356 static int SigTest47TestNegatedContent(
void)
2358 return SigTestNegativeTestContent(
"alert tcp any any -> any any (content:\"aaa\"; offset:5; "
2359 "content:!\"eeeeeeeeeee\"; depth:23; sid:1;)",
2360 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff gggggggg hhhhhhhh");
2367 static int SigTest48TestNegatedContent(
void)
2369 return SigTestPositiveTestContent(
2370 "alert tcp any any -> any any (content:\"GET\"; content:!\"GES\"; within:26; sid:1;)",
2371 (uint8_t *)
"GET /one/ HTTP/1.1\r\n Host: one.example.org\r\n\r\n\r\nGET /two/ "
2372 "HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n");
2379 static int SigTest49TestNegatedContent(
void)
2381 return SigTestNegativeTestContent(
2382 "alert tcp any any -> any any (content:\"GET\"; content:!\"Host\"; within:26; sid:1;)",
2383 (uint8_t *)
"GET /one/ HTTP/1.1\r\n Host: one.example.org\r\n\r\n\r\nGET /two/ "
2384 "HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n");
2391 static int SigTest50TestNegatedContent(
void)
2393 return SigTestPositiveTestContent(
2394 "alert tcp any any -> any any (content:\"GET\"; content:!\"GES\"; distance:25; sid:1;)",
2395 (uint8_t *)
"GET /one/ HTTP/1.1\r\n Host: one.example.org\r\n\r\n\r\nGET /two/ "
2396 "HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n");
2406 static int SigTest51TestNegatedContent(
void)
2408 return SigTestNegativeTestContent(
"alert tcp any any -> any any (content:\"GET\"; content:!\"Host\"; distance:17; sid:1;)", (uint8_t *)
"GET /one/ HTTP/1.1\r\nHost: one.example.org\r\n\r\n\r\nGET /two/ HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n");
2415 static int SigTest52TestNegatedContent(
void)
2417 return SigTestNegativeTestContent(
2418 "alert tcp any any -> any any (content:\"GES\"; content:!\"BOO\"; sid:1;)",
2419 (uint8_t *)
"GET /one/ HTTP/1.1\r\n Host: one.example.org\r\n\r\n\r\nGET /two/ "
2420 "HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n");
2427 static int SigTest53TestNegatedContent(
void)
2429 return SigTestNegativeTestContent(
2430 "alert tcp any any -> any any (content:\"aaa\"; content:!\"Ggggg\"; within:56; sid:1;)",
2431 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2438 static int SigTest54TestNegatedContent(
void)
2440 return SigTestPositiveTestContent(
"alert tcp any any -> any any (content:\"aaa\"; "
2441 "content:!\"gggggg\"; within:20; sid:1;)",
2442 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff ggggggggg hhhhhhhh");
2449 static int SigTest55TestNegatedContent(
void)
2451 return SigTestNegativeTestContent(
2452 "alert tcp any any -> any any (content:!\"aaa\"; depth:5; sid:1;)",
2453 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff gggggggg hhhhhhhh");
2460 static int SigTest56TestNegatedContent(
void)
2462 return SigTestPositiveTestContent(
2463 "alert tcp any any -> any any (content:\"aaa\"; content:\"Ggggg\"; within:56; sid:1;)",
2464 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Gggggggg hhhhhhhh");
2471 static int SigTest57TestNegatedContent(
void)
2473 return SigTestNegativeTestContent(
2474 "alert tcp any any -> any any (content:\"aaa\"; content:!\"Ggggg\"; within:56; sid:1;)",
2475 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2482 static int SigTest58TestNegatedContent(
void)
2484 return SigTestPositiveTestContent(
"alert tcp any any -> any any (content:\"aaa\"; "
2485 "content:!\"Ggggg\"; distance:57; sid:1;)",
2486 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2493 static int SigTest59TestNegatedContent(
void)
2495 return SigTestNegativeTestContent(
"alert tcp any any -> any any (content:\"aaa\"; "
2496 "content:!\"Gggg\"; distance:30; sid:1;)",
2497 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2500 static int SigTest60TestNegatedContent(
void)
2502 return SigTestNegativeTestContent(
2503 "alert tcp any any -> any any (content:!\"aaa\"; content:\"Ggggg\"; sid:1;)",
2504 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2507 static int SigTest61TestNegatedContent(
void)
2509 return SigTestPositiveTestContent(
"alert tcp any any -> any any (content:\"aaa\"; depth:10; "
2510 "content:!\"Ggggg\"; within:30; sid:1;)",
2511 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2521 static int SigTest62TestNegatedContent(
void)
2523 return SigTestNegativeTestContent(
