suricata
detect-engine-content-inspection.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Tests for the content inspection engine.
24  */
25 
26 #include "../suricata-common.h"
27 #include "../decode.h"
28 #include "../flow.h"
29 #include "../detect.h"
30 #include "detect-engine-build.h"
31 
32 extern thread_local uint32_t ut_inspection_recursion_counter;
33 
34 #define TEST_HEADER \
35  ThreadVars tv; \
36  memset(&tv, 0, sizeof(tv)); \
37  Flow f; \
38  memset(&f, 0, sizeof(f));
39 
40 #define TEST_RUN(buf, buflen, sig, match, steps) \
41  { \
42  DetectEngineCtx *de_ctx = DetectEngineCtxInit(); \
43  FAIL_IF_NULL(de_ctx); \
44  DetectEngineThreadCtx *det_ctx = NULL; \
45  char rule[2048]; \
46  snprintf(rule, sizeof(rule), "alert tcp any any -> any any (%s sid:1; rev:1;)", (sig)); \
47  Signature *s = DetectEngineAppendSig(de_ctx, rule); \
48  FAIL_IF_NULL(s); \
49  SigGroupBuild(de_ctx); \
50  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); \
51  FAIL_IF_NULL(det_ctx); \
52  int r = DetectEngineContentInspection(de_ctx, det_ctx, s, \
53  s->sm_arrays[DETECT_SM_LIST_PMATCH], NULL, &f, (uint8_t *)(buf), (buflen), 0, \
54  DETECT_CI_FLAGS_SINGLE, DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD); \
55  FAIL_IF_NOT(r == (match)); \
56  FAIL_IF_NOT(ut_inspection_recursion_counter == (steps)); \
57  DetectEngineThreadCtxDeinit(&tv, det_ctx); \
58  DetectEngineCtxFree(de_ctx); \
59  StatsThreadCleanup(&tv); \
60  }
61 #define TEST_FOOTER \
62  PASS
63 
64 /** \test simple match with distance */
65 static int DetectEngineContentInspectionTest01(void) {
66  TEST_HEADER;
67  TEST_RUN("ab", 2, "content:\"a\"; content:\"b\";", true, 2);
68  TEST_RUN("ab", 2, "content:\"a\"; content:\"b\"; distance:0; ", true, 2);
69  TEST_RUN("ba", 2, "content:\"a\"; content:\"b\"; distance:0; ", false, 2);
70  TEST_FOOTER;
71 }
72 
73 /** \test simple match with pcre/R */
74 static int DetectEngineContentInspectionTest02(void) {
75  TEST_HEADER;
76  TEST_RUN("ab", 2, "content:\"a\"; pcre:\"/b/\";", true, 2);
77  TEST_RUN("ab", 2, "content:\"a\"; pcre:\"/b/R\";", true, 2);
78  TEST_RUN("ba", 2, "content:\"a\"; pcre:\"/b/R\";", false, 2);
79  TEST_FOOTER;
80 }
81 
82 /** \test simple recursion logic */
83 static int DetectEngineContentInspectionTest03(void) {
84  TEST_HEADER;
85  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"c\";", true, 3);
86  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"d\";", false, 3);
87 
88  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0;", true, 3);
89  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; content:\"d\"; distance:0;", false, 3);
90 
91  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"d\"; distance:0; within:1;", false, 5);
92 
93  // 5 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found
94  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1;", true, 5);
95  // 6 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found, (6) bab
96  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; content:\"bab\";", true, 6);
97  // 6 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found, (6) no not found
98  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; content:\"no\";", false, 6);
99 
100  // 5 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found
101  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; pcre:\"/^c$/R\";", true, 5);
102  // 6 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found, (6) bab
103  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; pcre:\"/^c$/R\"; content:\"bab\";", true, 6);
104  // 6 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found, (6) no not found
105  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; pcre:\"/^c$/R\"; content:\"no\";", false, 6);
106 
107  TEST_FOOTER;
108 }
109 
110 /** \test pcre recursion logic */
111 static int DetectEngineContentInspectionTest04(void) {
112  TEST_HEADER;
113  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"c\";", true, 3);
