/src/detect-fast-pattern.c

https://github.com/decanio/suricata-tilera · C · 19997 lines · 16405 code · 3297 blank · 295 comment · 4164 complexity · 8f001207f0544d429199869e0b3116f1 MD5 · raw file

  1. /* Copyright (C) 2007-2010 Open Information Security Foundation
  2. *
  3. * You can copy, redistribute or modify this Program under the terms of
  4. * the GNU General Public License version 2 as published by the Free
  5. * Software Foundation.
  6. *
  7. * This program is distributed in the hope that it will be useful,
  8. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  9. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  10. * GNU General Public License for more details.
  11. *
  12. * You should have received a copy of the GNU General Public License
  13. * version 2 along with this program; if not, write to the Free Software
  14. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
  15. * 02110-1301, USA.
  16. */
  17. /**
  18. * \file
  19. *
  20. * \author Anoop Saldanha <anoopsaldanha@gmail.com>
  21. *
  22. * Implements the fast_pattern keyword
  23. */
  24. #include "suricata-common.h"
  25. #include "detect.h"
  26. #include "flow.h"
  27. #include "detect-content.h"
  28. #include "detect-parse.h"
  29. #include "detect-engine.h"
  30. #include "detect-engine-mpm.h"
  31. #include "detect-fast-pattern.h"
  32. #include "util-error.h"
  33. #include "util-debug.h"
  34. #include "util-unittest.h"
  35. #include "util-unittest-helper.h"
  36. #define DETECT_FAST_PATTERN_REGEX "^(\\s*only\\s*)|\\s*([0-9]+)\\s*,\\s*([0-9]+)\\s*$"
  37. static pcre *parse_regex = NULL;
  38. static pcre_extra *parse_regex_study = NULL;
  39. static int DetectFastPatternSetup(DetectEngineCtx *, Signature *, char *);
  40. void DetectFastPatternRegisterTests(void);
  41. /* holds the list of sm match lists that need to be searched for a keyword
  42. * that has fp support */
  43. SCFPSupportSMList *sm_fp_support_smlist_list = NULL;
  44. /**
  45. * \brief Lets one add a sm list id to be searched for potential fp supported
  46. * keywords later.
  47. *
  48. * \param list_id SM list id.
  49. * \param priority Priority for this list.
  50. */
  51. static void SupportFastPatternForSigMatchList(int list_id, int priority)
  52. {
  53. if (sm_fp_support_smlist_list == NULL) {
  54. SCFPSupportSMList *new = SCMalloc(sizeof(SCFPSupportSMList));
  55. if (unlikely(new == NULL))
  56. exit(EXIT_FAILURE);
  57. memset(new, 0, sizeof(SCFPSupportSMList));
  58. new->list_id = list_id;
  59. new->priority = priority;
  60. sm_fp_support_smlist_list = new;
  61. return;
  62. }
  63. /* insertion point - ip */
  64. SCFPSupportSMList *ip = NULL;
  65. for (SCFPSupportSMList *tmp = sm_fp_support_smlist_list; tmp != NULL; tmp = tmp->next) {
  66. if (list_id == tmp->list_id) {
  67. SCLogError(SC_ERR_FATAL, "SM list already registered.");
  68. exit(EXIT_FAILURE);
  69. }
  70. if (priority <= tmp->priority)
  71. break;
  72. ip = tmp;
  73. }
  74. SCFPSupportSMList *new = SCMalloc(sizeof(SCFPSupportSMList));
  75. if (unlikely(new == NULL))
  76. exit(EXIT_FAILURE);
  77. memset(new, 0, sizeof(SCFPSupportSMList));
  78. new->list_id = list_id;
  79. new->priority = priority;
  80. if (ip == NULL) {
  81. new->next = sm_fp_support_smlist_list;
  82. sm_fp_support_smlist_list = new;
  83. } else {
  84. new->next = ip->next;
  85. ip->next = new;
  86. }
  87. for (SCFPSupportSMList *tmp = new->next; tmp != NULL; tmp = tmp->next) {
  88. if (list_id == tmp->list_id) {
  89. SCLogError(SC_ERR_FATAL, "SM list already registered.");
  90. exit(EXIT_FAILURE);
  91. }
  92. }
  93. return;
  94. }
  95. /**
  96. * \brief Registers the keywords(SMs) that should be given fp support.
  97. */
  98. void SupportFastPatternForSigMatchTypes(void)
  99. {
  100. SupportFastPatternForSigMatchList(DETECT_SM_LIST_HCBDMATCH, 2);
  101. SupportFastPatternForSigMatchList(DETECT_SM_LIST_HSBDMATCH, 2);
  102. SupportFastPatternForSigMatchList(DETECT_SM_LIST_HHDMATCH, 2);
  103. SupportFastPatternForSigMatchList(DETECT_SM_LIST_HRHDMATCH, 2);
  104. SupportFastPatternForSigMatchList(DETECT_SM_LIST_UMATCH, 2);
  105. SupportFastPatternForSigMatchList(DETECT_SM_LIST_HRUDMATCH, 2);
  106. SupportFastPatternForSigMatchList(DETECT_SM_LIST_HHHDMATCH, 2);
  107. SupportFastPatternForSigMatchList(DETECT_SM_LIST_HRHHDMATCH, 2);
  108. SupportFastPatternForSigMatchList(DETECT_SM_LIST_HCDMATCH, 2);
  109. SupportFastPatternForSigMatchList(DETECT_SM_LIST_HUADMATCH, 2);
  110. SupportFastPatternForSigMatchList(DETECT_SM_LIST_PMATCH, 3);
  111. SupportFastPatternForSigMatchList(DETECT_SM_LIST_HMDMATCH, 3);
  112. SupportFastPatternForSigMatchList(DETECT_SM_LIST_HSCDMATCH, 3);
  113. SupportFastPatternForSigMatchList(DETECT_SM_LIST_HSMDMATCH, 3);
  114. #if 0
  115. SCFPSupportSMList *tmp = sm_fp_support_smlist_list;
  116. while (tmp != NULL) {
  117. printf("%d - %d\n", tmp->list_id, tmp->priority);
  118. tmp = tmp->next;
  119. }
  120. #endif
  121. return;
  122. }
  123. /**
  124. * \brief Registration function for fast_pattern keyword
  125. */
  126. void DetectFastPatternRegister(void)
  127. {
  128. sigmatch_table[DETECT_FAST_PATTERN].name = "fast_pattern";
  129. sigmatch_table[DETECT_FAST_PATTERN].desc = "force using preceding content in the multi pattern matcher";
  130. sigmatch_table[DETECT_FAST_PATTERN].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#fast_pattern";
  131. sigmatch_table[DETECT_FAST_PATTERN].Match = NULL;
  132. sigmatch_table[DETECT_FAST_PATTERN].Setup = DetectFastPatternSetup;
  133. sigmatch_table[DETECT_FAST_PATTERN].Free = NULL;
  134. sigmatch_table[DETECT_FAST_PATTERN].RegisterTests = DetectFastPatternRegisterTests;
  135. sigmatch_table[DETECT_FAST_PATTERN].flags |= SIGMATCH_PAYLOAD;
  136. const char *eb;
  137. int eo;
  138. int opts = 0;
  139. parse_regex = pcre_compile(DETECT_FAST_PATTERN_REGEX, opts, &eb, &eo, NULL);
  140. if(parse_regex == NULL)
  141. {
  142. SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at "
  143. "offset %" PRId32 ": %s", DETECT_FAST_PATTERN_REGEX, eo, eb);
  144. goto error;
  145. }
  146. parse_regex_study = pcre_study(parse_regex, 0, &eb);
  147. if(eb != NULL)
  148. {
  149. SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
  150. goto error;
  151. }
  152. return;
  153. error:
  154. /* get some way to return an error code! */
  155. return;
  156. }
  157. //static int DetectFastPatternParseArg(
  158. /**
  159. * \brief Configures the previous content context for a fast_pattern modifier
  160. * keyword used in the rule.
  161. *
  162. * \param de_ctx Pointer to the Detection Engine Context.
  163. * \param s Pointer to the Signature to which the current keyword belongs.
  164. * \param null_str Should hold an empty string always.
  165. *
  166. * \retval 0 On success.
  167. * \retval -1 On failure.
  168. */
  169. static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
  170. {
  171. #define MAX_SUBSTRINGS 30
  172. int ret = 0, res = 0;
  173. int ov[MAX_SUBSTRINGS];
  174. const char *arg_substr = NULL;
  175. DetectContentData *cd = NULL;
  176. if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL &&
  177. s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL &&
  178. s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH] == NULL &&
  179. s->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH] == NULL &&
  180. s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH] == NULL &&
  181. s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH] == NULL &&
  182. s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH] == NULL &&
  183. s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH] == NULL &&
  184. s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH] == NULL &&
  185. s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH] == NULL &&
  186. s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH] == NULL &&
  187. s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH] == NULL &&
  188. s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH] == NULL &&
  189. s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
  190. SCLogWarning(SC_WARN_COMPATIBILITY, "fast_pattern found inside the "
  191. "rule, without a preceding content based keyword. "
  192. "Currently we provide fast_pattern support for content, "
  193. "uricontent, http_client_body, http_server_body, http_header, "
  194. "http_raw_header, http_method, http_cookie, "
  195. "http_raw_uri, http_stat_msg, http_stat_code, "
  196. "http_user_agent, http_host or http_raw_host option");
  197. return -1;
  198. }
  199. SigMatch *pm = SigMatchGetLastSMFromLists(s, 28,
  200. DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
  201. DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH],
  202. DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH],
  203. DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH],
  204. DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH],
  205. DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH],
  206. DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH],
  207. DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH],
  208. DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH],
  209. DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH],
  210. DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH],
  211. DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH],
  212. DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH],
  213. DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]);
  214. if (pm == NULL) {
  215. SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside "
  216. "the rule, without a content context. Please use a "
  217. "content based keyword before using fast_pattern");
  218. return -1;
  219. }
  220. cd = pm->ctx;
  221. if ((cd->flags & DETECT_CONTENT_NEGATED) &&
  222. ((cd->flags & DETECT_CONTENT_DISTANCE) ||
  223. (cd->flags & DETECT_CONTENT_WITHIN) ||
  224. (cd->flags & DETECT_CONTENT_OFFSET) ||
  225. (cd->flags & DETECT_CONTENT_DEPTH))) {
  226. /* we can't have any of these if we are having "only" */
  227. SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern; cannot be "
  228. "used with negated content, along with relative modifiers");
  229. goto error;
  230. }
  231. if (arg == NULL|| strcmp(arg, "") == 0) {
  232. if (cd->flags & DETECT_CONTENT_FAST_PATTERN) {
  233. SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple fast_pattern "
  234. "options for the same content");
  235. goto error;
  236. }
  237. else { /*allow only one content to have fast_pattern modifier*/
  238. int list_id = 0;
  239. for (list_id = 0; list_id < DETECT_SM_LIST_MAX; list_id++) {
  240. SigMatch *sm = NULL;
  241. for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) {
  242. if (sm->type == DETECT_CONTENT) {
  243. DetectContentData *tmp_cd = sm->ctx;
  244. if (tmp_cd->flags & DETECT_CONTENT_FAST_PATTERN) {
  245. SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern "
  246. "can be used on only one content in a rule");
  247. goto error;
  248. }
  249. }
  250. } /* for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) */
  251. }
  252. }
  253. cd->flags |= DETECT_CONTENT_FAST_PATTERN;
  254. return 0;
  255. }
  256. /* Execute the regex and populate args with captures. */
  257. ret = pcre_exec(parse_regex, parse_regex_study, arg,
  258. strlen(arg), 0, 0, ov, MAX_SUBSTRINGS);
  259. /* fast pattern only */
  260. if (ret == 2) {
  261. if ((cd->flags & DETECT_CONTENT_NEGATED) ||
  262. (cd->flags & DETECT_CONTENT_DISTANCE) ||
  263. (cd->flags & DETECT_CONTENT_WITHIN) ||
  264. (cd->flags & DETECT_CONTENT_OFFSET) ||
  265. (cd->flags & DETECT_CONTENT_DEPTH)) {
  266. /* we can't have any of these if we are having "only" */
  267. SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern: only; cannot be "
  268. "used with negated content or with any of the relative "
  269. "modifiers like distance, within, offset, depth");
  270. goto error;
  271. }
  272. cd->flags |= DETECT_CONTENT_FAST_PATTERN_ONLY;
  273. /* fast pattern chop */
  274. } else if (ret == 4) {
  275. res = pcre_get_substring((char *)arg, ov, MAX_SUBSTRINGS,
  276. 2, &arg_substr);
  277. if (res < 0) {
  278. SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed "
  279. "for fast_pattern offset");
  280. goto error;
  281. }
  282. int offset = atoi(arg_substr);
  283. if (offset > 65535) {
  284. SCLogError(SC_ERR_INVALID_SIGNATURE, "Fast pattern offset exceeds "
  285. "limit");
  286. goto error;
  287. }
  288. res = pcre_get_substring((char *)arg, ov, MAX_SUBSTRINGS,
  289. 3, &arg_substr);
  290. if (res < 0) {
  291. SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed "
  292. "for fast_pattern offset");
  293. goto error;
  294. }
  295. int length = atoi(arg_substr);
  296. if (offset > 65535) {
  297. SCLogError(SC_ERR_INVALID_SIGNATURE, "Fast pattern length exceeds "
  298. "limit");
  299. goto error;
  300. }
  301. if (offset + length > 65535) {
  302. SCLogError(SC_ERR_INVALID_SIGNATURE, "Fast pattern (length + offset) "
  303. "exceeds limit pattern length limit");
  304. goto error;
  305. }
  306. if (offset + length > cd->content_len) {
  307. SCLogError(SC_ERR_INVALID_SIGNATURE, "Fast pattern (length + "
  308. "offset (%u)) exceeds pattern length (%u)",
  309. offset + length, cd->content_len);
  310. goto error;
  311. }
  312. cd->fp_chop_offset = offset;
  313. cd->fp_chop_len = length;
  314. cd->flags |= DETECT_CONTENT_FAST_PATTERN_CHOP;
  315. } else {
  316. SCLogError(SC_ERR_PCRE_PARSE, "parse error, ret %" PRId32
  317. ", string %s", ret, arg);
  318. goto error;
  319. }
  320. //int args;
  321. //args = 0;
  322. //printf("ret-%d\n", ret);
  323. //for (args = 0; args < ret; args++) {
  324. // res = pcre_get_substring((char *)arg, ov, MAX_SUBSTRINGS,
  325. // args, &arg_substr);
  326. // if (res < 0) {
  327. // SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed "
  328. // "for arg 1");
  329. // goto error;
  330. // }
  331. // printf("%d-%s\n", args, arg_substr);
  332. //}
  333. cd->flags |= DETECT_CONTENT_FAST_PATTERN;
  334. return 0;
  335. error:
  336. return -1;
  337. }
  338. /*----------------------------------Unittests---------------------------------*/
  339. #ifdef UNITTESTS
  340. /**
  341. * \test Checks if a fast_pattern is registered in a Signature
  342. */
  343. int DetectFastPatternTest01(void)
  344. {
  345. SigMatch *sm = NULL;
  346. DetectEngineCtx *de_ctx = NULL;
  347. int result = 0;
  348. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  349. goto end;
  350. de_ctx->flags |= DE_QUIET;
  351. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  352. "(content:\"/one/\"; tcpv4-csum:valid; fast_pattern; "
  353. "msg:\"Testing fast_pattern\"; sid:1;)");
  354. if (de_ctx->sig_list == NULL)
  355. goto end;
  356. result = 0;
  357. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
  358. while (sm != NULL) {
  359. if (sm->type == DETECT_CONTENT) {
  360. if ( ((DetectContentData *)sm->ctx)->flags &
  361. DETECT_CONTENT_FAST_PATTERN) {
  362. result = 1;
  363. break;
  364. } else {
  365. result = 0;
  366. break;
  367. }
  368. }
  369. sm = sm->next;
  370. }
  371. end:
  372. SigCleanSignatures(de_ctx);
  373. DetectEngineCtxFree(de_ctx);
  374. return result;
  375. }
  376. /**
  377. * \test Checks if a fast_pattern is registered in a Signature
  378. */
  379. int DetectFastPatternTest02(void)
  380. {
  381. DetectEngineCtx *de_ctx = NULL;
  382. int result = 0;
  383. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  384. goto end;
  385. de_ctx->flags |= DE_QUIET;
  386. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  387. "(content:\"/one/\"; fast_pattern; "
  388. "content:\"boo\"; fast_pattern; "
  389. "msg:\"Testing fast_pattern\"; sid:1;)");
  390. if (de_ctx->sig_list != NULL)
  391. goto end;
  392. result = 1;
  393. end:
  394. SigCleanSignatures(de_ctx);
  395. DetectEngineCtxFree(de_ctx);
  396. return result;
  397. }
  398. /**
  399. * \test Checks that we have no fast_pattern registerd for a Signature when the
  400. * Signature doesn't contain a fast_pattern
  401. */
  402. int DetectFastPatternTest03(void)
  403. {
  404. SigMatch *sm = NULL;
  405. DetectEngineCtx *de_ctx = NULL;
  406. int result = 0;
  407. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  408. goto end;
  409. de_ctx->flags |= DE_QUIET;
  410. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  411. "(content:\"/one/\"; "
  412. "msg:\"Testing fast_pattern\"; sid:1;)");
  413. if (de_ctx->sig_list == NULL)
  414. goto end;
  415. result = 0;
  416. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
  417. while (sm != NULL) {
  418. if (sm->type == DETECT_CONTENT) {
  419. if ( !(((DetectContentData *)sm->ctx)->flags &
  420. DETECT_CONTENT_FAST_PATTERN)) {
  421. result = 1;
  422. } else {
  423. result = 0;
  424. break;
  425. }
  426. }
  427. sm = sm->next;
  428. }
  429. end:
  430. SigCleanSignatures(de_ctx);
  431. DetectEngineCtxFree(de_ctx);
  432. return result;
  433. }
  434. /**
  435. * \test Checks that a fast_pattern is not registered in a Signature, when we
  436. * supply a fast_pattern with an argument
  437. */
  438. int DetectFastPatternTest04(void)
  439. {
  440. DetectEngineCtx *de_ctx = NULL;
  441. int result = 0;
  442. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  443. goto end;
  444. de_ctx->flags |= DE_QUIET;
  445. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  446. "(content:\"/one/\"; fast_pattern:boo; "
  447. "msg:\"Testing fast_pattern\"; sid:1;)");
  448. if (de_ctx->sig_list == NULL)
  449. result = 1;
  450. end:
  451. SigCleanSignatures(de_ctx);
  452. DetectEngineCtxFree(de_ctx);
  453. return result;
  454. }
  455. /**
  456. * \test Checks that a fast_pattern is used in the mpm phase.
  457. */
  458. int DetectFastPatternTest05(void)
  459. {
  460. uint8_t *buf = (uint8_t *) "Oh strin1. But what "
  461. "strin2. This is strings3. We strins_str4. we "
  462. "have strins_string5";
  463. uint16_t buflen = strlen((char *)buf);
  464. Packet *p = NULL;
  465. ThreadVars th_v;
  466. DetectEngineThreadCtx *det_ctx = NULL;
  467. int result = 0;
  468. memset(&th_v, 0, sizeof(th_v));
  469. p = UTHBuildPacket(buf,buflen,IPPROTO_TCP);
  470. DetectEngineCtx *de_ctx = DetectEngineCtxInit();
  471. if (de_ctx == NULL)
  472. goto end;
  473. de_ctx->flags |= DE_QUIET;
  474. de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
  475. "(msg:\"fast_pattern test\"; content:\"string1\"; "
  476. "content:\"string2\"; content:\"strings3\"; fast_pattern; "
  477. "content:\"strings_str4\"; content:\"strings_string5\"; "
  478. "sid:1;)");
  479. if (de_ctx->sig_list == NULL) {
  480. printf("sig parse failed: ");
  481. goto end;
  482. }
  483. SigGroupBuild(de_ctx);
  484. DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
  485. /* start the search phase */
  486. det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
  487. if (PacketPatternSearchWithStreamCtx(det_ctx, p) != 0)
  488. result = 1;
  489. SigGroupCleanup(de_ctx);
  490. SigCleanSignatures(de_ctx);
  491. DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
  492. end:
  493. UTHFreePackets(&p, 1);
  494. DetectEngineCtxFree(de_ctx);
  495. return result;
  496. }
  497. /**
  498. * \test Checks that a fast_pattern is used in the mpm phase.
  499. */
  500. int DetectFastPatternTest06(void)
  501. {
  502. uint8_t *buf = (uint8_t *) "Oh this is a string1. But what is this with "
  503. "string2. This is strings3. We have strings_str4. We also have "
  504. "strings_string5";
  505. uint16_t buflen = strlen((char *)buf);
  506. Packet *p = NULL;
  507. ThreadVars th_v;
  508. DetectEngineThreadCtx *det_ctx = NULL;
  509. int result = 0;
  510. memset(&th_v, 0, sizeof(th_v));
  511. p = UTHBuildPacket(buf,buflen,IPPROTO_TCP);
  512. DetectEngineCtx *de_ctx = DetectEngineCtxInit();
  513. if (de_ctx == NULL)
  514. goto end;
  515. de_ctx->flags |= DE_QUIET;
  516. de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
  517. "(msg:\"fast_pattern test\"; content:\"string1\"; "
  518. "content:\"string2\"; content:\"strings3\"; fast_pattern; "
  519. "content:\"strings_str4\"; content:\"strings_string5\"; "
  520. "sid:1;)");
  521. if (de_ctx->sig_list == NULL)
  522. goto end;
  523. SigGroupBuild(de_ctx);
  524. DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
  525. /* start the search phase */
  526. det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
  527. if (PacketPatternSearchWithStreamCtx(det_ctx, p) != 0)
  528. result = 1;
  529. SigGroupCleanup(de_ctx);
  530. SigCleanSignatures(de_ctx);
  531. DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
  532. end:
  533. UTHFreePackets(&p, 1);
  534. DetectEngineCtxFree(de_ctx);
  535. return result;
  536. }
  537. /**
  538. * \test Checks that a fast_pattern is used in the mpm phase, when the payload
  539. * doesn't contain the fast_pattern string within it.
  540. */
  541. int DetectFastPatternTest07(void)
  542. {
  543. uint8_t *buf = (uint8_t *) "Dummy is our name. Oh yes. From right here "
  544. "right now, all the way to hangover. right. now here comes our "
  545. "dark knight strings_string5. Yes here is our dark knight";
  546. uint16_t buflen = strlen((char *)buf);
  547. Packet *p = NULL;
  548. ThreadVars th_v;
  549. DetectEngineThreadCtx *det_ctx = NULL;
  550. int result = 0;
  551. memset(&th_v, 0, sizeof(th_v));
  552. p = UTHBuildPacket(buf,buflen,IPPROTO_TCP);
  553. DetectEngineCtx *de_ctx = DetectEngineCtxInit();
  554. if (de_ctx == NULL)
  555. goto end;
  556. de_ctx->flags |= DE_QUIET;
  557. de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
  558. "(msg:\"fast_pattern test\"; content:\"string1\"; "
  559. "content:\"string2\"; content:\"strings3\"; fast_pattern; "
  560. "content:\"strings_str4\"; content:\"strings_string5\"; "
  561. "sid:1;)");
  562. if (de_ctx->sig_list == NULL)
  563. goto end;
  564. SigGroupBuild(de_ctx);
  565. DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
  566. /* start the search phase */
  567. det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
  568. if (PacketPatternSearchWithStreamCtx(det_ctx, p) == 0)
  569. result = 1;
  570. SigGroupCleanup(de_ctx);
  571. SigCleanSignatures(de_ctx);
  572. DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
  573. end:
  574. UTHFreePackets(&p, 1);
  575. DetectEngineCtxFree(de_ctx);
  576. return result;
  577. }
  578. /**
  579. * \test Checks that a fast_pattern is used in the mpm phase and that we get
  580. * exactly 1 match for the mpm phase.
  581. */
  582. int DetectFastPatternTest08(void)
  583. {
  584. uint8_t *buf = (uint8_t *) "Dummy is our name. Oh yes. From right here "
  585. "right now, all the way to hangover. right. now here comes our "
  586. "dark knight strings3. Yes here is our dark knight";
  587. uint16_t buflen = strlen((char *)buf);
  588. Packet *p = NULL;
  589. ThreadVars th_v;
  590. DetectEngineThreadCtx *det_ctx = NULL;
  591. int result = 0;
  592. memset(&th_v, 0, sizeof(th_v));
  593. p = UTHBuildPacket(buf,buflen,IPPROTO_TCP);
  594. DetectEngineCtx *de_ctx = DetectEngineCtxInit();
  595. if (de_ctx == NULL) {
  596. printf("de_ctx init: ");
  597. goto end;
  598. }
  599. de_ctx->flags |= DE_QUIET;
  600. de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
  601. "(msg:\"fast_pattern test\"; content:\"string1\"; "
  602. "content:\"string2\"; content:\"strings3\"; fast_pattern; "
  603. "content:\"strings_str4\"; content:\"strings_string5\"; "
  604. "sid:1;)");
  605. if (de_ctx->sig_list == NULL) {
  606. printf("sig parse failed: ");
  607. goto end;
  608. }
  609. SigGroupBuild(de_ctx);
  610. DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
  611. /* start the search phase */
  612. det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
  613. uint32_t r = PacketPatternSearchWithStreamCtx(det_ctx, p);
  614. if (r != 1) {
  615. printf("expected 1, got %"PRIu32": ", r);
  616. goto end;
  617. }
  618. result = 1;
  619. end:
  620. UTHFreePackets(&p, 1);
  621. SigGroupCleanup(de_ctx);
  622. SigCleanSignatures(de_ctx);
  623. DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
  624. DetectEngineCtxFree(de_ctx);
  625. return result;
  626. }
  627. /**
  628. * \test Checks that a fast_pattern is used in the mpm phase, when the payload
  629. * doesn't contain the fast_pattern string within it.
  630. */
  631. int DetectFastPatternTest09(void)
  632. {
  633. uint8_t *buf = (uint8_t *) "Dummy is our name. Oh yes. From right here "
  634. "right now, all the way to hangover. right. no_strings4 _imp now here "
  635. "comes our dark knight strings3. Yes here is our dark knight";
  636. uint16_t buflen = strlen((char *)buf);
  637. Packet *p = NULL;
  638. ThreadVars th_v;
  639. DetectEngineThreadCtx *det_ctx = NULL;
  640. int result = 0;
  641. memset(&th_v, 0, sizeof(th_v));
  642. p = UTHBuildPacket(buf,buflen,IPPROTO_TCP);
  643. DetectEngineCtx *de_ctx = DetectEngineCtxInit();
  644. if (de_ctx == NULL)
  645. goto end;
  646. de_ctx->flags |= DE_QUIET;
  647. de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
  648. "(msg:\"fast_pattern test\"; content:\"string1\"; "
  649. "content:\"string2\"; content:\"strings3\"; "
  650. "content:\"strings4_imp\"; fast_pattern; "
  651. "content:\"strings_string5\"; sid:1;)");
  652. if (de_ctx->sig_list == NULL)
  653. goto end;
  654. SigGroupBuild(de_ctx);
  655. DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
  656. /* start the search phase */
  657. det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
  658. if (PacketPatternSearchWithStreamCtx(det_ctx, p) == 0)
  659. result = 1;
  660. SigGroupCleanup(de_ctx);
  661. SigCleanSignatures(de_ctx);
  662. DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
  663. end:
  664. UTHFreePackets(&p, 1);
  665. DetectEngineCtxFree(de_ctx);
  666. return result;
  667. }
  668. /**
  669. * \test Checks that a the SigInit chooses the fast_pattern with better pattern
  670. * strength, when we have multiple fast_patterns in the Signature. Also
  671. * checks that we get a match for the fast_pattern from the mpm phase.
  672. */
  673. int DetectFastPatternTest10(void)
  674. {
  675. uint8_t *buf = (uint8_t *) "Dummy is our name. Oh yes. From right here "
  676. "right now, all the way to hangover. right. strings4_imp now here "
  677. "comes our dark knight strings5. Yes here is our dark knight";
  678. uint16_t buflen = strlen((char *)buf);
  679. Packet *p = NULL;
  680. ThreadVars th_v;
  681. DetectEngineThreadCtx *det_ctx = NULL;
  682. int result = 0;
  683. memset(&th_v, 0, sizeof(th_v));
  684. p = UTHBuildPacket(buf,buflen,IPPROTO_TCP);
  685. DetectEngineCtx *de_ctx = DetectEngineCtxInit();
  686. if (de_ctx == NULL) {
  687. printf("de_ctx init: ");
  688. goto end;
  689. }
  690. de_ctx->flags |= DE_QUIET;
  691. de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
  692. "(msg:\"fast_pattern test\"; content:\"string1\"; "
  693. "content:\"string2\"; content:\"strings3\"; "
  694. "content:\"strings4_imp\"; fast_pattern; "
  695. "content:\"strings_string5\"; sid:1;)");
  696. if (de_ctx->sig_list == NULL) {
  697. printf("sig parse failed: ");
  698. goto end;
  699. }
  700. SigGroupBuild(de_ctx);
  701. DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
  702. /* start the search phase */
  703. det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
  704. uint32_t r = PacketPatternSearchWithStreamCtx(det_ctx, p);
  705. if (r != 1) {
  706. printf("expected 1, got %"PRIu32": ", r);
  707. goto end;
  708. }
  709. result = 1;
  710. end:
  711. UTHFreePackets(&p, 1);
  712. SigGroupCleanup(de_ctx);
  713. SigCleanSignatures(de_ctx);
  714. DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
  715. DetectEngineCtxFree(de_ctx);
  716. return result;
  717. }
  718. /**
  719. * \test Checks that a the SigInit chooses the fast_pattern with better pattern
  720. * strength, when we have multiple fast_patterns in the Signature. Also
  721. * checks that we get no matches for the fast_pattern from the mpm phase.
  722. */
  723. int DetectFastPatternTest11(void)
  724. {
  725. uint8_t *buf = (uint8_t *) "Dummy is our name. Oh yes. From right here "
  726. "right now, all the way to hangover. right. strings5_imp now here "
  727. "comes our dark knight strings5. Yes here is our dark knight";
  728. uint16_t buflen = strlen((char *)buf);
  729. Packet *p = NULL;
  730. ThreadVars th_v;
  731. DetectEngineThreadCtx *det_ctx = NULL;
  732. int result = 0;
  733. memset(&th_v, 0, sizeof(th_v));
  734. p = UTHBuildPacket(buf,buflen,IPPROTO_TCP);
  735. DetectEngineCtx *de_ctx = DetectEngineCtxInit();
  736. if (de_ctx == NULL)
  737. goto end;
  738. de_ctx->flags |= DE_QUIET;
  739. de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
  740. "(msg:\"fast_pattern test\"; content:\"string1\"; "
  741. "content:\"string2\"; content:\"strings3\"; "
  742. "content:\"strings4_imp\"; fast_pattern; "
  743. "content:\"strings_string5\"; sid:1;)");
  744. if (de_ctx->sig_list == NULL)
  745. goto end;
  746. SigGroupBuild(de_ctx);
  747. DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
  748. /* start the search phase */
  749. det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
  750. if (PacketPatternSearchWithStreamCtx(det_ctx, p) == 0)
  751. result = 1;
  752. end:
  753. UTHFreePackets(&p, 1);
  754. if (de_ctx != NULL) {
  755. SigGroupCleanup(de_ctx);
  756. SigCleanSignatures(de_ctx);
  757. if (det_ctx != NULL)
  758. DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
  759. DetectEngineCtxFree(de_ctx);
  760. }
  761. return result;
  762. }
  763. /**
  764. * \test Checks that we don't get a match for the mpm phase.
  765. */
  766. int DetectFastPatternTest12(void)
  767. {
  768. uint8_t *buf = (uint8_t *) "Dummy is our name. Oh yes. From right here "
  769. "right now, all the way to hangover. right. strings5_imp now here "
  770. "comes our dark knight strings5. Yes here is our dark knight";
  771. uint16_t buflen = strlen((char *)buf);
  772. Packet *p = NULL;
  773. ThreadVars th_v;
  774. DetectEngineThreadCtx *det_ctx = NULL;
  775. int result = 0;
  776. memset(&th_v, 0, sizeof(th_v));
  777. p = UTHBuildPacket(buf,buflen,IPPROTO_TCP);
  778. DetectEngineCtx *de_ctx = DetectEngineCtxInit();
  779. if (de_ctx == NULL)
  780. goto end;
  781. de_ctx->flags |= DE_QUIET;
  782. de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
  783. "(msg:\"fast_pattern test\"; content:\"string1\"; "
  784. "content:\"string2\"; content:\"strings3\"; "
  785. "content:\"strings4_imp\"; "
  786. "content:\"strings_string5\"; sid:1;)");
  787. if (de_ctx->sig_list == NULL)
  788. goto end;
  789. SigGroupBuild(de_ctx);
  790. DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
  791. /* start the search phase */
  792. det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
  793. if (PacketPatternSearchWithStreamCtx(det_ctx, p) == 0)
  794. result = 1;
  795. SigGroupCleanup(de_ctx);
  796. SigCleanSignatures(de_ctx);
  797. DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
  798. end:
  799. UTHFreePackets(&p, 1);
  800. DetectEngineCtxFree(de_ctx);
  801. return result;
  802. }
  803. /**
  804. * \test Checks that a the SigInit chooses the fast_pattern with a better
  805. * strength from the available patterns, when we don't specify a
  806. * fast_pattern. We also check that we get a match from the mpm
  807. * phase.