"alert tcp any any -> any any (content:\"aaa\"; depth:10; "
2524 "content:!\"Gggggg\"; within:49; sid:1;)",
2525 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2528 static int SigTest63TestNegatedContent(
void)
2530 return SigTestNegativeTestContent(
"alert tcp any any -> any any (content:\"aaa\"; depth:10; "
2531 "content:!\"Gggggg\"; within:56; sid:1;)",
2532 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2535 static int SigTest64TestNegatedContent(
void)
2537 return SigTestPositiveTestContent(
"alert tcp any any -> any any (content:\"aaa\"; depth:10; "
2538 "content:!\"Gggggg\"; within:30; sid:1;)",
2539 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2549 static int SigTest65TestNegatedContent(
void)
2551 return SigTestNegativeTestContent(
"alert tcp any any -> any any (content:\"aaa\"; depth:10; "
2552 "content:!\"Gggggg\"; distance:0; within:49; sid:1;)",
2553 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2556 static int SigTest66TestNegatedContent(
void)
2558 return SigTestPositiveTestContent(
"alert tcp any any -> any any (content:\"aaa\"; depth:10; "
2559 "content:!\"Gggggg\"; within:30; sid:1;)",
2560 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2563 static int SigTest67TestNegatedContent(
void)
2565 return SigTestNegativeTestContent(
"alert tcp any any -> any any (content:\"aaa\"; depth:10; "
2566 "content:!\"XXXX\"; within:56; sid:1;)",
2567 (uint8_t *)
"aaa bbbb cccc XXXXdddd eeeeeeeeeee ffffffffff XXXXggggg hhhhhhhh");
2570 static int SigTest68TestNegatedContent(
void)
2572 return SigTestPositiveTestContent(
2573 "alert tcp any any -> any any (content:\"aaa\"; depth:10; content:\"cccc\"; offset:8; "
2574 "content:!\"Gggggg\"; within:28; content:\"hhhhhhhh\"; sid:1;)",
2575 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2578 static int SigTest69TestNegatedContent(
void)
2580 return SigTestNegativeTestContent(
2581 "alert tcp any any -> any any (content:\"aaa\"; depth:10; content:\"cccc\"; offset:8; "
2582 "content:!\"Gggggg\"; within:48; content:\"hhhhhhhh\"; sid:1;)",
2583 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2586 static int SigTest70TestNegatedContent(
void)
2588 return SigTestNegativeTestContent(
"alert tcp any any -> any any (content:\"aaa\"; "
2589 "content:!\"Gggggg\"; within:52; sid:1;)",
2590 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2594 static int SigTest71TestNegatedContent(
void)
2596 return SigTestNegativeTestContent(
"alert tcp any any -> any any (content:\"aaa\"; "
2597 "content:!\"Gggggg\"; within:40; distance:43; sid:1;)",
2598 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2601 static int SigTest72TestNegatedContent(
void)
2603 return SigTestNegativeTestContent(
"alert tcp any any -> any any (content:\"aaa\"; "
2604 "content:!\"Gggggg\"; within:49; distance:43; sid:1;)",
2605 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff Ggggggggg hhhhhhhh");
2608 static int SigTest73TestNegatedContent(
void)
2610 return SigTestNegativeTestContent(
"alert tcp any any -> any any (content:\"aaa\"; depth:5; "
2611 "content:!\"eeeeeeeeeee\"; depth:35; sid:1;)",
2612 (uint8_t *)
"aaa bbbb cccc dddddddd eeeeeeeeeee ffffffffff ggggggggg hhhhhhhh");
2615 static int SigTest74TestNegatedContent(
void)
2617 return SigTestPositiveTestContent(
"alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"USER\"; content:!\"PASS\"; sid:1;)", (uint8_t *)
"USER apple");
2620 static int SigTest75TestNegatedContent(
void)
2622 return SigTestPositiveTestContent(
"alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"USER\"; content:\"!PASS\"; sid:1;)", (uint8_t *)
"USER !PASS");
2625 static int SigTest76TestBug134(
void)
2627 uint8_t *buf = (uint8_t *)
"test detect ${IFS} in traffic";
2628 uint16_t buflen = strlen((
char *)buf);
2633 memset(&f, 0,
sizeof(
Flow));
2642 char sig[] =
"alert tcp any any -> any 515 "
2643 "(msg:\"detect IFS\"; flow:to_server,established; content:\"${IFS}\";"
2644 " depth:50; offset:0; sid:900091; rev:1;)";
2659 static int SigTest77TestBug139(
void)
2662 0x12, 0x23, 0x34, 0x35, 0x52, 0x52, 0x24, 0x42, 0x22, 0x24,
2663 0x52, 0x24, 0x82, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x34 };
2664 uint16_t buflen =
sizeof(buf);
2669 char sig[] =
"alert udp any any -> any 53 (msg:\"dns testing\";"
2670 " content:\"|00 00|\"; depth:5; offset:13; sid:9436601;"
