suricata
detect-engine-content-inspection.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Tests for the content inspection engine.
24  */
25 
26 #include "../suricata-common.h"
27 #include "../decode.h"
28 #include "../flow.h"
29 #include "../detect.h"
30 #include "detect-engine-build.h"
31 
32 extern thread_local uint32_t ut_inspection_recursion_counter;
33 
34 #define TEST_HEADER \
35  ThreadVars tv; \
36  memset(&tv, 0, sizeof(tv)); \
37  StatsThreadInit(&tv.stats); \
38  Flow f; \
39  memset(&f, 0, sizeof(f));
40 
41 #define TEST_RUN(buf, buflen, sig, match, steps) \
42  { \
43  DetectEngineCtx *de_ctx = DetectEngineCtxInit(); \
44  FAIL_IF_NULL(de_ctx); \
45  DetectEngineThreadCtx *det_ctx = NULL; \
46  char rule[2048]; \
47  snprintf(rule, sizeof(rule), "alert tcp any any -> any any (%s sid:1; rev:1;)", (sig)); \
48  Signature *s = DetectEngineAppendSig(de_ctx, rule); \
49  FAIL_IF_NULL(s); \
50  SigGroupBuild(de_ctx); \
51  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); \
52  FAIL_IF_NULL(det_ctx); \
53  int r = DetectEngineContentInspection(de_ctx, det_ctx, s, \
54  s->sm_arrays[DETECT_SM_LIST_PMATCH], NULL, &f, (uint8_t *)(buf), (buflen), 0, \
55  DETECT_CI_FLAGS_SINGLE, DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD); \
56  FAIL_IF_NOT(r == (match)); \
57  FAIL_IF_NOT(ut_inspection_recursion_counter == (steps)); \
58  DetectEngineThreadCtxDeinit(&tv, det_ctx); \
59  DetectEngineCtxFree(de_ctx); \
60  StatsThreadCleanup(&tv.stats); \
61  }
62 #define TEST_FOOTER \
63  PASS
64 
65 /** \test simple match with distance */
66 static int DetectEngineContentInspectionTest01(void) {
67  TEST_HEADER;
68  TEST_RUN("ab", 2, "content:\"a\"; content:\"b\";", true, 2);
69  TEST_RUN("ab", 2, "content:\"a\"; content:\"b\"; distance:0; ", true, 2);
70  TEST_RUN("ba", 2, "content:\"a\"; content:\"b\"; distance:0; ", false, 2);
71  TEST_FOOTER;
72 }
73 
74 /** \test simple match with pcre/R */
75 static int DetectEngineContentInspectionTest02(void) {
76  TEST_HEADER;
77  TEST_RUN("ab", 2, "content:\"a\"; pcre:\"/b/\";", true, 2);
78  TEST_RUN("ab", 2, "content:\"a\"; pcre:\"/b/R\";", true, 2);
79  TEST_RUN("ba", 2, "content:\"a\"; pcre:\"/b/R\";", false, 2);
80  TEST_FOOTER;
81 }
82 
83 /** \test simple recursion logic */
84 static int DetectEngineContentInspectionTest03(void) {
85  TEST_HEADER;
86  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"c\";", true, 3);
87  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"d\";", false, 3);
88 
89  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0;", true, 3);
90  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; content:\"d\"; distance:0;", false, 3);
91 
92  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"d\"; distance:0; within:1;", false, 5);
93 
94  // 5 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found
95  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1;", true, 5);
96  // 6 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found, (6) bab
97  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; content:\"bab\";", true, 6);
98  // 6 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found, (6) no not found
99  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; content:\"no\";", false, 6);
100 
101  // 5 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found
102  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; pcre:\"/^c$/R\";", true, 5);
103  // 6 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found, (6) bab
104  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; pcre:\"/^c$/R\"; content:\"bab\";", true, 6);
105  // 6 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found, (6) no not found
106  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; pcre:\"/^c$/R\"; content:\"no\";", false, 6);
107 
108  TEST_FOOTER;
109 }
110 
111 /** \test pcre recursion logic */
112 static int DetectEngineContentInspectionTest04(void) {
113  TEST_HEADER;