  808. */
  809. int DetectFastPatternTest13(void)
  810. {
  811. uint8_t *buf = (uint8_t *) "Dummy is our name. Oh yes. From right here "
  812. "right now, all the way to hangover. right. strings5_imp now here "
  813. "comes our dark knight strings_string5. Yes here is our dark knight";
  814. uint16_t buflen = strlen((char *)buf);
  815. Packet *p = NULL;
  816. ThreadVars th_v;
  817. DetectEngineThreadCtx *det_ctx = NULL;
  818. int result = 0;
  819. memset(&th_v, 0, sizeof(th_v));
  820. p = UTHBuildPacket(buf,buflen,IPPROTO_TCP);
  821. DetectEngineCtx *de_ctx = DetectEngineCtxInit();
  822. if (de_ctx == NULL) {
  823. printf("de_ctx init: ");
  824. goto end;
  825. }
  826. de_ctx->flags |= DE_QUIET;
  827. de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
  828. "(msg:\"fast_pattern test\"; content:\"string1\"; "
  829. "content:\"string2\"; content:\"strings3\"; "
  830. "content:\"strings4_imp\"; "
  831. "content:\"strings_string5\"; sid:1;)");
  832. if (de_ctx->sig_list == NULL) {
  833. printf("sig parse failed: ");
  834. goto end;
  835. }
  836. SigGroupBuild(de_ctx);
  837. DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
  838. /* start the search phase */
  839. det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
  840. uint32_t r = PacketPatternSearchWithStreamCtx(det_ctx, p);
  841. if (r != 1) {
  842. printf("expected 1 result, got %"PRIu32": ", r);
  843. goto end;
  844. }
  845. result = 1;
  846. end:
  847. UTHFreePackets(&p, 1);
  848. SigGroupCleanup(de_ctx);
  849. SigCleanSignatures(de_ctx);
  850. DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
  851. DetectEngineCtxFree(de_ctx);
  852. return result;
  853. }
  854. /**
  855. * \test Checks to make sure that other sigs work that should when fast_pattern is inspecting on the same payload
  856. *
  857. */
  858. int DetectFastPatternTest14(void)
  859. {
  860. uint8_t *buf = (uint8_t *) "Dummy is our name. Oh yes. From right here "
  861. "right now, all the way to hangover. right. strings5_imp now here "
  862. "comes our dark knight strings_string5. Yes here is our dark knight";
  863. uint16_t buflen = strlen((char *)buf);
  864. Packet *p = NULL;
  865. ThreadVars th_v;
  866. DetectEngineThreadCtx *det_ctx = NULL;
  867. int alertcnt = 0;
  868. int result = 0;
  869. memset(&th_v, 0, sizeof(th_v));
  870. p = UTHBuildPacket(buf,buflen,IPPROTO_TCP);
  871. DetectEngineCtx *de_ctx = DetectEngineCtxInit();
  872. if (de_ctx == NULL)
  873. goto end;
  874. FlowInitConfig(FLOW_QUIET);
  875. de_ctx->mpm_matcher = MPM_B3G;
  876. de_ctx->flags |= DE_QUIET;
  877. de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
  878. "(msg:\"fast_pattern test\"; content:\"strings_string5\"; content:\"knight\"; fast_pattern; sid:1;)");
  879. if (de_ctx->sig_list == NULL)
  880. goto end;
  881. de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any "
  882. "(msg:\"test different content\"; content:\"Dummy is our name\"; sid:2;)");
  883. if (de_ctx->sig_list->next == NULL)
  884. goto end;
  885. SigGroupBuild(de_ctx);
  886. DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
  887. SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
  888. if (PacketAlertCheck(p, 1)){
  889. alertcnt++;
  890. }else{
  891. SCLogInfo("could not match on sig 1 with when fast_pattern is inspecting payload");
  892. goto end;
  893. }
  894. if (PacketAlertCheck(p, 2)){
  895. result = 1;
  896. }else{
  897. SCLogInfo("match on sig 1 fast_pattern no match sig 2 inspecting same payload");
  898. }
  899. end:
  900. UTHFreePackets(&p, 1);
  901. SigGroupCleanup(de_ctx);
  902. SigCleanSignatures(de_ctx);
  903. DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
  904. DetectEngineCtxFree(de_ctx);
  905. FlowShutdown();
  906. return result;
  907. }
  908. /**
  909. * \test Checks if a fast_pattern is registered in a Signature
  910. */
  911. int DetectFastPatternTest15(void)
  912. {
  913. SigMatch *sm = NULL;
  914. DetectEngineCtx *de_ctx = NULL;
  915. int result = 0;
  916. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  917. goto end;
  918. de_ctx->flags |= DE_QUIET;
  919. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  920. "(content:\"/one/\"; fast_pattern:only; "
  921. "msg:\"Testing fast_pattern\"; sid:1;)");
  922. if (de_ctx->sig_list == NULL)
  923. goto end;
  924. result = 0;
  925. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
  926. while (sm != NULL) {
  927. if (sm->type == DETECT_CONTENT) {
  928. if ( ((DetectContentData *)sm->ctx)->flags &
  929. DETECT_CONTENT_FAST_PATTERN) {
  930. result = 1;
  931. break;
  932. } else {
  933. result = 0;
  934. break;
  935. }
  936. }
  937. sm = sm->next;
  938. }
  939. end:
  940. SigCleanSignatures(de_ctx);
  941. DetectEngineCtxFree(de_ctx);
  942. return result;
  943. }
  944. /**
  945. * \test Checks if a fast_pattern is registered in a Signature
  946. */
  947. int DetectFastPatternTest16(void)
  948. {
  949. SigMatch *sm = NULL;
  950. DetectEngineCtx *de_ctx = NULL;
  951. int result = 0;
  952. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  953. goto end;
  954. de_ctx->flags |= DE_QUIET;
  955. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  956. "(content:\"oneoneone\"; fast_pattern:3,4; "
  957. "msg:\"Testing fast_pattern\"; sid:1;)");
  958. if (de_ctx->sig_list == NULL)
  959. goto end;
  960. result = 0;
  961. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
  962. while (sm != NULL) {
  963. if (sm->type == DETECT_CONTENT) {
  964. if ( ((DetectContentData *)sm->ctx)->flags &
  965. DETECT_CONTENT_FAST_PATTERN) {
  966. result = 1;
  967. break;
  968. } else {
  969. result = 0;
  970. break;
  971. }
  972. }
  973. sm = sm->next;
  974. }
  975. end:
  976. SigCleanSignatures(de_ctx);
  977. DetectEngineCtxFree(de_ctx);
  978. return result;
  979. }
  980. int DetectFastPatternTest17(void)
  981. {
  982. SigMatch *sm = NULL;
  983. DetectEngineCtx *de_ctx = NULL;
  984. int result = 0;
  985. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  986. goto end;
  987. de_ctx->flags |= DE_QUIET;
  988. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  989. "(content:\"one\"; fast_pattern:only; sid:1;)");
  990. if (de_ctx->sig_list == NULL)
  991. goto end;
  992. result = 0;
  993. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
  994. DetectContentData *cd = sm->ctx;
  995. if (sm->type == DETECT_CONTENT) {
  996. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  997. cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  998. !(cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  999. cd->fp_chop_offset == 0 &&
  1000. cd->fp_chop_len == 0) {
  1001. result = 1;
  1002. } else {
  1003. result = 0;
  1004. }
  1005. }
  1006. end:
  1007. SigCleanSignatures(de_ctx);
  1008. DetectEngineCtxFree(de_ctx);
  1009. return result;
  1010. }
  1011. int DetectFastPatternTest18(void)
  1012. {
  1013. SigMatch *sm = NULL;
  1014. DetectEngineCtx *de_ctx = NULL;
  1015. int result = 0;
  1016. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1017. goto end;
  1018. de_ctx->flags |= DE_QUIET;
  1019. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1020. "(content:\"oneoneone\"; fast_pattern:3,4; sid:1;)");
  1021. if (de_ctx->sig_list == NULL)
  1022. goto end;
  1023. result = 0;
  1024. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
  1025. DetectContentData *cd = sm->ctx;
  1026. if (sm->type == DETECT_CONTENT) {
  1027. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1028. !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  1029. cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  1030. cd->fp_chop_offset == 3 &&
  1031. cd->fp_chop_len == 4) {
  1032. result = 1;
  1033. } else {
  1034. result = 0;
  1035. }
  1036. }
  1037. end:
  1038. SigCleanSignatures(de_ctx);
  1039. DetectEngineCtxFree(de_ctx);
  1040. return result;
  1041. }
  1042. int DetectFastPatternTest19(void)
  1043. {
  1044. DetectEngineCtx *de_ctx = NULL;
  1045. int result = 0;
  1046. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1047. goto end;
  1048. de_ctx->flags |= DE_QUIET;
  1049. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1050. "(content:\"one\"; content:\"two\"; fast_pattern:only; distance:10; sid:1;)");
  1051. if (de_ctx->sig_list != NULL)
  1052. goto end;
  1053. result = 1;
  1054. end:
  1055. SigCleanSignatures(de_ctx);
  1056. DetectEngineCtxFree(de_ctx);
  1057. return result;
  1058. }
  1059. int DetectFastPatternTest20(void)
  1060. {
  1061. DetectEngineCtx *de_ctx = NULL;
  1062. int result = 0;
  1063. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1064. goto end;
  1065. de_ctx->flags |= DE_QUIET;
  1066. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1067. "(content:\"one\"; content:\"two\"; distance:10; fast_pattern:only; sid:1;)");
  1068. if (de_ctx->sig_list != NULL)
  1069. goto end;
  1070. result = 1;
  1071. end:
  1072. SigCleanSignatures(de_ctx);
  1073. DetectEngineCtxFree(de_ctx);
  1074. return result;
  1075. }
  1076. int DetectFastPatternTest21(void)
  1077. {
  1078. DetectEngineCtx *de_ctx = NULL;
  1079. int result = 0;
  1080. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1081. goto end;
  1082. de_ctx->flags |= DE_QUIET;
  1083. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1084. "(content:\"one\"; content:\"two\"; fast_pattern:only; within:10; sid:1;)");
  1085. if (de_ctx->sig_list != NULL)
  1086. goto end;
  1087. result = 1;
  1088. end:
  1089. SigCleanSignatures(de_ctx);
  1090. DetectEngineCtxFree(de_ctx);
  1091. return result;
  1092. }
  1093. int DetectFastPatternTest22(void)
  1094. {
  1095. DetectEngineCtx *de_ctx = NULL;
  1096. int result = 0;
  1097. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1098. goto end;
  1099. de_ctx->flags |= DE_QUIET;
  1100. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1101. "(content:\"one\"; content:\"two\"; within:10; fast_pattern:only; sid:1;)");
  1102. if (de_ctx->sig_list != NULL)
  1103. goto end;
  1104. result = 1;
  1105. end:
  1106. SigCleanSignatures(de_ctx);
  1107. DetectEngineCtxFree(de_ctx);
  1108. return result;
  1109. }
  1110. int DetectFastPatternTest23(void)
  1111. {
  1112. DetectEngineCtx *de_ctx = NULL;
  1113. int result = 0;
  1114. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1115. goto end;
  1116. de_ctx->flags |= DE_QUIET;
  1117. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1118. "(content:\"one\"; content:\"two\"; fast_pattern:only; offset:10; sid:1;)");
  1119. if (de_ctx->sig_list != NULL)
  1120. goto end;
  1121. result = 1;
  1122. end:
  1123. SigCleanSignatures(de_ctx);
  1124. DetectEngineCtxFree(de_ctx);
  1125. return result;
  1126. }
  1127. int DetectFastPatternTest24(void)
  1128. {
  1129. DetectEngineCtx *de_ctx = NULL;
  1130. int result = 0;
  1131. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1132. goto end;
  1133. de_ctx->flags |= DE_QUIET;
  1134. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1135. "(content:\"one\"; content:\"two\"; offset:10; fast_pattern:only; sid:1;)");
  1136. if (de_ctx->sig_list != NULL)
  1137. goto end;
  1138. result = 1;
  1139. end:
  1140. SigCleanSignatures(de_ctx);
  1141. DetectEngineCtxFree(de_ctx);
  1142. return result;
  1143. }
  1144. int DetectFastPatternTest25(void)
  1145. {
  1146. DetectEngineCtx *de_ctx = NULL;
  1147. int result = 0;
  1148. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1149. goto end;
  1150. de_ctx->flags |= DE_QUIET;
  1151. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1152. "(content:\"one\"; content:\"two\"; fast_pattern:only; depth:10; sid:1;)");
  1153. if (de_ctx->sig_list != NULL)
  1154. goto end;
  1155. result = 1;
  1156. end:
  1157. SigCleanSignatures(de_ctx);
  1158. DetectEngineCtxFree(de_ctx);
  1159. return result;
  1160. }
  1161. int DetectFastPatternTest26(void)
  1162. {
  1163. DetectEngineCtx *de_ctx = NULL;
  1164. int result = 0;
  1165. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1166. goto end;
  1167. de_ctx->flags |= DE_QUIET;
  1168. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1169. "(content:\"one\"; content:\"two\"; depth:10; fast_pattern:only; sid:1;)");
  1170. if (de_ctx->sig_list != NULL)
  1171. goto end;
  1172. result = 1;
  1173. end:
  1174. SigCleanSignatures(de_ctx);
  1175. DetectEngineCtxFree(de_ctx);
  1176. return result;
  1177. }
  1178. int DetectFastPatternTest27(void)
  1179. {
  1180. DetectEngineCtx *de_ctx = NULL;
  1181. int result = 0;
  1182. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1183. goto end;
  1184. de_ctx->flags |= DE_QUIET;
  1185. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1186. "(content:\"one\"; content:!\"two\"; fast_pattern:only; sid:1;)");
  1187. if (de_ctx->sig_list != NULL)
  1188. goto end;
  1189. result = 1;
  1190. end:
  1191. SigCleanSignatures(de_ctx);
  1192. DetectEngineCtxFree(de_ctx);
  1193. return result;
  1194. }
  1195. int DetectFastPatternTest28(void)
  1196. {
  1197. DetectEngineCtx *de_ctx = NULL;
  1198. int result = 0;
  1199. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1200. goto end;
  1201. de_ctx->flags |= DE_QUIET;
  1202. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1203. "(content: \"one\"; content:\"two\"; distance:30; content:\"two\"; fast_pattern:only; sid:1;)");
  1204. if (de_ctx->sig_list == NULL)
  1205. goto end;
  1206. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
  1207. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1208. cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  1209. !(cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  1210. cd->fp_chop_offset == 0 &&
  1211. cd->fp_chop_len == 0) {
  1212. result = 1;
  1213. } else {
  1214. result = 0;
  1215. }
  1216. end:
  1217. SigCleanSignatures(de_ctx);
  1218. DetectEngineCtxFree(de_ctx);
  1219. return result;
  1220. }
  1221. int DetectFastPatternTest29(void)
  1222. {
  1223. DetectEngineCtx *de_ctx = NULL;
  1224. int result = 0;
  1225. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1226. goto end;
  1227. de_ctx->flags |= DE_QUIET;
  1228. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1229. "(content:\"one\"; content:\"two\"; within:30; content:\"two\"; fast_pattern:only; sid:1;)");
  1230. if (de_ctx->sig_list == NULL)
  1231. goto end;
  1232. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
  1233. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1234. cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  1235. !(cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  1236. cd->fp_chop_offset == 0 &&
  1237. cd->fp_chop_len == 0) {
  1238. result = 1;
  1239. } else {
  1240. result = 0;
  1241. }
  1242. end:
  1243. SigCleanSignatures(de_ctx);
  1244. DetectEngineCtxFree(de_ctx);
  1245. return result;
  1246. }
  1247. int DetectFastPatternTest30(void)
  1248. {
  1249. DetectEngineCtx *de_ctx = NULL;
  1250. int result = 0;
  1251. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1252. goto end;
  1253. de_ctx->flags |= DE_QUIET;
  1254. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1255. "(content:\"one\"; content:\"two\"; offset:30; content:\"two\"; fast_pattern:only; sid:1;)");
  1256. if (de_ctx->sig_list == NULL)
  1257. goto end;
  1258. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
  1259. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1260. cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  1261. !(cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  1262. cd->fp_chop_offset == 0 &&
  1263. cd->fp_chop_len == 0) {
  1264. result = 1;
  1265. } else {
  1266. result = 0;
  1267. }
  1268. end:
  1269. SigCleanSignatures(de_ctx);
  1270. DetectEngineCtxFree(de_ctx);
  1271. return result;
  1272. }
  1273. int DetectFastPatternTest31(void)
  1274. {
  1275. DetectEngineCtx *de_ctx = NULL;
  1276. int result = 0;
  1277. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1278. goto end;
  1279. de_ctx->flags |= DE_QUIET;
  1280. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1281. "(content:\"one\"; content:\"two\"; depth:30; content:\"two\"; fast_pattern:only; sid:1;)");
  1282. if (de_ctx->sig_list == NULL)
  1283. goto end;
  1284. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
  1285. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1286. cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  1287. !(cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  1288. cd->fp_chop_offset == 0 &&
  1289. cd->fp_chop_len == 0) {
  1290. result = 1;
  1291. } else {
  1292. result = 0;
  1293. }
  1294. end:
  1295. SigCleanSignatures(de_ctx);
  1296. DetectEngineCtxFree(de_ctx);
  1297. return result;
  1298. }
  1299. int DetectFastPatternTest32(void)
  1300. {
  1301. DetectEngineCtx *de_ctx = NULL;
  1302. int result = 0;
  1303. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1304. goto end;
  1305. de_ctx->flags |= DE_QUIET;
  1306. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1307. "(content:!\"one\"; fast_pattern; content:\"two\"; sid:1;)");
  1308. if (de_ctx->sig_list == NULL)
  1309. goto end;
  1310. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
  1311. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1312. cd->flags & DETECT_CONTENT_NEGATED &&
  1313. !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  1314. !(cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  1315. cd->fp_chop_offset == 0 &&
  1316. cd->fp_chop_len == 0) {
  1317. result = 1;
  1318. } else {
  1319. result = 0;
  1320. }
  1321. end:
  1322. SigCleanSignatures(de_ctx);
  1323. DetectEngineCtxFree(de_ctx);
  1324. return result;
  1325. }
  1326. int DetectFastPatternTest33(void)
  1327. {
  1328. DetectEngineCtx *de_ctx = NULL;
  1329. int result = 0;
  1330. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1331. goto end;
  1332. de_ctx->flags |= DE_QUIET;
  1333. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1334. "(content:\"two\"; content:!\"one\"; fast_pattern; distance:20; sid:1;)");
  1335. if (de_ctx->sig_list != NULL)
  1336. goto end;
  1337. result = 1;
  1338. end:
  1339. SigCleanSignatures(de_ctx);
  1340. DetectEngineCtxFree(de_ctx);
  1341. return result;
  1342. }
  1343. int DetectFastPatternTest34(void)
  1344. {
  1345. DetectEngineCtx *de_ctx = NULL;
  1346. int result = 0;
  1347. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1348. goto end;
  1349. de_ctx->flags |= DE_QUIET;
  1350. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1351. "(content:\"two\"; content:!\"one\"; fast_pattern; within:20; sid:1;)");
  1352. if (de_ctx->sig_list != NULL)
  1353. goto end;
  1354. result = 1;
  1355. end:
  1356. SigCleanSignatures(de_ctx);
  1357. DetectEngineCtxFree(de_ctx);
  1358. return result;
  1359. }
  1360. int DetectFastPatternTest35(void)
  1361. {
  1362. DetectEngineCtx *de_ctx = NULL;
  1363. int result = 0;
  1364. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1365. goto end;
  1366. de_ctx->flags |= DE_QUIET;
  1367. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1368. "(content:\"two\"; content:!\"one\"; fast_pattern; offset:20; sid:1;)");
  1369. if (de_ctx->sig_list != NULL)
  1370. goto end;
  1371. result = 1;
  1372. end:
  1373. SigCleanSignatures(de_ctx);
  1374. DetectEngineCtxFree(de_ctx);
  1375. return result;
  1376. }
  1377. int DetectFastPatternTest36(void)
  1378. {
  1379. DetectEngineCtx *de_ctx = NULL;
  1380. int result = 0;
  1381. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1382. goto end;
  1383. de_ctx->flags |= DE_QUIET;
  1384. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1385. "(content:\"two\"; content:!\"one\"; fast_pattern; depth:20; sid:1;)");
  1386. if (de_ctx->sig_list != NULL)
  1387. goto end;
  1388. result = 1;
  1389. end:
  1390. SigCleanSignatures(de_ctx);
  1391. DetectEngineCtxFree(de_ctx);
  1392. return result;
  1393. }
  1394. int DetectFastPatternTest37(void)
  1395. {
  1396. DetectEngineCtx *de_ctx = NULL;
  1397. int result = 0;
  1398. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1399. goto end;
  1400. de_ctx->flags |= DE_QUIET;
  1401. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1402. "(content:\"oneoneone\"; content:\"oneonetwo\"; fast_pattern:3,4; content:\"three\"; sid:1;)");
  1403. if (de_ctx->sig_list == NULL)
  1404. goto end;
  1405. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
  1406. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1407. !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  1408. cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  1409. cd->fp_chop_offset == 3 &&
  1410. cd->fp_chop_len == 4) {
  1411. result = 1;
  1412. } else {
  1413. result = 0;
  1414. }
  1415. end:
  1416. SigCleanSignatures(de_ctx);
  1417. DetectEngineCtxFree(de_ctx);
  1418. return result;
  1419. }
  1420. int DetectFastPatternTest38(void)
  1421. {
  1422. DetectEngineCtx *de_ctx = NULL;
  1423. int result = 0;
  1424. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1425. goto end;
  1426. de_ctx->flags |= DE_QUIET;
  1427. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1428. "(content:\"one\"; content:\"twotwotwo\"; fast_pattern:3,4; content:\"three\"; distance:30; sid:1;)");
  1429. if (de_ctx->sig_list == NULL)
  1430. goto end;
  1431. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
  1432. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1433. !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  1434. cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  1435. cd->fp_chop_offset == 3 &&
  1436. cd->fp_chop_len == 4) {
  1437. result = 1;
  1438. } else {
  1439. result = 0;
  1440. }
  1441. end:
  1442. SigCleanSignatures(de_ctx);
  1443. DetectEngineCtxFree(de_ctx);
  1444. return result;
  1445. }
  1446. int DetectFastPatternTest39(void)
  1447. {
  1448. DetectEngineCtx *de_ctx = NULL;
  1449. int result = 0;
  1450. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1451. goto end;
  1452. de_ctx->flags |= DE_QUIET;
  1453. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1454. "(content:\"one\"; content:\"twotwotwo\"; fast_pattern:3,4; content:\"three\"; within:30; sid:1;)");
  1455. if (de_ctx->sig_list == NULL)
  1456. goto end;
  1457. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
  1458. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1459. !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  1460. cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  1461. cd->fp_chop_offset == 3 &&
  1462. cd->fp_chop_len == 4) {
  1463. result = 1;
  1464. } else {
  1465. result = 0;
  1466. }
  1467. end:
  1468. SigCleanSignatures(de_ctx);
  1469. DetectEngineCtxFree(de_ctx);
  1470. return result;
  1471. }
  1472. int DetectFastPatternTest40(void)
  1473. {
  1474. DetectEngineCtx *de_ctx = NULL;
  1475. int result = 0;
  1476. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1477. goto end;
  1478. de_ctx->flags |= DE_QUIET;
  1479. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1480. "(content:\"one\"; content:\"twotwotwo\"; fast_pattern:3,4; content:\"three\"; offset:30; sid:1;)");
  1481. if (de_ctx->sig_list == NULL)
  1482. goto end;
  1483. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
  1484. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1485. !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  1486. cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  1487. cd->fp_chop_offset == 3 &&
  1488. cd->fp_chop_len == 4) {
  1489. result = 1;
  1490. } else {
  1491. result = 0;
  1492. }
  1493. end:
  1494. SigCleanSignatures(de_ctx);
  1495. DetectEngineCtxFree(de_ctx);
  1496. return result;
  1497. }
  1498. int DetectFastPatternTest41(void)
  1499. {
  1500. DetectEngineCtx *de_ctx = NULL;
  1501. int result = 0;
  1502. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1503. goto end;
  1504. de_ctx->flags |= DE_QUIET;
  1505. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1506. "(content:\"one\"; content:\"twotwotwo\"; fast_pattern:3,4; content:\"three\"; depth:30; sid:1;)");
  1507. if (de_ctx->sig_list == NULL)
  1508. goto end;
  1509. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
  1510. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1511. !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  1512. cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  1513. cd->fp_chop_offset == 3 &&
  1514. cd->fp_chop_len == 4) {
  1515. result = 1;
  1516. } else {
  1517. result = 0;
  1518. }
  1519. end:
  1520. SigCleanSignatures(de_ctx);
  1521. DetectEngineCtxFree(de_ctx);
  1522. return result;
  1523. }
  1524. int DetectFastPatternTest42(void)
  1525. {
  1526. DetectEngineCtx *de_ctx = NULL;
  1527. int result = 0;
  1528. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1529. goto end;
  1530. de_ctx->flags |= DE_QUIET;
  1531. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1532. "(content:\"one\"; content:\"two\"; distance:10; content:\"threethree\"; fast_pattern:3,4; sid:1;)");
  1533. if (de_ctx->sig_list == NULL)
  1534. goto end;
  1535. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
  1536. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1537. !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  1538. cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  1539. cd->fp_chop_offset == 3 &&
  1540. cd->fp_chop_len == 4) {
  1541. result = 1;
  1542. } else {
  1543. result = 0;
  1544. }
  1545. end:
  1546. SigCleanSignatures(de_ctx);
  1547. DetectEngineCtxFree(de_ctx);
  1548. return result;
  1549. }
  1550. int DetectFastPatternTest43(void)
  1551. {
  1552. DetectEngineCtx *de_ctx = NULL;
  1553. int result = 0;
  1554. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1555. goto end;
  1556. de_ctx->flags |= DE_QUIET;
  1557. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1558. "(content:\"one\"; content:\"two\"; within:10; content:\"threethree\"; fast_pattern:3,4; sid:1;)");
  1559. if (de_ctx->sig_list == NULL)
  1560. goto end;
  1561. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
  1562. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1563. !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  1564. cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  1565. cd->fp_chop_offset == 3 &&
  1566. cd->fp_chop_len == 4) {
  1567. result = 1;
  1568. } else {
  1569. result = 0;
  1570. }
  1571. end:
  1572. SigCleanSignatures(de_ctx);
  1573. DetectEngineCtxFree(de_ctx);
  1574. return result;
  1575. }
  1576. int DetectFastPatternTest44(void)
  1577. {
  1578. DetectEngineCtx *de_ctx = NULL;
  1579. int result = 0;
  1580. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1581. goto end;
  1582. de_ctx->flags |= DE_QUIET;
  1583. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1584. "(content:\"one\"; content:\"two\"; offset:10; content:\"threethree\"; fast_pattern:3,4; sid:1;)");
  1585. if (de_ctx->sig_list == NULL)
  1586. goto end;
  1587. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
  1588. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1589. !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  1590. cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  1591. cd->fp_chop_offset == 3 &&
  1592. cd->fp_chop_len == 4) {
  1593. result = 1;
  1594. } else {
  1595. result = 0;
  1596. }
  1597. end:
  1598. SigCleanSignatures(de_ctx);
  1599. DetectEngineCtxFree(de_ctx);
  1600. return result;
  1601. }
  1602. int DetectFastPatternTest45(void)
  1603. {
  1604. DetectEngineCtx *de_ctx = NULL;
  1605. int result = 0;
  1606. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1607. goto end;
  1608. de_ctx->flags |= DE_QUIET;
  1609. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1610. "(content:\"one\"; content:\"two\"; depth:10; content:\"threethree\"; fast_pattern:3,4; sid:1;)");
  1611. if (de_ctx->sig_list == NULL)
  1612. goto end;
  1613. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
  1614. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1615. !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  1616. cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  1617. cd->fp_chop_offset == 3 &&
  1618. cd->fp_chop_len == 4) {
  1619. result = 1;
  1620. } else {
  1621. result = 0;
  1622. }
  1623. end:
  1624. SigCleanSignatures(de_ctx);
  1625. DetectEngineCtxFree(de_ctx);
  1626. return result;
  1627. }
  1628. int DetectFastPatternTest46(void)
  1629. {
  1630. DetectEngineCtx *de_ctx = NULL;
  1631. int result = 0;
  1632. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1633. goto end;
  1634. de_ctx->flags |= DE_QUIET;
  1635. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1636. "(content:\"one\"; content:\"two\"; fast_pattern:65977,4; content:\"three\"; distance:10; sid:1;)");
  1637. if (de_ctx->sig_list != NULL)
  1638. goto end;
  1639. result = 1;
  1640. end:
  1641. SigCleanSignatures(de_ctx);
  1642. DetectEngineCtxFree(de_ctx);
  1643. return result;
  1644. }
  1645. int DetectFastPatternTest47(void)
  1646. {
  1647. DetectEngineCtx *de_ctx = NULL;
  1648. int result = 0;
  1649. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1650. goto end;
  1651. de_ctx->flags |= DE_QUIET;
  1652. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1653. "(content:\"one\"; content:\"twooneone\"; fast_pattern:3,65977; content:\"three\"; distance:10; sid:1;)");
  1654. if (de_ctx->sig_list != NULL)
  1655. goto end;
  1656. result = 1;
  1657. end:
  1658. SigCleanSignatures(de_ctx);
  1659. DetectEngineCtxFree(de_ctx);
  1660. return result;
  1661. }
  1662. int DetectFastPatternTest48(void)
  1663. {
  1664. DetectEngineCtx *de_ctx = NULL;
  1665. int result = 0;
  1666. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1667. goto end;
  1668. de_ctx->flags |= DE_QUIET;
  1669. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1670. "(content:\"one\"; content:\"two\"; fast_pattern:65534,4; content:\"three\"; distance:10; sid:1;)");
  1671. if (de_ctx->sig_list != NULL)
  1672. goto end;
  1673. result = 1;
  1674. end:
  1675. SigCleanSignatures(de_ctx);
  1676. DetectEngineCtxFree(de_ctx);
  1677. return result;
  1678. }
  1679. int DetectFastPatternTest49(void)
  1680. {
  1681. DetectEngineCtx *de_ctx = NULL;
  1682. int result = 0;
  1683. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1684. goto end;
  1685. de_ctx->flags |= DE_QUIET;
  1686. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1687. "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; content:\"three\"; sid:1;)");
  1688. if (de_ctx->sig_list == NULL)
  1689. goto end;
  1690. DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
  1691. if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
  1692. cd->flags & DETECT_CONTENT_NEGATED &&
  1693. !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  1694. cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  1695. cd->fp_chop_offset == 3 &&
  1696. cd->fp_chop_len == 4) {
  1697. result = 1;
  1698. } else {
  1699. result = 0;
  1700. }
  1701. end:
  1702. SigCleanSignatures(de_ctx);
  1703. DetectEngineCtxFree(de_ctx);
  1704. return result;
  1705. }
  1706. int DetectFastPatternTest50(void)
  1707. {
  1708. DetectEngineCtx *de_ctx = NULL;
  1709. int result = 0;
  1710. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1711. goto end;
  1712. de_ctx->flags |= DE_QUIET;
  1713. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1714. "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; distance:10; content:\"three\"; sid:1;)");
  1715. if (de_ctx->sig_list != NULL)
  1716. goto end;
  1717. result = 1;
  1718. end:
  1719. SigCleanSignatures(de_ctx);
  1720. DetectEngineCtxFree(de_ctx);
  1721. return result;
  1722. }
  1723. int DetectFastPatternTest51(void)
  1724. {
  1725. DetectEngineCtx *de_ctx = NULL;
  1726. int result = 0;
  1727. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1728. goto end;
  1729. de_ctx->flags |= DE_QUIET;
  1730. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1731. "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; within:10; content:\"three\"; sid:1;)");
  1732. if (de_ctx->sig_list != NULL)
  1733. goto end;
  1734. result = 1;
  1735. end:
  1736. SigCleanSignatures(de_ctx);
  1737. DetectEngineCtxFree(de_ctx);
  1738. return result;
  1739. }
  1740. int DetectFastPatternTest52(void)
  1741. {
  1742. DetectEngineCtx *de_ctx = NULL;
  1743. int result = 0;
  1744. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1745. goto end;
  1746. de_ctx->flags |= DE_QUIET;
  1747. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1748. "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; offset:10; content:\"three\"; sid:1;)");
  1749. if (de_ctx->sig_list != NULL)
  1750. goto end;
  1751. result = 1;
  1752. end:
  1753. SigCleanSignatures(de_ctx);
  1754. DetectEngineCtxFree(de_ctx);
  1755. return result;
  1756. }
  1757. int DetectFastPatternTest53(void)
  1758. {
  1759. DetectEngineCtx *de_ctx = NULL;
  1760. int result = 0;
  1761. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1762. goto end;
  1763. de_ctx->flags |= DE_QUIET;
  1764. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1765. "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; depth:10; content:\"three\"; sid:1;)");
  1766. if (de_ctx->sig_list != NULL)
  1767. goto end;
  1768. result = 1;
  1769. end:
  1770. SigCleanSignatures(de_ctx);
  1771. DetectEngineCtxFree(de_ctx);
  1772. return result;
  1773. }
  1774. /* content fast_pattern tests ^ */
  1775. /* uricontent fast_pattern tests v */
  1776. /**
  1777. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  1778. */
  1779. int DetectFastPatternTest54(void)
  1780. {
  1781. SigMatch *sm = NULL;
  1782. DetectEngineCtx *de_ctx = NULL;
  1783. int result = 0;
  1784. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1785. goto end;
  1786. de_ctx->flags |= DE_QUIET;
  1787. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1788. "(uricontent:\"/one/\"; fast_pattern:only; "
  1789. "msg:\"Testing fast_pattern\"; sid:1;)");
  1790. if (de_ctx->sig_list == NULL)
  1791. goto end;
  1792. result = 0;
  1793. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
  1794. while (sm != NULL) {
  1795. if (sm->type == DETECT_CONTENT) {
  1796. if ( ((DetectContentData *)sm->ctx)->flags &
  1797. DETECT_CONTENT_FAST_PATTERN) {
  1798. result = 1;
  1799. break;
  1800. } else {
  1801. result = 0;
  1802. break;
  1803. }
  1804. }
  1805. sm = sm->next;
  1806. }
  1807. end:
  1808. SigCleanSignatures(de_ctx);
  1809. DetectEngineCtxFree(de_ctx);
  1810. return result;
  1811. }
  1812. /**
  1813. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  1814. */
  1815. int DetectFastPatternTest55(void)
  1816. {
  1817. SigMatch *sm = NULL;
  1818. DetectEngineCtx *de_ctx = NULL;
  1819. int result = 0;
  1820. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1821. goto end;
  1822. de_ctx->flags |= DE_QUIET;
  1823. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1824. "(uricontent:\"oneoneone\"; fast_pattern:3,4; "
  1825. "msg:\"Testing fast_pattern\"; sid:1;)");
  1826. if (de_ctx->sig_list == NULL)
  1827. goto end;
  1828. result = 0;
  1829. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
  1830. while (sm != NULL) {
  1831. if (sm->type == DETECT_CONTENT) {
  1832. if ( ((DetectContentData *)sm->ctx)->flags &
  1833. DETECT_CONTENT_FAST_PATTERN) {
  1834. result = 1;
  1835. break;
  1836. } else {
  1837. result = 0;
  1838. break;
  1839. }
  1840. }
  1841. sm = sm->next;
  1842. }
  1843. end:
  1844. SigCleanSignatures(de_ctx);
  1845. DetectEngineCtxFree(de_ctx);
  1846. return result;
  1847. }
  1848. int DetectFastPatternTest56(void)
  1849. {
  1850. SigMatch *sm = NULL;
  1851. DetectEngineCtx *de_ctx = NULL;
  1852. int result = 0;
  1853. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1854. goto end;
  1855. de_ctx->flags |= DE_QUIET;
  1856. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1857. "(uricontent:\"one\"; fast_pattern:only; sid:1;)");
  1858. if (de_ctx->sig_list == NULL)
  1859. goto end;
  1860. result = 0;
  1861. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
  1862. DetectContentData *ud = sm->ctx;
  1863. if (sm->type == DETECT_CONTENT) {
  1864. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  1865. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  1866. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  1867. ud->fp_chop_offset == 0 &&
  1868. ud->fp_chop_len == 0) {
  1869. result = 1;
  1870. } else {
  1871. result = 0;
  1872. }
  1873. }
  1874. end:
  1875. SigCleanSignatures(de_ctx);
  1876. DetectEngineCtxFree(de_ctx);
  1877. return result;
  1878. }
  1879. int DetectFastPatternTest57(void)
  1880. {
  1881. SigMatch *sm = NULL;
  1882. DetectEngineCtx *de_ctx = NULL;
  1883. int result = 0;
  1884. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1885. goto end;
  1886. de_ctx->flags |= DE_QUIET;
  1887. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1888. "(uricontent:\"oneoneone\"; fast_pattern:3,4; sid:1;)");
  1889. if (de_ctx->sig_list == NULL)
  1890. goto end;
  1891. result = 0;
  1892. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
  1893. DetectContentData *ud = sm->ctx;
  1894. if (sm->type == DETECT_CONTENT) {
  1895. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  1896. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  1897. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  1898. ud->fp_chop_offset == 3 &&
  1899. ud->fp_chop_len == 4) {
  1900. result = 1;
  1901. } else {
  1902. result = 0;
  1903. }
  1904. }
  1905. end:
  1906. SigCleanSignatures(de_ctx);
  1907. DetectEngineCtxFree(de_ctx);
  1908. return result;
  1909. }
  1910. int DetectFastPatternTest58(void)
  1911. {
  1912. DetectEngineCtx *de_ctx = NULL;
  1913. int result = 0;
  1914. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1915. goto end;
  1916. de_ctx->flags |= DE_QUIET;
  1917. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1918. "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:only; distance:10; sid:1;)");
  1919. if (de_ctx->sig_list != NULL)
  1920. goto end;
  1921. result = 1;
  1922. end:
  1923. SigCleanSignatures(de_ctx);
  1924. DetectEngineCtxFree(de_ctx);
  1925. return result;
  1926. }
  1927. int DetectFastPatternTest59(void)
  1928. {
  1929. DetectEngineCtx *de_ctx = NULL;
  1930. int result = 0;
  1931. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1932. goto end;
  1933. de_ctx->flags |= DE_QUIET;
  1934. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1935. "(uricontent:\"one\"; uricontent:\"two\"; distance:10; fast_pattern:only; sid:1;)");
  1936. if (de_ctx->sig_list != NULL)
  1937. goto end;
  1938. result = 1;
  1939. end:
  1940. SigCleanSignatures(de_ctx);
  1941. DetectEngineCtxFree(de_ctx);
  1942. return result;
  1943. }
  1944. int DetectFastPatternTest60(void)
  1945. {
  1946. DetectEngineCtx *de_ctx = NULL;
  1947. int result = 0;
  1948. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1949. goto end;
  1950. de_ctx->flags |= DE_QUIET;
  1951. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1952. "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:only; within:10; sid:1;)");
  1953. if (de_ctx->sig_list != NULL)
  1954. goto end;
  1955. result = 1;
  1956. end:
  1957. SigCleanSignatures(de_ctx);
  1958. DetectEngineCtxFree(de_ctx);
  1959. return result;
  1960. }
  1961. int DetectFastPatternTest61(void)
  1962. {
  1963. DetectEngineCtx *de_ctx = NULL;
  1964. int result = 0;
  1965. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1966. goto end;
  1967. de_ctx->flags |= DE_QUIET;
  1968. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1969. "(uricontent:\"one\"; uricontent:\"two\"; within:10; fast_pattern:only; sid:1;)");
  1970. if (de_ctx->sig_list != NULL)
  1971. goto end;
  1972. result = 1;
  1973. end:
  1974. SigCleanSignatures(de_ctx);
  1975. DetectEngineCtxFree(de_ctx);
  1976. return result;
  1977. }
  1978. int DetectFastPatternTest62(void)
  1979. {
  1980. DetectEngineCtx *de_ctx = NULL;
  1981. int result = 0;
  1982. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  1983. goto end;
  1984. de_ctx->flags |= DE_QUIET;
  1985. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  1986. "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:only; offset:10; sid:1;)");
  1987. if (de_ctx->sig_list != NULL)
  1988. goto end;
  1989. result = 1;
  1990. end:
  1991. SigCleanSignatures(de_ctx);
  1992. DetectEngineCtxFree(de_ctx);
  1993. return result;
  1994. }
  1995. int DetectFastPatternTest63(void)
  1996. {
  1997. DetectEngineCtx *de_ctx = NULL;
  1998. int result = 0;
  1999. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2000. goto end;
  2001. de_ctx->flags |= DE_QUIET;
  2002. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2003. "(uricontent:\"one\"; uricontent:\"two\"; offset:10; fast_pattern:only; sid:1;)");
  2004. if (de_ctx->sig_list != NULL)
  2005. goto end;
  2006. result = 1;
  2007. end:
  2008. SigCleanSignatures(de_ctx);
  2009. DetectEngineCtxFree(de_ctx);
  2010. return result;
  2011. }
  2012. int DetectFastPatternTest64(void)
  2013. {
  2014. DetectEngineCtx *de_ctx = NULL;
  2015. int result = 0;
  2016. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2017. goto end;
  2018. de_ctx->flags |= DE_QUIET;
  2019. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2020. "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:only; depth:10; sid:1;)");
  2021. if (de_ctx->sig_list != NULL)
  2022. goto end;
  2023. result = 1;
  2024. end:
  2025. SigCleanSignatures(de_ctx);
  2026. DetectEngineCtxFree(de_ctx);
  2027. return result;
  2028. }
  2029. int DetectFastPatternTest65(void)
  2030. {
  2031. DetectEngineCtx *de_ctx = NULL;
  2032. int result = 0;
  2033. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2034. goto end;
  2035. de_ctx->flags |= DE_QUIET;
  2036. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2037. "(uricontent:\"one\"; uricontent:\"two\"; depth:10; fast_pattern:only; sid:1;)");
  2038. if (de_ctx->sig_list != NULL)
  2039. goto end;
  2040. result = 1;
  2041. end:
  2042. SigCleanSignatures(de_ctx);
  2043. DetectEngineCtxFree(de_ctx);
  2044. return result;
  2045. }
  2046. int DetectFastPatternTest66(void)
  2047. {
  2048. DetectEngineCtx *de_ctx = NULL;
  2049. int result = 0;
  2050. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2051. goto end;
  2052. de_ctx->flags |= DE_QUIET;
  2053. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2054. "(uricontent:\"one\"; uricontent:!\"two\"; fast_pattern:only; sid:1;)");
  2055. if (de_ctx->sig_list != NULL)
  2056. goto end;
  2057. result = 1;
  2058. end:
  2059. SigCleanSignatures(de_ctx);
  2060. DetectEngineCtxFree(de_ctx);