2684 static int DetectLongContentTestCommon(
const char *sig, uint32_t sid)
2687 static uint8_t pkt[739] = {
2688 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2689 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x45, 0x00,
2690 0x02, 0xd5, 0x4a, 0x18, 0x40, 0x00, 0x40, 0x06,
2691 0xd7, 0xd6, 0x0a, 0x10, 0x01, 0x0b, 0x0a, 0x10,
2692 0x01, 0x0a, 0xdb, 0x36, 0x00, 0x50, 0xca, 0xc5,
2693 0xcc, 0xd1, 0x95, 0x77, 0x0f, 0x7d, 0x80, 0x18,
2694 0x00, 0xe5, 0x77, 0x9d, 0x00, 0x00, 0x01, 0x01,
2695 0x08, 0x0a, 0x1d, 0xe0, 0x86, 0xc6, 0xfc, 0x73,
2696 0x49, 0xf3, 0x50, 0x4f, 0x53, 0x54, 0x20, 0x2f,
2697 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e,
2698 0x31, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
2699 0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x63,
2700 0x75, 0x72, 0x6c, 0x2f, 0x37, 0x2e, 0x33, 0x37,
2701 0x2e, 0x30, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74,
2702 0x3a, 0x20, 0x31, 0x30, 0x2e, 0x31, 0x36, 0x2e,
2703 0x31, 0x2e, 0x31, 0x30, 0x0d, 0x0a, 0x41, 0x63,
2704 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20, 0x2a, 0x2f,
2705 0x2a, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65,
2706 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74,
2707 0x68, 0x3a, 0x20, 0x35, 0x32, 0x38, 0x0d, 0x0a,
2708 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d,
2709 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x61, 0x70,
2710 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f,
2711 0x6e, 0x2f, 0x78, 0x2d, 0x77, 0x77, 0x77, 0x2d,
2712 0x66, 0x6f, 0x72, 0x6d, 0x2d, 0x75, 0x72, 0x6c,
2713 0x65, 0x6e, 0x63, 0x6f, 0x64, 0x65, 0x64, 0x0d,
2714 0x0a, 0x0d, 0x0a, 0x58, 0x58, 0x58, 0x58, 0x58,
2715 0x58, 0x58, 0x58, 0x41, 0x41, 0x41, 0x41, 0x41,
2716 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2717 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2718 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2719 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2720 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2721 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2722 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2723 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2724 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2725 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2726 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2727 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2728 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2729 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2730 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2731 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2732 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2733 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2734 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2735 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2736 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2737 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2738 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2739 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2740 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2741 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2742 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2743 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2744 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2745 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2746 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2747 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2748 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2749 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2750 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2751 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2752 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2753 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2754 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2755 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2756 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2757 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2758 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2759 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2760 