53 static void DetectReplaceRegisterTests(
void);
83 uint8_t *content = NULL;
87 SCLogError(
"Can't negate replacement string: %s", replacestr);
110 "preceding content option for raw sig");
124 "negated keyword set along with a replacement");
129 "length different from replace length");
178 newlist->
found = found;
181 newlist->
next = replist;
196 replist = replist->
next;
208 replist = replist->
next;
227 int DetectReplaceLongPatternMatchTest(uint8_t *raw_eth_pkt, uint16_t pktsize,
228 const char *sig, uint32_t sid, uint8_t *pp,
244 SCLogDebug(
"replace: looks like a second run");
249 memset(&th_v, 0,
sizeof(th_v));
272 printf(
"relative next flag set on final match which is content: ");
285 SCLogDebug(
"replace: no alert on sig %d", sid);
315 static int DetectReplaceLongPatternMatchTestWrp(
const char *sig, uint32_t sid,
const char *sig_rep, uint32_t sid_rep)
323 uint8_t raw_eth_pkt[] = {
324 0xff,0xff,0xff,0xff,0xff,0xff,0x00,0x00,
325 0x00,0x00,0x00,0x00,0x08,0x00,0x45,0x00,
326 0x00,0x85,0x00,0x01,0x00,0x00,0x40,0x06,
327 0x7c,0x70,0x7f,0x00,0x00,0x01,0x7f,0x00,
328 0x00,0x01,0x00,0x14,0x00,0x50,0x00,0x00,
329 0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x02,
330 0x20,0x00,0xc9,0xad,0x00,0x00,0x48,0x69,
331 0x2c,0x20,0x74,0x68,0x69,0x73,0x20,0x69,
332 0x73,0x20,0x61,0x20,0x62,0x69,0x67,0x20,
333 0x74,0x65,0x73,0x74,0x20,0x74,0x6f,0x20,
334 0x63,0x68,0x65,0x63,0x6b,0x20,0x63,0x6f,
335 0x6e,0x74,0x65,0x6e,0x74,0x20,0x6d,0x61,
336 0x74,0x63,0x68,0x65,0x73,0x20,0x6f,0x66,
337 0x20,0x73,0x70,0x6c,0x69,0x74,0x74,0x65,
338 0x64,0x20,0x70,0x61,0x74,0x74,0x65,0x72,
339 0x6e,0x73,0x20,0x62,0x65,0x74,0x77,0x65,
340 0x65,0x6e,0x20,0x6d,0x75,0x6c,0x74,0x69,
341 0x70,0x6c,0x65,0x20,0x63,0x68,0x75,0x6e,
343 uint8_t p[
sizeof(raw_eth_pkt)];
344 uint16_t psize =
sizeof(raw_eth_pkt);
349 ret = DetectReplaceLongPatternMatchTest(raw_eth_pkt, (uint16_t)
sizeof(raw_eth_pkt),
350 sig, sid, p, &psize);
353 ret = DetectReplaceLongPatternMatchTest(p, psize, sig_rep, sid_rep, NULL, NULL);
363 static int DetectReplaceLongPatternMatchTestUDPWrp(
const char *sig, uint32_t sid,
const char *sig_rep, uint32_t sid_rep)
368 uint8_t raw_eth_pkt[] = {
369 0x8c, 0xa9, 0x82, 0x75, 0x5d, 0x62, 0xb4, 0x07,
370 0xf9, 0xf3, 0xc7, 0x0a, 0x08, 0x00, 0x45, 0x00,
371 0x00, 0x3a, 0x92, 0x4f, 0x40, 0x00, 0x40, 0x11,
372 0x31, 0x1a, 0xc0, 0xa8, 0x00, 0x02, 0xc1, 0xbd,
373 0xf4, 0xe1, 0x3b, 0x7e, 0x00, 0x35, 0x00, 0x26,
374 0xcb, 0x81, 0x37, 0x62, 0x01, 0x00, 0x00, 0x01,
375 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x61,
376 0x31, 0x05, 0x74, 0x77, 0x69, 0x6d, 0x67, 0x03,
377 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01 };
379 uint8_t p[
sizeof(raw_eth_pkt)];
380 uint16_t psize =
sizeof(raw_eth_pkt);
384 ret = DetectReplaceLongPatternMatchTest(raw_eth_pkt, (uint16_t)
sizeof(raw_eth_pkt),
385 sig, sid, p, &psize);
387 SCLogDebug(
"replace: test1 phase1 ok: %" PRIuMAX
" vs %d",(uintmax_t)
sizeof(raw_eth_pkt),psize);
388 ret = DetectReplaceLongPatternMatchTest(p, psize, sig_rep, sid_rep, NULL, NULL);
397 static int DetectReplaceMatchTest01(
void)
399 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
400 " content:\"big\"; replace:\"pig\"; sid:1;)";
401 const char *sig_rep =
"alert tcp any any -> any any (msg:\"replace worked\";"
402 " content:\"this is a pig test\"; sid:2;)";
403 FAIL_IF_NOT(DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2));
410 static int DetectReplaceMatchTest02(
void)
412 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
413 " content:\"th\"; offset: 4; replace:\"TH\"; sid:1;)";
414 const char *sig_rep =
"alert tcp any any -> any any (msg:\"replace worked\";"
415 " content:\"THis\"; offset:4; sid:2;)";
416 FAIL_IF_NOT(DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2));
423 static int DetectReplaceMatchTest03(
void)