  2061. return result;
  2062. }
  2063. int DetectFastPatternTest67(void)
  2064. {
  2065. DetectEngineCtx *de_ctx = NULL;
  2066. int result = 0;
  2067. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2068. goto end;
  2069. de_ctx->flags |= DE_QUIET;
  2070. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2071. "(uricontent: \"one\"; uricontent:\"two\"; distance:30; uricontent:\"two\"; fast_pattern:only; sid:1;)");
  2072. if (de_ctx->sig_list == NULL)
  2073. goto end;
  2074. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  2075. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2076. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  2077. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  2078. ud->fp_chop_offset == 0 &&
  2079. ud->fp_chop_len == 0) {
  2080. result = 1;
  2081. } else {
  2082. result = 0;
  2083. }
  2084. end:
  2085. SigCleanSignatures(de_ctx);
  2086. DetectEngineCtxFree(de_ctx);
  2087. return result;
  2088. }
  2089. int DetectFastPatternTest68(void)
  2090. {
  2091. DetectEngineCtx *de_ctx = NULL;
  2092. int result = 0;
  2093. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2094. goto end;
  2095. de_ctx->flags |= DE_QUIET;
  2096. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2097. "(uricontent:\"one\"; uricontent:\"two\"; within:30; uricontent:\"two\"; fast_pattern:only; sid:1;)");
  2098. if (de_ctx->sig_list == NULL)
  2099. goto end;
  2100. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  2101. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2102. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  2103. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  2104. ud->fp_chop_offset == 0 &&
  2105. ud->fp_chop_len == 0) {
  2106. result = 1;
  2107. } else {
  2108. result = 0;
  2109. }
  2110. end:
  2111. SigCleanSignatures(de_ctx);
  2112. DetectEngineCtxFree(de_ctx);
  2113. return result;
  2114. }
  2115. int DetectFastPatternTest69(void)
  2116. {
  2117. DetectEngineCtx *de_ctx = NULL;
  2118. int result = 0;
  2119. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2120. goto end;
  2121. de_ctx->flags |= DE_QUIET;
  2122. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2123. "(uricontent:\"one\"; uricontent:\"two\"; offset:30; uricontent:\"two\"; fast_pattern:only; sid:1;)");
  2124. if (de_ctx->sig_list == NULL)
  2125. goto end;
  2126. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  2127. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2128. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  2129. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  2130. ud->fp_chop_offset == 0 &&
  2131. ud->fp_chop_len == 0) {
  2132. result = 1;
  2133. } else {
  2134. result = 0;
  2135. }
  2136. end:
  2137. SigCleanSignatures(de_ctx);
  2138. DetectEngineCtxFree(de_ctx);
  2139. return result;
  2140. }
  2141. int DetectFastPatternTest70(void)
  2142. {
  2143. DetectEngineCtx *de_ctx = NULL;
  2144. int result = 0;
  2145. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2146. goto end;
  2147. de_ctx->flags |= DE_QUIET;
  2148. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2149. "(uricontent:\"one\"; uricontent:\"two\"; depth:30; uricontent:\"two\"; fast_pattern:only; sid:1;)");
  2150. if (de_ctx->sig_list == NULL)
  2151. goto end;
  2152. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  2153. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2154. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  2155. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  2156. ud->fp_chop_offset == 0 &&
  2157. ud->fp_chop_len == 0) {
  2158. result = 1;
  2159. } else {
  2160. result = 0;
  2161. }
  2162. end:
  2163. SigCleanSignatures(de_ctx);
  2164. DetectEngineCtxFree(de_ctx);
  2165. return result;
  2166. }
  2167. int DetectFastPatternTest71(void)
  2168. {
  2169. DetectEngineCtx *de_ctx = NULL;
  2170. int result = 0;
  2171. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2172. goto end;
  2173. de_ctx->flags |= DE_QUIET;
  2174. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2175. "(uricontent:!\"one\"; fast_pattern; uricontent:\"two\"; sid:1;)");
  2176. if (de_ctx->sig_list == NULL)
  2177. goto end;
  2178. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  2179. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2180. ud->flags & DETECT_CONTENT_NEGATED &&
  2181. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  2182. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  2183. ud->fp_chop_offset == 0 &&
  2184. ud->fp_chop_len == 0) {
  2185. result = 1;
  2186. } else {
  2187. result = 0;
  2188. }
  2189. end:
  2190. SigCleanSignatures(de_ctx);
  2191. DetectEngineCtxFree(de_ctx);
  2192. return result;
  2193. }
  2194. int DetectFastPatternTest72(void)
  2195. {
  2196. DetectEngineCtx *de_ctx = NULL;
  2197. int result = 0;
  2198. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2199. goto end;
  2200. de_ctx->flags |= DE_QUIET;
  2201. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2202. "(uricontent:\"two\"; uricontent:!\"one\"; fast_pattern; distance:20; sid:1;)");
  2203. if (de_ctx->sig_list != NULL)
  2204. goto end;
  2205. result = 1;
  2206. end:
  2207. SigCleanSignatures(de_ctx);
  2208. DetectEngineCtxFree(de_ctx);
  2209. return result;
  2210. }
  2211. int DetectFastPatternTest73(void)
  2212. {
  2213. DetectEngineCtx *de_ctx = NULL;
  2214. int result = 0;
  2215. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2216. goto end;
  2217. de_ctx->flags |= DE_QUIET;
  2218. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2219. "(uricontent:\"two\"; uricontent:!\"one\"; fast_pattern; within:20; sid:1;)");
  2220. if (de_ctx->sig_list != NULL)
  2221. goto end;
  2222. result = 1;
  2223. end:
  2224. SigCleanSignatures(de_ctx);
  2225. DetectEngineCtxFree(de_ctx);
  2226. return result;
  2227. }
  2228. int DetectFastPatternTest74(void)
  2229. {
  2230. DetectEngineCtx *de_ctx = NULL;
  2231. int result = 0;
  2232. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2233. goto end;
  2234. de_ctx->flags |= DE_QUIET;
  2235. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2236. "(uricontent:\"two\"; uricontent:!\"one\"; fast_pattern; offset:20; sid:1;)");
  2237. if (de_ctx->sig_list != NULL)
  2238. goto end;
  2239. result = 1;
  2240. end:
  2241. SigCleanSignatures(de_ctx);
  2242. DetectEngineCtxFree(de_ctx);
  2243. return result;
  2244. }
  2245. int DetectFastPatternTest75(void)
  2246. {
  2247. DetectEngineCtx *de_ctx = NULL;
  2248. int result = 0;
  2249. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2250. goto end;
  2251. de_ctx->flags |= DE_QUIET;
  2252. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2253. "(uricontent:\"two\"; uricontent:!\"one\"; fast_pattern; depth:20; sid:1;)");
  2254. if (de_ctx->sig_list != NULL)
  2255. goto end;
  2256. result = 1;
  2257. end:
  2258. SigCleanSignatures(de_ctx);
  2259. DetectEngineCtxFree(de_ctx);
  2260. return result;
  2261. }
  2262. int DetectFastPatternTest76(void)
  2263. {
  2264. DetectEngineCtx *de_ctx = NULL;
  2265. int result = 0;
  2266. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2267. goto end;
  2268. de_ctx->flags |= DE_QUIET;
  2269. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2270. "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; sid:1;)");
  2271. if (de_ctx->sig_list == NULL)
  2272. goto end;
  2273. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  2274. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2275. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  2276. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  2277. ud->fp_chop_offset == 3 &&
  2278. ud->fp_chop_len == 4) {
  2279. result = 1;
  2280. } else {
  2281. result = 0;
  2282. }
  2283. end:
  2284. SigCleanSignatures(de_ctx);
  2285. DetectEngineCtxFree(de_ctx);
  2286. return result;
  2287. }
  2288. int DetectFastPatternTest77(void)
  2289. {
  2290. DetectEngineCtx *de_ctx = NULL;
  2291. int result = 0;
  2292. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2293. goto end;
  2294. de_ctx->flags |= DE_QUIET;
  2295. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2296. "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; distance:30; sid:1;)");
  2297. if (de_ctx->sig_list == NULL)
  2298. goto end;
  2299. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  2300. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2301. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  2302. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  2303. ud->fp_chop_offset == 3 &&
  2304. ud->fp_chop_len == 4) {
  2305. result = 1;
  2306. } else {
  2307. result = 0;
  2308. }
  2309. end:
  2310. SigCleanSignatures(de_ctx);
  2311. DetectEngineCtxFree(de_ctx);
  2312. return result;
  2313. }
  2314. int DetectFastPatternTest78(void)
  2315. {
  2316. DetectEngineCtx *de_ctx = NULL;
  2317. int result = 0;
  2318. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2319. goto end;
  2320. de_ctx->flags |= DE_QUIET;
  2321. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2322. "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; within:30; sid:1;)");
  2323. if (de_ctx->sig_list == NULL)
  2324. goto end;
  2325. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  2326. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2327. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  2328. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  2329. ud->fp_chop_offset == 3 &&
  2330. ud->fp_chop_len == 4) {
  2331. result = 1;
  2332. } else {
  2333. result = 0;
  2334. }
  2335. end:
  2336. SigCleanSignatures(de_ctx);
  2337. DetectEngineCtxFree(de_ctx);
  2338. return result;
  2339. }
  2340. int DetectFastPatternTest79(void)
  2341. {
  2342. DetectEngineCtx *de_ctx = NULL;
  2343. int result = 0;
  2344. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2345. goto end;
  2346. de_ctx->flags |= DE_QUIET;
  2347. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2348. "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; offset:30; sid:1;)");
  2349. if (de_ctx->sig_list == NULL)
  2350. goto end;
  2351. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  2352. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2353. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  2354. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  2355. ud->fp_chop_offset == 3 &&
  2356. ud->fp_chop_len == 4) {
  2357. result = 1;
  2358. } else {
  2359. result = 0;
  2360. }
  2361. end:
  2362. SigCleanSignatures(de_ctx);
  2363. DetectEngineCtxFree(de_ctx);
  2364. return result;
  2365. }
  2366. int DetectFastPatternTest80(void)
  2367. {
  2368. DetectEngineCtx *de_ctx = NULL;
  2369. int result = 0;
  2370. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2371. goto end;
  2372. de_ctx->flags |= DE_QUIET;
  2373. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2374. "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; depth:30; sid:1;)");
  2375. if (de_ctx->sig_list == NULL)
  2376. goto end;
  2377. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  2378. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2379. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  2380. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  2381. ud->fp_chop_offset == 3 &&
  2382. ud->fp_chop_len == 4) {
  2383. result = 1;
  2384. } else {
  2385. result = 0;
  2386. }
  2387. end:
  2388. SigCleanSignatures(de_ctx);
  2389. DetectEngineCtxFree(de_ctx);
  2390. return result;
  2391. }
  2392. int DetectFastPatternTest81(void)
  2393. {
  2394. DetectEngineCtx *de_ctx = NULL;
  2395. int result = 0;
  2396. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2397. goto end;
  2398. de_ctx->flags |= DE_QUIET;
  2399. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2400. "(uricontent:\"one\"; uricontent:\"two\"; distance:10; uricontent:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
  2401. if (de_ctx->sig_list == NULL)
  2402. goto end;
  2403. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  2404. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2405. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  2406. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  2407. ud->fp_chop_offset == 3 &&
  2408. ud->fp_chop_len == 4) {
  2409. result = 1;
  2410. } else {
  2411. result = 0;
  2412. }
  2413. end:
  2414. SigCleanSignatures(de_ctx);
  2415. DetectEngineCtxFree(de_ctx);
  2416. return result;
  2417. }
  2418. int DetectFastPatternTest82(void)
  2419. {
  2420. DetectEngineCtx *de_ctx = NULL;
  2421. int result = 0;
  2422. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2423. goto end;
  2424. de_ctx->flags |= DE_QUIET;
  2425. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2426. "(uricontent:\"one\"; uricontent:\"two\"; within:10; uricontent:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
  2427. if (de_ctx->sig_list == NULL)
  2428. goto end;
  2429. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  2430. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2431. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  2432. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  2433. ud->fp_chop_offset == 3 &&
  2434. ud->fp_chop_len == 4) {
  2435. result = 1;
  2436. } else {
  2437. result = 0;
  2438. }
  2439. end:
  2440. SigCleanSignatures(de_ctx);
  2441. DetectEngineCtxFree(de_ctx);
  2442. return result;
  2443. }
  2444. int DetectFastPatternTest83(void)
  2445. {
  2446. DetectEngineCtx *de_ctx = NULL;
  2447. int result = 0;
  2448. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2449. goto end;
  2450. de_ctx->flags |= DE_QUIET;
  2451. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2452. "(uricontent:\"one\"; uricontent:\"two\"; offset:10; uricontent:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
  2453. if (de_ctx->sig_list == NULL)
  2454. goto end;
  2455. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  2456. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2457. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  2458. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  2459. ud->fp_chop_offset == 3 &&
  2460. ud->fp_chop_len == 4) {
  2461. result = 1;
  2462. } else {
  2463. result = 0;
  2464. }
  2465. end:
  2466. SigCleanSignatures(de_ctx);
  2467. DetectEngineCtxFree(de_ctx);
  2468. return result;
  2469. }
  2470. int DetectFastPatternTest84(void)
  2471. {
  2472. DetectEngineCtx *de_ctx = NULL;
  2473. int result = 0;
  2474. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2475. goto end;
  2476. de_ctx->flags |= DE_QUIET;
  2477. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2478. "(uricontent:\"one\"; uricontent:\"two\"; depth:10; uricontent:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
  2479. if (de_ctx->sig_list == NULL)
  2480. goto end;
  2481. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  2482. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2483. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  2484. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  2485. ud->fp_chop_offset == 3 &&
  2486. ud->fp_chop_len == 4) {
  2487. result = 1;
  2488. } else {
  2489. result = 0;
  2490. }
  2491. result = 1;
  2492. end:
  2493. SigCleanSignatures(de_ctx);
  2494. DetectEngineCtxFree(de_ctx);
  2495. return result;
  2496. }
  2497. int DetectFastPatternTest85(void)
  2498. {
  2499. DetectEngineCtx *de_ctx = NULL;
  2500. int result = 0;
  2501. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2502. goto end;
  2503. de_ctx->flags |= DE_QUIET;
  2504. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2505. "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:65977,4; uricontent:\"three\"; distance:10; sid:1;)");
  2506. if (de_ctx->sig_list != NULL)
  2507. goto end;
  2508. result = 1;
  2509. end:
  2510. SigCleanSignatures(de_ctx);
  2511. DetectEngineCtxFree(de_ctx);
  2512. return result;
  2513. }
  2514. int DetectFastPatternTest86(void)
  2515. {
  2516. DetectEngineCtx *de_ctx = NULL;
  2517. int result = 0;
  2518. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2519. goto end;
  2520. de_ctx->flags |= DE_QUIET;
  2521. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2522. "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,65977; uricontent:\"three\"; distance:10; sid:1;)");
  2523. if (de_ctx->sig_list != NULL)
  2524. goto end;
  2525. result = 1;
  2526. end:
  2527. SigCleanSignatures(de_ctx);
  2528. DetectEngineCtxFree(de_ctx);
  2529. return result;
  2530. }
  2531. int DetectFastPatternTest87(void)
  2532. {
  2533. DetectEngineCtx *de_ctx = NULL;
  2534. int result = 0;
  2535. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2536. goto end;
  2537. de_ctx->flags |= DE_QUIET;
  2538. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2539. "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:65534,4; uricontent:\"three\"; distance:10; sid:1;)");
  2540. if (de_ctx->sig_list != NULL)
  2541. goto end;
  2542. result = 1;
  2543. end:
  2544. SigCleanSignatures(de_ctx);
  2545. DetectEngineCtxFree(de_ctx);
  2546. return result;
  2547. }
  2548. int DetectFastPatternTest88(void)
  2549. {
  2550. DetectEngineCtx *de_ctx = NULL;
  2551. int result = 0;
  2552. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2553. goto end;
  2554. de_ctx->flags |= DE_QUIET;
  2555. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2556. "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; sid:1;)");
  2557. if (de_ctx->sig_list == NULL)
  2558. goto end;
  2559. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  2560. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2561. ud->flags & DETECT_CONTENT_NEGATED &&
  2562. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  2563. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  2564. ud->fp_chop_offset == 3 &&
  2565. ud->fp_chop_len == 4) {
  2566. result = 1;
  2567. } else {
  2568. result = 0;
  2569. }
  2570. end:
  2571. SigCleanSignatures(de_ctx);
  2572. DetectEngineCtxFree(de_ctx);
  2573. return result;
  2574. }
  2575. int DetectFastPatternTest89(void)
  2576. {
  2577. DetectEngineCtx *de_ctx = NULL;
  2578. int result = 0;
  2579. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2580. goto end;
  2581. de_ctx->flags |= DE_QUIET;
  2582. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2583. "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; distance:10; uricontent:\"three\"; sid:1;)");
  2584. if (de_ctx->sig_list != NULL)
  2585. goto end;
  2586. result = 1;
  2587. end:
  2588. SigCleanSignatures(de_ctx);
  2589. DetectEngineCtxFree(de_ctx);
  2590. return result;
  2591. }
  2592. int DetectFastPatternTest90(void)
  2593. {
  2594. DetectEngineCtx *de_ctx = NULL;
  2595. int result = 0;
  2596. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2597. goto end;
  2598. de_ctx->flags |= DE_QUIET;
  2599. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2600. "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; within:10; uricontent:\"three\"; sid:1;)");
  2601. if (de_ctx->sig_list != NULL)
  2602. goto end;
  2603. result = 1;
  2604. end:
  2605. SigCleanSignatures(de_ctx);
  2606. DetectEngineCtxFree(de_ctx);
  2607. return result;
  2608. }
  2609. int DetectFastPatternTest91(void)
  2610. {
  2611. DetectEngineCtx *de_ctx = NULL;
  2612. int result = 0;
  2613. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2614. goto end;
  2615. de_ctx->flags |= DE_QUIET;
  2616. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2617. "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; offset:10; uricontent:\"three\"; sid:1;)");
  2618. if (de_ctx->sig_list != NULL)
  2619. goto end;
  2620. result = 1;
  2621. end:
  2622. SigCleanSignatures(de_ctx);
  2623. DetectEngineCtxFree(de_ctx);
  2624. return result;
  2625. }
  2626. int DetectFastPatternTest92(void)
  2627. {
  2628. DetectEngineCtx *de_ctx = NULL;
  2629. int result = 0;
  2630. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2631. goto end;
  2632. de_ctx->flags |= DE_QUIET;
  2633. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2634. "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; depth:10; uricontent:\"three\"; sid:1;)");
  2635. if (de_ctx->sig_list != NULL)
  2636. goto end;
  2637. result = 1;
  2638. end:
  2639. SigCleanSignatures(de_ctx);
  2640. DetectEngineCtxFree(de_ctx);
  2641. return result;
  2642. }
  2643. /* uricontent fast_pattern tests ^ */
  2644. /* http_uri fast_pattern tests v */
  2645. int DetectFastPatternTest93(void)
  2646. {
  2647. DetectEngineCtx *de_ctx = NULL;
  2648. int result = 0;
  2649. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2650. goto end;
  2651. de_ctx->flags |= DE_QUIET;
  2652. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2653. "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; sid:1;)");
  2654. if (de_ctx->sig_list == NULL)
  2655. goto end;
  2656. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  2657. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2658. ud->flags & DETECT_CONTENT_NEGATED &&
  2659. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  2660. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  2661. ud->fp_chop_offset == 3 &&
  2662. ud->fp_chop_len == 4) {
  2663. result = 1;
  2664. } else {
  2665. result = 0;
  2666. }
  2667. end:
  2668. SigCleanSignatures(de_ctx);
  2669. DetectEngineCtxFree(de_ctx);
  2670. return result;
  2671. }
  2672. /**
  2673. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  2674. */
  2675. int DetectFastPatternTest94(void)
  2676. {
  2677. SigMatch *sm = NULL;
  2678. DetectEngineCtx *de_ctx = NULL;
  2679. int result = 0;
  2680. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2681. goto end;
  2682. de_ctx->flags |= DE_QUIET;
  2683. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2684. "(content:\"/one/\"; fast_pattern:only; http_uri; "
  2685. "msg:\"Testing fast_pattern\"; sid:1;)");
  2686. if (de_ctx->sig_list == NULL)
  2687. goto end;
  2688. result = 0;
  2689. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
  2690. while (sm != NULL) {
  2691. if (sm->type == DETECT_CONTENT) {
  2692. if ( ((DetectContentData *)sm->ctx)->flags &
  2693. DETECT_CONTENT_FAST_PATTERN) {
  2694. result = 1;
  2695. break;
  2696. } else {
  2697. result = 0;
  2698. break;
  2699. }
  2700. }
  2701. sm = sm->next;
  2702. }
  2703. end:
  2704. SigCleanSignatures(de_ctx);
  2705. DetectEngineCtxFree(de_ctx);
  2706. return result;
  2707. }
  2708. /**
  2709. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  2710. */
  2711. int DetectFastPatternTest95(void)
  2712. {
  2713. SigMatch *sm = NULL;
  2714. DetectEngineCtx *de_ctx = NULL;
  2715. int result = 0;
  2716. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2717. goto end;
  2718. de_ctx->flags |= DE_QUIET;
  2719. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2720. "(content:\"oneoneone\"; fast_pattern:3,4; http_uri; "
  2721. "msg:\"Testing fast_pattern\"; sid:1;)");
  2722. if (de_ctx->sig_list == NULL)
  2723. goto end;
  2724. result = 0;
  2725. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
  2726. while (sm != NULL) {
  2727. if (sm->type == DETECT_CONTENT) {
  2728. if ( ((DetectContentData *)sm->ctx)->flags &
  2729. DETECT_CONTENT_FAST_PATTERN) {
  2730. result = 1;
  2731. break;
  2732. } else {
  2733. result = 0;
  2734. break;
  2735. }
  2736. }
  2737. sm = sm->next;
  2738. }
  2739. end:
  2740. SigCleanSignatures(de_ctx);
  2741. DetectEngineCtxFree(de_ctx);
  2742. return result;
  2743. }
  2744. int DetectFastPatternTest96(void)
  2745. {
  2746. SigMatch *sm = NULL;
  2747. DetectEngineCtx *de_ctx = NULL;
  2748. int result = 0;
  2749. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2750. goto end;
  2751. de_ctx->flags |= DE_QUIET;
  2752. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2753. "(content:\"one\"; fast_pattern:only; http_uri; sid:1;)");
  2754. if (de_ctx->sig_list == NULL)
  2755. goto end;
  2756. result = 0;
  2757. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
  2758. DetectContentData *ud = sm->ctx;
  2759. if (sm->type == DETECT_CONTENT) {
  2760. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2761. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  2762. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  2763. ud->fp_chop_offset == 0 &&
  2764. ud->fp_chop_len == 0) {
  2765. result = 1;
  2766. } else {
  2767. result = 0;
  2768. }
  2769. }
  2770. end:
  2771. SigCleanSignatures(de_ctx);
  2772. DetectEngineCtxFree(de_ctx);
  2773. return result;
  2774. }
  2775. int DetectFastPatternTest97(void)
  2776. {
  2777. SigMatch *sm = NULL;
  2778. DetectEngineCtx *de_ctx = NULL;
  2779. int result = 0;
  2780. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2781. goto end;
  2782. de_ctx->flags |= DE_QUIET;
  2783. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2784. "(content:\"oneoneone\"; fast_pattern:3,4; http_uri; sid:1;)");
  2785. if (de_ctx->sig_list == NULL)
  2786. goto end;
  2787. result = 0;
  2788. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
  2789. DetectContentData *ud = sm->ctx;
  2790. if (sm->type == DETECT_CONTENT) {
  2791. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2792. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  2793. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  2794. ud->fp_chop_offset == 3 &&
  2795. ud->fp_chop_len == 4) {
  2796. result = 1;
  2797. } else {
  2798. result = 0;
  2799. }
  2800. }
  2801. end:
  2802. SigCleanSignatures(de_ctx);
  2803. DetectEngineCtxFree(de_ctx);
  2804. return result;
  2805. }
  2806. int DetectFastPatternTest98(void)
  2807. {
  2808. DetectEngineCtx *de_ctx = NULL;
  2809. int result = 0;
  2810. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2811. goto end;
  2812. de_ctx->flags |= DE_QUIET;
  2813. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2814. "(uricontent:\"one\"; content:\"two\"; fast_pattern:only; http_uri; distance:10; sid:1;)");
  2815. if (de_ctx->sig_list != NULL)
  2816. goto end;
  2817. result = 1;
  2818. end:
  2819. SigCleanSignatures(de_ctx);
  2820. DetectEngineCtxFree(de_ctx);
  2821. return result;
  2822. }
  2823. int DetectFastPatternTest99(void)
  2824. {
  2825. DetectEngineCtx *de_ctx = NULL;
  2826. int result = 0;
  2827. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2828. goto end;
  2829. de_ctx->flags |= DE_QUIET;
  2830. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2831. "(uricontent:\"one\"; content:\"two\"; distance:10; fast_pattern:only; http_uri; sid:1;)");
  2832. if (de_ctx->sig_list != NULL)
  2833. goto end;
  2834. result = 1;
  2835. end:
  2836. SigCleanSignatures(de_ctx);
  2837. DetectEngineCtxFree(de_ctx);
  2838. return result;
  2839. }
  2840. int DetectFastPatternTest100(void)
  2841. {
  2842. DetectEngineCtx *de_ctx = NULL;
  2843. int result = 0;
  2844. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2845. goto end;
  2846. de_ctx->flags |= DE_QUIET;
  2847. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2848. "(uricontent:\"one\"; content:\"two\"; fast_pattern:only; http_uri; within:10; sid:1;)");
  2849. if (de_ctx->sig_list != NULL)
  2850. goto end;
  2851. result = 1;
  2852. end:
  2853. SigCleanSignatures(de_ctx);
  2854. DetectEngineCtxFree(de_ctx);
  2855. return result;
  2856. }
  2857. int DetectFastPatternTest101(void)
  2858. {
  2859. DetectEngineCtx *de_ctx = NULL;
  2860. int result = 0;
  2861. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2862. goto end;
  2863. de_ctx->flags |= DE_QUIET;
  2864. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2865. "(uricontent:\"one\"; content:\"two\"; within:10; fast_pattern:only; http_uri; sid:1;)");
  2866. if (de_ctx->sig_list != NULL)
  2867. goto end;
  2868. result = 1;
  2869. end:
  2870. SigCleanSignatures(de_ctx);
  2871. DetectEngineCtxFree(de_ctx);
  2872. return result;
  2873. }
  2874. int DetectFastPatternTest102(void)
  2875. {
  2876. DetectEngineCtx *de_ctx = NULL;
  2877. int result = 0;
  2878. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2879. goto end;
  2880. de_ctx->flags |= DE_QUIET;
  2881. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2882. "(uricontent:\"one\"; content:\"two\"; fast_pattern:only; http_uri; offset:10; sid:1;)");
  2883. if (de_ctx->sig_list != NULL)
  2884. goto end;
  2885. result = 1;
  2886. end:
  2887. SigCleanSignatures(de_ctx);
  2888. DetectEngineCtxFree(de_ctx);
  2889. return result;
  2890. }
  2891. int DetectFastPatternTest103(void)
  2892. {
  2893. DetectEngineCtx *de_ctx = NULL;
  2894. int result = 0;
  2895. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2896. goto end;
  2897. de_ctx->flags |= DE_QUIET;
  2898. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2899. "(uricontent:\"one\"; content:\"two\"; offset:10; fast_pattern:only; http_uri; sid:1;)");
  2900. if (de_ctx->sig_list != NULL)
  2901. goto end;
  2902. result = 1;
  2903. end:
  2904. SigCleanSignatures(de_ctx);
  2905. DetectEngineCtxFree(de_ctx);
  2906. return result;
  2907. }
  2908. int DetectFastPatternTest104(void)
  2909. {
  2910. DetectEngineCtx *de_ctx = NULL;
  2911. int result = 0;
  2912. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2913. goto end;
  2914. de_ctx->flags |= DE_QUIET;
  2915. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2916. "(uricontent:\"one\"; content:\"two\"; fast_pattern:only; http_uri; depth:10; sid:1;)");
  2917. if (de_ctx->sig_list != NULL)
  2918. goto end;
  2919. result = 1;
  2920. end:
  2921. SigCleanSignatures(de_ctx);
  2922. DetectEngineCtxFree(de_ctx);
  2923. return result;
  2924. }
  2925. int DetectFastPatternTest105(void)
  2926. {
  2927. DetectEngineCtx *de_ctx = NULL;
  2928. int result = 0;
  2929. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2930. goto end;
  2931. de_ctx->flags |= DE_QUIET;
  2932. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2933. "(uricontent:\"one\"; content:\"two\"; depth:10; fast_pattern:only; http_uri; sid:1;)");
  2934. if (de_ctx->sig_list != NULL)
  2935. goto end;
  2936. result = 1;
  2937. end:
  2938. SigCleanSignatures(de_ctx);
  2939. DetectEngineCtxFree(de_ctx);
  2940. return result;
  2941. }
  2942. int DetectFastPatternTest106(void)
  2943. {
  2944. DetectEngineCtx *de_ctx = NULL;
  2945. int result = 0;
  2946. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2947. goto end;
  2948. de_ctx->flags |= DE_QUIET;
  2949. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2950. "(uricontent:\"one\"; content:!\"two\"; fast_pattern:only; http_uri; sid:1;)");
  2951. if (de_ctx->sig_list != NULL)
  2952. goto end;
  2953. result = 1;
  2954. end:
  2955. SigCleanSignatures(de_ctx);
  2956. DetectEngineCtxFree(de_ctx);
  2957. return result;
  2958. }
  2959. int DetectFastPatternTest107(void)
  2960. {
  2961. DetectEngineCtx *de_ctx = NULL;
  2962. int result = 0;
  2963. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2964. goto end;
  2965. de_ctx->flags |= DE_QUIET;
  2966. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2967. "(uricontent: \"one\"; uricontent:\"two\"; distance:30; content:\"two\"; fast_pattern:only; http_uri; sid:1;)");
  2968. if (de_ctx->sig_list == NULL)
  2969. goto end;
  2970. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  2971. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2972. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  2973. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  2974. ud->fp_chop_offset == 0 &&
  2975. ud->fp_chop_len == 0) {
  2976. result = 1;
  2977. } else {
  2978. result = 0;
  2979. }
  2980. end:
  2981. SigCleanSignatures(de_ctx);
  2982. DetectEngineCtxFree(de_ctx);
  2983. return result;
  2984. }
  2985. int DetectFastPatternTest108(void)
  2986. {
  2987. DetectEngineCtx *de_ctx = NULL;
  2988. int result = 0;
  2989. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  2990. goto end;
  2991. de_ctx->flags |= DE_QUIET;
  2992. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  2993. "(uricontent:\"one\"; uricontent:\"two\"; within:30; content:\"two\"; fast_pattern:only; http_uri; sid:1;)");
  2994. if (de_ctx->sig_list == NULL)
  2995. goto end;
  2996. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  2997. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  2998. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  2999. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  3000. ud->fp_chop_offset == 0 &&
  3001. ud->fp_chop_len == 0) {
  3002. result = 1;
  3003. } else {
  3004. result = 0;
  3005. }
  3006. end:
  3007. SigCleanSignatures(de_ctx);
  3008. DetectEngineCtxFree(de_ctx);
  3009. return result;
  3010. }
  3011. int DetectFastPatternTest109(void)
  3012. {
  3013. DetectEngineCtx *de_ctx = NULL;
  3014. int result = 0;
  3015. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3016. goto end;
  3017. de_ctx->flags |= DE_QUIET;
  3018. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3019. "(uricontent:\"one\"; uricontent:\"two\"; offset:30; content:\"two\"; fast_pattern:only; http_uri; sid:1;)");
  3020. if (de_ctx->sig_list == NULL)
  3021. goto end;
  3022. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  3023. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3024. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  3025. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  3026. ud->fp_chop_offset == 0 &&
  3027. ud->fp_chop_len == 0) {
  3028. result = 1;
  3029. } else {
  3030. result = 0;
  3031. }
  3032. end:
  3033. SigCleanSignatures(de_ctx);
  3034. DetectEngineCtxFree(de_ctx);
  3035. return result;
  3036. }
  3037. int DetectFastPatternTest110(void)
  3038. {
  3039. DetectEngineCtx *de_ctx = NULL;
  3040. int result = 0;
  3041. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3042. goto end;
  3043. de_ctx->flags |= DE_QUIET;
  3044. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3045. "(uricontent:\"one\"; uricontent:\"two\"; depth:30; content:\"two\"; fast_pattern:only; http_uri; sid:1;)");
  3046. if (de_ctx->sig_list == NULL)
  3047. goto end;
  3048. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  3049. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3050. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  3051. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  3052. ud->fp_chop_offset == 0 &&
  3053. ud->fp_chop_len == 0) {
  3054. result = 1;
  3055. } else {
  3056. result = 0;
  3057. }
  3058. end:
  3059. SigCleanSignatures(de_ctx);
  3060. DetectEngineCtxFree(de_ctx);
  3061. return result;
  3062. }
  3063. int DetectFastPatternTest111(void)
  3064. {
  3065. DetectEngineCtx *de_ctx = NULL;
  3066. int result = 0;
  3067. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3068. goto end;
  3069. de_ctx->flags |= DE_QUIET;
  3070. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3071. "(content:!\"one\"; fast_pattern; http_uri; uricontent:\"two\"; sid:1;)");
  3072. if (de_ctx->sig_list == NULL)
  3073. goto end;
  3074. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  3075. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3076. ud->flags & DETECT_CONTENT_NEGATED &&
  3077. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3078. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  3079. ud->fp_chop_offset == 0 &&
  3080. ud->fp_chop_len == 0) {
  3081. result = 1;
  3082. } else {
  3083. result = 0;
  3084. }
  3085. end:
  3086. SigCleanSignatures(de_ctx);
  3087. DetectEngineCtxFree(de_ctx);
  3088. return result;
  3089. }
  3090. int DetectFastPatternTest112(void)
  3091. {
  3092. DetectEngineCtx *de_ctx = NULL;
  3093. int result = 0;
  3094. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3095. goto end;
  3096. de_ctx->flags |= DE_QUIET;
  3097. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3098. "(uricontent:\"two\"; content:!\"one\"; fast_pattern; http_uri; distance:20; sid:1;)");
  3099. if (de_ctx->sig_list != NULL)
  3100. goto end;
  3101. result = 1;
  3102. end:
  3103. SigCleanSignatures(de_ctx);
  3104. DetectEngineCtxFree(de_ctx);
  3105. return result;
  3106. }
  3107. int DetectFastPatternTest113(void)
  3108. {
  3109. DetectEngineCtx *de_ctx = NULL;
  3110. int result = 0;
  3111. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3112. goto end;
  3113. de_ctx->flags |= DE_QUIET;
  3114. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3115. "(uricontent:\"two\"; content:!\"one\"; fast_pattern; http_uri; within:20; sid:1;)");
  3116. if (de_ctx->sig_list != NULL)
  3117. goto end;
  3118. result = 1;
  3119. end:
  3120. SigCleanSignatures(de_ctx);
  3121. DetectEngineCtxFree(de_ctx);
  3122. return result;
  3123. }
  3124. int DetectFastPatternTest114(void)
  3125. {
  3126. DetectEngineCtx *de_ctx = NULL;
  3127. int result = 0;
  3128. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3129. goto end;
  3130. de_ctx->flags |= DE_QUIET;
  3131. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3132. "(uricontent:\"two\"; content:!\"one\"; fast_pattern; http_uri; offset:20; sid:1;)");
  3133. if (de_ctx->sig_list != NULL)
  3134. goto end;
  3135. result = 1;
  3136. end:
  3137. SigCleanSignatures(de_ctx);
  3138. DetectEngineCtxFree(de_ctx);
  3139. return result;
  3140. }
  3141. int DetectFastPatternTest115(void)
  3142. {
  3143. DetectEngineCtx *de_ctx = NULL;
  3144. int result = 0;
  3145. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3146. goto end;
  3147. de_ctx->flags |= DE_QUIET;
  3148. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3149. "(uricontent:\"two\"; content:!\"one\"; fast_pattern; http_uri; depth:20; sid:1;)");
  3150. if (de_ctx->sig_list != NULL)
  3151. goto end;
  3152. result = 1;
  3153. end:
  3154. SigCleanSignatures(de_ctx);
  3155. DetectEngineCtxFree(de_ctx);
  3156. return result;
  3157. }
  3158. int DetectFastPatternTest116(void)
  3159. {
  3160. DetectEngineCtx *de_ctx = NULL;
  3161. int result = 0;
  3162. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3163. goto end;
  3164. de_ctx->flags |= DE_QUIET;
  3165. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3166. "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; sid:1;)");
  3167. if (de_ctx->sig_list == NULL)
  3168. goto end;
  3169. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  3170. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3171. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3172. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  3173. ud->fp_chop_offset == 3 &&
  3174. ud->fp_chop_len == 4) {
  3175. result = 1;
  3176. } else {
  3177. result = 0;
  3178. }
  3179. end:
  3180. SigCleanSignatures(de_ctx);
  3181. DetectEngineCtxFree(de_ctx);
  3182. return result;
  3183. }
  3184. int DetectFastPatternTest117(void)
  3185. {
  3186. DetectEngineCtx *de_ctx = NULL;
  3187. int result = 0;
  3188. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3189. goto end;
  3190. de_ctx->flags |= DE_QUIET;
  3191. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3192. "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; distance:30; sid:1;)");
  3193. if (de_ctx->sig_list == NULL)
  3194. goto end;
  3195. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  3196. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3197. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3198. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  3199. ud->fp_chop_offset == 3 &&
  3200. ud->fp_chop_len == 4) {
  3201. result = 1;
  3202. } else {
  3203. result = 0;
  3204. }
  3205. end:
  3206. SigCleanSignatures(de_ctx);
  3207. DetectEngineCtxFree(de_ctx);
  3208. return result;
  3209. }
  3210. int DetectFastPatternTest118(void)
  3211. {
  3212. DetectEngineCtx *de_ctx = NULL;
  3213. int result = 0;
  3214. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3215. goto end;
  3216. de_ctx->flags |= DE_QUIET;
  3217. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3218. "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; within:30; sid:1;)");
  3219. if (de_ctx->sig_list == NULL)
  3220. goto end;
  3221. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  3222. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3223. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3224. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  3225. ud->fp_chop_offset == 3 &&
  3226. ud->fp_chop_len == 4) {
  3227. result = 1;
  3228. } else {
  3229. result = 0;
  3230. }
  3231. end:
  3232. SigCleanSignatures(de_ctx);
  3233. DetectEngineCtxFree(de_ctx);
  3234. return result;
  3235. }
  3236. int DetectFastPatternTest119(void)
  3237. {
  3238. DetectEngineCtx *de_ctx = NULL;
  3239. int result = 0;
  3240. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3241. goto end;
  3242. de_ctx->flags |= DE_QUIET;
  3243. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3244. "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; offset:30; sid:1;)");
  3245. if (de_ctx->sig_list == NULL)
  3246. goto end;
  3247. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  3248. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3249. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3250. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  3251. ud->fp_chop_offset == 3 &&
  3252. ud->fp_chop_len == 4) {
  3253. result = 1;
  3254. } else {
  3255. result = 0;
  3256. }
  3257. end:
  3258. SigCleanSignatures(de_ctx);
  3259. DetectEngineCtxFree(de_ctx);
  3260. return result;
  3261. }
  3262. int DetectFastPatternTest120(void)
  3263. {
  3264. DetectEngineCtx *de_ctx = NULL;
  3265. int result = 0;
  3266. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3267. goto end;
  3268. de_ctx->flags |= DE_QUIET;
  3269. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3270. "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; depth:30; sid:1;)");
  3271. if (de_ctx->sig_list == NULL)
  3272. goto end;
  3273. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  3274. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3275. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3276. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  3277. ud->fp_chop_offset == 3 &&
  3278. ud->fp_chop_len == 4) {
  3279. result = 1;
  3280. } else {
  3281. result = 0;
  3282. }
  3283. end:
  3284. SigCleanSignatures(de_ctx);
  3285. DetectEngineCtxFree(de_ctx);
  3286. return result;
  3287. }
  3288. int DetectFastPatternTest121(void)
  3289. {
  3290. DetectEngineCtx *de_ctx = NULL;
  3291. int result = 0;
  3292. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3293. goto end;
  3294. de_ctx->flags |= DE_QUIET;
