suricata
detect-transform-xor.c
Go to the documentation of this file.
1 /* Copyright (C) 2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "../suricata-common.h"
19 
20 #include "../detect-engine.h"
21 
22 #include "../detect-transform-xor.h"
23 
24 #include "../util-unittest.h"
25 
26 /**
27  * \test signature with an invalid xor value.
28  */
29 
30 static int DetectTransformXorParseTest01(void)
31 {
34 
35  Signature *sig = DetectEngineAppendSig(de_ctx, "alert tcp any any <> any 1 xor:\"nohexa\";");
36  FAIL_IF_NOT_NULL(sig);
37 
39  PASS;
40 }
41 
42 /**
43  * \test signature with a valid xor value.
44  */
45 
46 static int DetectTransformXorParseTest02(void)
47 {
50 
52  "alert http any any -> any any (msg:\"HTTP with xor\"; http.request_line; "
53  "xor:\"0a0DC8ff\"; content:\"/z4d4kWk.jpg\"; sid:1;)");
54  FAIL_IF_NULL(sig);
55 
57  PASS;
58 }
59 
60 /**
61  * \brief this function registers unit tests for DetectTransformXor
62  */
64 {
65  UtRegisterTest("DetectTransformXorParseTest01", DetectTransformXorParseTest01);
66  UtRegisterTest("DetectTransformXorParseTest02", DetectTransformXorParseTest02);
67 }
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:785
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2442
DetectTransformXorRegisterTests
void DetectTransformXorRegisterTests(void)
this function registers unit tests for DetectTransformXor
Definition: detect-transform-xor.c:63
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2434
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
Signature_
Signature container.
Definition: detect.h:540
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2403