114  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"c\";", true, 3);
115  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"d\";", false, 3);
116 
117  // simple chain of pcre
118  TEST_RUN("ababc", 5, "pcre:\"/^a/\"; pcre:\"/^b/R\"; pcre:\"/c/R\"; ", true, 3);
119  TEST_RUN("ababc", 5, "pcre:\"/a/\"; pcre:\"/^b/R\"; pcre:\"/^c/R\"; ", true, 5);
120  TEST_RUN("ababc", 5, "pcre:\"/^a/\"; pcre:\"/^b/R\"; pcre:\"/d/R\"; ", false, 3);
121  TEST_RUN("ababc", 5, "pcre:\"/^a/\"; pcre:\"/^b/R\"; pcre:\"/c/R\"; pcre:\"/d/\"; ", false, 4);
122 
123  TEST_FOOTER;
124 }
125 
126 /** \test multiple independent blocks recursion logic */
127 static int DetectEngineContentInspectionTest05(void) {
128  TEST_HEADER;
129  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"c\";", true, 3);
130  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"d\";", false, 3);
131 
132  // first block 2: (1) a, (2) b
133  // second block 3: (1) b, (2) c not found, (x) b continues within loop, (3) c found
134  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"b\"; content:\"c\"; distance:0; within:1;", true, 5);
135 
136  TEST_FOOTER;
137 }
138 
139 /** \test isdataat recursion logic */
140 static int DetectEngineContentInspectionTest06(void) {
141  TEST_HEADER;
142  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"c\";", true, 3);
143  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"d\";", false, 3);
144 
145  // 6 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found, isdataat
146  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; isdataat:!1,relative;", true, 5);
147  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; isdataat:1,relative;", false, 6);
148  TEST_RUN("abcabc", 6,
149  "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; "
150  "within:1; isdataat:10,relative;",
151  false, 4);
152 
153  TEST_RUN("ababcabc", 8, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; isdataat:!1,relative;", true, 7);
154  TEST_RUN("ababcabc", 8, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; isdataat:1,relative;", true, 6);
155 
156  TEST_RUN("abcXYZ", 6, "content:\"abc\"; content:\"XYZ\"; distance:0; within:3; isdataat:!1,relative;", true, 2);
157  TEST_RUN("abcXYZ", 6, "content:\"XYZ\"; distance:3; within:3; isdataat:!1,relative;", true, 1);
158  TEST_RUN("abcXYZ", 6, "content:\"cXY\"; distance:2; within:3; isdataat:!1,relative;", false, 1);
159 
160  TEST_RUN("xxxxxxxxxxxxxxxxxyYYYYYYYYYYYYYYYY", 34, "content:\"yYYYYYYYYYYYYYYYY\"; distance:9; within:29; isdataat:!1,relative;", true, 1);
161  TEST_FOOTER;
162 }
163 
164 /** \test extreme recursion */
165 static int DetectEngineContentInspectionTest07(void) {
166  TEST_HEADER;
167  TEST_RUN("abcabcabcabcabcabcabcabcabcabcd", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; content:\"d\";", true, 4);
168  TEST_RUN("abcabcabcabcabcabcabcabcabcabcd", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; content:\"d\"; within:1; distance:0; ", true, 31);
169  TEST_RUN("abcabcabcabcabcabcabcabcabcabcx", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; content:\"d\"; within:1; distance:0; ", false, 31);
170 
171  TEST_RUN("abcabcabcabcabcabcabcabcabcabcx", 31, "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; content:\"d\"; distance:0; ", false, 4);
172  TEST_RUN("abcabcabcabcabcabcabcabcabcabcx", 31, "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; pcre:\"/^d/R\"; ", false, 13);
173  TEST_RUN("abcabcabcabcabcabcabcabcabcabcx", 31, "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; isdataat:!1,relative; ", false, 3);
174  TEST_RUN("abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdx", 41,
175  "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; content:\"d\"; distance:0; content:\"e\"; distance:0; ", false, 5);
176  TEST_RUN("abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdx", 41,
177  "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; content:\"d\"; distance:0; pcre:\"/^e/R\"; ", false, 14); // TODO should be 5?