  3295. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3296. "(uricontent:\"one\"; uricontent:\"two\"; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_uri; sid:1;)");
  3297. if (de_ctx->sig_list == NULL)
  3298. goto end;
  3299. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  3300. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3301. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3302. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  3303. ud->fp_chop_offset == 3 &&
  3304. ud->fp_chop_len == 4) {
  3305. result = 1;
  3306. } else {
  3307. result = 0;
  3308. }
  3309. end:
  3310. SigCleanSignatures(de_ctx);
  3311. DetectEngineCtxFree(de_ctx);
  3312. return result;
  3313. }
  3314. int DetectFastPatternTest122(void)
  3315. {
  3316. DetectEngineCtx *de_ctx = NULL;
  3317. int result = 0;
  3318. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3319. goto end;
  3320. de_ctx->flags |= DE_QUIET;
  3321. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3322. "(uricontent:\"one\"; uricontent:\"two\"; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_uri; sid:1;)");
  3323. if (de_ctx->sig_list == NULL)
  3324. goto end;
  3325. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  3326. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3327. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3328. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  3329. ud->fp_chop_offset == 3 &&
  3330. ud->fp_chop_len == 4) {
  3331. result = 1;
  3332. } else {
  3333. result = 0;
  3334. }
  3335. end:
  3336. SigCleanSignatures(de_ctx);
  3337. DetectEngineCtxFree(de_ctx);
  3338. return result;
  3339. }
  3340. int DetectFastPatternTest123(void)
  3341. {
  3342. DetectEngineCtx *de_ctx = NULL;
  3343. int result = 0;
  3344. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3345. goto end;
  3346. de_ctx->flags |= DE_QUIET;
  3347. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3348. "(uricontent:\"one\"; uricontent:\"two\"; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_uri; sid:1;)");
  3349. if (de_ctx->sig_list == NULL)
  3350. goto end;
  3351. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  3352. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3353. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3354. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  3355. ud->fp_chop_offset == 3 &&
  3356. ud->fp_chop_len == 4) {
  3357. result = 1;
  3358. } else {
  3359. result = 0;
  3360. }
  3361. end:
  3362. SigCleanSignatures(de_ctx);
  3363. DetectEngineCtxFree(de_ctx);
  3364. return result;
  3365. }
  3366. int DetectFastPatternTest124(void)
  3367. {
  3368. DetectEngineCtx *de_ctx = NULL;
  3369. int result = 0;
  3370. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3371. goto end;
  3372. de_ctx->flags |= DE_QUIET;
  3373. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3374. "(uricontent:\"one\"; uricontent:\"two\"; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_uri; sid:1;)");
  3375. if (de_ctx->sig_list == NULL)
  3376. goto end;
  3377. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
  3378. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3379. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3380. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  3381. ud->fp_chop_offset == 3 &&
  3382. ud->fp_chop_len == 4) {
  3383. result = 1;
  3384. } else {
  3385. result = 0;
  3386. }
  3387. result = 1;
  3388. end:
  3389. SigCleanSignatures(de_ctx);
  3390. DetectEngineCtxFree(de_ctx);
  3391. return result;
  3392. }
  3393. int DetectFastPatternTest125(void)
  3394. {
  3395. DetectEngineCtx *de_ctx = NULL;
  3396. int result = 0;
  3397. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3398. goto end;
  3399. de_ctx->flags |= DE_QUIET;
  3400. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3401. "(uricontent:\"one\"; content:\"two\"; fast_pattern:65977,4; http_uri; uricontent:\"three\"; distance:10; sid:1;)");
  3402. if (de_ctx->sig_list != NULL)
  3403. goto end;
  3404. result = 1;
  3405. end:
  3406. SigCleanSignatures(de_ctx);
  3407. DetectEngineCtxFree(de_ctx);
  3408. return result;
  3409. }
  3410. int DetectFastPatternTest126(void)
  3411. {
  3412. DetectEngineCtx *de_ctx = NULL;
  3413. int result = 0;
  3414. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3415. goto end;
  3416. de_ctx->flags |= DE_QUIET;
  3417. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3418. "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,65977; http_uri; uricontent:\"three\"; distance:10; sid:1;)");
  3419. if (de_ctx->sig_list != NULL)
  3420. goto end;
  3421. result = 1;
  3422. end:
  3423. SigCleanSignatures(de_ctx);
  3424. DetectEngineCtxFree(de_ctx);
  3425. return result;
  3426. }
  3427. int DetectFastPatternTest127(void)
  3428. {
  3429. DetectEngineCtx *de_ctx = NULL;
  3430. int result = 0;
  3431. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3432. goto end;
  3433. de_ctx->flags |= DE_QUIET;
  3434. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3435. "(uricontent:\"one\"; content:\"two\"; fast_pattern:65534,4; http_uri; uricontent:\"three\"; distance:10; sid:1;)");
  3436. if (de_ctx->sig_list != NULL)
  3437. goto end;
  3438. result = 1;
  3439. end:
  3440. SigCleanSignatures(de_ctx);
  3441. DetectEngineCtxFree(de_ctx);
  3442. return result;
  3443. }
  3444. int DetectFastPatternTest128(void)
  3445. {
  3446. DetectEngineCtx *de_ctx = NULL;
  3447. int result = 0;
  3448. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3449. goto end;
  3450. de_ctx->flags |= DE_QUIET;
  3451. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3452. "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; sid:1;)");
  3453. if (de_ctx->sig_list == NULL)
  3454. goto end;
  3455. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  3456. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3457. ud->flags & DETECT_CONTENT_NEGATED &&
  3458. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3459. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  3460. ud->fp_chop_offset == 3 &&
  3461. ud->fp_chop_len == 4) {
  3462. result = 1;
  3463. } else {
  3464. result = 0;
  3465. }
  3466. end:
  3467. SigCleanSignatures(de_ctx);
  3468. DetectEngineCtxFree(de_ctx);
  3469. return result;
  3470. }
  3471. int DetectFastPatternTest129(void)
  3472. {
  3473. DetectEngineCtx *de_ctx = NULL;
  3474. int result = 0;
  3475. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3476. goto end;
  3477. de_ctx->flags |= DE_QUIET;
  3478. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3479. "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; distance:10; uricontent:\"three\"; sid:1;)");
  3480. if (de_ctx->sig_list != NULL)
  3481. goto end;
  3482. result = 1;
  3483. end:
  3484. SigCleanSignatures(de_ctx);
  3485. DetectEngineCtxFree(de_ctx);
  3486. return result;
  3487. }
  3488. int DetectFastPatternTest130(void)
  3489. {
  3490. DetectEngineCtx *de_ctx = NULL;
  3491. int result = 0;
  3492. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3493. goto end;
  3494. de_ctx->flags |= DE_QUIET;
  3495. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3496. "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; within:10; uricontent:\"three\"; sid:1;)");
  3497. if (de_ctx->sig_list != NULL)
  3498. goto end;
  3499. result = 1;
  3500. end:
  3501. SigCleanSignatures(de_ctx);
  3502. DetectEngineCtxFree(de_ctx);
  3503. return result;
  3504. }
  3505. int DetectFastPatternTest131(void)
  3506. {
  3507. DetectEngineCtx *de_ctx = NULL;
  3508. int result = 0;
  3509. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3510. goto end;
  3511. de_ctx->flags |= DE_QUIET;
  3512. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3513. "(uricontent:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; http_uri; offset:10; uricontent:\"three\"; sid:1;)");
  3514. if (de_ctx->sig_list != NULL)
  3515. goto end;
  3516. result = 1;
  3517. end:
  3518. SigCleanSignatures(de_ctx);
  3519. DetectEngineCtxFree(de_ctx);
  3520. return result;
  3521. }
  3522. int DetectFastPatternTest132(void)
  3523. {
  3524. DetectEngineCtx *de_ctx = NULL;
  3525. int result = 0;
  3526. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3527. goto end;
  3528. de_ctx->flags |= DE_QUIET;
  3529. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3530. "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; depth:10; uricontent:\"three\"; sid:1;)");
  3531. if (de_ctx->sig_list != NULL)
  3532. goto end;
  3533. result = 1;
  3534. end:
  3535. SigCleanSignatures(de_ctx);
  3536. DetectEngineCtxFree(de_ctx);
  3537. return result;
  3538. }
  3539. int DetectFastPatternTest133(void)
  3540. {
  3541. DetectEngineCtx *de_ctx = NULL;
  3542. int result = 0;
  3543. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3544. goto end;
  3545. de_ctx->flags |= DE_QUIET;
  3546. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3547. "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; sid:1;)");
  3548. if (de_ctx->sig_list == NULL)
  3549. goto end;
  3550. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
  3551. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3552. ud->flags & DETECT_CONTENT_NEGATED &&
  3553. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3554. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  3555. ud->fp_chop_offset == 3 &&
  3556. ud->fp_chop_len == 4) {
  3557. result = 1;
  3558. } else {
  3559. result = 0;
  3560. }
  3561. end:
  3562. SigCleanSignatures(de_ctx);
  3563. DetectEngineCtxFree(de_ctx);
  3564. return result;
  3565. }
  3566. /* http_uri fast_pattern tests ^ */
  3567. /* http_client_body fast_pattern tests v */
  3568. int DetectFastPatternTest134(void)
  3569. {
  3570. DetectEngineCtx *de_ctx = NULL;
  3571. int result = 0;
  3572. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3573. goto end;
  3574. de_ctx->flags |= DE_QUIET;
  3575. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3576. "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; sid:1;)");
  3577. if (de_ctx->sig_list == NULL)
  3578. goto end;
  3579. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx;
  3580. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3581. ud->flags & DETECT_CONTENT_NEGATED &&
  3582. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3583. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  3584. ud->fp_chop_offset == 3 &&
  3585. ud->fp_chop_len == 4) {
  3586. result = 1;
  3587. } else {
  3588. result = 0;
  3589. }
  3590. end:
  3591. SigCleanSignatures(de_ctx);
  3592. DetectEngineCtxFree(de_ctx);
  3593. return result;
  3594. }
  3595. /**
  3596. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  3597. */
  3598. int DetectFastPatternTest135(void)
  3599. {
  3600. SigMatch *sm = NULL;
  3601. DetectEngineCtx *de_ctx = NULL;
  3602. int result = 0;
  3603. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3604. goto end;
  3605. de_ctx->flags |= DE_QUIET;
  3606. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3607. "(content:\"/one/\"; fast_pattern:only; http_client_body; "
  3608. "msg:\"Testing fast_pattern\"; sid:1;)");
  3609. if (de_ctx->sig_list == NULL)
  3610. goto end;
  3611. result = 0;
  3612. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH];
  3613. if (sm != NULL) {
  3614. if ( ((DetectContentData *)sm->ctx)->flags &
  3615. DETECT_CONTENT_FAST_PATTERN) {
  3616. result = 1;
  3617. } else {
  3618. result = 0;
  3619. }
  3620. }
  3621. end:
  3622. SigCleanSignatures(de_ctx);
  3623. DetectEngineCtxFree(de_ctx);
  3624. return result;
  3625. }
  3626. /**
  3627. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  3628. */
  3629. int DetectFastPatternTest136(void)
  3630. {
  3631. SigMatch *sm = NULL;
  3632. DetectEngineCtx *de_ctx = NULL;
  3633. int result = 0;
  3634. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3635. goto end;
  3636. de_ctx->flags |= DE_QUIET;
  3637. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3638. "(content:\"oneoneone\"; fast_pattern:3,4; http_client_body; "
  3639. "msg:\"Testing fast_pattern\"; sid:1;)");
  3640. if (de_ctx->sig_list == NULL)
  3641. goto end;
  3642. result = 0;
  3643. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH];
  3644. if (sm != NULL) {
  3645. if ( ((DetectContentData *)sm->ctx)->flags &
  3646. DETECT_CONTENT_FAST_PATTERN) {
  3647. result = 1;
  3648. } else {
  3649. result = 0;
  3650. }
  3651. }
  3652. end:
  3653. SigCleanSignatures(de_ctx);
  3654. DetectEngineCtxFree(de_ctx);
  3655. return result;
  3656. }
  3657. int DetectFastPatternTest137(void)
  3658. {
  3659. SigMatch *sm = NULL;
  3660. DetectEngineCtx *de_ctx = NULL;
  3661. int result = 0;
  3662. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3663. goto end;
  3664. de_ctx->flags |= DE_QUIET;
  3665. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3666. "(content:\"one\"; fast_pattern:only; http_client_body; sid:1;)");
  3667. if (de_ctx->sig_list == NULL)
  3668. goto end;
  3669. result = 0;
  3670. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH];
  3671. DetectContentData *ud = sm->ctx;
  3672. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3673. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  3674. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  3675. ud->fp_chop_offset == 0 &&
  3676. ud->fp_chop_len == 0) {
  3677. result = 1;
  3678. } else {
  3679. result = 0;
  3680. }
  3681. end:
  3682. SigCleanSignatures(de_ctx);
  3683. DetectEngineCtxFree(de_ctx);
  3684. return result;
  3685. }
  3686. int DetectFastPatternTest138(void)
  3687. {
  3688. SigMatch *sm = NULL;
  3689. DetectEngineCtx *de_ctx = NULL;
  3690. int result = 0;
  3691. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3692. goto end;
  3693. de_ctx->flags |= DE_QUIET;
  3694. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3695. "(content:\"oneoneone\"; fast_pattern:3,4; http_client_body; sid:1;)");
  3696. if (de_ctx->sig_list == NULL)
  3697. goto end;
  3698. result = 0;
  3699. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH];
  3700. DetectContentData *ud = sm->ctx;
  3701. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3702. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3703. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  3704. ud->fp_chop_offset == 3 &&
  3705. ud->fp_chop_len == 4) {
  3706. result = 1;
  3707. } else {
  3708. result = 0;
  3709. }
  3710. end:
  3711. SigCleanSignatures(de_ctx);
  3712. DetectEngineCtxFree(de_ctx);
  3713. return result;
  3714. }
  3715. int DetectFastPatternTest139(void)
  3716. {
  3717. DetectEngineCtx *de_ctx = NULL;
  3718. int result = 0;
  3719. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3720. goto end;
  3721. de_ctx->flags |= DE_QUIET;
  3722. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3723. "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:only; http_client_body; distance:10; sid:1;)");
  3724. if (de_ctx->sig_list != NULL)
  3725. goto end;
  3726. result = 1;
  3727. end:
  3728. SigCleanSignatures(de_ctx);
  3729. DetectEngineCtxFree(de_ctx);
  3730. return result;
  3731. }
  3732. int DetectFastPatternTest140(void)
  3733. {
  3734. DetectEngineCtx *de_ctx = NULL;
  3735. int result = 0;
  3736. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3737. goto end;
  3738. de_ctx->flags |= DE_QUIET;
  3739. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3740. "(content:\"one\"; http_client_body; content:\"two\"; distance:10; fast_pattern:only; http_client_body; sid:1;)");
  3741. if (de_ctx->sig_list != NULL)
  3742. goto end;
  3743. result = 1;
  3744. end:
  3745. SigCleanSignatures(de_ctx);
  3746. DetectEngineCtxFree(de_ctx);
  3747. return result;
  3748. }
  3749. int DetectFastPatternTest141(void)
  3750. {
  3751. DetectEngineCtx *de_ctx = NULL;
  3752. int result = 0;
  3753. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3754. goto end;
  3755. de_ctx->flags |= DE_QUIET;
  3756. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3757. "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:only; http_client_body; within:10; sid:1;)");
  3758. if (de_ctx->sig_list != NULL)
  3759. goto end;
  3760. result = 1;
  3761. end:
  3762. SigCleanSignatures(de_ctx);
  3763. DetectEngineCtxFree(de_ctx);
  3764. return result;
  3765. }
  3766. int DetectFastPatternTest142(void)
  3767. {
  3768. DetectEngineCtx *de_ctx = NULL;
  3769. int result = 0;
  3770. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3771. goto end;
  3772. de_ctx->flags |= DE_QUIET;
  3773. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3774. "(content:\"one\"; http_client_body; content:\"two\"; within:10; fast_pattern:only; http_client_body; sid:1;)");
  3775. if (de_ctx->sig_list != NULL)
  3776. goto end;
  3777. result = 1;
  3778. end:
  3779. SigCleanSignatures(de_ctx);
  3780. DetectEngineCtxFree(de_ctx);
  3781. return result;
  3782. }
  3783. int DetectFastPatternTest143(void)
  3784. {
  3785. DetectEngineCtx *de_ctx = NULL;
  3786. int result = 0;
  3787. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3788. goto end;
  3789. de_ctx->flags |= DE_QUIET;
  3790. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3791. "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:only; http_client_body; offset:10; sid:1;)");
  3792. if (de_ctx->sig_list != NULL)
  3793. goto end;
  3794. result = 1;
  3795. end:
  3796. SigCleanSignatures(de_ctx);
  3797. DetectEngineCtxFree(de_ctx);
  3798. return result;
  3799. }
  3800. int DetectFastPatternTest144(void)
  3801. {
  3802. DetectEngineCtx *de_ctx = NULL;
  3803. int result = 0;
  3804. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3805. goto end;
  3806. de_ctx->flags |= DE_QUIET;
  3807. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3808. "(content:\"one\"; http_client_body; content:\"two\"; offset:10; fast_pattern:only; http_client_body; sid:1;)");
  3809. if (de_ctx->sig_list != NULL)
  3810. goto end;
  3811. result = 1;
  3812. end:
  3813. SigCleanSignatures(de_ctx);
  3814. DetectEngineCtxFree(de_ctx);
  3815. return result;
  3816. }
  3817. int DetectFastPatternTest145(void)
  3818. {
  3819. DetectEngineCtx *de_ctx = NULL;
  3820. int result = 0;
  3821. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3822. goto end;
  3823. de_ctx->flags |= DE_QUIET;
  3824. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3825. "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:only; http_client_body; depth:10; sid:1;)");
  3826. if (de_ctx->sig_list != NULL)
  3827. goto end;
  3828. result = 1;
  3829. end:
  3830. SigCleanSignatures(de_ctx);
  3831. DetectEngineCtxFree(de_ctx);
  3832. return result;
  3833. }
  3834. int DetectFastPatternTest146(void)
  3835. {
  3836. DetectEngineCtx *de_ctx = NULL;
  3837. int result = 0;
  3838. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3839. goto end;
  3840. de_ctx->flags |= DE_QUIET;
  3841. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3842. "(content:\"one\"; http_client_body; content:\"two\"; depth:10; fast_pattern:only; http_client_body; sid:1;)");
  3843. if (de_ctx->sig_list != NULL)
  3844. goto end;
  3845. result = 1;
  3846. end:
  3847. SigCleanSignatures(de_ctx);
  3848. DetectEngineCtxFree(de_ctx);
  3849. return result;
  3850. }
  3851. int DetectFastPatternTest147(void)
  3852. {
  3853. DetectEngineCtx *de_ctx = NULL;
  3854. int result = 0;
  3855. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3856. goto end;
  3857. de_ctx->flags |= DE_QUIET;
  3858. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3859. "(content:\"one\"; http_client_body; content:!\"two\"; fast_pattern:only; http_client_body; sid:1;)");
  3860. if (de_ctx->sig_list != NULL)
  3861. goto end;
  3862. result = 1;
  3863. end:
  3864. SigCleanSignatures(de_ctx);
  3865. DetectEngineCtxFree(de_ctx);
  3866. return result;
  3867. }
  3868. int DetectFastPatternTest148(void)
  3869. {
  3870. DetectEngineCtx *de_ctx = NULL;
  3871. int result = 0;
  3872. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3873. goto end;
  3874. de_ctx->flags |= DE_QUIET;
  3875. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3876. "(content: \"one\"; http_client_body; content:\"two\"; http_client_body; distance:30; content:\"two\"; fast_pattern:only; http_client_body; sid:1;)");
  3877. if (de_ctx->sig_list == NULL)
  3878. goto end;
  3879. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx;
  3880. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3881. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  3882. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  3883. ud->fp_chop_offset == 0 &&
  3884. ud->fp_chop_len == 0) {
  3885. result = 1;
  3886. } else {
  3887. result = 0;
  3888. }
  3889. end:
  3890. SigCleanSignatures(de_ctx);
  3891. DetectEngineCtxFree(de_ctx);
  3892. return result;
  3893. }
  3894. int DetectFastPatternTest149(void)
  3895. {
  3896. DetectEngineCtx *de_ctx = NULL;
  3897. int result = 0;
  3898. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3899. goto end;
  3900. de_ctx->flags |= DE_QUIET;
  3901. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3902. "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; within:30; content:\"two\"; fast_pattern:only; http_client_body; sid:1;)");
  3903. if (de_ctx->sig_list == NULL)
  3904. goto end;
  3905. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx;
  3906. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3907. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  3908. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  3909. ud->fp_chop_offset == 0 &&
  3910. ud->fp_chop_len == 0) {
  3911. result = 1;
  3912. } else {
  3913. result = 0;
  3914. }
  3915. end:
  3916. SigCleanSignatures(de_ctx);
  3917. DetectEngineCtxFree(de_ctx);
  3918. return result;
  3919. }
  3920. int DetectFastPatternTest150(void)
  3921. {
  3922. DetectEngineCtx *de_ctx = NULL;
  3923. int result = 0;
  3924. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3925. goto end;
  3926. de_ctx->flags |= DE_QUIET;
  3927. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3928. "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; offset:30; content:\"two\"; fast_pattern:only; http_client_body; sid:1;)");
  3929. if (de_ctx->sig_list == NULL)
  3930. goto end;
  3931. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx;
  3932. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3933. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  3934. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  3935. ud->fp_chop_offset == 0 &&
  3936. ud->fp_chop_len == 0) {
  3937. result = 1;
  3938. } else {
  3939. result = 0;
  3940. }
  3941. end:
  3942. SigCleanSignatures(de_ctx);
  3943. DetectEngineCtxFree(de_ctx);
  3944. return result;
  3945. }
  3946. int DetectFastPatternTest151(void)
  3947. {
  3948. DetectEngineCtx *de_ctx = NULL;
  3949. int result = 0;
  3950. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3951. goto end;
  3952. de_ctx->flags |= DE_QUIET;
  3953. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3954. "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; depth:30; content:\"two\"; fast_pattern:only; http_client_body; sid:1;)");
  3955. if (de_ctx->sig_list == NULL)
  3956. goto end;
  3957. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx;
  3958. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3959. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  3960. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  3961. ud->fp_chop_offset == 0 &&
  3962. ud->fp_chop_len == 0) {
  3963. result = 1;
  3964. } else {
  3965. result = 0;
  3966. }
  3967. end:
  3968. SigCleanSignatures(de_ctx);
  3969. DetectEngineCtxFree(de_ctx);
  3970. return result;
  3971. }
  3972. int DetectFastPatternTest152(void)
  3973. {
  3974. DetectEngineCtx *de_ctx = NULL;
  3975. int result = 0;
  3976. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  3977. goto end;
  3978. de_ctx->flags |= DE_QUIET;
  3979. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  3980. "(content:!\"one\"; fast_pattern; http_client_body; content:\"two\"; http_client_body; sid:1;)");
  3981. if (de_ctx->sig_list == NULL)
  3982. goto end;
  3983. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx;
  3984. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  3985. ud->flags & DETECT_CONTENT_NEGATED &&
  3986. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  3987. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  3988. ud->fp_chop_offset == 0 &&
  3989. ud->fp_chop_len == 0) {
  3990. result = 1;
  3991. } else {
  3992. result = 0;
  3993. }
  3994. end:
  3995. SigCleanSignatures(de_ctx);
  3996. DetectEngineCtxFree(de_ctx);
  3997. return result;
  3998. }
  3999. int DetectFastPatternTest153(void)
  4000. {
  4001. DetectEngineCtx *de_ctx = NULL;
  4002. int result = 0;
  4003. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4004. goto end;
  4005. de_ctx->flags |= DE_QUIET;
  4006. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4007. "(content:\"two\"; http_client_body; content:!\"one\"; fast_pattern; http_client_body; distance:20; sid:1;)");
  4008. if (de_ctx->sig_list != NULL)
  4009. goto end;
  4010. result = 1;
  4011. end:
  4012. SigCleanSignatures(de_ctx);
  4013. DetectEngineCtxFree(de_ctx);
  4014. return result;
  4015. }
  4016. int DetectFastPatternTest154(void)
  4017. {
  4018. DetectEngineCtx *de_ctx = NULL;
  4019. int result = 0;
  4020. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4021. goto end;
  4022. de_ctx->flags |= DE_QUIET;
  4023. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4024. "(content:\"two\"; http_client_body; content:!\"one\"; fast_pattern; http_client_body; within:20; sid:1;)");
  4025. if (de_ctx->sig_list != NULL)
  4026. goto end;
  4027. result = 1;
  4028. end:
  4029. SigCleanSignatures(de_ctx);
  4030. DetectEngineCtxFree(de_ctx);
  4031. return result;
  4032. }
  4033. int DetectFastPatternTest155(void)
  4034. {
  4035. DetectEngineCtx *de_ctx = NULL;
  4036. int result = 0;
  4037. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4038. goto end;
  4039. de_ctx->flags |= DE_QUIET;
  4040. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4041. "(content:\"two\"; http_client_body; content:!\"one\"; fast_pattern; http_client_body; offset:20; sid:1;)");
  4042. if (de_ctx->sig_list != NULL)
  4043. goto end;
  4044. result = 1;
  4045. end:
  4046. SigCleanSignatures(de_ctx);
  4047. DetectEngineCtxFree(de_ctx);
  4048. return result;
  4049. }
  4050. int DetectFastPatternTest156(void)
  4051. {
  4052. DetectEngineCtx *de_ctx = NULL;
  4053. int result = 0;
  4054. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4055. goto end;
  4056. de_ctx->flags |= DE_QUIET;
  4057. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4058. "(content:\"two\"; http_client_body; content:!\"one\"; fast_pattern; http_client_body; depth:20; sid:1;)");
  4059. if (de_ctx->sig_list != NULL)
  4060. goto end;
  4061. result = 1;
  4062. end:
  4063. SigCleanSignatures(de_ctx);
  4064. DetectEngineCtxFree(de_ctx);
  4065. return result;
  4066. }
  4067. int DetectFastPatternTest157(void)
  4068. {
  4069. DetectEngineCtx *de_ctx = NULL;
  4070. int result = 0;
  4071. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4072. goto end;
  4073. de_ctx->flags |= DE_QUIET;
  4074. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4075. "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; sid:1;)");
  4076. if (de_ctx->sig_list == NULL)
  4077. goto end;
  4078. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx;
  4079. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4080. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  4081. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  4082. ud->fp_chop_offset == 3 &&
  4083. ud->fp_chop_len == 4) {
  4084. result = 1;
  4085. } else {
  4086. result = 0;
  4087. }
  4088. end:
  4089. SigCleanSignatures(de_ctx);
  4090. DetectEngineCtxFree(de_ctx);
  4091. return result;
  4092. }
  4093. int DetectFastPatternTest158(void)
  4094. {
  4095. DetectEngineCtx *de_ctx = NULL;
  4096. int result = 0;
  4097. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4098. goto end;
  4099. de_ctx->flags |= DE_QUIET;
  4100. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4101. "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; distance:30; sid:1;)");
  4102. if (de_ctx->sig_list == NULL)
  4103. goto end;
  4104. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx;
  4105. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4106. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  4107. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  4108. ud->fp_chop_offset == 3 &&
  4109. ud->fp_chop_len == 4) {
  4110. result = 1;
  4111. } else {
  4112. result = 0;
  4113. }
  4114. end:
  4115. SigCleanSignatures(de_ctx);
  4116. DetectEngineCtxFree(de_ctx);
  4117. return result;
  4118. }
  4119. int DetectFastPatternTest159(void)
  4120. {
  4121. DetectEngineCtx *de_ctx = NULL;
  4122. int result = 0;
  4123. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4124. goto end;
  4125. de_ctx->flags |= DE_QUIET;
  4126. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4127. "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; within:30; sid:1;)");
  4128. if (de_ctx->sig_list == NULL)
  4129. goto end;
  4130. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx;
  4131. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4132. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  4133. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  4134. ud->fp_chop_offset == 3 &&
  4135. ud->fp_chop_len == 4) {
  4136. result = 1;
  4137. } else {
  4138. result = 0;
  4139. }
  4140. end:
  4141. SigCleanSignatures(de_ctx);
  4142. DetectEngineCtxFree(de_ctx);
  4143. return result;
  4144. }
  4145. int DetectFastPatternTest160(void)
  4146. {
  4147. DetectEngineCtx *de_ctx = NULL;
  4148. int result = 0;
  4149. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4150. goto end;
  4151. de_ctx->flags |= DE_QUIET;
  4152. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4153. "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; offset:30; sid:1;)");
  4154. if (de_ctx->sig_list == NULL)
  4155. goto end;
  4156. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx;
  4157. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4158. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  4159. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  4160. ud->fp_chop_offset == 3 &&
  4161. ud->fp_chop_len == 4) {
  4162. result = 1;
  4163. } else {
  4164. result = 0;
  4165. }
  4166. end:
  4167. SigCleanSignatures(de_ctx);
  4168. DetectEngineCtxFree(de_ctx);
  4169. return result;
  4170. }
  4171. int DetectFastPatternTest161(void)
  4172. {
  4173. DetectEngineCtx *de_ctx = NULL;
  4174. int result = 0;
  4175. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4176. goto end;
  4177. de_ctx->flags |= DE_QUIET;
  4178. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4179. "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; depth:30; sid:1;)");
  4180. if (de_ctx->sig_list == NULL)
  4181. goto end;
  4182. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx;
  4183. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4184. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  4185. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  4186. ud->fp_chop_offset == 3 &&
  4187. ud->fp_chop_len == 4) {
  4188. result = 1;
  4189. } else {
  4190. result = 0;
  4191. }
  4192. end:
  4193. SigCleanSignatures(de_ctx);
  4194. DetectEngineCtxFree(de_ctx);
  4195. return result;
  4196. }
  4197. int DetectFastPatternTest162(void)
  4198. {
  4199. DetectEngineCtx *de_ctx = NULL;
  4200. int result = 0;
  4201. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4202. goto end;
  4203. de_ctx->flags |= DE_QUIET;
  4204. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4205. "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_client_body; sid:1;)");
  4206. if (de_ctx->sig_list == NULL)
  4207. goto end;
  4208. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx;
  4209. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4210. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  4211. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  4212. ud->fp_chop_offset == 3 &&
  4213. ud->fp_chop_len == 4) {
  4214. result = 1;
  4215. } else {
  4216. result = 0;
  4217. }
  4218. end:
  4219. SigCleanSignatures(de_ctx);
  4220. DetectEngineCtxFree(de_ctx);
  4221. return result;
  4222. }
  4223. int DetectFastPatternTest163(void)
  4224. {
  4225. DetectEngineCtx *de_ctx = NULL;
  4226. int result = 0;
  4227. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4228. goto end;
  4229. de_ctx->flags |= DE_QUIET;
  4230. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4231. "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_client_body; sid:1;)");
  4232. if (de_ctx->sig_list == NULL)
  4233. goto end;
  4234. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx;
  4235. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4236. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  4237. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  4238. ud->fp_chop_offset == 3 &&
  4239. ud->fp_chop_len == 4) {
  4240. result = 1;
  4241. } else {
  4242. result = 0;
  4243. }
  4244. end:
  4245. SigCleanSignatures(de_ctx);
  4246. DetectEngineCtxFree(de_ctx);
  4247. return result;
  4248. }
  4249. int DetectFastPatternTest164(void)
  4250. {
  4251. DetectEngineCtx *de_ctx = NULL;
  4252. int result = 0;
  4253. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4254. goto end;
  4255. de_ctx->flags |= DE_QUIET;
  4256. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4257. "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_client_body; sid:1;)");
  4258. if (de_ctx->sig_list == NULL)
  4259. goto end;
  4260. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx;
  4261. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4262. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  4263. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  4264. ud->fp_chop_offset == 3 &&
  4265. ud->fp_chop_len == 4) {
  4266. result = 1;
  4267. } else {
  4268. result = 0;
  4269. }
  4270. end:
  4271. SigCleanSignatures(de_ctx);
  4272. DetectEngineCtxFree(de_ctx);
  4273. return result;
  4274. }
  4275. int DetectFastPatternTest165(void)
  4276. {
  4277. DetectEngineCtx *de_ctx = NULL;
  4278. int result = 0;
  4279. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4280. goto end;
  4281. de_ctx->flags |= DE_QUIET;
  4282. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4283. "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_client_body; sid:1;)");
  4284. if (de_ctx->sig_list == NULL)
  4285. goto end;
  4286. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx;
  4287. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4288. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  4289. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  4290. ud->fp_chop_offset == 3 &&
  4291. ud->fp_chop_len == 4) {
  4292. result = 1;
  4293. } else {
  4294. result = 0;
  4295. }
  4296. result = 1;
  4297. end:
  4298. SigCleanSignatures(de_ctx);
  4299. DetectEngineCtxFree(de_ctx);
  4300. return result;
  4301. }
  4302. int DetectFastPatternTest166(void)
  4303. {
  4304. DetectEngineCtx *de_ctx = NULL;
  4305. int result = 0;
  4306. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4307. goto end;
  4308. de_ctx->flags |= DE_QUIET;
  4309. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4310. "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:65977,4; http_client_body; content:\"three\"; http_client_body; distance:10; sid:1;)");
  4311. if (de_ctx->sig_list != NULL)
  4312. goto end;
  4313. result = 1;
  4314. end:
  4315. SigCleanSignatures(de_ctx);
  4316. DetectEngineCtxFree(de_ctx);
  4317. return result;
  4318. }
  4319. int DetectFastPatternTest167(void)
  4320. {
  4321. DetectEngineCtx *de_ctx = NULL;
  4322. int result = 0;
  4323. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4324. goto end;
  4325. de_ctx->flags |= DE_QUIET;
  4326. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4327. "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,65977; http_client_body; content:\"three\"; distance:10; http_client_body; sid:1;)");
  4328. if (de_ctx->sig_list != NULL)
  4329. goto end;
  4330. result = 1;
  4331. end:
  4332. SigCleanSignatures(de_ctx);
  4333. DetectEngineCtxFree(de_ctx);
  4334. return result;
  4335. }
  4336. int DetectFastPatternTest168(void)
  4337. {
  4338. DetectEngineCtx *de_ctx = NULL;
  4339. int result = 0;
  4340. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4341. goto end;
  4342. de_ctx->flags |= DE_QUIET;
  4343. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4344. "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:65534,4; http_client_body; content:\"three\"; http_client_body; distance:10; sid:1;)");
  4345. if (de_ctx->sig_list != NULL)
  4346. goto end;
  4347. result = 1;
  4348. end:
  4349. SigCleanSignatures(de_ctx);
  4350. DetectEngineCtxFree(de_ctx);
  4351. return result;
  4352. }
  4353. int DetectFastPatternTest169(void)
  4354. {
  4355. DetectEngineCtx *de_ctx = NULL;
  4356. int result = 0;
  4357. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4358. goto end;
  4359. de_ctx->flags |= DE_QUIET;
  4360. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4361. "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; sid:1;)");
  4362. if (de_ctx->sig_list == NULL)
  4363. goto end;
  4364. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx;
  4365. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4366. ud->flags & DETECT_CONTENT_NEGATED &&
  4367. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  4368. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  4369. ud->fp_chop_offset == 3 &&
  4370. ud->fp_chop_len == 4) {
  4371. result = 1;
  4372. } else {
  4373. result = 0;
  4374. }
  4375. end:
  4376. SigCleanSignatures(de_ctx);
  4377. DetectEngineCtxFree(de_ctx);
  4378. return result;
  4379. }
  4380. int DetectFastPatternTest170(void)
  4381. {
  4382. DetectEngineCtx *de_ctx = NULL;
  4383. int result = 0;
  4384. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4385. goto end;
  4386. de_ctx->flags |= DE_QUIET;
  4387. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4388. "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; distance:10; content:\"three\"; http_client_body; sid:1;)");
  4389. if (de_ctx->sig_list != NULL)
  4390. goto end;
  4391. result = 1;
  4392. end:
  4393. SigCleanSignatures(de_ctx);
  4394. DetectEngineCtxFree(de_ctx);
  4395. return result;
  4396. }
  4397. int DetectFastPatternTest171(void)
  4398. {
  4399. DetectEngineCtx *de_ctx = NULL;
  4400. int result = 0;
  4401. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4402. goto end;
  4403. de_ctx->flags |= DE_QUIET;
  4404. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4405. "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; within:10; content:\"three\"; http_client_body; sid:1;)");
  4406. if (de_ctx->sig_list != NULL)
  4407. goto end;
  4408. result = 1;
  4409. end:
  4410. SigCleanSignatures(de_ctx);
  4411. DetectEngineCtxFree(de_ctx);
  4412. return result;
  4413. }
  4414. int DetectFastPatternTest172(void)
  4415. {
  4416. DetectEngineCtx *de_ctx = NULL;
  4417. int result = 0;
  4418. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4419. goto end;
  4420. de_ctx->flags |= DE_QUIET;
  4421. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4422. "(content:\"one\"; http_client_body; content:!\"twooneone\"; fast_pattern:3,4; http_client_body; offset:10; content:\"three\"; http_client_body; sid:1;)");
  4423. if (de_ctx->sig_list != NULL)
  4424. goto end;
  4425. result = 1;
  4426. end:
  4427. SigCleanSignatures(de_ctx);
  4428. DetectEngineCtxFree(de_ctx);
  4429. return result;
  4430. }
  4431. int DetectFastPatternTest173(void)
  4432. {
  4433. DetectEngineCtx *de_ctx = NULL;
  4434. int result = 0;
  4435. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4436. goto end;
  4437. de_ctx->flags |= DE_QUIET;
  4438. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4439. "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; depth:10; content:\"three\"; http_client_body; sid:1;)");
  4440. if (de_ctx->sig_list != NULL)
  4441. goto end;
  4442. result = 1;
  4443. end:
  4444. SigCleanSignatures(de_ctx);
  4445. DetectEngineCtxFree(de_ctx);
  4446. return result;
  4447. }
  4448. int DetectFastPatternTest174(void)
  4449. {
  4450. DetectEngineCtx *de_ctx = NULL;
  4451. int result = 0;
  4452. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4453. goto end;
  4454. de_ctx->flags |= DE_QUIET;
  4455. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4456. "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; sid:1;)");
  4457. if (de_ctx->sig_list == NULL)
  4458. goto end;
  4459. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx;
  4460. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4461. ud->flags & DETECT_CONTENT_NEGATED &&
  4462. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  4463. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  4464. ud->fp_chop_offset == 3 &&
  4465. ud->fp_chop_len == 4) {
  4466. result = 1;
  4467. } else {
  4468. result = 0;
  4469. }
  4470. end:
  4471. SigCleanSignatures(de_ctx);
  4472. DetectEngineCtxFree(de_ctx);
  4473. return result;
  4474. }
  4475. /* http_client_body fast_pattern tests ^ */
  4476. /* content fast_pattern tests v */
  4477. int DetectFastPatternTest175(void)
  4478. {
  4479. DetectEngineCtx *de_ctx = NULL;
  4480. int result = 0;
  4481. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4482. goto end;
  4483. de_ctx->flags |= DE_QUIET;
  4484. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4485. "(content:\"two\"; content:!\"one\"; distance:20; fast_pattern; sid:1;)");
  4486. if (de_ctx->sig_list != NULL)
  4487. goto end;
  4488. result = 1;
  4489. end:
  4490. SigCleanSignatures(de_ctx);
  4491. DetectEngineCtxFree(de_ctx);
  4492. return result;
  4493. }
  4494. int DetectFastPatternTest176(void)
  4495. {
  4496. DetectEngineCtx *de_ctx = NULL;
  4497. int result = 0;
  4498. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4499. goto end;
  4500. de_ctx->flags |= DE_QUIET;
  4501. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4502. "(content:\"two\"; content:!\"one\"; within:20; fast_pattern; sid:1;)");
  4503. if (de_ctx->sig_list != NULL)
  4504. goto end;
  4505. result = 1;
  4506. end:
  4507. SigCleanSignatures(de_ctx);
  4508. DetectEngineCtxFree(de_ctx);
  4509. return result;
  4510. }
  4511. int DetectFastPatternTest177(void)
  4512. {
  4513. DetectEngineCtx *de_ctx = NULL;
  4514. int result = 0;
  4515. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4516. goto end;
  4517. de_ctx->flags |= DE_QUIET;
  4518. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4519. "(content:\"two\"; content:!\"one\"; offset:20; fast_pattern; sid:1;)");
  4520. if (de_ctx->sig_list != NULL)
  4521. goto end;
  4522. result = 1;
  4523. end:
  4524. SigCleanSignatures(de_ctx);
  4525. DetectEngineCtxFree(de_ctx);
  4526. return result;
  4527. }
  4528. int DetectFastPatternTest178(void)
  4529. {
  4530. DetectEngineCtx *de_ctx = NULL;
  4531. int result = 0;
  4532. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4533. goto end;
  4534. de_ctx->flags |= DE_QUIET;
  4535. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4536. "(content:\"two\"; content:!\"one\"; depth:20; fast_pattern; sid:1;)");
  4537. if (de_ctx->sig_list != NULL)
  4538. goto end;
  4539. result = 1;
  4540. end:
  4541. SigCleanSignatures(de_ctx);
  4542. DetectEngineCtxFree(de_ctx);
  4543. return result;
  4544. }
  4545. /* content fast_pattern tests ^ */
  4546. /* http_header fast_pattern tests v */
  4547. int DetectFastPatternTest179(void)
  4548. {
  4549. DetectEngineCtx *de_ctx = NULL;
  4550. int result = 0;
  4551. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4552. goto end;
  4553. de_ctx->flags |= DE_QUIET;
  4554. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4555. "(content:\"one\"; http_header; "
  4556. "content:!\"oneonetwo\"; fast_pattern:3,4; http_header; "
  4557. "content:\"three\"; http_header; sid:1;)");
  4558. if (de_ctx->sig_list == NULL)
  4559. goto end;
  4560. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx;
  4561. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4562. ud->flags & DETECT_CONTENT_NEGATED &&
  4563. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  4564. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  4565. ud->fp_chop_offset == 3 &&
  4566. ud->fp_chop_len == 4) {
  4567. result = 1;
  4568. } else {
  4569. result = 0;
  4570. }
  4571. end:
  4572. SigCleanSignatures(de_ctx);
  4573. DetectEngineCtxFree(de_ctx);
  4574. return result;
  4575. }
  4576. /**
  4577. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  4578. */
  4579. int DetectFastPatternTest180(void)
  4580. {
  4581. SigMatch *sm = NULL;
  4582. DetectEngineCtx *de_ctx = NULL;
  4583. int result = 0;
  4584. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4585. goto end;
  4586. de_ctx->flags |= DE_QUIET;
  4587. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4588. "(content:\"/one/\"; fast_pattern:only; http_header; "
  4589. "msg:\"Testing fast_pattern\"; sid:1;)");
  4590. if (de_ctx->sig_list == NULL)
  4591. goto end;
  4592. result = 0;
  4593. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH];
  4594. if (sm != NULL) {
  4595. if ( ((DetectContentData *)sm->ctx)->flags &
  4596. DETECT_CONTENT_FAST_PATTERN) {
  4597. result = 1;
  4598. } else {
  4599. result = 0;
  4600. }
  4601. }
  4602. end:
  4603. SigCleanSignatures(de_ctx);
  4604. DetectEngineCtxFree(de_ctx);
  4605. return result;
  4606. }
  4607. /**
  4608. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  4609. */
  4610. int DetectFastPatternTest181(void)
  4611. {
  4612. SigMatch *sm = NULL;
  4613. DetectEngineCtx *de_ctx = NULL;
  4614. int result = 0;
  4615. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4616. goto end;
  4617. de_ctx->flags |= DE_QUIET;
  4618. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4619. "(content:\"oneoneone\"; fast_pattern:3,4; http_header; "
  4620. "msg:\"Testing fast_pattern\"; sid:1;)");
  4621. if (de_ctx->sig_list == NULL)
  4622. goto end;
  4623. result = 0;
  4624. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH];
  4625. if (sm != NULL) {
  4626. if ( ((DetectContentData *)sm->ctx)->flags &
  4627. DETECT_CONTENT_FAST_PATTERN) {
  4628. result = 1;
  4629. } else {
  4630. result = 0;
  4631. }
  4632. }
  4633. end:
  4634. SigCleanSignatures(de_ctx);
  4635. DetectEngineCtxFree(de_ctx);
  4636. return result;
  4637. }
  4638. int DetectFastPatternTest182(void)
  4639. {
  4640. SigMatch *sm = NULL;
  4641. DetectEngineCtx *de_ctx = NULL;
  4642. int result = 0;
  4643. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4644. goto end;
  4645. de_ctx->flags |= DE_QUIET;
  4646. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4647. "(content:\"one\"; fast_pattern:only; http_header; sid:1;)");
  4648. if (de_ctx->sig_list == NULL)
  4649. goto end;
  4650. result = 0;
  4651. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH];
  4652. DetectContentData *ud = sm->ctx;
  4653. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4654. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  4655. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  4656. ud->fp_chop_offset == 0 &&
  4657. ud->fp_chop_len == 0) {
  4658. result = 1;
  4659. } else {
  4660. result = 0;
  4661. }
  4662. end:
  4663. SigCleanSignatures(de_ctx);
  4664. DetectEngineCtxFree(de_ctx);
  4665. return result;
  4666. }
  4667. int DetectFastPatternTest183(void)
  4668. {
  4669. SigMatch *sm = NULL;
  4670. DetectEngineCtx *de_ctx = NULL;
  4671. int result = 0;
  4672. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4673. goto end;
  4674. de_ctx->flags |= DE_QUIET;
  4675. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4676. "(content:\"oneoneone\"; fast_pattern:3,4; http_header; sid:1;)");
  4677. if (de_ctx->sig_list == NULL)
  4678. goto end;
  4679. result = 0;
  4680. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH];
  4681. DetectContentData *ud = sm->ctx;
  4682. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4683. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  4684. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  4685. ud->fp_chop_offset == 3 &&
  4686. ud->fp_chop_len == 4) {
  4687. result = 1;
  4688. } else {
  4689. result = 0;
  4690. }
  4691. end:
  4692. SigCleanSignatures(de_ctx);
  4693. DetectEngineCtxFree(de_ctx);
  4694. return result;
  4695. }
  4696. int DetectFastPatternTest184(void)
  4697. {
  4698. DetectEngineCtx *de_ctx = NULL;
  4699. int result = 0;
  4700. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4701. goto end;
  4702. de_ctx->flags |= DE_QUIET;
  4703. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4704. "(content:\"one\"; http_header; content:\"two\"; fast_pattern:only; http_header; distance:10; sid:1;)");
  4705. if (de_ctx->sig_list != NULL)
  4706. goto end;
  4707. result = 1;
  4708. end:
  4709. SigCleanSignatures(de_ctx);
  4710. DetectEngineCtxFree(de_ctx);
  4711. return result;
  4712. }
  4713. int DetectFastPatternTest185(void)
  4714. {
  4715. DetectEngineCtx *de_ctx = NULL;
  4716. int result = 0;
  4717. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4718. goto end;
  4719. de_ctx->flags |= DE_QUIET;
  4720. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4721. "(content:\"one\"; http_header; content:\"two\"; distance:10; fast_pattern:only; http_header; sid:1;)");
  4722. if (de_ctx->sig_list != NULL)
  4723. goto end;
  4724. result = 1;
  4725. end:
  4726. SigCleanSignatures(de_ctx);
  4727. DetectEngineCtxFree(de_ctx);
  4728. return result;
  4729. }
  4730. int DetectFastPatternTest186(void)
  4731. {
  4732. DetectEngineCtx *de_ctx = NULL;
  4733. int result = 0;
  4734. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4735. goto end;
  4736. de_ctx->flags |= DE_QUIET;
  4737. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4738. "(content:\"one\"; http_header; content:\"two\"; fast_pattern:only; http_header; within:10; sid:1;)");
  4739. if (de_ctx->sig_list != NULL)
  4740. goto end;
  4741. result = 1;
  4742. end:
  4743. SigCleanSignatures(de_ctx);
  4744. DetectEngineCtxFree(de_ctx);
  4745. return result;
  4746. }
  4747. int DetectFastPatternTest187(void)
  4748. {
  4749. DetectEngineCtx *de_ctx = NULL;
  4750. int result = 0;
  4751. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4752. goto end;
  4753. de_ctx->flags |= DE_QUIET;
  4754. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4755. "(content:\"one\"; http_header; content:\"two\"; within:10; fast_pattern:only; http_header; sid:1;)");
  4756. if (de_ctx->sig_list != NULL)
  4757. goto end;
  4758. result = 1;
  4759. end:
  4760. SigCleanSignatures(de_ctx);
  4761. DetectEngineCtxFree(de_ctx);
  4762. return result;
  4763. }
  4764. int DetectFastPatternTest188(void)
  4765. {
  4766. DetectEngineCtx *de_ctx = NULL;
  4767. int result = 0;
  4768. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4769. goto end;
  4770. de_ctx->flags |= DE_QUIET;
  4771. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4772. "(content:\"one\"; http_header; content:\"two\"; fast_pattern:only; http_header; offset:10; sid:1;)");
  4773. if (de_ctx->sig_list != NULL)
  4774. goto end;
  4775. result = 1;
  4776. end:
  4777. SigCleanSignatures(de_ctx);
  4778. DetectEngineCtxFree(de_ctx);
  4779. return result;
  4780. }
  4781. int DetectFastPatternTest189(void)
  4782. {
  4783. DetectEngineCtx *de_ctx = NULL;
  4784. int result = 0;
  4785. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4786. goto end;
  4787. de_ctx->flags |= DE_QUIET;
  4788. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4789. "(content:\"one\"; http_header; content:\"two\"; offset:10; fast_pattern:only; http_header; sid:1;)");
  4790. if (de_ctx->sig_list != NULL)
  4791. goto end;
  4792. result = 1;
  4793. end:
  4794. SigCleanSignatures(de_ctx);
  4795. DetectEngineCtxFree(de_ctx);
  4796. return result;
  4797. }
  4798. int DetectFastPatternTest190(void)
  4799. {
  4800. DetectEngineCtx *de_ctx = NULL;
  4801. int result = 0;
  4802. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4803. goto end;
  4804. de_ctx->flags |= DE_QUIET;
  4805. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4806. "(content:\"one\"; http_header; content:\"two\"; fast_pattern:only; http_header; depth:10; sid:1;)");
  4807. if (de_ctx->sig_list != NULL)
  4808. goto end;
  4809. result = 1;
  4810. end:
  4811. SigCleanSignatures(de_ctx);
  4812. DetectEngineCtxFree(de_ctx);
  4813. return result;
  4814. }
  4815. int DetectFastPatternTest191(void)
  4816. {
  4817. DetectEngineCtx *de_ctx = NULL;
  4818. int result = 0;
  4819. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4820. goto end;
  4821. de_ctx->flags |= DE_QUIET;
  4822. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4823. "(content:\"one\"; http_header; content:\"two\"; depth:10; fast_pattern:only; http_header; sid:1;)");
  4824. if (de_ctx->sig_list != NULL)
  4825. goto end;
  4826. result = 1;
  4827. end:
  4828. SigCleanSignatures(de_ctx);
  4829. DetectEngineCtxFree(de_ctx);
  4830. return result;
  4831. }
  4832. int DetectFastPatternTest192(void)
  4833. {
  4834. DetectEngineCtx *de_ctx = NULL;
  4835. int result = 0;
  4836. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4837. goto end;
  4838. de_ctx->flags |= DE_QUIET;
  4839. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4840. "(content:\"one\"; http_header; content:!\"two\"; fast_pattern:only; http_header; sid:1;)");
  4841. if (de_ctx->sig_list != NULL)
  4842. goto end;
  4843. result = 1;
  4844. end:
  4845. SigCleanSignatures(de_ctx);
  4846. DetectEngineCtxFree(de_ctx);
  4847. return result;
  4848. }
  4849. int DetectFastPatternTest193(void)
  4850. {
  4851. DetectEngineCtx *de_ctx = NULL;
  4852. int result = 0;
  4853. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4854. goto end;
  4855. de_ctx->flags |= DE_QUIET;
  4856. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4857. "(content: \"one\"; http_header; content:\"two\"; http_header; distance:30; content:\"two\"; fast_pattern:only; http_header; sid:1;)");
  4858. if (de_ctx->sig_list == NULL)
  4859. goto end;
  4860. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx;
  4861. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4862. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  4863. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  4864. ud->fp_chop_offset == 0 &&
  4865. ud->fp_chop_len == 0) {
  4866. result = 1;
  4867. } else {
  4868. result = 0;
  4869. }
  4870. end:
  4871. SigCleanSignatures(de_ctx);
  4872. DetectEngineCtxFree(de_ctx);
  4873. return result;
  4874. }
  4875. int DetectFastPatternTest194(void)
  4876. {
  4877. DetectEngineCtx *de_ctx = NULL;
  4878. int result = 0;
  4879. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4880. goto end;
  4881. de_ctx->flags |= DE_QUIET;
  4882. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4883. "(content:\"one\"; http_header; content:\"two\"; http_header; within:30; content:\"two\"; fast_pattern:only; http_header; sid:1;)");
  4884. if (de_ctx->sig_list == NULL)
  4885. goto end;
  4886. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx;
  4887. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4888. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  4889. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  4890. ud->fp_chop_offset == 0 &&
  4891. ud->fp_chop_len == 0) {
  4892. result = 1;
  4893. } else {
  4894. result = 0;
  4895. }
  4896. end:
  4897. SigCleanSignatures(de_ctx);
  4898. DetectEngineCtxFree(de_ctx);
  4899. return result;
  4900. }
  4901. int DetectFastPatternTest195(void)
  4902. {
  4903. DetectEngineCtx *de_ctx = NULL;
  4904. int result = 0;
  4905. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4906. goto end;
  4907. de_ctx->flags |= DE_QUIET;
  4908. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4909. "(content:\"one\"; http_header; content:\"two\"; http_header; offset:30; content:\"two\"; fast_pattern:only; http_header; sid:1;)");
  4910. if (de_ctx->sig_list == NULL)
  4911. goto end;
  4912. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx;
  4913. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4914. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  4915. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  4916. ud->fp_chop_offset == 0 &&
  4917. ud->fp_chop_len == 0) {
  4918. result = 1;
  4919. } else {
  4920. result = 0;
  4921. }
  4922. end:
  4923. SigCleanSignatures(de_ctx);
  4924. DetectEngineCtxFree(de_ctx);
  4925. return result;
  4926. }
  4927. int DetectFastPatternTest196(void)
  4928. {
  4929. DetectEngineCtx *de_ctx = NULL;
  4930. int result = 0;
  4931. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4932. goto end;
  4933. de_ctx->flags |= DE_QUIET;
  4934. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4935. "(content:\"one\"; http_header; content:\"two\"; http_header; depth:30; content:\"two\"; fast_pattern:only; http_header; sid:1;)");
  4936. if (de_ctx->sig_list == NULL)
  4937. goto end;
  4938. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx;
  4939. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4940. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  4941. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  4942. ud->fp_chop_offset == 0 &&
  4943. ud->fp_chop_len == 0) {
  4944. result = 1;
  4945. } else {
  4946. result = 0;
  4947. }
  4948. end:
  4949. SigCleanSignatures(de_ctx);
  4950. DetectEngineCtxFree(de_ctx);
  4951. return result;
  4952. }
  4953. int DetectFastPatternTest197(void)
  4954. {
  4955. DetectEngineCtx *de_ctx = NULL;
  4956. int result = 0;
  4957. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4958. goto end;
  4959. de_ctx->flags |= DE_QUIET;
  4960. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4961. "(content:!\"one\"; fast_pattern; http_header; content:\"two\"; http_header; sid:1;)");
  4962. if (de_ctx->sig_list == NULL)
  4963. goto end;
  4964. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx;
  4965. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  4966. ud->flags & DETECT_CONTENT_NEGATED &&
  4967. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  4968. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  4969. ud->fp_chop_offset == 0 &&
  4970. ud->fp_chop_len == 0) {
  4971. result = 1;
  4972. } else {
  4973. result = 0;
  4974. }
  4975. end:
  4976. SigCleanSignatures(de_ctx);
  4977. DetectEngineCtxFree(de_ctx);
  4978. return result;
  4979. }
  4980. int DetectFastPatternTest198(void)
  4981. {
  4982. DetectEngineCtx *de_ctx = NULL;
  4983. int result = 0;
  4984. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  4985. goto end;
  4986. de_ctx->flags |= DE_QUIET;
  4987. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  4988. "(content:\"two\"; http_header; content:!\"one\"; fast_pattern; http_header; distance:20; sid:1;)");
  4989. if (de_ctx->sig_list != NULL)
  4990. goto end;
  4991. result = 1;
  4992. end:
  4993. SigCleanSignatures(de_ctx);
  4994. DetectEngineCtxFree(de_ctx);
  4995. return result;
  4996. }
  4997. int DetectFastPatternTest199(void)
  4998. {
  4999. DetectEngineCtx *de_ctx = NULL;
  5000. int result = 0;
  5001. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5002. goto end;
  5003. de_ctx->flags |= DE_QUIET;
  5004. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5005. "(content:\"two\"; http_header; content:!\"one\"; fast_pattern; http_header; within:20; sid:1;)");
  5006. if (de_ctx->sig_list != NULL)
  5007. goto end;
  5008. result = 1;
  5009. end:
  5010. SigCleanSignatures(de_ctx);
  5011. DetectEngineCtxFree(de_ctx);
  5012. return result;
  5013. }
  5014. int DetectFastPatternTest200(void)
  5015. {
  5016. DetectEngineCtx *de_ctx = NULL;
  5017. int result = 0;
  5018. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5019. goto end;
  5020. de_ctx->flags |= DE_QUIET;
  5021. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5022. "(content:\"two\"; http_header; content:!\"one\"; fast_pattern; http_header; offset:20; sid:1;)");
  5023. if (de_ctx->sig_list != NULL)
  5024. goto end;
  5025. result = 1;
  5026. end:
  5027. SigCleanSignatures(de_ctx);
  5028. DetectEngineCtxFree(de_ctx);
  5029. return result;
  5030. }
  5031. int DetectFastPatternTest201(void)
  5032. {
  5033. DetectEngineCtx *de_ctx = NULL;
  5034. int result = 0;
  5035. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5036. goto end;
  5037. de_ctx->flags |= DE_QUIET;
  5038. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5039. "(content:\"two\"; http_header; content:!\"one\"; fast_pattern; http_header; depth:20; sid:1;)");
  5040. if (de_ctx->sig_list != NULL)
  5041. goto end;
  5042. result = 1;
  5043. end:
  5044. SigCleanSignatures(de_ctx);
  5045. DetectEngineCtxFree(de_ctx);
  5046. return result;
  5047. }
  5048. int DetectFastPatternTest202(void)
  5049. {
  5050. DetectEngineCtx *de_ctx = NULL;
  5051. int result = 0;
  5052. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5053. goto end;
  5054. de_ctx->flags |= DE_QUIET;
  5055. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5056. "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; sid:1;)");
  5057. if (de_ctx->sig_list == NULL)
  5058. goto end;
  5059. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx;
  5060. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5061. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5062. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  5063. ud->fp_chop_offset == 3 &&
  5064. ud->fp_chop_len == 4) {
  5065. result = 1;
  5066. } else {
  5067. result = 0;
  5068. }
  5069. end:
  5070. SigCleanSignatures(de_ctx);
  5071. DetectEngineCtxFree(de_ctx);
  5072. return result;
  5073. }
  5074. int DetectFastPatternTest203(void)
  5075. {
  5076. DetectEngineCtx *de_ctx = NULL;
  5077. int result = 0;
  5078. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5079. goto end;
  5080. de_ctx->flags |= DE_QUIET;
  5081. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5082. "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; distance:30; sid:1;)");
  5083. if (de_ctx->sig_list == NULL)
  5084. goto end;
  5085. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx;
  5086. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5087. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5088. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  5089. ud->fp_chop_offset == 3 &&
  5090. ud->fp_chop_len == 4) {
  5091. result = 1;
  5092. } else {
  5093. result = 0;
  5094. }
  5095. end:
  5096. SigCleanSignatures(de_ctx);
  5097. DetectEngineCtxFree(de_ctx);
  5098. return result;
  5099. }
  5100. int DetectFastPatternTest204(void)
  5101. {
  5102. DetectEngineCtx *de_ctx = NULL;
  5103. int result = 0;
  5104. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5105. goto end;
  5106. de_ctx->flags |= DE_QUIET;
  5107. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5108. "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; within:30; sid:1;)");
  5109. if (de_ctx->sig_list == NULL)
  5110. goto end;
  5111. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx;
  5112. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5113. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5114. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  5115. ud->fp_chop_offset == 3 &&
  5116. ud->fp_chop_len == 4) {
  5117. result = 1;
  5118. } else {
  5119. result = 0;
  5120. }
  5121. end:
  5122. SigCleanSignatures(de_ctx);
  5123. DetectEngineCtxFree(de_ctx);
  5124. return result;
  5125. }
  5126. int DetectFastPatternTest205(void)
  5127. {
  5128. DetectEngineCtx *de_ctx = NULL;
  5129. int result = 0;
  5130. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5131. goto end;
  5132. de_ctx->flags |= DE_QUIET;
  5133. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5134. "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; offset:30; sid:1;)");
  5135. if (de_ctx->sig_list == NULL)
  5136. goto end;
  5137. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx;
  5138. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5139. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5140. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  5141. ud->fp_chop_offset == 3 &&
  5142. ud->fp_chop_len == 4) {
  5143. result = 1;
  5144. } else {
  5145. result = 0;
  5146. }
  5147. end:
  5148. SigCleanSignatures(de_ctx);
  5149. DetectEngineCtxFree(de_ctx);
  5150. return result;
  5151. }
  5152. int DetectFastPatternTest206(void)
  5153. {
  5154. DetectEngineCtx *de_ctx = NULL;
  5155. int result = 0;
  5156. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5157. goto end;
  5158. de_ctx->flags |= DE_QUIET;
  5159. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5160. "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; depth:30; sid:1;)");
  5161. if (de_ctx->sig_list == NULL)
  5162. goto end;
  5163. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx;
  5164. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5165. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5166. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  5167. ud->fp_chop_offset == 3 &&
  5168. ud->fp_chop_len == 4) {
  5169. result = 1;
  5170. } else {
  5171. result = 0;
  5172. }
  5173. end:
  5174. SigCleanSignatures(de_ctx);
  5175. DetectEngineCtxFree(de_ctx);
  5176. return result;
  5177. }
  5178. int DetectFastPatternTest207(void)
  5179. {
  5180. DetectEngineCtx *de_ctx = NULL;
  5181. int result = 0;
  5182. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5183. goto end;
  5184. de_ctx->flags |= DE_QUIET;
  5185. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5186. "(content:\"one\"; http_header; content:\"two\"; http_header; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_header; sid:1;)");
  5187. if (de_ctx->sig_list == NULL)
  5188. goto end;
  5189. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx;
  5190. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5191. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5192. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  5193. ud->fp_chop_offset == 3 &&
  5194. ud->fp_chop_len == 4) {
  5195. result = 1;
  5196. } else {
  5197. result = 0;
  5198. }
  5199. end:
  5200. SigCleanSignatures(de_ctx);
  5201. DetectEngineCtxFree(de_ctx);
  5202. return result;
  5203. }
  5204. int DetectFastPatternTest208(void)
  5205. {
  5206. DetectEngineCtx *de_ctx = NULL;
  5207. int result = 0;
  5208. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5209. goto end;
  5210. de_ctx->flags |= DE_QUIET;
  5211. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5212. "(content:\"one\"; http_header; content:\"two\"; http_header; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_header; sid:1;)");
  5213. if (de_ctx->sig_list == NULL)
  5214. goto end;
  5215. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx;
  5216. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5217. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5218. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  5219. ud->fp_chop_offset == 3 &&
  5220. ud->fp_chop_len == 4) {
  5221. result = 1;
  5222. } else {
  5223. result = 0;
  5224. }
  5225. end:
  5226. SigCleanSignatures(de_ctx);
  5227. DetectEngineCtxFree(de_ctx);
  5228. return result;
  5229. }
  5230. int DetectFastPatternTest209(void)
  5231. {
  5232. DetectEngineCtx *de_ctx = NULL;
  5233. int result = 0;
  5234. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5235. goto end;
  5236. de_ctx->flags |= DE_QUIET;
  5237. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5238. "(content:\"one\"; http_header; content:\"two\"; http_header; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_header; sid:1;)");
  5239. if (de_ctx->sig_list == NULL)
  5240. goto end;
  5241. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx;
  5242. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5243. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5244. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  5245. ud->fp_chop_offset == 3 &&
  5246. ud->fp_chop_len == 4) {
  5247. result = 1;
  5248. } else {
  5249. result = 0;
  5250. }
  5251. end:
  5252. SigCleanSignatures(de_ctx);
  5253. DetectEngineCtxFree(de_ctx);
  5254. return result;
  5255. }
  5256. int DetectFastPatternTest210(void)
  5257. {
  5258. DetectEngineCtx *de_ctx = NULL;
  5259. int result = 0;
  5260. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5261. goto end;
  5262. de_ctx->flags |= DE_QUIET;
  5263. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5264. "(content:\"one\"; http_header; content:\"two\"; http_header; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_header; sid:1;)");
  5265. if (de_ctx->sig_list == NULL)
  5266. goto end;
  5267. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx;
  5268. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5269. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5270. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  5271. ud->fp_chop_offset == 3 &&
  5272. ud->fp_chop_len == 4) {
  5273. result = 1;
  5274. } else {
  5275. result = 0;
  5276. }
  5277. result = 1;
  5278. end:
  5279. SigCleanSignatures(de_ctx);
  5280. DetectEngineCtxFree(de_ctx);
  5281. return result;
  5282. }
  5283. int DetectFastPatternTest211(void)
  5284. {
  5285. DetectEngineCtx *de_ctx = NULL;
  5286. int result = 0;
  5287. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5288. goto end;
  5289. de_ctx->flags |= DE_QUIET;
  5290. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5291. "(content:\"one\"; http_header; content:\"two\"; fast_pattern:65977,4; http_header; content:\"three\"; http_header; distance:10; sid:1;)");
  5292. if (de_ctx->sig_list != NULL)
  5293. goto end;
  5294. result = 1;
  5295. end:
  5296. SigCleanSignatures(de_ctx);
  5297. DetectEngineCtxFree(de_ctx);
  5298. return result;
  5299. }
  5300. int DetectFastPatternTest212(void)
  5301. {
  5302. DetectEngineCtx *de_ctx = NULL;
  5303. int result = 0;
  5304. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5305. goto end;
  5306. de_ctx->flags |= DE_QUIET;
  5307. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5308. "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,65977; http_header; content:\"three\"; distance:10; http_header; sid:1;)");
  5309. if (de_ctx->sig_list != NULL)
  5310. goto end;
  5311. result = 1;
  5312. end:
  5313. SigCleanSignatures(de_ctx);
  5314. DetectEngineCtxFree(de_ctx);
  5315. return result;
  5316. }
  5317. int DetectFastPatternTest213(void)
  5318. {
  5319. DetectEngineCtx *de_ctx = NULL;
  5320. int result = 0;
  5321. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5322. goto end;
  5323. de_ctx->flags |= DE_QUIET;
  5324. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5325. "(content:\"one\"; http_header; content:\"two\"; fast_pattern:65534,4; http_header; content:\"three\"; http_header; distance:10; sid:1;)");
  5326. if (de_ctx->sig_list != NULL)
  5327. goto end;
  5328. result = 1;
  5329. end:
  5330. SigCleanSignatures(de_ctx);
  5331. DetectEngineCtxFree(de_ctx);
  5332. return result;
  5333. }
  5334. int DetectFastPatternTest214(void)
  5335. {
  5336. DetectEngineCtx *de_ctx = NULL;
  5337. int result = 0;
  5338. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5339. goto end;
  5340. de_ctx->flags |= DE_QUIET;
  5341. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5342. "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; sid:1;)");
  5343. if (de_ctx->sig_list == NULL)
  5344. goto end;
  5345. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx;
  5346. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5347. ud->flags & DETECT_CONTENT_NEGATED &&
  5348. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5349. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  5350. ud->fp_chop_offset == 3 &&
  5351. ud->fp_chop_len == 4) {
  5352. result = 1;
  5353. } else {
  5354. result = 0;
  5355. }
  5356. end:
  5357. SigCleanSignatures(de_ctx);
  5358. DetectEngineCtxFree(de_ctx);
  5359. return result;
  5360. }
  5361. int DetectFastPatternTest215(void)
  5362. {
  5363. DetectEngineCtx *de_ctx = NULL;
  5364. int result = 0;
  5365. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5366. goto end;
  5367. de_ctx->flags |= DE_QUIET;
  5368. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5369. "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; distance:10; content:\"three\"; http_header; sid:1;)");
  5370. if (de_ctx->sig_list != NULL)
  5371. goto end;
  5372. result = 1;
  5373. end:
  5374. SigCleanSignatures(de_ctx);
  5375. DetectEngineCtxFree(de_ctx);
  5376. return result;
  5377. }
  5378. int DetectFastPatternTest216(void)
  5379. {
  5380. DetectEngineCtx *de_ctx = NULL;
  5381. int result = 0;
  5382. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5383. goto end;
  5384. de_ctx->flags |= DE_QUIET;
  5385. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5386. "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; within:10; content:\"three\"; http_header; sid:1;)");
  5387. if (de_ctx->sig_list != NULL)
  5388. goto end;
  5389. result = 1;
  5390. end:
  5391. SigCleanSignatures(de_ctx);
  5392. DetectEngineCtxFree(de_ctx);
  5393. return result;
  5394. }
  5395. int DetectFastPatternTest217(void)
  5396. {
  5397. DetectEngineCtx *de_ctx = NULL;
  5398. int result = 0;
  5399. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5400. goto end;
  5401. de_ctx->flags |= DE_QUIET;
  5402. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5403. "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; offset:10; content:\"three\"; http_header; sid:1;)");
  5404. if (de_ctx->sig_list != NULL)
  5405. goto end;
  5406. result = 1;
  5407. end:
  5408. SigCleanSignatures(de_ctx);
  5409. DetectEngineCtxFree(de_ctx);
  5410. return result;
  5411. }
  5412. int DetectFastPatternTest218(void)
  5413. {
  5414. DetectEngineCtx *de_ctx = NULL;
  5415. int result = 0;
  5416. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5417. goto end;
  5418. de_ctx->flags |= DE_QUIET;
  5419. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5420. "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; depth:10; content:\"three\"; http_header; sid:1;)");
  5421. if (de_ctx->sig_list != NULL)
  5422. goto end;
  5423. result = 1;
  5424. end:
  5425. SigCleanSignatures(de_ctx);
  5426. DetectEngineCtxFree(de_ctx);
  5427. return result;
  5428. }
  5429. int DetectFastPatternTest219(void)
  5430. {
  5431. DetectEngineCtx *de_ctx = NULL;
  5432. int result = 0;
  5433. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5434. goto end;
  5435. de_ctx->flags |= DE_QUIET;
  5436. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  5437. "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; sid:1;)");
  5438. if (de_ctx->sig_list == NULL)
  5439. goto end;
  5440. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx;
  5441. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5442. ud->flags & DETECT_CONTENT_NEGATED &&
  5443. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5444. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  5445. ud->fp_chop_offset == 3 &&
  5446. ud->fp_chop_len == 4) {
  5447. result = 1;
  5448. } else {
  5449. result = 0;
  5450. }
  5451. end:
  5452. SigCleanSignatures(de_ctx);
  5453. DetectEngineCtxFree(de_ctx);
  5454. return result;
  5455. }
  5456. /* http_header fast_pattern tests ^ */
  5457. /* http_raw_header fast_pattern tests v */
  5458. int DetectFastPatternTest220(void)
  5459. {
  5460. DetectEngineCtx *de_ctx = NULL;
  5461. int result = 0;
  5462. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5463. goto end;
  5464. de_ctx->flags |= DE_QUIET;
  5465. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5466. "(flow:to_server; content:\"one\"; http_raw_header; "
  5467. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; "
  5468. "content:\"three\"; http_raw_header; sid:1;)");
  5469. if (de_ctx->sig_list == NULL)
  5470. goto end;
  5471. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx;
  5472. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5473. ud->flags & DETECT_CONTENT_NEGATED &&
  5474. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5475. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  5476. ud->fp_chop_offset == 3 &&
  5477. ud->fp_chop_len == 4) {
  5478. result = 1;
  5479. } else {
  5480. result = 0;
  5481. }
  5482. end:
  5483. SigCleanSignatures(de_ctx);
  5484. DetectEngineCtxFree(de_ctx);
  5485. return result;
  5486. }
  5487. /**
  5488. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  5489. */
  5490. int DetectFastPatternTest221(void)
  5491. {
  5492. SigMatch *sm = NULL;
  5493. DetectEngineCtx *de_ctx = NULL;
  5494. int result = 0;
  5495. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5496. goto end;
  5497. de_ctx->flags |= DE_QUIET;
  5498. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5499. "(flow:to_server; content:\"/one/\"; fast_pattern:only; http_raw_header; "
  5500. "msg:\"Testing fast_pattern\"; sid:1;)");
  5501. if (de_ctx->sig_list == NULL)
  5502. goto end;
  5503. result = 0;
  5504. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH];
  5505. if (sm != NULL) {
  5506. if ( ((DetectContentData *)sm->ctx)->flags &
  5507. DETECT_CONTENT_FAST_PATTERN) {
  5508. result = 1;
  5509. } else {
  5510. result = 0;
  5511. }
  5512. }
  5513. end:
  5514. SigCleanSignatures(de_ctx);
  5515. DetectEngineCtxFree(de_ctx);
  5516. return result;
  5517. }
  5518. /**
  5519. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  5520. */
  5521. int DetectFastPatternTest222(void)
  5522. {
  5523. SigMatch *sm = NULL;
  5524. DetectEngineCtx *de_ctx = NULL;
  5525. int result = 0;
  5526. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5527. goto end;
  5528. de_ctx->flags |= DE_QUIET;
  5529. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5530. "(flow:to_server; content:\"oneoneone\"; fast_pattern:3,4; http_raw_header; "
  5531. "msg:\"Testing fast_pattern\"; sid:1;)");
  5532. if (de_ctx->sig_list == NULL)
  5533. goto end;
  5534. result = 0;
  5535. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH];
  5536. if (sm != NULL) {
  5537. if ( ((DetectContentData *)sm->ctx)->flags &
  5538. DETECT_CONTENT_FAST_PATTERN) {
  5539. result = 1;
  5540. } else {
  5541. result = 0;
  5542. }
  5543. }
  5544. end:
  5545. SigCleanSignatures(de_ctx);
  5546. DetectEngineCtxFree(de_ctx);
  5547. return result;
  5548. }
  5549. int DetectFastPatternTest223(void)
  5550. {
  5551. SigMatch *sm = NULL;
  5552. DetectEngineCtx *de_ctx = NULL;
  5553. int result = 0;
  5554. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5555. goto end;
  5556. de_ctx->flags |= DE_QUIET;
  5557. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5558. "(flow:to_server; content:\"one\"; fast_pattern:only; http_raw_header; sid:1;)");
  5559. if (de_ctx->sig_list == NULL)
  5560. goto end;
  5561. result = 0;
  5562. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH];
  5563. DetectContentData *ud = sm->ctx;
  5564. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5565. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  5566. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  5567. ud->fp_chop_offset == 0 &&
  5568. ud->fp_chop_len == 0) {
  5569. result = 1;
  5570. } else {
  5571. result = 0;
  5572. }
  5573. end:
  5574. SigCleanSignatures(de_ctx);
  5575. DetectEngineCtxFree(de_ctx);
  5576. return result;
  5577. }
  5578. int DetectFastPatternTest224(void)
  5579. {
  5580. SigMatch *sm = NULL;
  5581. DetectEngineCtx *de_ctx = NULL;
  5582. int result = 0;
  5583. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5584. goto end;
  5585. de_ctx->flags |= DE_QUIET;
  5586. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5587. "(flow:to_server; content:\"oneoneone\"; fast_pattern:3,4; http_raw_header; sid:1;)");
  5588. if (de_ctx->sig_list == NULL)
  5589. goto end;
  5590. result = 0;
  5591. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH];
  5592. DetectContentData *ud = sm->ctx;
  5593. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5594. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5595. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  5596. ud->fp_chop_offset == 3 &&
  5597. ud->fp_chop_len == 4) {
  5598. result = 1;
  5599. } else {
  5600. result = 0;
  5601. }
  5602. end:
  5603. SigCleanSignatures(de_ctx);
  5604. DetectEngineCtxFree(de_ctx);
  5605. return result;
  5606. }
  5607. int DetectFastPatternTest225(void)
  5608. {
  5609. DetectEngineCtx *de_ctx = NULL;
  5610. int result = 0;
  5611. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5612. goto end;
  5613. de_ctx->flags |= DE_QUIET;
  5614. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5615. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:only; http_raw_header; distance:10; sid:1;)");
  5616. if (de_ctx->sig_list != NULL)
  5617. goto end;
  5618. result = 1;
  5619. end:
  5620. SigCleanSignatures(de_ctx);
  5621. DetectEngineCtxFree(de_ctx);
  5622. return result;
  5623. }
  5624. int DetectFastPatternTest226(void)
  5625. {
  5626. DetectEngineCtx *de_ctx = NULL;
  5627. int result = 0;
  5628. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5629. goto end;
  5630. de_ctx->flags |= DE_QUIET;
  5631. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5632. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; distance:10; fast_pattern:only; http_raw_header; sid:1;)");
  5633. if (de_ctx->sig_list != NULL)
  5634. goto end;
  5635. result = 1;
  5636. end:
  5637. SigCleanSignatures(de_ctx);
  5638. DetectEngineCtxFree(de_ctx);
  5639. return result;
  5640. }
  5641. int DetectFastPatternTest227(void)
  5642. {
  5643. DetectEngineCtx *de_ctx = NULL;
  5644. int result = 0;
  5645. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5646. goto end;
  5647. de_ctx->flags |= DE_QUIET;
  5648. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5649. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:only; http_raw_header; within:10; sid:1;)");
  5650. if (de_ctx->sig_list != NULL)
  5651. goto end;
  5652. result = 1;
  5653. end:
  5654. SigCleanSignatures(de_ctx);
  5655. DetectEngineCtxFree(de_ctx);
  5656. return result;
  5657. }
  5658. int DetectFastPatternTest228(void)
  5659. {
  5660. DetectEngineCtx *de_ctx = NULL;
  5661. int result = 0;
  5662. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5663. goto end;
  5664. de_ctx->flags |= DE_QUIET;
  5665. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5666. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; within:10; fast_pattern:only; http_raw_header; sid:1;)");
  5667. if (de_ctx->sig_list != NULL)
  5668. goto end;
  5669. result = 1;
  5670. end:
  5671. SigCleanSignatures(de_ctx);
  5672. DetectEngineCtxFree(de_ctx);
  5673. return result;
  5674. }
  5675. int DetectFastPatternTest229(void)
  5676. {
  5677. DetectEngineCtx *de_ctx = NULL;
  5678. int result = 0;
  5679. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5680. goto end;
  5681. de_ctx->flags |= DE_QUIET;
  5682. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5683. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:only; http_raw_header; offset:10; sid:1;)");
  5684. if (de_ctx->sig_list != NULL)
  5685. goto end;
  5686. result = 1;
  5687. end:
  5688. SigCleanSignatures(de_ctx);
  5689. DetectEngineCtxFree(de_ctx);
  5690. return result;
  5691. }
  5692. int DetectFastPatternTest230(void)
  5693. {
  5694. DetectEngineCtx *de_ctx = NULL;
  5695. int result = 0;
  5696. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5697. goto end;
  5698. de_ctx->flags |= DE_QUIET;
  5699. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5700. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; offset:10; fast_pattern:only; http_raw_header; sid:1;)");
  5701. if (de_ctx->sig_list != NULL)
  5702. goto end;
  5703. result = 1;
  5704. end:
  5705. SigCleanSignatures(de_ctx);
  5706. DetectEngineCtxFree(de_ctx);
  5707. return result;
  5708. }
  5709. int DetectFastPatternTest231(void)
  5710. {
  5711. DetectEngineCtx *de_ctx = NULL;
  5712. int result = 0;
  5713. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5714. goto end;
  5715. de_ctx->flags |= DE_QUIET;
  5716. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5717. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:only; http_raw_header; depth:10; sid:1;)");
  5718. if (de_ctx->sig_list != NULL)
  5719. goto end;
  5720. result = 1;
  5721. end:
  5722. SigCleanSignatures(de_ctx);
  5723. DetectEngineCtxFree(de_ctx);
  5724. return result;
  5725. }
  5726. int DetectFastPatternTest232(void)
  5727. {
  5728. DetectEngineCtx *de_ctx = NULL;
  5729. int result = 0;