114  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"d\";", false, 3);
115 
116  // simple chain of pcre
117  TEST_RUN("ababc", 5, "pcre:\"/^a/\"; pcre:\"/^b/R\"; pcre:\"/c/R\"; ", true, 3);
118  TEST_RUN("ababc", 5, "pcre:\"/a/\"; pcre:\"/^b/R\"; pcre:\"/^c/R\"; ", true, 5);
119  TEST_RUN("ababc", 5, "pcre:\"/^a/\"; pcre:\"/^b/R\"; pcre:\"/d/R\"; ", false, 3);
120  TEST_RUN("ababc", 5, "pcre:\"/^a/\"; pcre:\"/^b/R\"; pcre:\"/c/R\"; pcre:\"/d/\"; ", false, 4);
121 
122  TEST_FOOTER;
123 }
124 
125 /** \test multiple independent blocks recursion logic */
126 static int DetectEngineContentInspectionTest05(void) {
127  TEST_HEADER;
128  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"c\";", true, 3);
129  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"d\";", false, 3);
130 
131  // first block 2: (1) a, (2) b
132  // second block 3: (1) b, (2) c not found, (x) b continues within loop, (3) c found
133  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"b\"; content:\"c\"; distance:0; within:1;", true, 5);
134 
135  TEST_FOOTER;
136 }
137 
138 /** \test isdataat recursion logic */
139 static int DetectEngineContentInspectionTest06(void) {
140  TEST_HEADER;
141  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"c\";", true, 3);
142  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:\"d\";", false, 3);
143 
144  // 6 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found, isdataat
145  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; isdataat:!1,relative;", true, 5);
146  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; isdataat:1,relative;", false, 6);
147  TEST_RUN("abcabc", 6,
148  "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; "
149  "within:1; isdataat:10,relative;",
150  false, 4);
151 
152  TEST_RUN("ababcabc", 8, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; isdataat:!1,relative;", true, 7);
153  TEST_RUN("ababcabc", 8, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; isdataat:1,relative;", true, 6);
154 
155  TEST_RUN("abcXYZ", 6, "content:\"abc\"; content:\"XYZ\"; distance:0; within:3; isdataat:!1,relative;", true, 2);
156  TEST_RUN("abcXYZ", 6, "content:\"XYZ\"; distance:3; within:3; isdataat:!1,relative;", true, 1);
157  TEST_RUN("abcXYZ", 6, "content:\"cXY\"; distance:2; within:3; isdataat:!1,relative;", false, 1);
158 
159  TEST_RUN("xxxxxxxxxxxxxxxxxyYYYYYYYYYYYYYYYY", 34, "content:\"yYYYYYYYYYYYYYYYY\"; distance:9; within:29; isdataat:!1,relative;", true, 1);
160  TEST_FOOTER;
161 }
162 
163 /** \test extreme recursion */
164 static int DetectEngineContentInspectionTest07(void) {
165  TEST_HEADER;
166  TEST_RUN("abcabcabcabcabcabcabcabcabcabcd", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; content:\"d\";", true, 4);
167  TEST_RUN("abcabcabcabcabcabcabcabcabcabcd", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; content:\"d\"; within:1; distance:0; ", true, 31);
168  TEST_RUN("abcabcabcabcabcabcabcabcabcabcx", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; content:\"d\"; within:1; distance:0; ", false, 31);
169 
170  TEST_RUN("abcabcabcabcabcabcabcabcabcabcx", 31, "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; content:\"d\"; distance:0; ", false, 4);
171  TEST_RUN("abcabcabcabcabcabcabcabcabcabcx", 31, "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; pcre:\"/^d/R\"; ", false, 13);
172  TEST_RUN("abcabcabcabcabcabcabcabcabcabcx", 31, "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; isdataat:!1,relative; ", false, 3);
173  TEST_RUN("abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdx", 41,
174  "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; content:\"d\"; distance:0; content:\"e\"; distance:0; ", false, 5);
175  TEST_RUN("abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdx", 41,
176  "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; content:\"d\"; distance:0; pcre:\"/^e/R\"; ", false, 14); // TODO should be 5?