178  TEST_RUN("abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdx", 41,
179  "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; content:\"d\"; distance:0; isdataat:!1,relative; ", false, 4);
180 
181  TEST_RUN("abcabcabcabcabcabcabcabcabcabcd", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/d/\";", true, 4);
182  TEST_RUN("abcabcabcabcabcabcabcabcabcabcd", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/d/R\";", true, 4);
183  TEST_RUN("abcabcabcabcabcabcabcabcabcabcd", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/^d/R\";", true, 31);
184 
185  TEST_RUN("abcabcabcabcabcabcabcabcabcabcx", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/d/\";", false, 4);
186  TEST_RUN("abcabcabcabcabcabcabcabcabcabcx", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/d/R\";", false, 31);
187  TEST_RUN("abcabcabcabcabcabcabcabcabcabcx", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/^d/R\";", false, 31);
188  TEST_FOOTER;
189 }
190 
191 /** \test mix in negation */
192 static int DetectEngineContentInspectionTest08(void) {
193  TEST_HEADER;
194  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:!\"d\";", true, 3);
195  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:!\"c\";", false, 3);
196 
197  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:!\"a\"; distance:0; within:1;", true, 5);
198  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:!\"a\"; distance:0; ", true, 5);
199 
200  TEST_RUN("abcdefghy", 9, "content:\"a\"; content:!\"x\"; content:\"c\"; distance:0; within:2; ",
201  true, 3);
202  TEST_RUN("abcdefghx", 9, "content:\"a\"; content:!\"x\"; content:\"c\"; distance:0; within:2; ",
203  false, 2);
204  TEST_RUN("abcdefghy", 9,
205  "content:\"a\"; content:!\"x\"; content:!\"c\"; distance:2; within:1; ", true, 3);
206 
207  TEST_RUN("aaabbbccc", 9, "content:\"ccc\"; endswith; content:!\"bccc\"; endswith; ", false, 2);
208  TEST_RUN("aaabbbccc", 9, "content:\"ccc\"; endswith; content:!\"accc\"; endswith; ", true, 2);
209  TEST_RUN("aaabbbccc", 9, "content:\"ccc\"; endswith; content:!\"bccc\"; endswith; depth:4; ",
210  true, 2);
211  TEST_RUN("aaabbbccc", 9, "content:\"ccc\"; endswith; content:!\"bccc\"; endswith; depth:9; ",
212  false, 2);
213  TEST_FOOTER;
214 }
215 
216 /** \test mix in byte_jump */
217 static int DetectEngineContentInspectionTest09(void) {
218  TEST_HEADER;
219  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:!\"d\";", true, 3);
220  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:!\"c\";", false, 3);
221 
222  TEST_RUN("abc03abcxyz", 11, "content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3;", true, 3);
223  TEST_RUN("abc03abc03abcxyz", 16, "content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3;", true, 5);
224  TEST_RUN("abc03abc03abcxyz", 16, "content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; isdataat:!1,relative;", true, 5);
225  TEST_RUN("abc03abc03abcxyz", 16, "content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; pcre:\"/klm$/R\";", false, 7);
226  TEST_RUN("abc03abc03abcxyzklm", 19, "content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; pcre:\"/klm$/R\";", true, 6);
227  TEST_RUN("abc03abc03abcxyzklx", 19, "content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; pcre:\"/^klm$/R\";", false, 7);
228  TEST_RUN("abc03abc03abc03abcxyzklm", 24, "content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; pcre:\"/^klm$/R\";", true, 8);