  5730. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5731. goto end;
  5732. de_ctx->flags |= DE_QUIET;
  5733. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5734. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; depth:10; fast_pattern:only; http_raw_header; sid:1;)");
  5735. if (de_ctx->sig_list != NULL)
  5736. goto end;
  5737. result = 1;
  5738. end:
  5739. SigCleanSignatures(de_ctx);
  5740. DetectEngineCtxFree(de_ctx);
  5741. return result;
  5742. }
  5743. int DetectFastPatternTest233(void)
  5744. {
  5745. DetectEngineCtx *de_ctx = NULL;
  5746. int result = 0;
  5747. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5748. goto end;
  5749. de_ctx->flags |= DE_QUIET;
  5750. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5751. "(flow:to_server; content:\"one\"; http_raw_header; content:!\"two\"; fast_pattern:only; http_raw_header; sid:1;)");
  5752. if (de_ctx->sig_list != NULL)
  5753. goto end;
  5754. result = 1;
  5755. end:
  5756. SigCleanSignatures(de_ctx);
  5757. DetectEngineCtxFree(de_ctx);
  5758. return result;
  5759. }
  5760. int DetectFastPatternTest234(void)
  5761. {
  5762. DetectEngineCtx *de_ctx = NULL;
  5763. int result = 0;
  5764. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5765. goto end;
  5766. de_ctx->flags |= DE_QUIET;
  5767. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5768. "(flow:to_server; content: \"one\"; http_raw_header; content:\"two\"; http_raw_header; distance:30; content:\"two\"; fast_pattern:only; http_raw_header; sid:1;)");
  5769. if (de_ctx->sig_list == NULL)
  5770. goto end;
  5771. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx;
  5772. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5773. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  5774. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  5775. ud->fp_chop_offset == 0 &&
  5776. ud->fp_chop_len == 0) {
  5777. result = 1;
  5778. } else {
  5779. result = 0;
  5780. }
  5781. end:
  5782. SigCleanSignatures(de_ctx);
  5783. DetectEngineCtxFree(de_ctx);
  5784. return result;
  5785. }
  5786. int DetectFastPatternTest235(void)
  5787. {
  5788. DetectEngineCtx *de_ctx = NULL;
  5789. int result = 0;
  5790. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5791. goto end;
  5792. de_ctx->flags |= DE_QUIET;
  5793. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5794. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; within:30; content:\"two\"; fast_pattern:only; http_raw_header; sid:1;)");
  5795. if (de_ctx->sig_list == NULL)
  5796. goto end;
  5797. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx;
  5798. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5799. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  5800. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  5801. ud->fp_chop_offset == 0 &&
  5802. ud->fp_chop_len == 0) {
  5803. result = 1;
  5804. } else {
  5805. result = 0;
  5806. }
  5807. end:
  5808. SigCleanSignatures(de_ctx);
  5809. DetectEngineCtxFree(de_ctx);
  5810. return result;
  5811. }
  5812. int DetectFastPatternTest236(void)
  5813. {
  5814. DetectEngineCtx *de_ctx = NULL;
  5815. int result = 0;
  5816. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5817. goto end;
  5818. de_ctx->flags |= DE_QUIET;
  5819. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5820. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; offset:30; content:\"two\"; fast_pattern:only; http_raw_header; sid:1;)");
  5821. if (de_ctx->sig_list == NULL)
  5822. goto end;
  5823. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx;
  5824. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5825. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  5826. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  5827. ud->fp_chop_offset == 0 &&
  5828. ud->fp_chop_len == 0) {
  5829. result = 1;
  5830. } else {
  5831. result = 0;
  5832. }
  5833. end:
  5834. SigCleanSignatures(de_ctx);
  5835. DetectEngineCtxFree(de_ctx);
  5836. return result;
  5837. }
  5838. int DetectFastPatternTest237(void)
  5839. {
  5840. DetectEngineCtx *de_ctx = NULL;
  5841. int result = 0;
  5842. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5843. goto end;
  5844. de_ctx->flags |= DE_QUIET;
  5845. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5846. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; depth:30; content:\"two\"; fast_pattern:only; http_raw_header; sid:1;)");
  5847. if (de_ctx->sig_list == NULL)
  5848. goto end;
  5849. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx;
  5850. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5851. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  5852. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  5853. ud->fp_chop_offset == 0 &&
  5854. ud->fp_chop_len == 0) {
  5855. result = 1;
  5856. } else {
  5857. result = 0;
  5858. }
  5859. end:
  5860. SigCleanSignatures(de_ctx);
  5861. DetectEngineCtxFree(de_ctx);
  5862. return result;
  5863. }
  5864. int DetectFastPatternTest238(void)
  5865. {
  5866. DetectEngineCtx *de_ctx = NULL;
  5867. int result = 0;
  5868. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5869. goto end;
  5870. de_ctx->flags |= DE_QUIET;
  5871. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5872. "(flow:to_server; content:!\"one\"; fast_pattern; http_raw_header; content:\"two\"; http_raw_header; sid:1;)");
  5873. if (de_ctx->sig_list == NULL)
  5874. goto end;
  5875. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx;
  5876. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5877. ud->flags & DETECT_CONTENT_NEGATED &&
  5878. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5879. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  5880. ud->fp_chop_offset == 0 &&
  5881. ud->fp_chop_len == 0) {
  5882. result = 1;
  5883. } else {
  5884. result = 0;
  5885. }
  5886. end:
  5887. SigCleanSignatures(de_ctx);
  5888. DetectEngineCtxFree(de_ctx);
  5889. return result;
  5890. }
  5891. int DetectFastPatternTest239(void)
  5892. {
  5893. DetectEngineCtx *de_ctx = NULL;
  5894. int result = 0;
  5895. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5896. goto end;
  5897. de_ctx->flags |= DE_QUIET;
  5898. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5899. "(flow:to_server; content:\"two\"; http_raw_header; content:!\"one\"; fast_pattern; http_raw_header; distance:20; sid:1;)");
  5900. if (de_ctx->sig_list != NULL)
  5901. goto end;
  5902. result = 1;
  5903. end:
  5904. SigCleanSignatures(de_ctx);
  5905. DetectEngineCtxFree(de_ctx);
  5906. return result;
  5907. }
  5908. int DetectFastPatternTest240(void)
  5909. {
  5910. DetectEngineCtx *de_ctx = NULL;
  5911. int result = 0;
  5912. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5913. goto end;
  5914. de_ctx->flags |= DE_QUIET;
  5915. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5916. "(flow:to_server; content:\"two\"; http_raw_header; content:!\"one\"; fast_pattern; http_raw_header; within:20; sid:1;)");
  5917. if (de_ctx->sig_list != NULL)
  5918. goto end;
  5919. result = 1;
  5920. end:
  5921. SigCleanSignatures(de_ctx);
  5922. DetectEngineCtxFree(de_ctx);
  5923. return result;
  5924. }
  5925. int DetectFastPatternTest241(void)
  5926. {
  5927. DetectEngineCtx *de_ctx = NULL;
  5928. int result = 0;
  5929. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5930. goto end;
  5931. de_ctx->flags |= DE_QUIET;
  5932. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5933. "(flow:to_server; content:\"two\"; http_raw_header; content:!\"one\"; fast_pattern; http_raw_header; offset:20; sid:1;)");
  5934. if (de_ctx->sig_list != NULL)
  5935. goto end;
  5936. result = 1;
  5937. end:
  5938. SigCleanSignatures(de_ctx);
  5939. DetectEngineCtxFree(de_ctx);
  5940. return result;
  5941. }
  5942. int DetectFastPatternTest242(void)
  5943. {
  5944. DetectEngineCtx *de_ctx = NULL;
  5945. int result = 0;
  5946. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5947. goto end;
  5948. de_ctx->flags |= DE_QUIET;
  5949. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5950. "(flow:to_server; content:\"two\"; http_raw_header; content:!\"one\"; fast_pattern; http_raw_header; depth:20; sid:1;)");
  5951. if (de_ctx->sig_list != NULL)
  5952. goto end;
  5953. result = 1;
  5954. end:
  5955. SigCleanSignatures(de_ctx);
  5956. DetectEngineCtxFree(de_ctx);
  5957. return result;
  5958. }
  5959. int DetectFastPatternTest243(void)
  5960. {
  5961. DetectEngineCtx *de_ctx = NULL;
  5962. int result = 0;
  5963. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5964. goto end;
  5965. de_ctx->flags |= DE_QUIET;
  5966. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5967. "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; sid:1;)");
  5968. if (de_ctx->sig_list == NULL)
  5969. goto end;
  5970. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx;
  5971. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5972. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5973. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  5974. ud->fp_chop_offset == 3 &&
  5975. ud->fp_chop_len == 4) {
  5976. result = 1;
  5977. } else {
  5978. result = 0;
  5979. }
  5980. end:
  5981. SigCleanSignatures(de_ctx);
  5982. DetectEngineCtxFree(de_ctx);
  5983. return result;
  5984. }
  5985. int DetectFastPatternTest244(void)
  5986. {
  5987. DetectEngineCtx *de_ctx = NULL;
  5988. int result = 0;
  5989. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  5990. goto end;
  5991. de_ctx->flags |= DE_QUIET;
  5992. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  5993. "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; distance:30; sid:1;)");
  5994. if (de_ctx->sig_list == NULL)
  5995. goto end;
  5996. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx;
  5997. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  5998. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  5999. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6000. ud->fp_chop_offset == 3 &&
  6001. ud->fp_chop_len == 4) {
  6002. result = 1;
  6003. } else {
  6004. result = 0;
  6005. }
  6006. end:
  6007. SigCleanSignatures(de_ctx);
  6008. DetectEngineCtxFree(de_ctx);
  6009. return result;
  6010. }
  6011. int DetectFastPatternTest245(void)
  6012. {
  6013. DetectEngineCtx *de_ctx = NULL;
  6014. int result = 0;
  6015. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6016. goto end;
  6017. de_ctx->flags |= DE_QUIET;
  6018. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6019. "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; within:30; sid:1;)");
  6020. if (de_ctx->sig_list == NULL)
  6021. goto end;
  6022. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx;
  6023. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6024. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6025. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6026. ud->fp_chop_offset == 3 &&
  6027. ud->fp_chop_len == 4) {
  6028. result = 1;
  6029. } else {
  6030. result = 0;
  6031. }
  6032. end:
  6033. SigCleanSignatures(de_ctx);
  6034. DetectEngineCtxFree(de_ctx);
  6035. return result;
  6036. }
  6037. int DetectFastPatternTest246(void)
  6038. {
  6039. DetectEngineCtx *de_ctx = NULL;
  6040. int result = 0;
  6041. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6042. goto end;
  6043. de_ctx->flags |= DE_QUIET;
  6044. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6045. "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; offset:30; sid:1;)");
  6046. if (de_ctx->sig_list == NULL)
  6047. goto end;
  6048. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx;
  6049. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6050. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6051. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6052. ud->fp_chop_offset == 3 &&
  6053. ud->fp_chop_len == 4) {
  6054. result = 1;
  6055. } else {
  6056. result = 0;
  6057. }
  6058. end:
  6059. SigCleanSignatures(de_ctx);
  6060. DetectEngineCtxFree(de_ctx);
  6061. return result;
  6062. }
  6063. int DetectFastPatternTest247(void)
  6064. {
  6065. DetectEngineCtx *de_ctx = NULL;
  6066. int result = 0;
  6067. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6068. goto end;
  6069. de_ctx->flags |= DE_QUIET;
  6070. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6071. "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; depth:30; sid:1;)");
  6072. if (de_ctx->sig_list == NULL)
  6073. goto end;
  6074. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx;
  6075. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6076. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6077. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6078. ud->fp_chop_offset == 3 &&
  6079. ud->fp_chop_len == 4) {
  6080. result = 1;
  6081. } else {
  6082. result = 0;
  6083. }
  6084. end:
  6085. SigCleanSignatures(de_ctx);
  6086. DetectEngineCtxFree(de_ctx);
  6087. return result;
  6088. }
  6089. int DetectFastPatternTest248(void)
  6090. {
  6091. DetectEngineCtx *de_ctx = NULL;
  6092. int result = 0;
  6093. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6094. goto end;
  6095. de_ctx->flags |= DE_QUIET;
  6096. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6097. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_raw_header; sid:1;)");
  6098. if (de_ctx->sig_list == NULL)
  6099. goto end;
  6100. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx;
  6101. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6102. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6103. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6104. ud->fp_chop_offset == 3 &&
  6105. ud->fp_chop_len == 4) {
  6106. result = 1;
  6107. } else {
  6108. result = 0;
  6109. }
  6110. end:
  6111. SigCleanSignatures(de_ctx);
  6112. DetectEngineCtxFree(de_ctx);
  6113. return result;
  6114. }
  6115. int DetectFastPatternTest249(void)
  6116. {
  6117. DetectEngineCtx *de_ctx = NULL;
  6118. int result = 0;
  6119. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6120. goto end;
  6121. de_ctx->flags |= DE_QUIET;
  6122. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6123. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_raw_header; sid:1;)");
  6124. if (de_ctx->sig_list == NULL)
  6125. goto end;
  6126. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx;
  6127. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6128. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6129. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6130. ud->fp_chop_offset == 3 &&
  6131. ud->fp_chop_len == 4) {
  6132. result = 1;
  6133. } else {
  6134. result = 0;
  6135. }
  6136. end:
  6137. SigCleanSignatures(de_ctx);
  6138. DetectEngineCtxFree(de_ctx);
  6139. return result;
  6140. }
  6141. int DetectFastPatternTest250(void)
  6142. {
  6143. DetectEngineCtx *de_ctx = NULL;
  6144. int result = 0;
  6145. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6146. goto end;
  6147. de_ctx->flags |= DE_QUIET;
  6148. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6149. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_raw_header; sid:1;)");
  6150. if (de_ctx->sig_list == NULL)
  6151. goto end;
  6152. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx;
  6153. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6154. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6155. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6156. ud->fp_chop_offset == 3 &&
  6157. ud->fp_chop_len == 4) {
  6158. result = 1;
  6159. } else {
  6160. result = 0;
  6161. }
  6162. end:
  6163. SigCleanSignatures(de_ctx);
  6164. DetectEngineCtxFree(de_ctx);
  6165. return result;
  6166. }
  6167. int DetectFastPatternTest251(void)
  6168. {
  6169. DetectEngineCtx *de_ctx = NULL;
  6170. int result = 0;
  6171. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6172. goto end;
  6173. de_ctx->flags |= DE_QUIET;
  6174. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6175. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_raw_header; sid:1;)");
  6176. if (de_ctx->sig_list == NULL)
  6177. goto end;
  6178. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx;
  6179. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6180. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6181. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6182. ud->fp_chop_offset == 3 &&
  6183. ud->fp_chop_len == 4) {
  6184. result = 1;
  6185. } else {
  6186. result = 0;
  6187. }
  6188. result = 1;
  6189. end:
  6190. SigCleanSignatures(de_ctx);
  6191. DetectEngineCtxFree(de_ctx);
  6192. return result;
  6193. }
  6194. int DetectFastPatternTest252(void)
  6195. {
  6196. DetectEngineCtx *de_ctx = NULL;
  6197. int result = 0;
  6198. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6199. goto end;
  6200. de_ctx->flags |= DE_QUIET;
  6201. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6202. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:65977,4; http_raw_header; content:\"three\"; http_raw_header; distance:10; sid:1;)");
  6203. if (de_ctx->sig_list != NULL)
  6204. goto end;
  6205. result = 1;
  6206. end:
  6207. SigCleanSignatures(de_ctx);
  6208. DetectEngineCtxFree(de_ctx);
  6209. return result;
  6210. }
  6211. int DetectFastPatternTest253(void)
  6212. {
  6213. DetectEngineCtx *de_ctx = NULL;
  6214. int result = 0;
  6215. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6216. goto end;
  6217. de_ctx->flags |= DE_QUIET;
  6218. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6219. "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,65977; http_raw_header; content:\"three\"; distance:10; http_raw_header; sid:1;)");
  6220. if (de_ctx->sig_list != NULL)
  6221. goto end;
  6222. result = 1;
  6223. end:
  6224. SigCleanSignatures(de_ctx);
  6225. DetectEngineCtxFree(de_ctx);
  6226. return result;
  6227. }
  6228. int DetectFastPatternTest254(void)
  6229. {
  6230. DetectEngineCtx *de_ctx = NULL;
  6231. int result = 0;
  6232. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6233. goto end;
  6234. de_ctx->flags |= DE_QUIET;
  6235. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6236. "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:65534,4; http_raw_header; content:\"three\"; http_raw_header; distance:10; sid:1;)");
  6237. if (de_ctx->sig_list != NULL)
  6238. goto end;
  6239. result = 1;
  6240. end:
  6241. SigCleanSignatures(de_ctx);
  6242. DetectEngineCtxFree(de_ctx);
  6243. return result;
  6244. }
  6245. int DetectFastPatternTest255(void)
  6246. {
  6247. DetectEngineCtx *de_ctx = NULL;
  6248. int result = 0;
  6249. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6250. goto end;
  6251. de_ctx->flags |= DE_QUIET;
  6252. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6253. "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; sid:1;)");
  6254. if (de_ctx->sig_list == NULL)
  6255. goto end;
  6256. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx;
  6257. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6258. ud->flags & DETECT_CONTENT_NEGATED &&
  6259. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6260. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6261. ud->fp_chop_offset == 3 &&
  6262. ud->fp_chop_len == 4) {
  6263. result = 1;
  6264. } else {
  6265. result = 0;
  6266. }
  6267. end:
  6268. SigCleanSignatures(de_ctx);
  6269. DetectEngineCtxFree(de_ctx);
  6270. return result;
  6271. }
  6272. int DetectFastPatternTest256(void)
  6273. {
  6274. DetectEngineCtx *de_ctx = NULL;
  6275. int result = 0;
  6276. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6277. goto end;
  6278. de_ctx->flags |= DE_QUIET;
  6279. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6280. "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; distance:10; content:\"three\"; http_raw_header; sid:1;)");
  6281. if (de_ctx->sig_list != NULL)
  6282. goto end;
  6283. result = 1;
  6284. end:
  6285. SigCleanSignatures(de_ctx);
  6286. DetectEngineCtxFree(de_ctx);
  6287. return result;
  6288. }
  6289. int DetectFastPatternTest257(void)
  6290. {
  6291. DetectEngineCtx *de_ctx = NULL;
  6292. int result = 0;
  6293. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6294. goto end;
  6295. de_ctx->flags |= DE_QUIET;
  6296. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6297. "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; within:10; content:\"three\"; http_raw_header; sid:1;)");
  6298. if (de_ctx->sig_list != NULL)
  6299. goto end;
  6300. result = 1;
  6301. end:
  6302. SigCleanSignatures(de_ctx);
  6303. DetectEngineCtxFree(de_ctx);
  6304. return result;
  6305. }
  6306. int DetectFastPatternTest258(void)
  6307. {
  6308. DetectEngineCtx *de_ctx = NULL;
  6309. int result = 0;
  6310. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6311. goto end;
  6312. de_ctx->flags |= DE_QUIET;
  6313. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6314. "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; offset:10; content:\"three\"; http_raw_header; sid:1;)");
  6315. if (de_ctx->sig_list != NULL)
  6316. goto end;
  6317. result = 1;
  6318. end:
  6319. SigCleanSignatures(de_ctx);
  6320. DetectEngineCtxFree(de_ctx);
  6321. return result;
  6322. }
  6323. int DetectFastPatternTest259(void)
  6324. {
  6325. DetectEngineCtx *de_ctx = NULL;
  6326. int result = 0;
  6327. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6328. goto end;
  6329. de_ctx->flags |= DE_QUIET;
  6330. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6331. "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; depth:10; content:\"three\"; http_raw_header; sid:1;)");
  6332. if (de_ctx->sig_list != NULL)
  6333. goto end;
  6334. result = 1;
  6335. end:
  6336. SigCleanSignatures(de_ctx);
  6337. DetectEngineCtxFree(de_ctx);
  6338. return result;
  6339. }
  6340. int DetectFastPatternTest260(void)
  6341. {
  6342. DetectEngineCtx *de_ctx = NULL;
  6343. int result = 0;
  6344. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6345. goto end;
  6346. de_ctx->flags |= DE_QUIET;
  6347. de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
  6348. "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; sid:1;)");
  6349. if (de_ctx->sig_list == NULL)
  6350. goto end;
  6351. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx;
  6352. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6353. ud->flags & DETECT_CONTENT_NEGATED &&
  6354. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6355. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6356. ud->fp_chop_offset == 3 &&
  6357. ud->fp_chop_len == 4) {
  6358. result = 1;
  6359. } else {
  6360. result = 0;
  6361. }
  6362. end:
  6363. SigCleanSignatures(de_ctx);
  6364. DetectEngineCtxFree(de_ctx);
  6365. return result;
  6366. }
  6367. /* http_raw_header fast_pattern tests ^ */
  6368. /* http_method fast_pattern tests v */
  6369. int DetectFastPatternTest261(void)
  6370. {
  6371. DetectEngineCtx *de_ctx = NULL;
  6372. int result = 0;
  6373. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6374. goto end;
  6375. de_ctx->flags |= DE_QUIET;
  6376. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6377. "(content:\"one\"; http_method; "
  6378. "content:!\"oneonetwo\"; fast_pattern:3,4; http_method; "
  6379. "content:\"three\"; http_method; sid:1;)");
  6380. if (de_ctx->sig_list == NULL)
  6381. goto end;
  6382. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
  6383. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6384. ud->flags & DETECT_CONTENT_NEGATED &&
  6385. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6386. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6387. ud->fp_chop_offset == 3 &&
  6388. ud->fp_chop_len == 4) {
  6389. result = 1;
  6390. } else {
  6391. result = 0;
  6392. }
  6393. end:
  6394. SigCleanSignatures(de_ctx);
  6395. DetectEngineCtxFree(de_ctx);
  6396. return result;
  6397. }
  6398. /**
  6399. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  6400. */
  6401. int DetectFastPatternTest262(void)
  6402. {
  6403. SigMatch *sm = NULL;
  6404. DetectEngineCtx *de_ctx = NULL;
  6405. int result = 0;
  6406. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6407. goto end;
  6408. de_ctx->flags |= DE_QUIET;
  6409. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6410. "(content:\"/one/\"; fast_pattern:only; http_method; "
  6411. "msg:\"Testing fast_pattern\"; sid:1;)");
  6412. if (de_ctx->sig_list == NULL)
  6413. goto end;
  6414. result = 0;
  6415. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HMDMATCH];
  6416. if (sm != NULL) {
  6417. if ( ((DetectContentData *)sm->ctx)->flags &
  6418. DETECT_CONTENT_FAST_PATTERN) {
  6419. result = 1;
  6420. } else {
  6421. result = 0;
  6422. }
  6423. }
  6424. end:
  6425. SigCleanSignatures(de_ctx);
  6426. DetectEngineCtxFree(de_ctx);
  6427. return result;
  6428. }
  6429. /**
  6430. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  6431. */
  6432. int DetectFastPatternTest263(void)
  6433. {
  6434. SigMatch *sm = NULL;
  6435. DetectEngineCtx *de_ctx = NULL;
  6436. int result = 0;
  6437. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6438. goto end;
  6439. de_ctx->flags |= DE_QUIET;
  6440. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6441. "(content:\"oneoneone\"; fast_pattern:3,4; http_method; "
  6442. "msg:\"Testing fast_pattern\"; sid:1;)");
  6443. if (de_ctx->sig_list == NULL)
  6444. goto end;
  6445. result = 0;
  6446. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HMDMATCH];
  6447. if (sm != NULL) {
  6448. if ( ((DetectContentData *)sm->ctx)->flags &
  6449. DETECT_CONTENT_FAST_PATTERN) {
  6450. result = 1;
  6451. } else {
  6452. result = 0;
  6453. }
  6454. }
  6455. end:
  6456. SigCleanSignatures(de_ctx);
  6457. DetectEngineCtxFree(de_ctx);
  6458. return result;
  6459. }
  6460. int DetectFastPatternTest264(void)
  6461. {
  6462. SigMatch *sm = NULL;
  6463. DetectEngineCtx *de_ctx = NULL;
  6464. int result = 0;
  6465. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6466. goto end;
  6467. de_ctx->flags |= DE_QUIET;
  6468. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6469. "(content:\"one\"; fast_pattern:only; http_method; sid:1;)");
  6470. if (de_ctx->sig_list == NULL)
  6471. goto end;
  6472. result = 0;
  6473. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HMDMATCH];
  6474. DetectContentData *ud = sm->ctx;
  6475. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6476. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  6477. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  6478. ud->fp_chop_offset == 0 &&
  6479. ud->fp_chop_len == 0) {
  6480. result = 1;
  6481. } else {
  6482. result = 0;
  6483. }
  6484. end:
  6485. SigCleanSignatures(de_ctx);
  6486. DetectEngineCtxFree(de_ctx);
  6487. return result;
  6488. }
  6489. int DetectFastPatternTest265(void)
  6490. {
  6491. SigMatch *sm = NULL;
  6492. DetectEngineCtx *de_ctx = NULL;
  6493. int result = 0;
  6494. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6495. goto end;
  6496. de_ctx->flags |= DE_QUIET;
  6497. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6498. "(content:\"oneoneone\"; fast_pattern:3,4; http_method; sid:1;)");
  6499. if (de_ctx->sig_list == NULL)
  6500. goto end;
  6501. result = 0;
  6502. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HMDMATCH];
  6503. DetectContentData *ud = sm->ctx;
  6504. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6505. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6506. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6507. ud->fp_chop_offset == 3 &&
  6508. ud->fp_chop_len == 4) {
  6509. result = 1;
  6510. } else {
  6511. result = 0;
  6512. }
  6513. end:
  6514. SigCleanSignatures(de_ctx);
  6515. DetectEngineCtxFree(de_ctx);
  6516. return result;
  6517. }
  6518. int DetectFastPatternTest266(void)
  6519. {
  6520. DetectEngineCtx *de_ctx = NULL;
  6521. int result = 0;
  6522. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6523. goto end;
  6524. de_ctx->flags |= DE_QUIET;
  6525. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6526. "(content:\"one\"; http_method; content:\"two\"; fast_pattern:only; http_method; distance:10; sid:1;)");
  6527. if (de_ctx->sig_list != NULL)
  6528. goto end;
  6529. result = 1;
  6530. end:
  6531. SigCleanSignatures(de_ctx);
  6532. DetectEngineCtxFree(de_ctx);
  6533. return result;
  6534. }
  6535. int DetectFastPatternTest267(void)
  6536. {
  6537. DetectEngineCtx *de_ctx = NULL;
  6538. int result = 0;
  6539. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6540. goto end;
  6541. de_ctx->flags |= DE_QUIET;
  6542. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6543. "(content:\"one\"; http_method; content:\"two\"; distance:10; fast_pattern:only; http_method; sid:1;)");
  6544. if (de_ctx->sig_list != NULL)
  6545. goto end;
  6546. result = 1;
  6547. end:
  6548. SigCleanSignatures(de_ctx);
  6549. DetectEngineCtxFree(de_ctx);
  6550. return result;
  6551. }
  6552. int DetectFastPatternTest268(void)
  6553. {
  6554. DetectEngineCtx *de_ctx = NULL;
  6555. int result = 0;
  6556. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6557. goto end;
  6558. de_ctx->flags |= DE_QUIET;
  6559. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6560. "(content:\"one\"; http_method; content:\"two\"; fast_pattern:only; http_method; within:10; sid:1;)");
  6561. if (de_ctx->sig_list != NULL)
  6562. goto end;
  6563. result = 1;
  6564. end:
  6565. SigCleanSignatures(de_ctx);
  6566. DetectEngineCtxFree(de_ctx);
  6567. return result;
  6568. }
  6569. int DetectFastPatternTest269(void)
  6570. {
  6571. DetectEngineCtx *de_ctx = NULL;
  6572. int result = 0;
  6573. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6574. goto end;
  6575. de_ctx->flags |= DE_QUIET;
  6576. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6577. "(content:\"one\"; http_method; content:\"two\"; within:10; fast_pattern:only; http_method; sid:1;)");
  6578. if (de_ctx->sig_list != NULL)
  6579. goto end;
  6580. result = 1;
  6581. end:
  6582. SigCleanSignatures(de_ctx);
  6583. DetectEngineCtxFree(de_ctx);
  6584. return result;
  6585. }
  6586. int DetectFastPatternTest270(void)
  6587. {
  6588. DetectEngineCtx *de_ctx = NULL;
  6589. int result = 0;
  6590. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6591. goto end;
  6592. de_ctx->flags |= DE_QUIET;
  6593. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6594. "(content:\"one\"; http_method; content:\"two\"; fast_pattern:only; http_method; offset:10; sid:1;)");
  6595. if (de_ctx->sig_list != NULL)
  6596. goto end;
  6597. result = 1;
  6598. end:
  6599. SigCleanSignatures(de_ctx);
  6600. DetectEngineCtxFree(de_ctx);
  6601. return result;
  6602. }
  6603. int DetectFastPatternTest271(void)
  6604. {
  6605. DetectEngineCtx *de_ctx = NULL;
  6606. int result = 0;
  6607. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6608. goto end;
  6609. de_ctx->flags |= DE_QUIET;
  6610. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6611. "(content:\"one\"; http_method; content:\"two\"; offset:10; fast_pattern:only; http_method; sid:1;)");
  6612. if (de_ctx->sig_list != NULL)
  6613. goto end;
  6614. result = 1;
  6615. end:
  6616. SigCleanSignatures(de_ctx);
  6617. DetectEngineCtxFree(de_ctx);
  6618. return result;
  6619. }
  6620. int DetectFastPatternTest272(void)
  6621. {
  6622. DetectEngineCtx *de_ctx = NULL;
  6623. int result = 0;
  6624. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6625. goto end;
  6626. de_ctx->flags |= DE_QUIET;
  6627. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6628. "(content:\"one\"; http_method; content:\"two\"; fast_pattern:only; http_method; depth:10; sid:1;)");
  6629. if (de_ctx->sig_list != NULL)
  6630. goto end;
  6631. result = 1;
  6632. end:
  6633. SigCleanSignatures(de_ctx);
  6634. DetectEngineCtxFree(de_ctx);
  6635. return result;
  6636. }
  6637. int DetectFastPatternTest273(void)
  6638. {
  6639. DetectEngineCtx *de_ctx = NULL;
  6640. int result = 0;
  6641. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6642. goto end;
  6643. de_ctx->flags |= DE_QUIET;
  6644. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6645. "(content:\"one\"; http_method; content:\"two\"; depth:10; fast_pattern:only; http_method; sid:1;)");
  6646. if (de_ctx->sig_list != NULL)
  6647. goto end;
  6648. result = 1;
  6649. end:
  6650. SigCleanSignatures(de_ctx);
  6651. DetectEngineCtxFree(de_ctx);
  6652. return result;
  6653. }
  6654. int DetectFastPatternTest274(void)
  6655. {
  6656. DetectEngineCtx *de_ctx = NULL;
  6657. int result = 0;
  6658. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6659. goto end;
  6660. de_ctx->flags |= DE_QUIET;
  6661. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6662. "(content:\"one\"; http_method; content:!\"two\"; fast_pattern:only; http_method; sid:1;)");
  6663. if (de_ctx->sig_list != NULL)
  6664. goto end;
  6665. result = 1;
  6666. end:
  6667. SigCleanSignatures(de_ctx);
  6668. DetectEngineCtxFree(de_ctx);
  6669. return result;
  6670. }
  6671. int DetectFastPatternTest275(void)
  6672. {
  6673. DetectEngineCtx *de_ctx = NULL;
  6674. int result = 0;
  6675. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6676. goto end;
  6677. de_ctx->flags |= DE_QUIET;
  6678. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6679. "(content: \"one\"; http_method; content:\"two\"; http_method; distance:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)");
  6680. if (de_ctx->sig_list == NULL)
  6681. goto end;
  6682. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
  6683. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6684. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  6685. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  6686. ud->fp_chop_offset == 0 &&
  6687. ud->fp_chop_len == 0) {
  6688. result = 1;
  6689. } else {
  6690. result = 0;
  6691. }
  6692. end:
  6693. SigCleanSignatures(de_ctx);
  6694. DetectEngineCtxFree(de_ctx);
  6695. return result;
  6696. }
  6697. int DetectFastPatternTest276(void)
  6698. {
  6699. DetectEngineCtx *de_ctx = NULL;
  6700. int result = 0;
  6701. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6702. goto end;
  6703. de_ctx->flags |= DE_QUIET;
  6704. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6705. "(content:\"one\"; http_method; content:\"two\"; http_method; within:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)");
  6706. if (de_ctx->sig_list == NULL)
  6707. goto end;
  6708. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
  6709. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6710. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  6711. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  6712. ud->fp_chop_offset == 0 &&
  6713. ud->fp_chop_len == 0) {
  6714. result = 1;
  6715. } else {
  6716. result = 0;
  6717. }
  6718. end:
  6719. SigCleanSignatures(de_ctx);
  6720. DetectEngineCtxFree(de_ctx);
  6721. return result;
  6722. }
  6723. int DetectFastPatternTest277(void)
  6724. {
  6725. DetectEngineCtx *de_ctx = NULL;
  6726. int result = 0;
  6727. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6728. goto end;
  6729. de_ctx->flags |= DE_QUIET;
  6730. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6731. "(content:\"one\"; http_method; content:\"two\"; http_method; offset:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)");
  6732. if (de_ctx->sig_list == NULL)
  6733. goto end;
  6734. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
  6735. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6736. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  6737. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  6738. ud->fp_chop_offset == 0 &&
  6739. ud->fp_chop_len == 0) {
  6740. result = 1;
  6741. } else {
  6742. result = 0;
  6743. }
  6744. end:
  6745. SigCleanSignatures(de_ctx);
  6746. DetectEngineCtxFree(de_ctx);
  6747. return result;
  6748. }
  6749. int DetectFastPatternTest278(void)
  6750. {
  6751. DetectEngineCtx *de_ctx = NULL;
  6752. int result = 0;
  6753. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6754. goto end;
  6755. de_ctx->flags |= DE_QUIET;
  6756. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6757. "(content:\"one\"; http_method; content:\"two\"; http_method; depth:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)");
  6758. if (de_ctx->sig_list == NULL)
  6759. goto end;
  6760. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
  6761. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6762. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  6763. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  6764. ud->fp_chop_offset == 0 &&
  6765. ud->fp_chop_len == 0) {
  6766. result = 1;
  6767. } else {
  6768. result = 0;
  6769. }
  6770. end:
  6771. SigCleanSignatures(de_ctx);
  6772. DetectEngineCtxFree(de_ctx);
  6773. return result;
  6774. }
  6775. int DetectFastPatternTest279(void)
  6776. {
  6777. DetectEngineCtx *de_ctx = NULL;
  6778. int result = 0;
  6779. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6780. goto end;
  6781. de_ctx->flags |= DE_QUIET;
  6782. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6783. "(content:!\"one\"; fast_pattern; http_method; content:\"two\"; http_method; sid:1;)");
  6784. if (de_ctx->sig_list == NULL)
  6785. goto end;
  6786. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
  6787. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6788. ud->flags & DETECT_CONTENT_NEGATED &&
  6789. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6790. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  6791. ud->fp_chop_offset == 0 &&
  6792. ud->fp_chop_len == 0) {
  6793. result = 1;
  6794. } else {
  6795. result = 0;
  6796. }
  6797. end:
  6798. SigCleanSignatures(de_ctx);
  6799. DetectEngineCtxFree(de_ctx);
  6800. return result;
  6801. }
  6802. int DetectFastPatternTest280(void)
  6803. {
  6804. DetectEngineCtx *de_ctx = NULL;
  6805. int result = 0;
  6806. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6807. goto end;
  6808. de_ctx->flags |= DE_QUIET;
  6809. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6810. "(content:\"two\"; http_method; content:!\"one\"; fast_pattern; http_method; distance:20; sid:1;)");
  6811. if (de_ctx->sig_list != NULL)
  6812. goto end;
  6813. result = 1;
  6814. end:
  6815. SigCleanSignatures(de_ctx);
  6816. DetectEngineCtxFree(de_ctx);
  6817. return result;
  6818. }
  6819. int DetectFastPatternTest281(void)
  6820. {
  6821. DetectEngineCtx *de_ctx = NULL;
  6822. int result = 0;
  6823. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6824. goto end;
  6825. de_ctx->flags |= DE_QUIET;
  6826. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6827. "(content:\"two\"; http_method; content:!\"one\"; fast_pattern; http_method; within:20; sid:1;)");
  6828. if (de_ctx->sig_list != NULL)
  6829. goto end;
  6830. result = 1;
  6831. end:
  6832. SigCleanSignatures(de_ctx);
  6833. DetectEngineCtxFree(de_ctx);
  6834. return result;
  6835. }
  6836. int DetectFastPatternTest282(void)
  6837. {
  6838. DetectEngineCtx *de_ctx = NULL;
  6839. int result = 0;
  6840. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6841. goto end;
  6842. de_ctx->flags |= DE_QUIET;
  6843. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6844. "(content:\"two\"; http_method; content:!\"one\"; fast_pattern; http_method; offset:20; sid:1;)");
  6845. if (de_ctx->sig_list != NULL)
  6846. goto end;
  6847. result = 1;
  6848. end:
  6849. SigCleanSignatures(de_ctx);
  6850. DetectEngineCtxFree(de_ctx);
  6851. return result;
  6852. }
  6853. int DetectFastPatternTest283(void)
  6854. {
  6855. DetectEngineCtx *de_ctx = NULL;
  6856. int result = 0;
  6857. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6858. goto end;
  6859. de_ctx->flags |= DE_QUIET;
  6860. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6861. "(content:\"two\"; http_method; content:!\"one\"; fast_pattern; http_method; depth:20; sid:1;)");
  6862. if (de_ctx->sig_list != NULL)
  6863. goto end;
  6864. result = 1;
  6865. end:
  6866. SigCleanSignatures(de_ctx);
  6867. DetectEngineCtxFree(de_ctx);
  6868. return result;
  6869. }
  6870. int DetectFastPatternTest284(void)
  6871. {
  6872. DetectEngineCtx *de_ctx = NULL;
  6873. int result = 0;
  6874. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6875. goto end;
  6876. de_ctx->flags |= DE_QUIET;
  6877. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6878. "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; sid:1;)");
  6879. if (de_ctx->sig_list == NULL)
  6880. goto end;
  6881. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
  6882. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6883. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6884. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6885. ud->fp_chop_offset == 3 &&
  6886. ud->fp_chop_len == 4) {
  6887. result = 1;
  6888. } else {
  6889. result = 0;
  6890. }
  6891. end:
  6892. SigCleanSignatures(de_ctx);
  6893. DetectEngineCtxFree(de_ctx);
  6894. return result;
  6895. }
  6896. int DetectFastPatternTest285(void)
  6897. {
  6898. DetectEngineCtx *de_ctx = NULL;
  6899. int result = 0;
  6900. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6901. goto end;
  6902. de_ctx->flags |= DE_QUIET;
  6903. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6904. "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; distance:30; sid:1;)");
  6905. if (de_ctx->sig_list == NULL)
  6906. goto end;
  6907. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
  6908. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6909. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6910. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6911. ud->fp_chop_offset == 3 &&
  6912. ud->fp_chop_len == 4) {
  6913. result = 1;
  6914. } else {
  6915. result = 0;
  6916. }
  6917. end:
  6918. SigCleanSignatures(de_ctx);
  6919. DetectEngineCtxFree(de_ctx);
  6920. return result;
  6921. }
  6922. int DetectFastPatternTest286(void)
  6923. {
  6924. DetectEngineCtx *de_ctx = NULL;
  6925. int result = 0;
  6926. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6927. goto end;
  6928. de_ctx->flags |= DE_QUIET;
  6929. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6930. "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; within:30; sid:1;)");
  6931. if (de_ctx->sig_list == NULL)
  6932. goto end;
  6933. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
  6934. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6935. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6936. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6937. ud->fp_chop_offset == 3 &&