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2761 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2762 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2763 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2764 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2765 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2766 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2767 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2768 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2769 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2770 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2771 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2772 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2773 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2774 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2775 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2776 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2777 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2778 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2779 0x41, 0x41, 0x41, 0x58, 0x58, 0x58, 0x58, 0x58,
2783 return DetectContentLongPatternMatchTest(pkt, (uint16_t)
sizeof(pkt), sig,
2787 static int DetectLongContentTest1(
void)
2790 const char *sig =
"alert tcp any any -> any any (msg:\"Test Rule\"; content:\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"; sid:1;)";
2792 return DetectLongContentTestCommon(sig, 1);
2795 static int DetectLongContentTest2(
void)
2798 const char *sig =
"alert tcp any any -> any any (msg:\"Test Rule\"; content:\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"; sid:1;)";
2800 return DetectLongContentTestCommon(sig, 1);
2803 static int DetectLongContentTest3(
void)
2806 const char *sig =
"alert tcp any any -> any any (msg:\"Test Rule\"; content:\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"; sid:1;)";
2808 return !DetectLongContentTestCommon(sig, 1);
2811 static int DetectBadBinContent(
void)
2818 de_ctx,
"alert tcp any any -> any any (msg:\"test\"; content:\"|a|\"; sid:1;)"));
2820 de_ctx,
"alert tcp any any -> any any (msg:\"test\"; content:\"|aa b|\"; sid:1;)"));
2822 de_ctx,
"alert tcp any any -> any any (msg:\"test\"; content:\"|aa bz|\"; sid:1;)"));
2825 de_ctx,
"alert tcp any any -> any any (msg:\"test\"; content:\"|22 2 22|\"; sid:1;)"));
2833 static void DetectContentRegisterTests(
void)
2838 UtRegisterTest(
"DetectContentDepthTest01", DetectContentDepthTest01);
2840 UtRegisterTest(
"DetectContentParseTest01", DetectContentParseTest01);
2841 UtRegisterTest(
"DetectContentParseTest02", DetectContentParseTest02);
2842 UtRegisterTest(
"DetectContentParseTest03", DetectContentParseTest03);
2843 UtRegisterTest(
"DetectContentParseTest04", DetectContentParseTest04);
2844 UtRegisterTest(
"DetectContentParseTest05", DetectContentParseTest05);
2845 UtRegisterTest(
"DetectContentParseTest06", DetectContentParseTest06);
2846 UtRegisterTest(
"DetectContentParseTest07", DetectContentParseTest07);
2847 UtRegisterTest(
"DetectContentParseTest08", DetectContentParseTest08);
2848 UtRegisterTest(
"DetectContentParseTest09", DetectContentParseTest09);
2849 UtRegisterTest(
"DetectContentParseTest17", DetectContentParseTest17);
2850 UtRegisterTest(
"DetectContentParseTest18", DetectContentParseTest18);
2851 UtRegisterTest(
"DetectContentParseTest19", DetectContentParseTest19);
2852 UtRegisterTest(
"DetectContentParseTest20", DetectContentParseTest20);
2853 UtRegisterTest(
"DetectContentParseTest21", DetectContentParseTest21);
2854 UtRegisterTest(
"DetectContentParseTest22", DetectContentParseTest22);
2855 UtRegisterTest(
"DetectContentParseTest23", DetectContentParseTest23);
2856 UtRegisterTest(
"DetectContentParseTest24", DetectContentParseTest24);
2857 UtRegisterTest(
"DetectContentParseTest25", DetectContentParseTest25);
2858 UtRegisterTest(
"DetectContentParseTest26", DetectContentParseTest26);
2859 UtRegisterTest(
"DetectContentParseTest27", DetectContentParseTest27);
2860 UtRegisterTest(
"DetectContentParseTest28", DetectContentParseTest28);
2861 UtRegisterTest(
"DetectContentParseTest29", DetectContentParseTest29);
2862 UtRegisterTest(
"DetectContentParseTest30", DetectContentParseTest30);
2863 UtRegisterTest(
"DetectContentParseTest31", DetectContentParseTest31);