229 
230  TEST_FOOTER;
231 }
232 
233 /** \test mix in byte_extract */
234 static int DetectEngineContentInspectionTest10(void) {
235  TEST_HEADER;
236  /* extract first byte as length field and check with isdataat */
237  TEST_RUN("9abcdefghi", 10, "byte_extract:1,0,data_size,string; isdataat:data_size;", true, 2);
238  TEST_RUN("9abcdefgh", 9, "byte_extract:1,0,data_size,string; isdataat:!data_size;", true, 2);
239  /* anchor len field to pattern 'x' to test recursion */
240  TEST_RUN("x9x9abcdefghi", 13, "content:\"x\"; byte_extract:1,0,data_size,string,relative; isdataat:data_size,relative;", true, 3);
241  TEST_RUN("x9x9abcdefgh", 12, "content:\"x\"; byte_extract:1,0,data_size,string,relative; isdataat:!data_size,relative;", true, 5);
242  TEST_RUN("x9x9abcdefgh", 12, "content:\"x\"; depth:1; byte_extract:1,0,data_size,string,relative; isdataat:!data_size,relative;", false, 3);
243  /* first isdataat should fail, second succeed */
244  TEST_RUN("x9x5abcdef", 10,
245  "content:\"x\"; byte_extract:1,0,data_size,string,relative; "
246  "isdataat:data_size,relative;",
247  true, 5);
248  /* check for super high extracted values */
249  TEST_RUN("100000000abcdefghi", 18, "byte_extract:0,0,data_size,string; isdataat:data_size;", false, 2);
250  TEST_RUN("100000000abcdefghi", 18, "byte_extract:0,0,data_size,string; isdataat:!data_size;", true, 2);
251  TEST_FOOTER;
252 }
253 
254 static int DetectEngineContentInspectionTest11(void) {
255  TEST_HEADER;
256  TEST_RUN("ab", 2, "content:\"a\"; startswith; content:\"b\";", true, 2);
257  TEST_RUN("ab", 2, "content:\"a\"; startswith; content:\"b\"; within:1; distance:0;", true, 2);
258  TEST_RUN("ab", 2, "content:\"ab\"; startswith;", true, 1);
259  TEST_RUN("ab", 2, "content:\"a\"; startswith;", true, 1);
260  TEST_RUN("ab", 2, "content:\"b\"; startswith;", false, 1);
261  TEST_FOOTER;
262 }
263 
264 /** \test endswith (isdataat) recursion logic
265  * based on DetectEngineContentInspectionTest06 */
266 static int DetectEngineContentInspectionTest12(void) {
267  TEST_HEADER;
268  // 6 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found, endswith
269  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; endswith;", true, 5);
270 
271  TEST_RUN("ababcabc", 8, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; endswith;", true, 7);
272 
273  TEST_RUN("abcXYZ", 6, "content:\"abc\"; content:\"XYZ\"; distance:0; within:3; endswith;", true, 2);
274  TEST_RUN("abcXYZ", 6, "content:\"XYZ\"; distance:3; within:3; endswith;", true, 1);
275  TEST_RUN("abcXYZ", 6, "content:\"cXY\"; distance:2; within:3; endswith;", false, 1);
276  TEST_RUN("abcXYZ", 6, "content:!\"cXY\"; endswith;", true, 1);
277  TEST_RUN("abcXYZ", 6, "content:!\"XYZ\"; endswith;", false, 1);
278 
279  TEST_RUN("xxxxxxxxxxxxxxxxxyYYYYYYYYYYYYYYYY", 34, "content:\"yYYYYYYYYYYYYYYYY\"; distance:9; within:29; endswith;", true, 1);
280  TEST_FOOTER;
281 }
282 
283 static int DetectEngineContentInspectionTest13(void) {
284  TEST_HEADER;
285  TEST_RUN("ab", 2, "content:\"a\"; startswith; content:\"b\"; endswith;", true, 2);
286  TEST_RUN("ab", 2, "content:\"a\"; startswith; content:\"b\"; within:1; distance:0; endswith;", true, 2);
287  TEST_RUN("ab", 2, "content:\"ab\"; startswith; endswith;", true, 1);
288  TEST_RUN("ab", 2, "content:\"a\"; startswith; endswith;", false, 1);