177  TEST_RUN("abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdx", 41,
178  "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; content:\"d\"; distance:0; isdataat:!1,relative; ", false, 4);
179 
180  TEST_RUN("abcabcabcabcabcabcabcabcabcabcd", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/d/\";", true, 4);
181  TEST_RUN("abcabcabcabcabcabcabcabcabcabcd", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/d/R\";", true, 4);
182  TEST_RUN("abcabcabcabcabcabcabcabcabcabcd", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/^d/R\";", true, 31);
183 
184  TEST_RUN("abcabcabcabcabcabcabcabcabcabcx", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/d/\";", false, 4);
185  TEST_RUN("abcabcabcabcabcabcabcabcabcabcx", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/d/R\";", false, 31);
186  TEST_RUN("abcabcabcabcabcabcabcabcabcabcx", 31, "content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/^d/R\";", false, 31);
187  TEST_FOOTER;
188 }
189 
190 /** \test mix in negation */
191 static int DetectEngineContentInspectionTest08(void) {
192  TEST_HEADER;
193  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:!\"d\";", true, 3);
194  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:!\"c\";", false, 3);
195 
196  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:!\"a\"; distance:0; within:1;", true, 5);
197  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:!\"a\"; distance:0; ", true, 5);
198 
199  TEST_RUN("abcdefghy", 9, "content:\"a\"; content:!\"x\"; content:\"c\"; distance:0; within:2; ",
200  true, 3);
201  TEST_RUN("abcdefghx", 9, "content:\"a\"; content:!\"x\"; content:\"c\"; distance:0; within:2; ",
202  false, 2);
203  TEST_RUN("abcdefghy", 9,
204  "content:\"a\"; content:!\"x\"; content:!\"c\"; distance:2; within:1; ", true, 3);
205 
206  TEST_RUN("aaabbbccc", 9, "content:\"ccc\"; endswith; content:!\"bccc\"; endswith; ", false, 2);
207  TEST_RUN("aaabbbccc", 9, "content:\"ccc\"; endswith; content:!\"accc\"; endswith; ", true, 2);
208  TEST_RUN("aaabbbccc", 9, "content:\"ccc\"; endswith; content:!\"bccc\"; endswith; depth:4; ",
209  true, 2);
210  TEST_RUN("aaabbbccc", 9, "content:\"ccc\"; endswith; content:!\"bccc\"; endswith; depth:9; ",
211  false, 2);
212  TEST_FOOTER;
213 }
214 
215 /** \test mix in byte_jump */
216 static int DetectEngineContentInspectionTest09(void) {
217  TEST_HEADER;
218  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:!\"d\";", true, 3);
219  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; content:!\"c\";", false, 3);
220 
221  TEST_RUN("abc03abcxyz", 11, "content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3;", true, 3);
222  TEST_RUN("abc03abc03abcxyz", 16, "content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3;", true, 5);
223  TEST_RUN("abc03abc03abcxyz", 16, "content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; isdataat:!1,relative;", true, 5);
224  TEST_RUN("abc03abc03abcxyz", 16, "content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; pcre:\"/klm$/R\";", false, 7);
225  TEST_RUN("abc03abc03abcxyzklm", 19, "content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; pcre:\"/klm$/R\";", true, 6);
226  TEST_RUN("abc03abc03abcxyzklx", 19, "content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; pcre:\"/^klm$/R\";", false, 7);
227  TEST_RUN("abc03abc03abc03abcxyzklm", 24, "content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; pcre:\"/^klm$/R\";", true, 8);