  6938. ud->fp_chop_len == 4) {
  6939. result = 1;
  6940. } else {
  6941. result = 0;
  6942. }
  6943. end:
  6944. SigCleanSignatures(de_ctx);
  6945. DetectEngineCtxFree(de_ctx);
  6946. return result;
  6947. }
  6948. int DetectFastPatternTest287(void)
  6949. {
  6950. DetectEngineCtx *de_ctx = NULL;
  6951. int result = 0;
  6952. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6953. goto end;
  6954. de_ctx->flags |= DE_QUIET;
  6955. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6956. "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; offset:30; sid:1;)");
  6957. if (de_ctx->sig_list == NULL)
  6958. goto end;
  6959. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
  6960. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6961. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6962. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6963. ud->fp_chop_offset == 3 &&
  6964. ud->fp_chop_len == 4) {
  6965. result = 1;
  6966. } else {
  6967. result = 0;
  6968. }
  6969. end:
  6970. SigCleanSignatures(de_ctx);
  6971. DetectEngineCtxFree(de_ctx);
  6972. return result;
  6973. }
  6974. int DetectFastPatternTest288(void)
  6975. {
  6976. DetectEngineCtx *de_ctx = NULL;
  6977. int result = 0;
  6978. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  6979. goto end;
  6980. de_ctx->flags |= DE_QUIET;
  6981. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  6982. "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; depth:30; sid:1;)");
  6983. if (de_ctx->sig_list == NULL)
  6984. goto end;
  6985. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
  6986. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  6987. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  6988. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  6989. ud->fp_chop_offset == 3 &&
  6990. ud->fp_chop_len == 4) {
  6991. result = 1;
  6992. } else {
  6993. result = 0;
  6994. }
  6995. end:
  6996. SigCleanSignatures(de_ctx);
  6997. DetectEngineCtxFree(de_ctx);
  6998. return result;
  6999. }
  7000. int DetectFastPatternTest289(void)
  7001. {
  7002. DetectEngineCtx *de_ctx = NULL;
  7003. int result = 0;
  7004. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7005. goto end;
  7006. de_ctx->flags |= DE_QUIET;
  7007. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7008. "(content:\"one\"; http_method; content:\"two\"; http_method; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)");
  7009. if (de_ctx->sig_list == NULL)
  7010. goto end;
  7011. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
  7012. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7013. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7014. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7015. ud->fp_chop_offset == 3 &&
  7016. ud->fp_chop_len == 4) {
  7017. result = 1;
  7018. } else {
  7019. result = 0;
  7020. }
  7021. end:
  7022. SigCleanSignatures(de_ctx);
  7023. DetectEngineCtxFree(de_ctx);
  7024. return result;
  7025. }
  7026. int DetectFastPatternTest290(void)
  7027. {
  7028. DetectEngineCtx *de_ctx = NULL;
  7029. int result = 0;
  7030. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7031. goto end;
  7032. de_ctx->flags |= DE_QUIET;
  7033. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7034. "(content:\"one\"; http_method; content:\"two\"; http_method; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)");
  7035. if (de_ctx->sig_list == NULL)
  7036. goto end;
  7037. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
  7038. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7039. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7040. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7041. ud->fp_chop_offset == 3 &&
  7042. ud->fp_chop_len == 4) {
  7043. result = 1;
  7044. } else {
  7045. result = 0;
  7046. }
  7047. end:
  7048. SigCleanSignatures(de_ctx);
  7049. DetectEngineCtxFree(de_ctx);
  7050. return result;
  7051. }
  7052. int DetectFastPatternTest291(void)
  7053. {
  7054. DetectEngineCtx *de_ctx = NULL;
  7055. int result = 0;
  7056. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7057. goto end;
  7058. de_ctx->flags |= DE_QUIET;
  7059. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7060. "(content:\"one\"; http_method; content:\"two\"; http_method; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)");
  7061. if (de_ctx->sig_list == NULL)
  7062. goto end;
  7063. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
  7064. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7065. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7066. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7067. ud->fp_chop_offset == 3 &&
  7068. ud->fp_chop_len == 4) {
  7069. result = 1;
  7070. } else {
  7071. result = 0;
  7072. }
  7073. end:
  7074. SigCleanSignatures(de_ctx);
  7075. DetectEngineCtxFree(de_ctx);
  7076. return result;
  7077. }
  7078. int DetectFastPatternTest292(void)
  7079. {
  7080. DetectEngineCtx *de_ctx = NULL;
  7081. int result = 0;
  7082. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7083. goto end;
  7084. de_ctx->flags |= DE_QUIET;
  7085. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7086. "(content:\"one\"; http_method; content:\"two\"; http_method; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)");
  7087. if (de_ctx->sig_list == NULL)
  7088. goto end;
  7089. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx;
  7090. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7091. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7092. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7093. ud->fp_chop_offset == 3 &&
  7094. ud->fp_chop_len == 4) {
  7095. result = 1;
  7096. } else {
  7097. result = 0;
  7098. }
  7099. result = 1;
  7100. end:
  7101. SigCleanSignatures(de_ctx);
  7102. DetectEngineCtxFree(de_ctx);
  7103. return result;
  7104. }
  7105. int DetectFastPatternTest293(void)
  7106. {
  7107. DetectEngineCtx *de_ctx = NULL;
  7108. int result = 0;
  7109. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7110. goto end;
  7111. de_ctx->flags |= DE_QUIET;
  7112. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7113. "(content:\"one\"; http_method; content:\"two\"; fast_pattern:65977,4; http_method; content:\"three\"; http_method; distance:10; sid:1;)");
  7114. if (de_ctx->sig_list != NULL)
  7115. goto end;
  7116. result = 1;
  7117. end:
  7118. SigCleanSignatures(de_ctx);
  7119. DetectEngineCtxFree(de_ctx);
  7120. return result;
  7121. }
  7122. int DetectFastPatternTest294(void)
  7123. {
  7124. DetectEngineCtx *de_ctx = NULL;
  7125. int result = 0;
  7126. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7127. goto end;
  7128. de_ctx->flags |= DE_QUIET;
  7129. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7130. "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,65977; http_method; content:\"three\"; distance:10; http_method; sid:1;)");
  7131. if (de_ctx->sig_list != NULL)
  7132. goto end;
  7133. result = 1;
  7134. end:
  7135. SigCleanSignatures(de_ctx);
  7136. DetectEngineCtxFree(de_ctx);
  7137. return result;
  7138. }
  7139. int DetectFastPatternTest295(void)
  7140. {
  7141. DetectEngineCtx *de_ctx = NULL;
  7142. int result = 0;
  7143. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7144. goto end;
  7145. de_ctx->flags |= DE_QUIET;
  7146. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7147. "(content:\"one\"; http_method; content:\"two\"; fast_pattern:65534,4; http_method; content:\"three\"; http_method; distance:10; sid:1;)");
  7148. if (de_ctx->sig_list != NULL)
  7149. goto end;
  7150. result = 1;
  7151. end:
  7152. SigCleanSignatures(de_ctx);
  7153. DetectEngineCtxFree(de_ctx);
  7154. return result;
  7155. }
  7156. int DetectFastPatternTest296(void)
  7157. {
  7158. DetectEngineCtx *de_ctx = NULL;
  7159. int result = 0;
  7160. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7161. goto end;
  7162. de_ctx->flags |= DE_QUIET;
  7163. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7164. "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; sid:1;)");
  7165. if (de_ctx->sig_list == NULL)
  7166. goto end;
  7167. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
  7168. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7169. ud->flags & DETECT_CONTENT_NEGATED &&
  7170. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7171. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7172. ud->fp_chop_offset == 3 &&
  7173. ud->fp_chop_len == 4) {
  7174. result = 1;
  7175. } else {
  7176. result = 0;
  7177. }
  7178. end:
  7179. SigCleanSignatures(de_ctx);
  7180. DetectEngineCtxFree(de_ctx);
  7181. return result;
  7182. }
  7183. int DetectFastPatternTest297(void)
  7184. {
  7185. DetectEngineCtx *de_ctx = NULL;
  7186. int result = 0;
  7187. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7188. goto end;
  7189. de_ctx->flags |= DE_QUIET;
  7190. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7191. "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; distance:10; content:\"three\"; http_method; sid:1;)");
  7192. if (de_ctx->sig_list != NULL)
  7193. goto end;
  7194. result = 1;
  7195. end:
  7196. SigCleanSignatures(de_ctx);
  7197. DetectEngineCtxFree(de_ctx);
  7198. return result;
  7199. }
  7200. int DetectFastPatternTest298(void)
  7201. {
  7202. DetectEngineCtx *de_ctx = NULL;
  7203. int result = 0;
  7204. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7205. goto end;
  7206. de_ctx->flags |= DE_QUIET;
  7207. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7208. "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; within:10; content:\"three\"; http_method; sid:1;)");
  7209. if (de_ctx->sig_list != NULL)
  7210. goto end;
  7211. result = 1;
  7212. end:
  7213. SigCleanSignatures(de_ctx);
  7214. DetectEngineCtxFree(de_ctx);
  7215. return result;
  7216. }
  7217. int DetectFastPatternTest299(void)
  7218. {
  7219. DetectEngineCtx *de_ctx = NULL;
  7220. int result = 0;
  7221. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7222. goto end;
  7223. de_ctx->flags |= DE_QUIET;
  7224. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7225. "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; offset:10; content:\"three\"; http_method; sid:1;)");
  7226. if (de_ctx->sig_list != NULL)
  7227. goto end;
  7228. result = 1;
  7229. end:
  7230. SigCleanSignatures(de_ctx);
  7231. DetectEngineCtxFree(de_ctx);
  7232. return result;
  7233. }
  7234. int DetectFastPatternTest300(void)
  7235. {
  7236. DetectEngineCtx *de_ctx = NULL;
  7237. int result = 0;
  7238. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7239. goto end;
  7240. de_ctx->flags |= DE_QUIET;
  7241. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7242. "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; depth:10; content:\"three\"; http_method; sid:1;)");
  7243. if (de_ctx->sig_list != NULL)
  7244. goto end;
  7245. result = 1;
  7246. end:
  7247. SigCleanSignatures(de_ctx);
  7248. DetectEngineCtxFree(de_ctx);
  7249. return result;
  7250. }
  7251. int DetectFastPatternTest301(void)
  7252. {
  7253. DetectEngineCtx *de_ctx = NULL;
  7254. int result = 0;
  7255. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7256. goto end;
  7257. de_ctx->flags |= DE_QUIET;
  7258. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7259. "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; sid:1;)");
  7260. if (de_ctx->sig_list == NULL)
  7261. goto end;
  7262. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx;
  7263. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7264. ud->flags & DETECT_CONTENT_NEGATED &&
  7265. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7266. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7267. ud->fp_chop_offset == 3 &&
  7268. ud->fp_chop_len == 4) {
  7269. result = 1;
  7270. } else {
  7271. result = 0;
  7272. }
  7273. end:
  7274. SigCleanSignatures(de_ctx);
  7275. DetectEngineCtxFree(de_ctx);
  7276. return result;
  7277. }
  7278. /* http_method fast_pattern tests ^ */
  7279. /* http_cookie fast_pattern tests v */
  7280. int DetectFastPatternTest302(void)
  7281. {
  7282. DetectEngineCtx *de_ctx = NULL;
  7283. int result = 0;
  7284. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7285. goto end;
  7286. de_ctx->flags |= DE_QUIET;
  7287. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7288. "(content:\"one\"; http_cookie; "
  7289. "content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; "
  7290. "content:\"three\"; http_cookie; sid:1;)");
  7291. if (de_ctx->sig_list == NULL)
  7292. goto end;
  7293. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx;
  7294. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7295. ud->flags & DETECT_CONTENT_NEGATED &&
  7296. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7297. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7298. ud->fp_chop_offset == 3 &&
  7299. ud->fp_chop_len == 4) {
  7300. result = 1;
  7301. } else {
  7302. result = 0;
  7303. }
  7304. end:
  7305. SigCleanSignatures(de_ctx);
  7306. DetectEngineCtxFree(de_ctx);
  7307. return result;
  7308. }
  7309. /**
  7310. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  7311. */
  7312. int DetectFastPatternTest303(void)
  7313. {
  7314. SigMatch *sm = NULL;
  7315. DetectEngineCtx *de_ctx = NULL;
  7316. int result = 0;
  7317. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7318. goto end;
  7319. de_ctx->flags |= DE_QUIET;
  7320. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7321. "(content:\"/one/\"; fast_pattern:only; http_cookie; "
  7322. "msg:\"Testing fast_pattern\"; sid:1;)");
  7323. if (de_ctx->sig_list == NULL)
  7324. goto end;
  7325. result = 0;
  7326. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCDMATCH];
  7327. if (sm != NULL) {
  7328. if ( ((DetectContentData *)sm->ctx)->flags &
  7329. DETECT_CONTENT_FAST_PATTERN) {
  7330. result = 1;
  7331. } else {
  7332. result = 0;
  7333. }
  7334. }
  7335. end:
  7336. SigCleanSignatures(de_ctx);
  7337. DetectEngineCtxFree(de_ctx);
  7338. return result;
  7339. }
  7340. /**
  7341. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  7342. */
  7343. int DetectFastPatternTest304(void)
  7344. {
  7345. SigMatch *sm = NULL;
  7346. DetectEngineCtx *de_ctx = NULL;
  7347. int result = 0;
  7348. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7349. goto end;
  7350. de_ctx->flags |= DE_QUIET;
  7351. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7352. "(content:\"oneoneone\"; fast_pattern:3,4; http_cookie; "
  7353. "msg:\"Testing fast_pattern\"; sid:1;)");
  7354. if (de_ctx->sig_list == NULL)
  7355. goto end;
  7356. result = 0;
  7357. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCDMATCH];
  7358. if (sm != NULL) {
  7359. if ( ((DetectContentData *)sm->ctx)->flags &
  7360. DETECT_CONTENT_FAST_PATTERN) {
  7361. result = 1;
  7362. } else {
  7363. result = 0;
  7364. }
  7365. }
  7366. end:
  7367. SigCleanSignatures(de_ctx);
  7368. DetectEngineCtxFree(de_ctx);
  7369. return result;
  7370. }
  7371. int DetectFastPatternTest305(void)
  7372. {
  7373. SigMatch *sm = NULL;
  7374. DetectEngineCtx *de_ctx = NULL;
  7375. int result = 0;
  7376. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7377. goto end;
  7378. de_ctx->flags |= DE_QUIET;
  7379. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7380. "(content:\"one\"; fast_pattern:only; http_cookie; sid:1;)");
  7381. if (de_ctx->sig_list == NULL)
  7382. goto end;
  7383. result = 0;
  7384. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCDMATCH];
  7385. DetectContentData *ud = sm->ctx;
  7386. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7387. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  7388. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  7389. ud->fp_chop_offset == 0 &&
  7390. ud->fp_chop_len == 0) {
  7391. result = 1;
  7392. } else {
  7393. result = 0;
  7394. }
  7395. end:
  7396. SigCleanSignatures(de_ctx);
  7397. DetectEngineCtxFree(de_ctx);
  7398. return result;
  7399. }
  7400. int DetectFastPatternTest306(void)
  7401. {
  7402. SigMatch *sm = NULL;
  7403. DetectEngineCtx *de_ctx = NULL;
  7404. int result = 0;
  7405. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7406. goto end;
  7407. de_ctx->flags |= DE_QUIET;
  7408. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7409. "(content:\"oneoneone\"; fast_pattern:3,4; http_cookie; sid:1;)");
  7410. if (de_ctx->sig_list == NULL)
  7411. goto end;
  7412. result = 0;
  7413. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCDMATCH];
  7414. DetectContentData *ud = sm->ctx;
  7415. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7416. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7417. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7418. ud->fp_chop_offset == 3 &&
  7419. ud->fp_chop_len == 4) {
  7420. result = 1;
  7421. } else {
  7422. result = 0;
  7423. }
  7424. end:
  7425. SigCleanSignatures(de_ctx);
  7426. DetectEngineCtxFree(de_ctx);
  7427. return result;
  7428. }
  7429. int DetectFastPatternTest307(void)
  7430. {
  7431. DetectEngineCtx *de_ctx = NULL;
  7432. int result = 0;
  7433. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7434. goto end;
  7435. de_ctx->flags |= DE_QUIET;
  7436. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7437. "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:only; http_cookie; distance:10; sid:1;)");
  7438. if (de_ctx->sig_list != NULL)
  7439. goto end;
  7440. result = 1;
  7441. end:
  7442. SigCleanSignatures(de_ctx);
  7443. DetectEngineCtxFree(de_ctx);
  7444. return result;
  7445. }
  7446. int DetectFastPatternTest308(void)
  7447. {
  7448. DetectEngineCtx *de_ctx = NULL;
  7449. int result = 0;
  7450. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7451. goto end;
  7452. de_ctx->flags |= DE_QUIET;
  7453. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7454. "(content:\"one\"; http_cookie; content:\"two\"; distance:10; fast_pattern:only; http_cookie; sid:1;)");
  7455. if (de_ctx->sig_list != NULL)
  7456. goto end;
  7457. result = 1;
  7458. end:
  7459. SigCleanSignatures(de_ctx);
  7460. DetectEngineCtxFree(de_ctx);
  7461. return result;
  7462. }
  7463. int DetectFastPatternTest309(void)
  7464. {
  7465. DetectEngineCtx *de_ctx = NULL;
  7466. int result = 0;
  7467. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7468. goto end;
  7469. de_ctx->flags |= DE_QUIET;
  7470. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7471. "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:only; http_cookie; within:10; sid:1;)");
  7472. if (de_ctx->sig_list != NULL)
  7473. goto end;
  7474. result = 1;
  7475. end:
  7476. SigCleanSignatures(de_ctx);
  7477. DetectEngineCtxFree(de_ctx);
  7478. return result;
  7479. }
  7480. int DetectFastPatternTest310(void)
  7481. {
  7482. DetectEngineCtx *de_ctx = NULL;
  7483. int result = 0;
  7484. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7485. goto end;
  7486. de_ctx->flags |= DE_QUIET;
  7487. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7488. "(content:\"one\"; http_cookie; content:\"two\"; within:10; fast_pattern:only; http_cookie; sid:1;)");
  7489. if (de_ctx->sig_list != NULL)
  7490. goto end;
  7491. result = 1;
  7492. end:
  7493. SigCleanSignatures(de_ctx);
  7494. DetectEngineCtxFree(de_ctx);
  7495. return result;
  7496. }
  7497. int DetectFastPatternTest311(void)
  7498. {
  7499. DetectEngineCtx *de_ctx = NULL;
  7500. int result = 0;
  7501. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7502. goto end;
  7503. de_ctx->flags |= DE_QUIET;
  7504. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7505. "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:only; http_cookie; offset:10; sid:1;)");
  7506. if (de_ctx->sig_list != NULL)
  7507. goto end;
  7508. result = 1;
  7509. end:
  7510. SigCleanSignatures(de_ctx);
  7511. DetectEngineCtxFree(de_ctx);
  7512. return result;
  7513. }
  7514. int DetectFastPatternTest312(void)
  7515. {
  7516. DetectEngineCtx *de_ctx = NULL;
  7517. int result = 0;
  7518. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7519. goto end;
  7520. de_ctx->flags |= DE_QUIET;
  7521. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7522. "(content:\"one\"; http_cookie; content:\"two\"; offset:10; fast_pattern:only; http_cookie; sid:1;)");
  7523. if (de_ctx->sig_list != NULL)
  7524. goto end;
  7525. result = 1;
  7526. end:
  7527. SigCleanSignatures(de_ctx);
  7528. DetectEngineCtxFree(de_ctx);
  7529. return result;
  7530. }
  7531. int DetectFastPatternTest313(void)
  7532. {
  7533. DetectEngineCtx *de_ctx = NULL;
  7534. int result = 0;
  7535. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7536. goto end;
  7537. de_ctx->flags |= DE_QUIET;
  7538. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7539. "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:only; http_cookie; depth:10; sid:1;)");
  7540. if (de_ctx->sig_list != NULL)
  7541. goto end;
  7542. result = 1;
  7543. end:
  7544. SigCleanSignatures(de_ctx);
  7545. DetectEngineCtxFree(de_ctx);
  7546. return result;
  7547. }
  7548. int DetectFastPatternTest314(void)
  7549. {
  7550. DetectEngineCtx *de_ctx = NULL;
  7551. int result = 0;
  7552. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7553. goto end;
  7554. de_ctx->flags |= DE_QUIET;
  7555. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7556. "(content:\"one\"; http_cookie; content:\"two\"; depth:10; fast_pattern:only; http_cookie; sid:1;)");
  7557. if (de_ctx->sig_list != NULL)
  7558. goto end;
  7559. result = 1;
  7560. end:
  7561. SigCleanSignatures(de_ctx);
  7562. DetectEngineCtxFree(de_ctx);
  7563. return result;
  7564. }
  7565. int DetectFastPatternTest315(void)
  7566. {
  7567. DetectEngineCtx *de_ctx = NULL;
  7568. int result = 0;
  7569. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7570. goto end;
  7571. de_ctx->flags |= DE_QUIET;
  7572. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7573. "(content:\"one\"; http_cookie; content:!\"two\"; fast_pattern:only; http_cookie; sid:1;)");
  7574. if (de_ctx->sig_list != NULL)
  7575. goto end;
  7576. result = 1;
  7577. end:
  7578. SigCleanSignatures(de_ctx);
  7579. DetectEngineCtxFree(de_ctx);
  7580. return result;
  7581. }
  7582. int DetectFastPatternTest316(void)
  7583. {
  7584. DetectEngineCtx *de_ctx = NULL;
  7585. int result = 0;
  7586. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7587. goto end;
  7588. de_ctx->flags |= DE_QUIET;
  7589. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7590. "(content: \"one\"; http_cookie; content:\"two\"; http_cookie; distance:30; content:\"two\"; fast_pattern:only; http_cookie; sid:1;)");
  7591. if (de_ctx->sig_list == NULL)
  7592. goto end;
  7593. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx;
  7594. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7595. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  7596. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  7597. ud->fp_chop_offset == 0 &&
  7598. ud->fp_chop_len == 0) {
  7599. result = 1;
  7600. } else {
  7601. result = 0;
  7602. }
  7603. end:
  7604. SigCleanSignatures(de_ctx);
  7605. DetectEngineCtxFree(de_ctx);
  7606. return result;
  7607. }
  7608. int DetectFastPatternTest317(void)
  7609. {
  7610. DetectEngineCtx *de_ctx = NULL;
  7611. int result = 0;
  7612. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7613. goto end;
  7614. de_ctx->flags |= DE_QUIET;
  7615. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7616. "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; within:30; content:\"two\"; fast_pattern:only; http_cookie; sid:1;)");
  7617. if (de_ctx->sig_list == NULL)
  7618. goto end;
  7619. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx;
  7620. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7621. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  7622. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  7623. ud->fp_chop_offset == 0 &&
  7624. ud->fp_chop_len == 0) {
  7625. result = 1;
  7626. } else {
  7627. result = 0;
  7628. }
  7629. end:
  7630. SigCleanSignatures(de_ctx);
  7631. DetectEngineCtxFree(de_ctx);
  7632. return result;
  7633. }
  7634. int DetectFastPatternTest318(void)
  7635. {
  7636. DetectEngineCtx *de_ctx = NULL;
  7637. int result = 0;
  7638. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7639. goto end;
  7640. de_ctx->flags |= DE_QUIET;
  7641. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7642. "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; offset:30; content:\"two\"; fast_pattern:only; http_cookie; sid:1;)");
  7643. if (de_ctx->sig_list == NULL)
  7644. goto end;
  7645. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx;
  7646. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7647. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  7648. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  7649. ud->fp_chop_offset == 0 &&
  7650. ud->fp_chop_len == 0) {
  7651. result = 1;
  7652. } else {
  7653. result = 0;
  7654. }
  7655. end:
  7656. SigCleanSignatures(de_ctx);
  7657. DetectEngineCtxFree(de_ctx);
  7658. return result;
  7659. }
  7660. int DetectFastPatternTest319(void)
  7661. {
  7662. DetectEngineCtx *de_ctx = NULL;
  7663. int result = 0;
  7664. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7665. goto end;
  7666. de_ctx->flags |= DE_QUIET;
  7667. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7668. "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; depth:30; content:\"two\"; fast_pattern:only; http_cookie; sid:1;)");
  7669. if (de_ctx->sig_list == NULL)
  7670. goto end;
  7671. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx;
  7672. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7673. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  7674. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  7675. ud->fp_chop_offset == 0 &&
  7676. ud->fp_chop_len == 0) {
  7677. result = 1;
  7678. } else {
  7679. result = 0;
  7680. }
  7681. end:
  7682. SigCleanSignatures(de_ctx);
  7683. DetectEngineCtxFree(de_ctx);
  7684. return result;
  7685. }
  7686. int DetectFastPatternTest320(void)
  7687. {
  7688. DetectEngineCtx *de_ctx = NULL;
  7689. int result = 0;
  7690. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7691. goto end;
  7692. de_ctx->flags |= DE_QUIET;
  7693. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7694. "(content:!\"one\"; fast_pattern; http_cookie; content:\"two\"; http_cookie; sid:1;)");
  7695. if (de_ctx->sig_list == NULL)
  7696. goto end;
  7697. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx;
  7698. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7699. ud->flags & DETECT_CONTENT_NEGATED &&
  7700. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7701. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  7702. ud->fp_chop_offset == 0 &&
  7703. ud->fp_chop_len == 0) {
  7704. result = 1;
  7705. } else {
  7706. result = 0;
  7707. }
  7708. end:
  7709. SigCleanSignatures(de_ctx);
  7710. DetectEngineCtxFree(de_ctx);
  7711. return result;
  7712. }
  7713. int DetectFastPatternTest321(void)
  7714. {
  7715. DetectEngineCtx *de_ctx = NULL;
  7716. int result = 0;
  7717. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7718. goto end;
  7719. de_ctx->flags |= DE_QUIET;
  7720. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7721. "(content:\"two\"; http_cookie; content:!\"one\"; fast_pattern; http_cookie; distance:20; sid:1;)");
  7722. if (de_ctx->sig_list != NULL)
  7723. goto end;
  7724. result = 1;
  7725. end:
  7726. SigCleanSignatures(de_ctx);
  7727. DetectEngineCtxFree(de_ctx);
  7728. return result;
  7729. }
  7730. int DetectFastPatternTest322(void)
  7731. {
  7732. DetectEngineCtx *de_ctx = NULL;
  7733. int result = 0;
  7734. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7735. goto end;
  7736. de_ctx->flags |= DE_QUIET;
  7737. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7738. "(content:\"two\"; http_cookie; content:!\"one\"; fast_pattern; http_cookie; within:20; sid:1;)");
  7739. if (de_ctx->sig_list != NULL)
  7740. goto end;
  7741. result = 1;
  7742. end:
  7743. SigCleanSignatures(de_ctx);
  7744. DetectEngineCtxFree(de_ctx);
  7745. return result;
  7746. }
  7747. int DetectFastPatternTest323(void)
  7748. {
  7749. DetectEngineCtx *de_ctx = NULL;
  7750. int result = 0;
  7751. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7752. goto end;
  7753. de_ctx->flags |= DE_QUIET;
  7754. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7755. "(content:\"two\"; http_cookie; content:!\"one\"; fast_pattern; http_cookie; offset:20; sid:1;)");
  7756. if (de_ctx->sig_list != NULL)
  7757. goto end;
  7758. result = 1;
  7759. end:
  7760. SigCleanSignatures(de_ctx);
  7761. DetectEngineCtxFree(de_ctx);
  7762. return result;
  7763. }
  7764. int DetectFastPatternTest324(void)
  7765. {
  7766. DetectEngineCtx *de_ctx = NULL;
  7767. int result = 0;
  7768. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7769. goto end;
  7770. de_ctx->flags |= DE_QUIET;
  7771. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7772. "(content:\"two\"; http_cookie; content:!\"one\"; fast_pattern; http_cookie; depth:20; sid:1;)");
  7773. if (de_ctx->sig_list != NULL)
  7774. goto end;
  7775. result = 1;
  7776. end:
  7777. SigCleanSignatures(de_ctx);
  7778. DetectEngineCtxFree(de_ctx);
  7779. return result;
  7780. }
  7781. int DetectFastPatternTest325(void)
  7782. {
  7783. DetectEngineCtx *de_ctx = NULL;
  7784. int result = 0;
  7785. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7786. goto end;
  7787. de_ctx->flags |= DE_QUIET;
  7788. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7789. "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; sid:1;)");
  7790. if (de_ctx->sig_list == NULL)
  7791. goto end;
  7792. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx;
  7793. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7794. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7795. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7796. ud->fp_chop_offset == 3 &&
  7797. ud->fp_chop_len == 4) {
  7798. result = 1;
  7799. } else {
  7800. result = 0;
  7801. }
  7802. end:
  7803. SigCleanSignatures(de_ctx);
  7804. DetectEngineCtxFree(de_ctx);
  7805. return result;
  7806. }
  7807. int DetectFastPatternTest326(void)
  7808. {
  7809. DetectEngineCtx *de_ctx = NULL;
  7810. int result = 0;
  7811. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7812. goto end;
  7813. de_ctx->flags |= DE_QUIET;
  7814. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7815. "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; distance:30; sid:1;)");
  7816. if (de_ctx->sig_list == NULL)
  7817. goto end;
  7818. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx;
  7819. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7820. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7821. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7822. ud->fp_chop_offset == 3 &&
  7823. ud->fp_chop_len == 4) {
  7824. result = 1;
  7825. } else {
  7826. result = 0;
  7827. }
  7828. end:
  7829. SigCleanSignatures(de_ctx);
  7830. DetectEngineCtxFree(de_ctx);
  7831. return result;
  7832. }
  7833. int DetectFastPatternTest327(void)
  7834. {
  7835. DetectEngineCtx *de_ctx = NULL;
  7836. int result = 0;
  7837. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7838. goto end;
  7839. de_ctx->flags |= DE_QUIET;
  7840. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7841. "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; within:30; sid:1;)");
  7842. if (de_ctx->sig_list == NULL)
  7843. goto end;
  7844. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx;
  7845. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7846. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7847. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7848. ud->fp_chop_offset == 3 &&
  7849. ud->fp_chop_len == 4) {
  7850. result = 1;
  7851. } else {
  7852. result = 0;
  7853. }
  7854. end:
  7855. SigCleanSignatures(de_ctx);
  7856. DetectEngineCtxFree(de_ctx);
  7857. return result;
  7858. }
  7859. int DetectFastPatternTest328(void)
  7860. {
  7861. DetectEngineCtx *de_ctx = NULL;
  7862. int result = 0;
  7863. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7864. goto end;
  7865. de_ctx->flags |= DE_QUIET;
  7866. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7867. "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; offset:30; sid:1;)");
  7868. if (de_ctx->sig_list == NULL)
  7869. goto end;
  7870. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx;
  7871. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7872. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7873. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7874. ud->fp_chop_offset == 3 &&
  7875. ud->fp_chop_len == 4) {
  7876. result = 1;
  7877. } else {
  7878. result = 0;
  7879. }
  7880. end:
  7881. SigCleanSignatures(de_ctx);
  7882. DetectEngineCtxFree(de_ctx);
  7883. return result;
  7884. }
  7885. int DetectFastPatternTest329(void)
  7886. {
  7887. DetectEngineCtx *de_ctx = NULL;
  7888. int result = 0;
  7889. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7890. goto end;
  7891. de_ctx->flags |= DE_QUIET;
  7892. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7893. "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; depth:30; sid:1;)");
  7894. if (de_ctx->sig_list == NULL)
  7895. goto end;
  7896. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx;
  7897. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7898. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7899. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7900. ud->fp_chop_offset == 3 &&
  7901. ud->fp_chop_len == 4) {
  7902. result = 1;
  7903. } else {
  7904. result = 0;
  7905. }
  7906. end:
  7907. SigCleanSignatures(de_ctx);
  7908. DetectEngineCtxFree(de_ctx);
  7909. return result;
  7910. }
  7911. int DetectFastPatternTest330(void)
  7912. {
  7913. DetectEngineCtx *de_ctx = NULL;
  7914. int result = 0;
  7915. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7916. goto end;
  7917. de_ctx->flags |= DE_QUIET;
  7918. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7919. "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_cookie; sid:1;)");
  7920. if (de_ctx->sig_list == NULL)
  7921. goto end;
  7922. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx;
  7923. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7924. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7925. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7926. ud->fp_chop_offset == 3 &&
  7927. ud->fp_chop_len == 4) {
  7928. result = 1;
  7929. } else {
  7930. result = 0;
  7931. }
  7932. end:
  7933. SigCleanSignatures(de_ctx);
  7934. DetectEngineCtxFree(de_ctx);
  7935. return result;
  7936. }
  7937. int DetectFastPatternTest331(void)
  7938. {
  7939. DetectEngineCtx *de_ctx = NULL;
  7940. int result = 0;
  7941. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7942. goto end;
  7943. de_ctx->flags |= DE_QUIET;
  7944. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7945. "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_cookie; sid:1;)");
  7946. if (de_ctx->sig_list == NULL)
  7947. goto end;
  7948. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx;
  7949. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7950. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7951. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7952. ud->fp_chop_offset == 3 &&
  7953. ud->fp_chop_len == 4) {
  7954. result = 1;
  7955. } else {
  7956. result = 0;
  7957. }
  7958. end:
  7959. SigCleanSignatures(de_ctx);
  7960. DetectEngineCtxFree(de_ctx);
  7961. return result;
  7962. }
  7963. int DetectFastPatternTest332(void)
  7964. {
  7965. DetectEngineCtx *de_ctx = NULL;
  7966. int result = 0;
  7967. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7968. goto end;
  7969. de_ctx->flags |= DE_QUIET;
  7970. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7971. "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_cookie; sid:1;)");
  7972. if (de_ctx->sig_list == NULL)
  7973. goto end;
  7974. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx;
  7975. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  7976. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  7977. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  7978. ud->fp_chop_offset == 3 &&
  7979. ud->fp_chop_len == 4) {
  7980. result = 1;
  7981. } else {
  7982. result = 0;
  7983. }
  7984. end:
  7985. SigCleanSignatures(de_ctx);
  7986. DetectEngineCtxFree(de_ctx);
  7987. return result;
  7988. }
  7989. int DetectFastPatternTest333(void)
  7990. {
  7991. DetectEngineCtx *de_ctx = NULL;
  7992. int result = 0;
  7993. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  7994. goto end;
  7995. de_ctx->flags |= DE_QUIET;
  7996. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  7997. "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_cookie; sid:1;)");
  7998. if (de_ctx->sig_list == NULL)
  7999. goto end;
  8000. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx;
  8001. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8002. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8003. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  8004. ud->fp_chop_offset == 3 &&
  8005. ud->fp_chop_len == 4) {
  8006. result = 1;
  8007. } else {
  8008. result = 0;
  8009. }
  8010. result = 1;
  8011. end:
  8012. SigCleanSignatures(de_ctx);
  8013. DetectEngineCtxFree(de_ctx);
  8014. return result;
  8015. }
  8016. int DetectFastPatternTest334(void)
  8017. {
  8018. DetectEngineCtx *de_ctx = NULL;
  8019. int result = 0;
  8020. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8021. goto end;
  8022. de_ctx->flags |= DE_QUIET;
  8023. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8024. "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:65977,4; http_cookie; content:\"three\"; http_cookie; distance:10; sid:1;)");
  8025. if (de_ctx->sig_list != NULL)
  8026. goto end;
  8027. result = 1;
  8028. end:
  8029. SigCleanSignatures(de_ctx);
  8030. DetectEngineCtxFree(de_ctx);
  8031. return result;
  8032. }
  8033. int DetectFastPatternTest335(void)
  8034. {
  8035. DetectEngineCtx *de_ctx = NULL;
  8036. int result = 0;
  8037. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8038. goto end;
  8039. de_ctx->flags |= DE_QUIET;
  8040. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8041. "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,65977; http_cookie; content:\"three\"; distance:10; http_cookie; sid:1;)");
  8042. if (de_ctx->sig_list != NULL)
  8043. goto end;
  8044. result = 1;
  8045. end:
  8046. SigCleanSignatures(de_ctx);
  8047. DetectEngineCtxFree(de_ctx);
  8048. return result;
  8049. }
  8050. int DetectFastPatternTest336(void)
  8051. {
  8052. DetectEngineCtx *de_ctx = NULL;
  8053. int result = 0;
  8054. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8055. goto end;
  8056. de_ctx->flags |= DE_QUIET;
  8057. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8058. "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:65534,4; http_cookie; content:\"three\"; http_cookie; distance:10; sid:1;)");
  8059. if (de_ctx->sig_list != NULL)
  8060. goto end;
  8061. result = 1;
  8062. end:
  8063. SigCleanSignatures(de_ctx);
  8064. DetectEngineCtxFree(de_ctx);
  8065. return result;
  8066. }
  8067. int DetectFastPatternTest337(void)
  8068. {
  8069. DetectEngineCtx *de_ctx = NULL;
  8070. int result = 0;
  8071. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8072. goto end;
  8073. de_ctx->flags |= DE_QUIET;
  8074. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8075. "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; sid:1;)");
  8076. if (de_ctx->sig_list == NULL)
  8077. goto end;
  8078. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx;
  8079. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8080. ud->flags & DETECT_CONTENT_NEGATED &&
  8081. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8082. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  8083. ud->fp_chop_offset == 3 &&
  8084. ud->fp_chop_len == 4) {
  8085. result = 1;
  8086. } else {
  8087. result = 0;
  8088. }
  8089. end:
  8090. SigCleanSignatures(de_ctx);
  8091. DetectEngineCtxFree(de_ctx);
  8092. return result;
  8093. }
  8094. int DetectFastPatternTest338(void)
  8095. {
  8096. DetectEngineCtx *de_ctx = NULL;
  8097. int result = 0;
  8098. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8099. goto end;
  8100. de_ctx->flags |= DE_QUIET;
  8101. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8102. "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; distance:10; content:\"three\"; http_cookie; sid:1;)");
  8103. if (de_ctx->sig_list != NULL)
  8104. goto end;
  8105. result = 1;
  8106. end:
  8107. SigCleanSignatures(de_ctx);
  8108. DetectEngineCtxFree(de_ctx);
  8109. return result;
  8110. }
  8111. int DetectFastPatternTest339(void)
  8112. {
  8113. DetectEngineCtx *de_ctx = NULL;
  8114. int result = 0;
  8115. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8116. goto end;
  8117. de_ctx->flags |= DE_QUIET;
  8118. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8119. "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; within:10; content:\"three\"; http_cookie; sid:1;)");
  8120. if (de_ctx->sig_list != NULL)
  8121. goto end;
  8122. result = 1;
  8123. end:
  8124. SigCleanSignatures(de_ctx);
  8125. DetectEngineCtxFree(de_ctx);
  8126. return result;
  8127. }
  8128. int DetectFastPatternTest340(void)
  8129. {
  8130. DetectEngineCtx *de_ctx = NULL;
  8131. int result = 0;
  8132. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8133. goto end;
  8134. de_ctx->flags |= DE_QUIET;
  8135. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8136. "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; offset:10; content:\"three\"; http_cookie; sid:1;)");
  8137. if (de_ctx->sig_list != NULL)
  8138. goto end;
  8139. result = 1;
  8140. end:
  8141. SigCleanSignatures(de_ctx);
  8142. DetectEngineCtxFree(de_ctx);
  8143. return result;
  8144. }
  8145. int DetectFastPatternTest341(void)
  8146. {
  8147. DetectEngineCtx *de_ctx = NULL;
  8148. int result = 0;
  8149. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8150. goto end;
  8151. de_ctx->flags |= DE_QUIET;