425 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
426 " content:\"th\"; replace:\"TH\"; offset: 4; sid:1;)";
427 const char *sig_rep =
"alert tcp any any -> any any (msg:\"replace worked\";"
428 " content:\"THis\"; offset:4; sid:2;)";
429 FAIL_IF_NOT(DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2));
436 static int DetectReplaceMatchTest04(
void)
438 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
439 " content:\"th\"; replace:\"TH\"; content:\"patter\"; replace:\"matter\"; sid:1;)";
440 const char *sig_rep =
"alert tcp any any -> any any (msg:\"replace worked\";"
441 " content:\"THis\"; content:\"matterns\"; sid:2;)";
442 FAIL_IF_NOT(DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2));
449 static int DetectReplaceMatchTest05(
void)
451 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
452 " content:\"th\"; replace:\"TH\"; content:\"nutella\"; sid:1;)";
453 const char *sig_rep =
"alert tcp any any -> any any (msg:\"replace worked\";"
454 " content:\"TH\"; sid:2;)";
455 FAIL_IF(DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2));
463 static int DetectReplaceMatchTest06(
void)
465 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
466 " content:\"nutella\"; replace:\"commode\"; content:\"this is\"; sid:1;)";
467 const char *sig_rep =
"alert tcp any any -> any any (msg:\"replace worked\";"
468 " content:\"commode\"; sid:2;)";
469 FAIL_IF(DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2));
476 static int DetectReplaceMatchTest07(
void)
478 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
479 " content:\"BiG\"; nocase; replace:\"pig\"; sid:1;)";
480 const char *sig_rep =
"alert tcp any any -> any any (msg:\"replace worked\";"
481 " content:\"this is a pig test\"; sid:2;)";
482 FAIL_IF_NOT(DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2));
489 static int DetectReplaceMatchTest08(
void)
491 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
492 " content:\"big\"; depth:17; replace:\"pig\"; sid:1;)";
493 const char *sig_rep =
"alert tcp any any -> any any (msg:\"replace worked\";"
494 " content:\"this is a pig test\"; sid:2;)";
495 FAIL_IF_NOT(DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2));
502 static int DetectReplaceMatchTest09(
void)
504 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
505 " content:\"big\"; depth:16; replace:\"pig\"; sid:1;)";
506 const char *sig_rep =
"alert tcp any any -> any any (msg:\"replace worked\";"
507 " content:\"this is a pig test\"; sid:2;)";
508 FAIL_IF(DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2));
515 static int DetectReplaceMatchTest10(
void)
517 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
518 " content:\"big\"; depth:17; replace:\"pig\"; offset: 14; sid:1;)";
519 const char *sig_rep =
"alert tcp any any -> any any (msg:\"replace worked\";"
520 " content:\"pig\"; depth:17; offset:14; sid:2;)";
521 FAIL_IF_NOT(DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2));
528 static int DetectReplaceMatchTest11(
void)
530 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
531 " content:\"big\"; replace:\"pig\"; content:\"to\"; within: 11; sid:1;)";
532 const char *sig_rep =
"alert tcp any any -> any any (msg:\"replace worked\";"
533 " content:\"pig\"; depth:17; offset:14; sid:2;)";
535 FAIL_IF_NOT(DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2));
542 static int DetectReplaceMatchTest12(
void)
544 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
545 " content:\"big\"; replace:\"pig\"; content:\"to\"; within: 4; sid:1;)";
546 const char *sig_rep =
"alert tcp any any -> any any (msg:\"replace worked\";"
547 " content:\"pig\"; depth:17; offset:14; sid:2;)";
548 FAIL_IF(DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2));
555 static int DetectReplaceMatchTest13(
void)
557 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