228 
229  TEST_FOOTER;
230 }
231 
232 /** \test mix in byte_extract */
233 static int DetectEngineContentInspectionTest10(void) {
234  TEST_HEADER;
235  /* extract first byte as length field and check with isdataat */
236  TEST_RUN("9abcdefghi", 10, "byte_extract:1,0,data_size,string; isdataat:data_size;", true, 2);
237  TEST_RUN("9abcdefgh", 9, "byte_extract:1,0,data_size,string; isdataat:!data_size;", true, 2);
238  /* anchor len field to pattern 'x' to test recursion */
239  TEST_RUN("x9x9abcdefghi", 13, "content:\"x\"; byte_extract:1,0,data_size,string,relative; isdataat:data_size,relative;", true, 3);
240  TEST_RUN("x9x9abcdefgh", 12, "content:\"x\"; byte_extract:1,0,data_size,string,relative; isdataat:!data_size,relative;", true, 5);
241  TEST_RUN("x9x9abcdefgh", 12, "content:\"x\"; depth:1; byte_extract:1,0,data_size,string,relative; isdataat:!data_size,relative;", false, 3);
242  /* first isdataat should fail, second succeed */
243  TEST_RUN("x9x5abcdef", 10,
244  "content:\"x\"; byte_extract:1,0,data_size,string,relative; "
245  "isdataat:data_size,relative;",
246  true, 5);
247  /* check for super high extracted values */
248  TEST_RUN("100000000abcdefghi", 18, "byte_extract:0,0,data_size,string; isdataat:data_size;", false, 2);
249  TEST_RUN("100000000abcdefghi", 18, "byte_extract:0,0,data_size,string; isdataat:!data_size;", true, 2);
250  TEST_FOOTER;
251 }
252 
253 static int DetectEngineContentInspectionTest11(void) {
254  TEST_HEADER;
255  TEST_RUN("ab", 2, "content:\"a\"; startswith; content:\"b\";", true, 2);
256  TEST_RUN("ab", 2, "content:\"a\"; startswith; content:\"b\"; within:1; distance:0;", true, 2);
257  TEST_RUN("ab", 2, "content:\"ab\"; startswith;", true, 1);
258  TEST_RUN("ab", 2, "content:\"a\"; startswith;", true, 1);
259  TEST_RUN("ab", 2, "content:\"b\"; startswith;", false, 1);
260  TEST_FOOTER;
261 }
262 
263 /** \test endswith (isdataat) recursion logic
264  * based on DetectEngineContentInspectionTest06 */
265 static int DetectEngineContentInspectionTest12(void) {
266  TEST_HEADER;
267  // 6 steps: (1) a, (2) 1st b, (3) c not found, (4) 2nd b, (5) c found, endswith
268  TEST_RUN("ababc", 5, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; endswith;", true, 5);
269 
270  TEST_RUN("ababcabc", 8, "content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; endswith;", true, 7);
271 
272  TEST_RUN("abcXYZ", 6, "content:\"abc\"; content:\"XYZ\"; distance:0; within:3; endswith;", true, 2);
273  TEST_RUN("abcXYZ", 6, "content:\"XYZ\"; distance:3; within:3; endswith;", true, 1);
274  TEST_RUN("abcXYZ", 6, "content:\"cXY\"; distance:2; within:3; endswith;", false, 1);
275  TEST_RUN("abcXYZ", 6, "content:!\"cXY\"; endswith;", true, 1);
276  TEST_RUN("abcXYZ", 6, "content:!\"XYZ\"; endswith;", false, 1);
277 
278  TEST_RUN("xxxxxxxxxxxxxxxxxyYYYYYYYYYYYYYYYY", 34, "content:\"yYYYYYYYYYYYYYYYY\"; distance:9; within:29; endswith;", true, 1);
279  TEST_FOOTER;
280 }
281 
282 static int DetectEngineContentInspectionTest13(void) {
283  TEST_HEADER;
284  TEST_RUN("ab", 2, "content:\"a\"; startswith; content:\"b\"; endswith;", true, 2);
285  TEST_RUN("ab", 2, "content:\"a\"; startswith; content:\"b\"; within:1; distance:0; endswith;", true, 2);
286  TEST_RUN("ab", 2, "content:\"ab\"; startswith; endswith;", true, 1);
287  TEST_RUN("ab", 2, "content:\"a\"; startswith; endswith;", false, 1);