2864 UtRegisterTest(
"DetectContentParseTest32", DetectContentParseTest32);
2865 UtRegisterTest(
"DetectContentParseTest33", DetectContentParseTest33);
2866 UtRegisterTest(
"DetectContentParseTest34", DetectContentParseTest34);
2867 UtRegisterTest(
"DetectContentParseTest35", DetectContentParseTest35);
2868 UtRegisterTest(
"DetectContentParseTest41", DetectContentParseTest41);
2869 UtRegisterTest(
"DetectContentParseTest42", DetectContentParseTest42);
2870 UtRegisterTest(
"DetectContentParseTest43", DetectContentParseTest43);
2871 UtRegisterTest(
"DetectContentParseTest44", DetectContentParseTest44);
2872 UtRegisterTest(
"DetectContentParseTest45", DetectContentParseTest45);
2876 DetectContentLongPatternMatchTest01);
2878 DetectContentLongPatternMatchTest02);
2880 DetectContentLongPatternMatchTest03);
2882 DetectContentLongPatternMatchTest04);
2884 DetectContentLongPatternMatchTest05);
2886 DetectContentLongPatternMatchTest06);
2888 DetectContentLongPatternMatchTest07);
2890 DetectContentLongPatternMatchTest08);
2892 DetectContentLongPatternMatchTest09);
2894 DetectContentLongPatternMatchTest10);
2896 DetectContentLongPatternMatchTest11);
2899 UtRegisterTest(
"SigTest41TestNegatedContent", SigTest41TestNegatedContent);
2901 SigTest41aTestNegatedContent);
2902 UtRegisterTest(
"SigTest42TestNegatedContent", SigTest42TestNegatedContent);
2903 UtRegisterTest(
"SigTest43TestNegatedContent", SigTest43TestNegatedContent);
2904 UtRegisterTest(
"SigTest44TestNegatedContent", SigTest44TestNegatedContent);
2905 UtRegisterTest(
"SigTest45TestNegatedContent", SigTest45TestNegatedContent);
2906 UtRegisterTest(
"SigTest46TestNegatedContent", SigTest46TestNegatedContent);
2907 UtRegisterTest(
"SigTest47TestNegatedContent", SigTest47TestNegatedContent);
2908 UtRegisterTest(
"SigTest48TestNegatedContent", SigTest48TestNegatedContent);
2909 UtRegisterTest(
"SigTest49TestNegatedContent", SigTest49TestNegatedContent);
2910 UtRegisterTest(
"SigTest50TestNegatedContent", SigTest50TestNegatedContent);
2911 UtRegisterTest(
"SigTest51TestNegatedContent", SigTest51TestNegatedContent);
2912 UtRegisterTest(
"SigTest52TestNegatedContent", SigTest52TestNegatedContent);
2913 UtRegisterTest(
"SigTest53TestNegatedContent", SigTest53TestNegatedContent);
2914 UtRegisterTest(
"SigTest54TestNegatedContent", SigTest54TestNegatedContent);
2915 UtRegisterTest(
"SigTest55TestNegatedContent", SigTest55TestNegatedContent);
2916 UtRegisterTest(
"SigTest56TestNegatedContent", SigTest56TestNegatedContent);
2917 UtRegisterTest(
"SigTest57TestNegatedContent", SigTest57TestNegatedContent);
2918 UtRegisterTest(
"SigTest58TestNegatedContent", SigTest58TestNegatedContent);
2919 UtRegisterTest(
"SigTest59TestNegatedContent", SigTest59TestNegatedContent);
2920 UtRegisterTest(
"SigTest60TestNegatedContent", SigTest60TestNegatedContent);
2921 UtRegisterTest(
"SigTest61TestNegatedContent", SigTest61TestNegatedContent);
2922 UtRegisterTest(
"SigTest62TestNegatedContent", SigTest62TestNegatedContent);
2923 UtRegisterTest(
"SigTest63TestNegatedContent", SigTest63TestNegatedContent);
2924 UtRegisterTest(
"SigTest64TestNegatedContent", SigTest64TestNegatedContent);
2925 UtRegisterTest(
"SigTest65TestNegatedContent", SigTest65TestNegatedContent);
2926 UtRegisterTest(
"SigTest66TestNegatedContent", SigTest66TestNegatedContent);
2927 UtRegisterTest(
"SigTest67TestNegatedContent", SigTest67TestNegatedContent);
2928 UtRegisterTest(
"SigTest68TestNegatedContent", SigTest68TestNegatedContent);
2929 UtRegisterTest(
"SigTest69TestNegatedContent", SigTest69TestNegatedContent);
2930 UtRegisterTest(
"SigTest70TestNegatedContent", SigTest70TestNegatedContent);
2931 UtRegisterTest(
"SigTest71TestNegatedContent", SigTest71TestNegatedContent);
2932 UtRegisterTest(
"SigTest72TestNegatedContent", SigTest72TestNegatedContent);
2933 UtRegisterTest(
"SigTest73TestNegatedContent", SigTest73TestNegatedContent);
2934 UtRegisterTest(
"SigTest74TestNegatedContent", SigTest74TestNegatedContent);
2935 UtRegisterTest(
"SigTest75TestNegatedContent", SigTest75TestNegatedContent);
2940 UtRegisterTest(
"DetectLongContentTest1", DetectLongContentTest1);
2941 UtRegisterTest(
"DetectLongContentTest2", DetectLongContentTest2);
2942 UtRegisterTest(
"DetectLongContentTest3", DetectLongContentTest3);