61 static void DetectUricontentRegisterTests(
void);
65 static int g_http_uri_buffer_id = 0;
121 const char *legacy = NULL;
122 if (
ConfGet(
"legacy.uricontent", &legacy) == 1) {
123 if (strcasecmp(
"disabled", legacy) == 0) {
125 "use a rule with \"uricontent\", either set the "
126 "option - \"legacy.uricontent\" in the conf to "
127 "\"enabled\" OR replace uricontent with "
128 "\'content:%s; http_uri;\'.",
131 }
else if (strcasecmp(
"enabled", legacy) == 0) {
135 "for legacy.uriconent - \"%s\". Valid values are "
136 "\"enabled\" OR \"disabled\".",
165 static int DetectUriSigTest01(
void)
170 memset(&th_v, 0,
sizeof(th_v));
177 "\" Test uricontent\"; content:\"me\"; uricontent:\"me\"; sid:1;)");
180 BUG_ON(s->sm_lists[g_http_uri_buffer_id] == NULL);
191 static int DetectUriSigTest02(
void)
199 "\" Test uricontent\"; "
200 "uricontent:\"foo\"; sid:1;)");
207 "\" Test uricontent and content\"; "
208 "uricontent:\"foo\"; content:\"bar\";sid:1;)");
216 "\" Test uricontent and content\"; "
217 "uricontent:\"foo\"; content:\"bar\";"
218 " depth:10; offset: 5; sid:1;)");
228 "\" Test uricontent and content\"; "
229 "content:\"foo\"; uricontent:\"bar\";"
230 " depth:10; offset: 5; sid:1;)");
240 "\" Test uricontent and content\"; "
241 "uricontent:\"foo\"; content:\"bar\";"
242 " depth:10; offset: 5; within:3; sid:1;)");
247 "\" Test uricontent and content\"; "
248 "uricontent:\"foo\"; content:\"bar\";"
249 " depth:10; offset: 5; distance:3; sid:1;)");
253 "\" Test uricontent and content\"; "
254 "uricontent:\"foo\"; content:\"bar\";"
255 " depth:10; offset: 5; content:"
256 "\"two_contents\"; within:30; sid:1;)");
267 "\" Test uricontent and content\"; "
268 "uricontent:\"foo\"; content:\"bar\";"
269 " depth:10; offset: 5; uricontent:"
270 "\"two_uricontents\"; within:30; sid:1;)");
281 "\" Test uricontent and content\"; "
282 "uricontent:\"foo\"; content:\"bar\";"
283 " depth:10; offset: 5; content:"
284 "\"two_contents\"; distance:30; sid:1;)");
295 "\" Test uricontent and content\"; "
296 "uricontent:\"foo\"; content:\"bar\";"
297 " depth:10; offset: 5; uricontent:"
298 "\"two_uricontents\"; distance:30; sid:1;)");
309 "\" Test uricontent and content\"; "
310 "uricontent:\"foo\"; content:\"bar\";"
311 " depth:10; offset: 5; uricontent:"
312 "\"two_uricontents\"; distance:30; "
313 "within:60; content:\"two_contents\";"
314 " within:70; distance:45; sid:1;)");
334 static int DetectUriSigTest03(
void)
341 "(msg:\"test\"; uricontent:\"\"; sid:238012;)");
351 static int DetectUriSigTest04(
void)
358 "(msg:\"test\"; uricontent:\"; sid:238012;)");
368 static int DetectUriSigTest05(
void)
375 "(msg:\"test\"; uricontent:\"boo; sid:238012;)");
385 static int DetectUriSigTest06(
void)
392 "(msg:\"test\"; uricontent:boo\"; sid:238012;)");
402 static int DetectUriSigTest07(
void)
412 "(msg:\"test\"; uricontent: !\"boo\"; sid:238012;)");
416 FAIL_IF_NULL(s->sm_lists_tail[g_http_uri_buffer_id]->ctx);
429 static int DetectUriContentParseTest08(
void)
436 "(msg:\"test\"; uricontent:\"|\"; sid:1;)");
446 static int DetectUriContentParseTest09(
void)
453 "(msg:\"test\"; uricontent:\"|af\"; sid:1;)");
463 static int DetectUriContentParseTest10(
void)
470 "(msg:\"test\"; uricontent:\"af|\"; sid:1;)");
480 static int DetectUriContentParseTest11(
void)
487 "(msg:\"test\"; uricontent:\"|af|\"; sid:1;)");
497 static int DetectUriContentParseTest12(
void)
504 "(msg:\"test\"; uricontent:\"aast|\"; sid:1;)");
514 static int DetectUriContentParseTest13(
void)
521 "(msg:\"test\"; uricontent:\"aast|af\"; sid:1;)");
531 static int DetectUriContentParseTest14(
void)
538 "(msg:\"test\"; uricontent:\"aast|af|\"; sid:1;)");
548 static int DetectUriContentParseTest15(
void)
555 "(msg:\"test\"; uricontent:\"|af|asdf\"; sid:1;)");
565 static int DetectUriContentParseTest16(
void)
572 "(msg:\"test\"; uricontent:\"|af|af|\"; sid:1;)");
582 static int DetectUriContentParseTest17(
void)
590 "(msg:\"test\"; uricontent:\"|af|af|af\"; sid:1;)");
600 static int DetectUriContentParseTest18(
void)
608 "(msg:\"test\"; uricontent:\"|af|af|af|\"; sid:1;)");
618 static int DetectUriContentParseTest19(
void)
625 "(msg:\"test\"; uricontent:\"\"; sid:1;)");
632 static int DetectUricontentIsdataatParseTest(
void)
639 "alert tcp any any -> any any ("
640 "uricontent:\"one\"; "
641 "isdataat:!4,relative; sid:1;)");
657 static void DetectUricontentRegisterTests(
void)
660 UtRegisterTest(
"DetectUriSigTest02 - Modifiers", DetectUriSigTest02);
667 UtRegisterTest(
"DetectUriContentParseTest08", DetectUriContentParseTest08);
668 UtRegisterTest(
"DetectUriContentParseTest09", DetectUriContentParseTest09);
669 UtRegisterTest(
"DetectUriContentParseTest10", DetectUriContentParseTest10);
670 UtRegisterTest(
"DetectUriContentParseTest11", DetectUriContentParseTest11);
671 UtRegisterTest(
"DetectUriContentParseTest12", DetectUriContentParseTest12);
672 UtRegisterTest(
"DetectUriContentParseTest13", DetectUriContentParseTest13);
673 UtRegisterTest(
"DetectUriContentParseTest14", DetectUriContentParseTest14);
674 UtRegisterTest(
"DetectUriContentParseTest15", DetectUriContentParseTest15);
675 UtRegisterTest(
"DetectUriContentParseTest16", DetectUriContentParseTest16);
676 UtRegisterTest(
"DetectUriContentParseTest17", DetectUriContentParseTest17);
677 UtRegisterTest(
"DetectUriContentParseTest18", DetectUriContentParseTest18);
678 UtRegisterTest(
"DetectUriContentParseTest19", DetectUriContentParseTest19);
681 DetectUricontentIsdataatParseTest);