suricata
detect-transform-pcrexform.c
Go to the documentation of this file.
1 /* Copyright (C) 2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "../suricata-common.h"
19 
20 #include "../detect-engine.h"
21 
22 #include "../detect-transform-pcrexform.h"
23 
24 #include "../util-unittest.h"
25 
26 /**
27  * \test signature with an invalid pcrexform value.
28  */
29 
30 static int DetectTransformPcrexformParseTest01 (void)
31 {
34 
36  "alert tcp any any <> any 1 pcrexform:\"[\";");
37  FAIL_IF_NOT_NULL(sig);
38 
40  PASS;
41 }
42 
43 /**
44  * \test signature with a valid pcrexform value.
45  */
46 
47 static int DetectTransformPcrexformParseTest02 (void)
48 {
51 
53  "alert http any any -> any any (msg:\"HTTP with pcrexform\"; http.request_line; pcrexform:\"[a-zA-Z]+\\s+(.*)\\s+HTTP\"; content:\"/z4d4kWk.jpg\"; sid:1;)");
54  FAIL_IF_NULL(sig);
55 
57  PASS;
58 }
59 
60 /**
61  * \test signature with a pcrexform value without substring capture
62  */
63 
64 static int DetectTransformPcrexformParseTest03(void)
65 {
68 
70  "alert http any any -> any any (msg:\"HTTP with pcrexform\"; http.request_line; "
71  "pcrexform:\"No-match\"; content:\"/no-match.jpg\"; sid:1;)");
72  FAIL_IF_NOT_NULL(sig);
73 
75  PASS;
76 }
77 
78 /**
79  * \brief this function registers unit tests for DetectTransformPcrexform
80  */
82 {
83  UtRegisterTest("DetectTransformPcrexformParseTest01", DetectTransformPcrexformParseTest01);
84  UtRegisterTest("DetectTransformPcrexformParseTest02", DetectTransformPcrexformParseTest02);
85  UtRegisterTest("DetectTransformPcrexformParseTest03", DetectTransformPcrexformParseTest03);
86 }
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:785
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2442
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2434
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectTransformPcrexformRegisterTests
void DetectTransformPcrexformRegisterTests(void)
this function registers unit tests for DetectTransformPcrexform
Definition: detect-transform-pcrexform.c:81
Signature_
Signature container.
Definition: detect.h:540
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2403