558 " content:\"big\"; replace:\"pig\"; content:\"test\"; distance: 1; sid:1;)";
559 const char *sig_rep =
"alert tcp any any -> any any (msg:\"replace worked\";"
560 " content:\"pig\"; depth:17; offset:14; sid:2;)";
561 FAIL_IF_NOT(DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2));
568 static int DetectReplaceMatchTest14(
void)
570 const char *sig =
"alert tcp any any -> any any (msg:\"Nothing..\";"
571 " content:\"big\"; replace:\"pig\"; content:\"test\"; distance: 2; sid:1;)";
572 const char *sig_rep =
"alert tcp any any -> any any (msg:\"replace worked\";"
573 " content:\"pig\"; depth:17; offset:14; sid:2;)";
574 FAIL_IF(DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2));
581 static int DetectReplaceMatchTest15(
void)
583 const char *sig =
"alert udp any any -> any any (msg:\"Nothing..\";"
584 " content:\"com\"; replace:\"org\"; sid:1;)";
585 const char *sig_rep =
"alert udp any any -> any any (msg:\"replace worked\";"
586 " content:\"twimg|03|org\"; sid:2;)";
587 FAIL_IF_NOT(DetectReplaceLongPatternMatchTestUDPWrp(sig, 1, sig_rep, 2));
595 static int DetectReplaceParseTest01(
void)
605 "alert udp any any -> any any "
606 "(msg:\"test\"; content:\"doh\"; replace:\"; sid:238012;)"));
616 static int DetectReplaceParseTest02(
void)
626 "alert http any any -> any any "
627 "(msg:\"test\"; content:\"doh\"; replace:\"bon\"; sid:238012;)"));
638 static int DetectReplaceParseTest03(
void)
649 "alert tcp any any -> any any "
650 "(msg:\"test\"; content:\"doh\"; replace:\"don\"; http_header; sid:238012;)"));
660 static int DetectReplaceParseTest04(
void)
670 "(msg:\"test\"; replace:\"don\"; sid:238012;)"));
680 static int DetectReplaceParseTest05(
void)
690 "alert tcp any any -> any any "
691 "(msg:\"test\"; replace:\"don\"; content:\"doh\"; sid:238012;)"));
701 static int DetectReplaceParseTest06(
void)
711 "alert tcp any any -> any any "
712 "(msg:\"test\"; content:\"don\"; replace:\"donut\"; sid:238012;)"));
722 static int DetectReplaceParseTest07(
void)
733 "(msg:\"test\"; content:\"don\"; replace:\"dou\"; "
734 "content:\"jpg\"; http_header; sid:238012;)"));
744 void DetectReplaceRegisterTests(
void)
747 UtRegisterTest(
"DetectReplaceMatchTest01", DetectReplaceMatchTest01);
748 UtRegisterTest(
"DetectReplaceMatchTest02", DetectReplaceMatchTest02);
749 UtRegisterTest(
"DetectReplaceMatchTest03", DetectReplaceMatchTest03);
750 UtRegisterTest(
"DetectReplaceMatchTest04", DetectReplaceMatchTest04);
751 UtRegisterTest(
"DetectReplaceMatchTest05", DetectReplaceMatchTest05);
752 UtRegisterTest(
"DetectReplaceMatchTest06", DetectReplaceMatchTest06);
753 UtRegisterTest(
"DetectReplaceMatchTest07", DetectReplaceMatchTest07);
754 UtRegisterTest(
"DetectReplaceMatchTest08", DetectReplaceMatchTest08);
755 UtRegisterTest(
"DetectReplaceMatchTest09", DetectReplaceMatchTest09);
756 UtRegisterTest(
"DetectReplaceMatchTest10", DetectReplaceMatchTest10);
757 UtRegisterTest(
"DetectReplaceMatchTest11", DetectReplaceMatchTest11);
758 UtRegisterTest(
"DetectReplaceMatchTest12", DetectReplaceMatchTest12);
759 UtRegisterTest(
"DetectReplaceMatchTest13", DetectReplaceMatchTest13);
760 UtRegisterTest(
"DetectReplaceMatchTest14", DetectReplaceMatchTest14);
761 UtRegisterTest(
"DetectReplaceMatchTest15", DetectReplaceMatchTest15);
763 UtRegisterTest(
"DetectReplaceParseTest01", DetectReplaceParseTest01);
764 UtRegisterTest(
"DetectReplaceParseTest02", DetectReplaceParseTest02);
765 UtRegisterTest(
"DetectReplaceParseTest03", DetectReplaceParseTest03);
766 UtRegisterTest(
"DetectReplaceParseTest04", DetectReplaceParseTest04);
767 UtRegisterTest(
"DetectReplaceParseTest05", DetectReplaceParseTest05);
768 UtRegisterTest(
"DetectReplaceParseTest06", DetectReplaceParseTest06);
769 UtRegisterTest(
"DetectReplaceParseTest07", DetectReplaceParseTest07);