288  TEST_RUN("ab", 2, "content:\"b\"; startswith;", false, 1);
289  TEST_RUN("ab", 2, "content:\"b\"; startswith; endswith;", false, 1);
290  TEST_FOOTER;
291 }
292 
293 static int DetectEngineContentInspectionTest14(void)
294 {
295  TEST_HEADER;
296  TEST_RUN("XYZ_klm_1234abcd_XYZ_klm_5678abcd", 33,
297  "content:\"XYZ\"; content:\"_klm_\"; distance:0; content:\"abcd\"; distance:4; "
298  "byte_test:4,=,1234,-8,relative,string;",
299  true, 4);
300  TEST_RUN("XYZ_klm_1234abcd_XYZ_klm_5678abcd", 33,
301  "content:\"XYZ\"; content:\"_klm_\"; distance:0; content:\"abcd\"; distance:4; "
302  "byte_test:4,=,5678,-8,relative,string;",
303  true, 5);
304  TEST_FOOTER;
305 }
306 
307 /** \brief negative distance */
308 static int DetectEngineContentInspectionTest17(void)
309 {
310  TEST_HEADER;
311  TEST_RUN("aaabbbcccdddee", 14,
312  "content:\"aaa\"; content:\"ee\"; within:2; distance:9; content:\"bbb\"; within:3; "
313  "distance:-11; content:\"ccc\"; within:3; distance:0;",
314  true, 4);
315  TEST_FOOTER;
316 }
317 
318 void DetectEngineContentInspectionRegisterTests(void)
319 {
320  UtRegisterTest("DetectEngineContentInspectionTest01",
321  DetectEngineContentInspectionTest01);
322  UtRegisterTest("DetectEngineContentInspectionTest02",
323  DetectEngineContentInspectionTest02);
324  UtRegisterTest("DetectEngineContentInspectionTest03",
325  DetectEngineContentInspectionTest03);
326  UtRegisterTest("DetectEngineContentInspectionTest04",
327  DetectEngineContentInspectionTest04);
328  UtRegisterTest("DetectEngineContentInspectionTest05",
329  DetectEngineContentInspectionTest05);
330  UtRegisterTest("DetectEngineContentInspectionTest06",
331  DetectEngineContentInspectionTest06);
332  UtRegisterTest("DetectEngineContentInspectionTest07",
333  DetectEngineContentInspectionTest07);
334  UtRegisterTest("DetectEngineContentInspectionTest08",
335  DetectEngineContentInspectionTest08);
336  UtRegisterTest("DetectEngineContentInspectionTest09",
337  DetectEngineContentInspectionTest09);
338  UtRegisterTest("DetectEngineContentInspectionTest10",
339  DetectEngineContentInspectionTest10);
340  UtRegisterTest("DetectEngineContentInspectionTest11 startswith",
341  DetectEngineContentInspectionTest11);
342  UtRegisterTest("DetectEngineContentInspectionTest12 endswith",
343  DetectEngineContentInspectionTest12);
344  UtRegisterTest("DetectEngineContentInspectionTest13 mix startswith/endswith",
345  DetectEngineContentInspectionTest13);
346  UtRegisterTest("DetectEngineContentInspectionTest14 byte_test negative offset",
347  DetectEngineContentInspectionTest14);
348  UtRegisterTest("DetectEngineContentInspectionTest17 negative distance",
349  DetectEngineContentInspectionTest17);
350 }
351 
352 #undef TEST_HEADER
353 #undef TEST_RUN
354 #undef TEST_FOOTER
DetectEngineContentInspectionRegisterTests
void DetectEngineContentInspectionRegisterTests(void)
Definition: detect-engine-content-inspection.c:318
TEST_HEADER
#define TEST_HEADER
Definition: detect-engine-content-inspection.c:34
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
TEST_FOOTER
#define TEST_FOOTER
Definition: detect-engine-content-inspection.c:61
detect-engine-build.h
ut_inspection_recursion_counter
thread_local uint32_t ut_inspection_recursion_counter
Definition: detect-engine-content-inspection.c:69
TEST_RUN
#define TEST_RUN(buf, buflen, sig, match, steps)
Definition: detect-engine-content-inspection.c:40