289  TEST_RUN("ab", 2, "content:\"b\"; startswith;", false, 1);
290  TEST_RUN("ab", 2, "content:\"b\"; startswith; endswith;", false, 1);
291  TEST_FOOTER;
292 }
293 
294 static int DetectEngineContentInspectionTest14(void)
295 {
296  TEST_HEADER;
297  TEST_RUN("XYZ_klm_1234abcd_XYZ_klm_5678abcd", 33,
298  "content:\"XYZ\"; content:\"_klm_\"; distance:0; content:\"abcd\"; distance:4; "
299  "byte_test:4,=,1234,-8,relative,string;",
300  true, 4);
301  TEST_RUN("XYZ_klm_1234abcd_XYZ_klm_5678abcd", 33,
302  "content:\"XYZ\"; content:\"_klm_\"; distance:0; content:\"abcd\"; distance:4; "
303  "byte_test:4,=,5678,-8,relative,string;",
304  true, 5);
305  TEST_FOOTER;
306 }
307 
308 /** \brief negative distance */
309 static int DetectEngineContentInspectionTest17(void)
310 {
311  TEST_HEADER;
312  TEST_RUN("aaabbbcccdddee", 14,
313  "content:\"aaa\"; content:\"ee\"; within:2; distance:9; content:\"bbb\"; within:3; "
314  "distance:-11; content:\"ccc\"; within:3; distance:0;",
315  true, 4);
316  TEST_FOOTER;
317 }
318 
319 void DetectEngineContentInspectionRegisterTests(void)
320 {
321  UtRegisterTest("DetectEngineContentInspectionTest01",
322  DetectEngineContentInspectionTest01);
323  UtRegisterTest("DetectEngineContentInspectionTest02",
324  DetectEngineContentInspectionTest02);
325  UtRegisterTest("DetectEngineContentInspectionTest03",
326  DetectEngineContentInspectionTest03);
327  UtRegisterTest("DetectEngineContentInspectionTest04",
328  DetectEngineContentInspectionTest04);
329  UtRegisterTest("DetectEngineContentInspectionTest05",
330  DetectEngineContentInspectionTest05);
331  UtRegisterTest("DetectEngineContentInspectionTest06",
332  DetectEngineContentInspectionTest06);
333  UtRegisterTest("DetectEngineContentInspectionTest07",
334  DetectEngineContentInspectionTest07);
335  UtRegisterTest("DetectEngineContentInspectionTest08",
336  DetectEngineContentInspectionTest08);
337  UtRegisterTest("DetectEngineContentInspectionTest09",
338  DetectEngineContentInspectionTest09);
339  UtRegisterTest("DetectEngineContentInspectionTest10",
340  DetectEngineContentInspectionTest10);
341  UtRegisterTest("DetectEngineContentInspectionTest11 startswith",
342  DetectEngineContentInspectionTest11);
343  UtRegisterTest("DetectEngineContentInspectionTest12 endswith",
344  DetectEngineContentInspectionTest12);
345  UtRegisterTest("DetectEngineContentInspectionTest13 mix startswith/endswith",
346  DetectEngineContentInspectionTest13);
347  UtRegisterTest("DetectEngineContentInspectionTest14 byte_test negative offset",
348  DetectEngineContentInspectionTest14);
349  UtRegisterTest("DetectEngineContentInspectionTest17 negative distance",
350  DetectEngineContentInspectionTest17);
351 }
352 
353 #undef TEST_HEADER
354 #undef TEST_RUN
355 #undef TEST_FOOTER
DetectEngineContentInspectionRegisterTests
void DetectEngineContentInspectionRegisterTests(void)
Definition: detect-engine-content-inspection.c:319
TEST_HEADER
#define TEST_HEADER
Definition: detect-engine-content-inspection.c:34
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
TEST_FOOTER
#define TEST_FOOTER
Definition: detect-engine-content-inspection.c:62
detect-engine-build.h
ut_inspection_recursion_counter
thread_local uint32_t ut_inspection_recursion_counter
Definition: detect-engine-content-inspection.c:69
TEST_RUN
#define TEST_RUN(buf, buflen, sig, match, steps)
Definition: detect-engine-content-inspection.c:41