  8152. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8153. "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; depth:10; content:\"three2\"; http_cookie; sid:1;)");
  8154. if (de_ctx->sig_list != NULL)
  8155. goto end;
  8156. result = 1;
  8157. end:
  8158. SigCleanSignatures(de_ctx);
  8159. DetectEngineCtxFree(de_ctx);
  8160. return result;
  8161. }
  8162. int DetectFastPatternTest342(void)
  8163. {
  8164. DetectEngineCtx *de_ctx = NULL;
  8165. int result = 0;
  8166. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8167. goto end;
  8168. de_ctx->flags |= DE_QUIET;
  8169. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8170. "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; sid:1;)");
  8171. if (de_ctx->sig_list == NULL)
  8172. goto end;
  8173. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx;
  8174. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8175. ud->flags & DETECT_CONTENT_NEGATED &&
  8176. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8177. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  8178. ud->fp_chop_offset == 3 &&
  8179. ud->fp_chop_len == 4) {
  8180. result = 1;
  8181. } else {
  8182. result = 0;
  8183. }
  8184. end:
  8185. SigCleanSignatures(de_ctx);
  8186. DetectEngineCtxFree(de_ctx);
  8187. return result;
  8188. }
  8189. /* http_cookie fast_pattern tests ^ */
  8190. /* http_raw_uri fast_pattern tests v */
  8191. int DetectFastPatternTest343(void)
  8192. {
  8193. DetectEngineCtx *de_ctx = NULL;
  8194. int result = 0;
  8195. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8196. goto end;
  8197. de_ctx->flags |= DE_QUIET;
  8198. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8199. "(content:\"one\"; http_raw_uri; "
  8200. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
  8201. "content:\"three\"; http_raw_uri; sid:1;)");
  8202. if (de_ctx->sig_list == NULL)
  8203. goto end;
  8204. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx;
  8205. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8206. ud->flags & DETECT_CONTENT_NEGATED &&
  8207. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8208. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  8209. ud->fp_chop_offset == 3 &&
  8210. ud->fp_chop_len == 4) {
  8211. result = 1;
  8212. } else {
  8213. result = 0;
  8214. }
  8215. end:
  8216. SigCleanSignatures(de_ctx);
  8217. DetectEngineCtxFree(de_ctx);
  8218. return result;
  8219. }
  8220. /**
  8221. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  8222. */
  8223. int DetectFastPatternTest344(void)
  8224. {
  8225. SigMatch *sm = NULL;
  8226. DetectEngineCtx *de_ctx = NULL;
  8227. int result = 0;
  8228. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8229. goto end;
  8230. de_ctx->flags |= DE_QUIET;
  8231. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8232. "(content:\"/one/\"; fast_pattern:only; http_raw_uri; "
  8233. "msg:\"Testing fast_pattern\"; sid:1;)");
  8234. if (de_ctx->sig_list == NULL)
  8235. goto end;
  8236. result = 0;
  8237. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH];
  8238. if (sm != NULL) {
  8239. if ( ((DetectContentData *)sm->ctx)->flags &
  8240. DETECT_CONTENT_FAST_PATTERN) {
  8241. result = 1;
  8242. } else {
  8243. result = 0;
  8244. }
  8245. }
  8246. end:
  8247. SigCleanSignatures(de_ctx);
  8248. DetectEngineCtxFree(de_ctx);
  8249. return result;
  8250. }
  8251. /**
  8252. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  8253. */
  8254. int DetectFastPatternTest345(void)
  8255. {
  8256. SigMatch *sm = NULL;
  8257. DetectEngineCtx *de_ctx = NULL;
  8258. int result = 0;
  8259. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8260. goto end;
  8261. de_ctx->flags |= DE_QUIET;
  8262. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8263. "(content:\"oneoneone\"; fast_pattern:3,4; http_raw_uri; "
  8264. "msg:\"Testing fast_pattern\"; sid:1;)");
  8265. if (de_ctx->sig_list == NULL)
  8266. goto end;
  8267. result = 0;
  8268. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH];
  8269. if (sm != NULL) {
  8270. if ( ((DetectContentData *)sm->ctx)->flags &
  8271. DETECT_CONTENT_FAST_PATTERN) {
  8272. result = 1;
  8273. } else {
  8274. result = 0;
  8275. }
  8276. }
  8277. end:
  8278. SigCleanSignatures(de_ctx);
  8279. DetectEngineCtxFree(de_ctx);
  8280. return result;
  8281. }
  8282. int DetectFastPatternTest346(void)
  8283. {
  8284. SigMatch *sm = NULL;
  8285. DetectEngineCtx *de_ctx = NULL;
  8286. int result = 0;
  8287. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8288. goto end;
  8289. de_ctx->flags |= DE_QUIET;
  8290. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8291. "(content:\"one\"; fast_pattern:only; http_raw_uri; sid:1;)");
  8292. if (de_ctx->sig_list == NULL)
  8293. goto end;
  8294. result = 0;
  8295. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH];
  8296. DetectContentData *ud = sm->ctx;
  8297. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8298. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  8299. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  8300. ud->fp_chop_offset == 0 &&
  8301. ud->fp_chop_len == 0) {
  8302. result = 1;
  8303. } else {
  8304. result = 0;
  8305. }
  8306. end:
  8307. SigCleanSignatures(de_ctx);
  8308. DetectEngineCtxFree(de_ctx);
  8309. return result;
  8310. }
  8311. int DetectFastPatternTest347(void)
  8312. {
  8313. SigMatch *sm = NULL;
  8314. DetectEngineCtx *de_ctx = NULL;
  8315. int result = 0;
  8316. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8317. goto end;
  8318. de_ctx->flags |= DE_QUIET;
  8319. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8320. "(content:\"oneoneone\"; fast_pattern:3,4; http_raw_uri; sid:1;)");
  8321. if (de_ctx->sig_list == NULL)
  8322. goto end;
  8323. result = 0;
  8324. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH];
  8325. DetectContentData *ud = sm->ctx;
  8326. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8327. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8328. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  8329. ud->fp_chop_offset == 3 &&
  8330. ud->fp_chop_len == 4) {
  8331. result = 1;
  8332. } else {
  8333. result = 0;
  8334. }
  8335. end:
  8336. SigCleanSignatures(de_ctx);
  8337. DetectEngineCtxFree(de_ctx);
  8338. return result;
  8339. }
  8340. int DetectFastPatternTest348(void)
  8341. {
  8342. DetectEngineCtx *de_ctx = NULL;
  8343. int result = 0;
  8344. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8345. goto end;
  8346. de_ctx->flags |= DE_QUIET;
  8347. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8348. "(content:\"one\"; http_raw_uri; "
  8349. "content:\"two\"; fast_pattern:only; http_raw_uri; distance:10; sid:1;)");
  8350. if (de_ctx->sig_list != NULL)
  8351. goto end;
  8352. result = 1;
  8353. end:
  8354. SigCleanSignatures(de_ctx);
  8355. DetectEngineCtxFree(de_ctx);
  8356. return result;
  8357. }
  8358. int DetectFastPatternTest349(void)
  8359. {
  8360. DetectEngineCtx *de_ctx = NULL;
  8361. int result = 0;
  8362. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8363. goto end;
  8364. de_ctx->flags |= DE_QUIET;
  8365. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8366. "(content:\"one\"; http_raw_uri; "
  8367. "content:\"two\"; distance:10; fast_pattern:only; http_raw_uri; sid:1;)");
  8368. if (de_ctx->sig_list != NULL)
  8369. goto end;
  8370. result = 1;
  8371. end:
  8372. SigCleanSignatures(de_ctx);
  8373. DetectEngineCtxFree(de_ctx);
  8374. return result;
  8375. }
  8376. int DetectFastPatternTest350(void)
  8377. {
  8378. DetectEngineCtx *de_ctx = NULL;
  8379. int result = 0;
  8380. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8381. goto end;
  8382. de_ctx->flags |= DE_QUIET;
  8383. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8384. "(content:\"one\"; http_raw_uri; "
  8385. "content:\"two\"; fast_pattern:only; http_raw_uri; within:10; sid:1;)");
  8386. if (de_ctx->sig_list != NULL)
  8387. goto end;
  8388. result = 1;
  8389. end:
  8390. SigCleanSignatures(de_ctx);
  8391. DetectEngineCtxFree(de_ctx);
  8392. return result;
  8393. }
  8394. int DetectFastPatternTest351(void)
  8395. {
  8396. DetectEngineCtx *de_ctx = NULL;
  8397. int result = 0;
  8398. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8399. goto end;
  8400. de_ctx->flags |= DE_QUIET;
  8401. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8402. "(content:\"one\"; http_raw_uri; "
  8403. "content:\"two\"; within:10; fast_pattern:only; http_raw_uri; sid:1;)");
  8404. if (de_ctx->sig_list != NULL)
  8405. goto end;
  8406. result = 1;
  8407. end:
  8408. SigCleanSignatures(de_ctx);
  8409. DetectEngineCtxFree(de_ctx);
  8410. return result;
  8411. }
  8412. int DetectFastPatternTest352(void)
  8413. {
  8414. DetectEngineCtx *de_ctx = NULL;
  8415. int result = 0;
  8416. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8417. goto end;
  8418. de_ctx->flags |= DE_QUIET;
  8419. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8420. "(content:\"one\"; http_raw_uri; "
  8421. "content:\"two\"; fast_pattern:only; http_raw_uri; offset:10; sid:1;)");
  8422. if (de_ctx->sig_list != NULL)
  8423. goto end;
  8424. result = 1;
  8425. end:
  8426. SigCleanSignatures(de_ctx);
  8427. DetectEngineCtxFree(de_ctx);
  8428. return result;
  8429. }
  8430. int DetectFastPatternTest353(void)
  8431. {
  8432. DetectEngineCtx *de_ctx = NULL;
  8433. int result = 0;
  8434. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8435. goto end;
  8436. de_ctx->flags |= DE_QUIET;
  8437. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8438. "(content:\"one\"; http_raw_uri; "
  8439. "content:\"two\"; offset:10; fast_pattern:only; http_raw_uri; sid:1;)");
  8440. if (de_ctx->sig_list != NULL)
  8441. goto end;
  8442. result = 1;
  8443. end:
  8444. SigCleanSignatures(de_ctx);
  8445. DetectEngineCtxFree(de_ctx);
  8446. return result;
  8447. }
  8448. int DetectFastPatternTest354(void)
  8449. {
  8450. DetectEngineCtx *de_ctx = NULL;
  8451. int result = 0;
  8452. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8453. goto end;
  8454. de_ctx->flags |= DE_QUIET;
  8455. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8456. "(content:\"one\"; http_raw_uri; "
  8457. "content:\"two\"; fast_pattern:only; http_raw_uri; depth:10; sid:1;)");
  8458. if (de_ctx->sig_list != NULL)
  8459. goto end;
  8460. result = 1;
  8461. end:
  8462. SigCleanSignatures(de_ctx);
  8463. DetectEngineCtxFree(de_ctx);
  8464. return result;
  8465. }
  8466. int DetectFastPatternTest355(void)
  8467. {
  8468. DetectEngineCtx *de_ctx = NULL;
  8469. int result = 0;
  8470. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8471. goto end;
  8472. de_ctx->flags |= DE_QUIET;
  8473. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8474. "(content:\"one\"; http_raw_uri; "
  8475. "content:\"two\"; depth:10; fast_pattern:only; http_raw_uri; sid:1;)");
  8476. if (de_ctx->sig_list != NULL)
  8477. goto end;
  8478. result = 1;
  8479. end:
  8480. SigCleanSignatures(de_ctx);
  8481. DetectEngineCtxFree(de_ctx);
  8482. return result;
  8483. }
  8484. int DetectFastPatternTest356(void)
  8485. {
  8486. DetectEngineCtx *de_ctx = NULL;
  8487. int result = 0;
  8488. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8489. goto end;
  8490. de_ctx->flags |= DE_QUIET;
  8491. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8492. "(content:\"one\"; http_raw_uri; "
  8493. "content:!\"two\"; fast_pattern:only; http_raw_uri; sid:1;)");
  8494. if (de_ctx->sig_list != NULL)
  8495. goto end;
  8496. result = 1;
  8497. end:
  8498. SigCleanSignatures(de_ctx);
  8499. DetectEngineCtxFree(de_ctx);
  8500. return result;
  8501. }
  8502. int DetectFastPatternTest357(void)
  8503. {
  8504. DetectEngineCtx *de_ctx = NULL;
  8505. int result = 0;
  8506. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8507. goto end;
  8508. de_ctx->flags |= DE_QUIET;
  8509. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8510. "(content: \"one\"; http_raw_uri; "
  8511. "content:\"two\"; http_raw_uri; distance:30; "
  8512. "content:\"two\"; fast_pattern:only; http_raw_uri; sid:1;)");
  8513. if (de_ctx->sig_list == NULL)
  8514. goto end;
  8515. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx;
  8516. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8517. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  8518. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  8519. ud->fp_chop_offset == 0 &&
  8520. ud->fp_chop_len == 0) {
  8521. result = 1;
  8522. } else {
  8523. result = 0;
  8524. }
  8525. end:
  8526. SigCleanSignatures(de_ctx);
  8527. DetectEngineCtxFree(de_ctx);
  8528. return result;
  8529. }
  8530. int DetectFastPatternTest358(void)
  8531. {
  8532. DetectEngineCtx *de_ctx = NULL;
  8533. int result = 0;
  8534. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8535. goto end;
  8536. de_ctx->flags |= DE_QUIET;
  8537. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8538. "(content:\"one\"; http_raw_uri; "
  8539. "content:\"two\"; http_raw_uri; within:30; "
  8540. "content:\"two\"; fast_pattern:only; http_raw_uri; sid:1;)");
  8541. if (de_ctx->sig_list == NULL)
  8542. goto end;
  8543. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx;
  8544. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8545. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  8546. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  8547. ud->fp_chop_offset == 0 &&
  8548. ud->fp_chop_len == 0) {
  8549. result = 1;
  8550. } else {
  8551. result = 0;
  8552. }
  8553. end:
  8554. SigCleanSignatures(de_ctx);
  8555. DetectEngineCtxFree(de_ctx);
  8556. return result;
  8557. }
  8558. int DetectFastPatternTest359(void)
  8559. {
  8560. DetectEngineCtx *de_ctx = NULL;
  8561. int result = 0;
  8562. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8563. goto end;
  8564. de_ctx->flags |= DE_QUIET;
  8565. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8566. "(content:\"one\"; http_raw_uri; "
  8567. "content:\"two\"; http_raw_uri; offset:30; "
  8568. "content:\"two\"; fast_pattern:only; http_raw_uri; sid:1;)");
  8569. if (de_ctx->sig_list == NULL)
  8570. goto end;
  8571. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx;
  8572. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8573. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  8574. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  8575. ud->fp_chop_offset == 0 &&
  8576. ud->fp_chop_len == 0) {
  8577. result = 1;
  8578. } else {
  8579. result = 0;
  8580. }
  8581. end:
  8582. SigCleanSignatures(de_ctx);
  8583. DetectEngineCtxFree(de_ctx);
  8584. return result;
  8585. }
  8586. int DetectFastPatternTest360(void)
  8587. {
  8588. DetectEngineCtx *de_ctx = NULL;
  8589. int result = 0;
  8590. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8591. goto end;
  8592. de_ctx->flags |= DE_QUIET;
  8593. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8594. "(content:\"one\"; http_raw_uri; "
  8595. "content:\"two\"; http_raw_uri; depth:30; "
  8596. "content:\"two\"; fast_pattern:only; http_raw_uri; sid:1;)");
  8597. if (de_ctx->sig_list == NULL)
  8598. goto end;
  8599. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx;
  8600. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8601. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  8602. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  8603. ud->fp_chop_offset == 0 &&
  8604. ud->fp_chop_len == 0) {
  8605. result = 1;
  8606. } else {
  8607. result = 0;
  8608. }
  8609. end:
  8610. SigCleanSignatures(de_ctx);
  8611. DetectEngineCtxFree(de_ctx);
  8612. return result;
  8613. }
  8614. int DetectFastPatternTest361(void)
  8615. {
  8616. DetectEngineCtx *de_ctx = NULL;
  8617. int result = 0;
  8618. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8619. goto end;
  8620. de_ctx->flags |= DE_QUIET;
  8621. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8622. "(content:!\"one\"; fast_pattern; http_raw_uri; "
  8623. "content:\"two\"; http_raw_uri; sid:1;)");
  8624. if (de_ctx->sig_list == NULL)
  8625. goto end;
  8626. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx;
  8627. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8628. ud->flags & DETECT_CONTENT_NEGATED &&
  8629. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8630. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  8631. ud->fp_chop_offset == 0 &&
  8632. ud->fp_chop_len == 0) {
  8633. result = 1;
  8634. } else {
  8635. result = 0;
  8636. }
  8637. end:
  8638. SigCleanSignatures(de_ctx);
  8639. DetectEngineCtxFree(de_ctx);
  8640. return result;
  8641. }
  8642. int DetectFastPatternTest362(void)
  8643. {
  8644. DetectEngineCtx *de_ctx = NULL;
  8645. int result = 0;
  8646. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8647. goto end;
  8648. de_ctx->flags |= DE_QUIET;
  8649. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8650. "(content:\"two\"; http_raw_uri; "
  8651. "content:!\"one\"; fast_pattern; http_raw_uri; distance:20; sid:1;)");
  8652. if (de_ctx->sig_list != NULL)
  8653. goto end;
  8654. result = 1;
  8655. end:
  8656. SigCleanSignatures(de_ctx);
  8657. DetectEngineCtxFree(de_ctx);
  8658. return result;
  8659. }
  8660. int DetectFastPatternTest363(void)
  8661. {
  8662. DetectEngineCtx *de_ctx = NULL;
  8663. int result = 0;
  8664. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8665. goto end;
  8666. de_ctx->flags |= DE_QUIET;
  8667. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8668. "(content:\"two\"; http_raw_uri; "
  8669. "content:!\"one\"; fast_pattern; http_raw_uri; within:20; sid:1;)");
  8670. if (de_ctx->sig_list != NULL)
  8671. goto end;
  8672. result = 1;
  8673. end:
  8674. SigCleanSignatures(de_ctx);
  8675. DetectEngineCtxFree(de_ctx);
  8676. return result;
  8677. }
  8678. int DetectFastPatternTest364(void)
  8679. {
  8680. DetectEngineCtx *de_ctx = NULL;
  8681. int result = 0;
  8682. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8683. goto end;
  8684. de_ctx->flags |= DE_QUIET;
  8685. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8686. "(content:\"two\"; http_raw_uri; "
  8687. "content:!\"one\"; fast_pattern; http_raw_uri; offset:20; sid:1;)");
  8688. if (de_ctx->sig_list != NULL)
  8689. goto end;
  8690. result = 1;
  8691. end:
  8692. SigCleanSignatures(de_ctx);
  8693. DetectEngineCtxFree(de_ctx);
  8694. return result;
  8695. }
  8696. int DetectFastPatternTest365(void)
  8697. {
  8698. DetectEngineCtx *de_ctx = NULL;
  8699. int result = 0;
  8700. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8701. goto end;
  8702. de_ctx->flags |= DE_QUIET;
  8703. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8704. "(content:\"two\"; http_raw_uri; "
  8705. "content:!\"one\"; fast_pattern; http_raw_uri; depth:20; sid:1;)");
  8706. if (de_ctx->sig_list != NULL)
  8707. goto end;
  8708. result = 1;
  8709. end:
  8710. SigCleanSignatures(de_ctx);
  8711. DetectEngineCtxFree(de_ctx);
  8712. return result;
  8713. }
  8714. int DetectFastPatternTest366(void)
  8715. {
  8716. DetectEngineCtx *de_ctx = NULL;
  8717. int result = 0;
  8718. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8719. goto end;
  8720. de_ctx->flags |= DE_QUIET;
  8721. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8722. "(content:\"one\"; http_raw_uri; "
  8723. "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
  8724. "content:\"three\"; http_raw_uri; sid:1;)");
  8725. if (de_ctx->sig_list == NULL)
  8726. goto end;
  8727. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx;
  8728. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8729. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8730. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  8731. ud->fp_chop_offset == 3 &&
  8732. ud->fp_chop_len == 4) {
  8733. result = 1;
  8734. } else {
  8735. result = 0;
  8736. }
  8737. end:
  8738. SigCleanSignatures(de_ctx);
  8739. DetectEngineCtxFree(de_ctx);
  8740. return result;
  8741. }
  8742. int DetectFastPatternTest367(void)
  8743. {
  8744. DetectEngineCtx *de_ctx = NULL;
  8745. int result = 0;
  8746. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8747. goto end;
  8748. de_ctx->flags |= DE_QUIET;
  8749. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8750. "(content:\"one\"; http_raw_uri; "
  8751. "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
  8752. "content:\"three\"; http_raw_uri; distance:30; sid:1;)");
  8753. if (de_ctx->sig_list == NULL)
  8754. goto end;
  8755. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx;
  8756. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8757. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8758. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  8759. ud->fp_chop_offset == 3 &&
  8760. ud->fp_chop_len == 4) {
  8761. result = 1;
  8762. } else {
  8763. result = 0;
  8764. }
  8765. end:
  8766. SigCleanSignatures(de_ctx);
  8767. DetectEngineCtxFree(de_ctx);
  8768. return result;
  8769. }
  8770. int DetectFastPatternTest368(void)
  8771. {
  8772. DetectEngineCtx *de_ctx = NULL;
  8773. int result = 0;
  8774. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8775. goto end;
  8776. de_ctx->flags |= DE_QUIET;
  8777. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8778. "(content:\"one\"; http_raw_uri; "
  8779. "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
  8780. "content:\"three\"; http_raw_uri; within:30; sid:1;)");
  8781. if (de_ctx->sig_list == NULL)
  8782. goto end;
  8783. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx;
  8784. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8785. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8786. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  8787. ud->fp_chop_offset == 3 &&
  8788. ud->fp_chop_len == 4) {
  8789. result = 1;
  8790. } else {
  8791. result = 0;
  8792. }
  8793. end:
  8794. SigCleanSignatures(de_ctx);
  8795. DetectEngineCtxFree(de_ctx);
  8796. return result;
  8797. }
  8798. int DetectFastPatternTest369(void)
  8799. {
  8800. DetectEngineCtx *de_ctx = NULL;
  8801. int result = 0;
  8802. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8803. goto end;
  8804. de_ctx->flags |= DE_QUIET;
  8805. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8806. "(content:\"one\"; http_raw_uri; "
  8807. "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
  8808. "content:\"three\"; http_raw_uri; offset:30; sid:1;)");
  8809. if (de_ctx->sig_list == NULL)
  8810. goto end;
  8811. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx;
  8812. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8813. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8814. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  8815. ud->fp_chop_offset == 3 &&
  8816. ud->fp_chop_len == 4) {
  8817. result = 1;
  8818. } else {
  8819. result = 0;
  8820. }
  8821. end:
  8822. SigCleanSignatures(de_ctx);
  8823. DetectEngineCtxFree(de_ctx);
  8824. return result;
  8825. }
  8826. int DetectFastPatternTest370(void)
  8827. {
  8828. DetectEngineCtx *de_ctx = NULL;
  8829. int result = 0;
  8830. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8831. goto end;
  8832. de_ctx->flags |= DE_QUIET;
  8833. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8834. "(content:\"one\"; http_raw_uri; "
  8835. "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
  8836. "content:\"three\"; http_raw_uri; depth:30; sid:1;)");
  8837. if (de_ctx->sig_list == NULL)
  8838. goto end;
  8839. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx;
  8840. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8841. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8842. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  8843. ud->fp_chop_offset == 3 &&
  8844. ud->fp_chop_len == 4) {
  8845. result = 1;
  8846. } else {
  8847. result = 0;
  8848. }
  8849. end:
  8850. SigCleanSignatures(de_ctx);
  8851. DetectEngineCtxFree(de_ctx);
  8852. return result;
  8853. }
  8854. int DetectFastPatternTest371(void)
  8855. {
  8856. DetectEngineCtx *de_ctx = NULL;
  8857. int result = 0;
  8858. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8859. goto end;
  8860. de_ctx->flags |= DE_QUIET;
  8861. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8862. "(content:\"one\"; http_raw_uri; "
  8863. "content:\"two\"; http_raw_uri; distance:10; "
  8864. "content:\"oneonethree\"; fast_pattern:3,4; http_raw_uri; sid:1;)");
  8865. if (de_ctx->sig_list == NULL)
  8866. goto end;
  8867. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx;
  8868. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8869. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8870. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  8871. ud->fp_chop_offset == 3 &&
  8872. ud->fp_chop_len == 4) {
  8873. result = 1;
  8874. } else {
  8875. result = 0;
  8876. }
  8877. end:
  8878. SigCleanSignatures(de_ctx);
  8879. DetectEngineCtxFree(de_ctx);
  8880. return result;
  8881. }
  8882. int DetectFastPatternTest372(void)
  8883. {
  8884. DetectEngineCtx *de_ctx = NULL;
  8885. int result = 0;
  8886. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8887. goto end;
  8888. de_ctx->flags |= DE_QUIET;
  8889. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8890. "(content:\"one\"; http_raw_uri; "
  8891. "content:\"two\"; http_raw_uri; within:10; "
  8892. "content:\"oneonethree\"; fast_pattern:3,4; http_raw_uri; sid:1;)");
  8893. if (de_ctx->sig_list == NULL)
  8894. goto end;
  8895. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx;
  8896. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8897. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8898. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  8899. ud->fp_chop_offset == 3 &&
  8900. ud->fp_chop_len == 4) {
  8901. result = 1;
  8902. } else {
  8903. result = 0;
  8904. }
  8905. end:
  8906. SigCleanSignatures(de_ctx);
  8907. DetectEngineCtxFree(de_ctx);
  8908. return result;
  8909. }
  8910. int DetectFastPatternTest373(void)
  8911. {
  8912. DetectEngineCtx *de_ctx = NULL;
  8913. int result = 0;
  8914. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8915. goto end;
  8916. de_ctx->flags |= DE_QUIET;
  8917. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8918. "(content:\"one\"; http_raw_uri; "
  8919. "content:\"two\"; http_raw_uri; offset:10; "
  8920. "content:\"oneonethree\"; fast_pattern:3,4; http_raw_uri; sid:1;)");
  8921. if (de_ctx->sig_list == NULL)
  8922. goto end;
  8923. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx;
  8924. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8925. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8926. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  8927. ud->fp_chop_offset == 3 &&
  8928. ud->fp_chop_len == 4) {
  8929. result = 1;
  8930. } else {
  8931. result = 0;
  8932. }
  8933. end:
  8934. SigCleanSignatures(de_ctx);
  8935. DetectEngineCtxFree(de_ctx);
  8936. return result;
  8937. }
  8938. int DetectFastPatternTest374(void)
  8939. {
  8940. DetectEngineCtx *de_ctx = NULL;
  8941. int result = 0;
  8942. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8943. goto end;
  8944. de_ctx->flags |= DE_QUIET;
  8945. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8946. "(content:\"one\"; http_raw_uri; "
  8947. "content:\"two\"; http_raw_uri; depth:10; "
  8948. "content:\"oneonethree\"; fast_pattern:3,4; http_raw_uri; sid:1;)");
  8949. if (de_ctx->sig_list == NULL)
  8950. goto end;
  8951. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx;
  8952. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  8953. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  8954. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  8955. ud->fp_chop_offset == 3 &&
  8956. ud->fp_chop_len == 4) {
  8957. result = 1;
  8958. } else {
  8959. result = 0;
  8960. }
  8961. result = 1;
  8962. end:
  8963. SigCleanSignatures(de_ctx);
  8964. DetectEngineCtxFree(de_ctx);
  8965. return result;
  8966. }
  8967. int DetectFastPatternTest375(void)
  8968. {
  8969. DetectEngineCtx *de_ctx = NULL;
  8970. int result = 0;
  8971. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8972. goto end;
  8973. de_ctx->flags |= DE_QUIET;
  8974. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8975. "(content:\"one\"; http_raw_uri; "
  8976. "content:\"two\"; fast_pattern:65977,4; http_raw_uri; "
  8977. "content:\"three\"; http_raw_uri; distance:10; sid:1;)");
  8978. if (de_ctx->sig_list != NULL)
  8979. goto end;
  8980. result = 1;
  8981. end:
  8982. SigCleanSignatures(de_ctx);
  8983. DetectEngineCtxFree(de_ctx);
  8984. return result;
  8985. }
  8986. int DetectFastPatternTest376(void)
  8987. {
  8988. DetectEngineCtx *de_ctx = NULL;
  8989. int result = 0;
  8990. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  8991. goto end;
  8992. de_ctx->flags |= DE_QUIET;
  8993. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  8994. "(content:\"one\"; http_raw_uri; "
  8995. "content:\"oneonetwo\"; fast_pattern:3,65977; http_raw_uri; "
  8996. "content:\"three\"; distance:10; http_raw_uri; sid:1;)");
  8997. if (de_ctx->sig_list != NULL)
  8998. goto end;
  8999. result = 1;
  9000. end:
  9001. SigCleanSignatures(de_ctx);
  9002. DetectEngineCtxFree(de_ctx);
  9003. return result;
  9004. }
  9005. int DetectFastPatternTest377(void)
  9006. {
  9007. DetectEngineCtx *de_ctx = NULL;
  9008. int result = 0;
  9009. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9010. goto end;
  9011. de_ctx->flags |= DE_QUIET;
  9012. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9013. "(content:\"one\"; http_raw_uri; "
  9014. "content:\"two\"; fast_pattern:65534,4; http_raw_uri; "
  9015. "content:\"three\"; http_raw_uri; distance:10; sid:1;)");
  9016. if (de_ctx->sig_list != NULL)
  9017. goto end;
  9018. result = 1;
  9019. end:
  9020. SigCleanSignatures(de_ctx);
  9021. DetectEngineCtxFree(de_ctx);
  9022. return result;
  9023. }
  9024. int DetectFastPatternTest378(void)
  9025. {
  9026. DetectEngineCtx *de_ctx = NULL;
  9027. int result = 0;
  9028. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9029. goto end;
  9030. de_ctx->flags |= DE_QUIET;
  9031. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9032. "(content:\"one\"; http_raw_uri; "
  9033. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
  9034. "content:\"three\"; http_raw_uri; sid:1;)");
  9035. if (de_ctx->sig_list == NULL)
  9036. goto end;
  9037. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx;
  9038. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9039. ud->flags & DETECT_CONTENT_NEGATED &&
  9040. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  9041. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  9042. ud->fp_chop_offset == 3 &&
  9043. ud->fp_chop_len == 4) {
  9044. result = 1;
  9045. } else {
  9046. result = 0;
  9047. }
  9048. end:
  9049. SigCleanSignatures(de_ctx);
  9050. DetectEngineCtxFree(de_ctx);
  9051. return result;
  9052. }
  9053. int DetectFastPatternTest379(void)
  9054. {
  9055. DetectEngineCtx *de_ctx = NULL;
  9056. int result = 0;
  9057. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9058. goto end;
  9059. de_ctx->flags |= DE_QUIET;
  9060. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9061. "(content:\"one\"; http_raw_uri; "
  9062. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; distance:10; "
  9063. "content:\"three\"; http_raw_uri; sid:1;)");
  9064. if (de_ctx->sig_list != NULL)
  9065. goto end;
  9066. result = 1;
  9067. end:
  9068. SigCleanSignatures(de_ctx);
  9069. DetectEngineCtxFree(de_ctx);
  9070. return result;
  9071. }
  9072. int DetectFastPatternTest380(void)
  9073. {
  9074. DetectEngineCtx *de_ctx = NULL;
  9075. int result = 0;
  9076. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9077. goto end;
  9078. de_ctx->flags |= DE_QUIET;
  9079. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9080. "(content:\"one\"; http_raw_uri; "
  9081. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; within:10; "
  9082. "content:\"three\"; http_raw_uri; sid:1;)");
  9083. if (de_ctx->sig_list != NULL)
  9084. goto end;
  9085. result = 1;
  9086. end:
  9087. SigCleanSignatures(de_ctx);
  9088. DetectEngineCtxFree(de_ctx);
  9089. return result;
  9090. }
  9091. int DetectFastPatternTest381(void)
  9092. {
  9093. DetectEngineCtx *de_ctx = NULL;
  9094. int result = 0;
  9095. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9096. goto end;
  9097. de_ctx->flags |= DE_QUIET;
  9098. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9099. "(content:\"one\"; http_raw_uri; "
  9100. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; offset:10; "
  9101. "content:\"three\"; http_raw_uri; sid:1;)");
  9102. if (de_ctx->sig_list != NULL)
  9103. goto end;
  9104. result = 1;
  9105. end:
  9106. SigCleanSignatures(de_ctx);
  9107. DetectEngineCtxFree(de_ctx);
  9108. return result;
  9109. }
  9110. int DetectFastPatternTest382(void)
  9111. {
  9112. DetectEngineCtx *de_ctx = NULL;
  9113. int result = 0;
  9114. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9115. goto end;
  9116. de_ctx->flags |= DE_QUIET;
  9117. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9118. "(content:\"one\"; http_raw_uri; "
  9119. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; depth:10; "
  9120. "content:\"three\"; http_raw_uri; sid:1;)");
  9121. if (de_ctx->sig_list != NULL)
  9122. goto end;
  9123. result = 1;
  9124. end:
  9125. SigCleanSignatures(de_ctx);
  9126. DetectEngineCtxFree(de_ctx);
  9127. return result;
  9128. }
  9129. int DetectFastPatternTest383(void)
  9130. {
  9131. DetectEngineCtx *de_ctx = NULL;
  9132. int result = 0;
  9133. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9134. goto end;
  9135. de_ctx->flags |= DE_QUIET;
  9136. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9137. "(content:\"one\"; http_raw_uri; "
  9138. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; "
  9139. "content:\"three\"; http_raw_uri; sid:1;)");
  9140. if (de_ctx->sig_list == NULL)
  9141. goto end;
  9142. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx;
  9143. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9144. ud->flags & DETECT_CONTENT_NEGATED &&
  9145. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  9146. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  9147. ud->fp_chop_offset == 3 &&
  9148. ud->fp_chop_len == 4) {
  9149. result = 1;
  9150. } else {
  9151. result = 0;
  9152. }
  9153. end:
  9154. SigCleanSignatures(de_ctx);
  9155. DetectEngineCtxFree(de_ctx);
  9156. return result;
  9157. }
  9158. /* http_raw_uri fast_pattern tests ^ */
  9159. /* http_stat_msg fast_pattern tests v */
  9160. int DetectFastPatternTest384(void)
  9161. {
  9162. DetectEngineCtx *de_ctx = NULL;
  9163. int result = 0;
  9164. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9165. goto end;
  9166. de_ctx->flags |= DE_QUIET;
  9167. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9168. "(content:\"one\"; http_stat_msg; "
  9169. "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
  9170. "content:\"three\"; http_stat_msg; sid:1;)");
  9171. if (de_ctx->sig_list == NULL)
  9172. goto end;
  9173. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx;
  9174. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9175. ud->flags & DETECT_CONTENT_NEGATED &&
  9176. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  9177. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  9178. ud->fp_chop_offset == 3 &&
  9179. ud->fp_chop_len == 4) {
  9180. result = 1;
  9181. } else {
  9182. result = 0;
  9183. }
  9184. end:
  9185. SigCleanSignatures(de_ctx);
  9186. DetectEngineCtxFree(de_ctx);
  9187. return result;
  9188. }
  9189. /**
  9190. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  9191. */
  9192. int DetectFastPatternTest385(void)
  9193. {
  9194. SigMatch *sm = NULL;
  9195. DetectEngineCtx *de_ctx = NULL;
  9196. int result = 0;
  9197. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9198. goto end;
  9199. de_ctx->flags |= DE_QUIET;
  9200. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9201. "(content:\"one\"; fast_pattern:only; http_stat_msg; "
  9202. "msg:\"Testing fast_pattern\"; sid:1;)");
  9203. if (de_ctx->sig_list == NULL)
  9204. goto end;
  9205. result = 0;
  9206. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSMDMATCH];
  9207. if (sm != NULL) {
  9208. if ( ((DetectContentData *)sm->ctx)->flags &
  9209. DETECT_CONTENT_FAST_PATTERN) {
  9210. result = 1;
  9211. } else {
  9212. result = 0;
  9213. }
  9214. }
  9215. end:
  9216. SigCleanSignatures(de_ctx);
  9217. DetectEngineCtxFree(de_ctx);
  9218. return result;
  9219. }
  9220. /**
  9221. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  9222. */
  9223. int DetectFastPatternTest386(void)
  9224. {
  9225. SigMatch *sm = NULL;
  9226. DetectEngineCtx *de_ctx = NULL;
  9227. int result = 0;
  9228. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9229. goto end;
  9230. de_ctx->flags |= DE_QUIET;
  9231. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9232. "(content:\"oneoneone\"; fast_pattern:3,4; http_stat_msg; "
  9233. "msg:\"Testing fast_pattern\"; sid:1;)");
  9234. if (de_ctx->sig_list == NULL)
  9235. goto end;
  9236. result = 0;
  9237. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSMDMATCH];
  9238. if (sm != NULL) {
  9239. if ( ((DetectContentData *)sm->ctx)->flags &
  9240. DETECT_CONTENT_FAST_PATTERN) {
  9241. result = 1;
  9242. } else {
  9243. result = 0;
  9244. }
  9245. }
  9246. end:
  9247. SigCleanSignatures(de_ctx);
  9248. DetectEngineCtxFree(de_ctx);
  9249. return result;
  9250. }
  9251. int DetectFastPatternTest387(void)
  9252. {
  9253. SigMatch *sm = NULL;
  9254. DetectEngineCtx *de_ctx = NULL;
  9255. int result = 0;
  9256. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9257. goto end;
  9258. de_ctx->flags |= DE_QUIET;
  9259. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9260. "(content:\"one\"; fast_pattern:only; http_stat_msg; sid:1;)");
  9261. if (de_ctx->sig_list == NULL)
  9262. goto end;
  9263. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSMDMATCH];
  9264. if (sm == NULL) {
  9265. goto end;
  9266. }
  9267. DetectContentData *ud = sm->ctx;
  9268. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9269. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  9270. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  9271. ud->fp_chop_offset == 0 &&
  9272. ud->fp_chop_len == 0) {
  9273. result = 1;
  9274. } else {
  9275. result = 0;
  9276. }
  9277. end:
  9278. SigCleanSignatures(de_ctx);
  9279. DetectEngineCtxFree(de_ctx);
  9280. return result;
  9281. }
  9282. int DetectFastPatternTest388(void)
  9283. {
  9284. SigMatch *sm = NULL;
  9285. DetectEngineCtx *de_ctx = NULL;
  9286. int result = 0;
  9287. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9288. goto end;
  9289. de_ctx->flags |= DE_QUIET;
  9290. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9291. "(content:\"oneoneone\"; fast_pattern:3,4; http_stat_msg; sid:1;)");
  9292. if (de_ctx->sig_list == NULL)
  9293. goto end;
  9294. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSMDMATCH];
  9295. if (sm == NULL) {
  9296. goto end;
  9297. }
  9298. DetectContentData *ud = sm->ctx;
  9299. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9300. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  9301. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  9302. ud->fp_chop_offset == 3 &&
  9303. ud->fp_chop_len == 4) {
  9304. result = 1;
  9305. } else {
  9306. result = 0;
  9307. }
  9308. end:
  9309. SigCleanSignatures(de_ctx);
  9310. DetectEngineCtxFree(de_ctx);
  9311. return result;
  9312. }
  9313. int DetectFastPatternTest389(void)
  9314. {
  9315. DetectEngineCtx *de_ctx = NULL;
  9316. int result = 0;
  9317. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9318. goto end;
  9319. de_ctx->flags |= DE_QUIET;
  9320. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9321. "(content:\"one\"; http_stat_msg; "
  9322. "content:\"two\"; fast_pattern:only; http_stat_msg; distance:10; sid:1;)");
  9323. if (de_ctx->sig_list != NULL)
  9324. goto end;
  9325. result = 1;
  9326. end:
  9327. SigCleanSignatures(de_ctx);
  9328. DetectEngineCtxFree(de_ctx);
  9329. return result;
  9330. }
  9331. int DetectFastPatternTest390(void)
  9332. {
  9333. DetectEngineCtx *de_ctx = NULL;
  9334. int result = 0;
  9335. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9336. goto end;
  9337. de_ctx->flags |= DE_QUIET;
  9338. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9339. "(content:\"one\"; http_stat_msg; "
  9340. "content:\"two\"; distance:10; fast_pattern:only; http_stat_msg; sid:1;)");
  9341. if (de_ctx->sig_list != NULL)
  9342. goto end;
  9343. result = 1;
  9344. end:
  9345. SigCleanSignatures(de_ctx);
  9346. DetectEngineCtxFree(de_ctx);
  9347. return result;
  9348. }
  9349. int DetectFastPatternTest391(void)
  9350. {
  9351. DetectEngineCtx *de_ctx = NULL;
  9352. int result = 0;
  9353. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9354. goto end;
  9355. de_ctx->flags |= DE_QUIET;
  9356. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9357. "(content:\"one\"; http_stat_msg; "
  9358. "content:\"two\"; fast_pattern:only; http_stat_msg; within:10; sid:1;)");
  9359. if (de_ctx->sig_list != NULL)
  9360. goto end;
  9361. result = 1;
  9362. end:
  9363. SigCleanSignatures(de_ctx);
  9364. DetectEngineCtxFree(de_ctx);
  9365. return result;
  9366. }
  9367. int DetectFastPatternTest392(void)
  9368. {
  9369. DetectEngineCtx *de_ctx = NULL;
  9370. int result = 0;
  9371. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9372. goto end;
  9373. de_ctx->flags |= DE_QUIET;
  9374. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9375. "(content:\"one\"; http_stat_msg; "
  9376. "content:\"two\"; within:10; fast_pattern:only; http_stat_msg; sid:1;)");
  9377. if (de_ctx->sig_list != NULL)
  9378. goto end;
  9379. result = 1;
  9380. end:
  9381. SigCleanSignatures(de_ctx);
  9382. DetectEngineCtxFree(de_ctx);
  9383. return result;
  9384. }
  9385. int DetectFastPatternTest393(void)
  9386. {
  9387. DetectEngineCtx *de_ctx = NULL;
  9388. int result = 0;
  9389. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9390. goto end;
  9391. de_ctx->flags |= DE_QUIET;
  9392. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9393. "(content:\"one\"; http_stat_msg; "
  9394. "content:\"two\"; fast_pattern:only; http_stat_msg; offset:10; sid:1;)");
  9395. if (de_ctx->sig_list != NULL)
  9396. goto end;
  9397. result = 1;
  9398. end:
  9399. SigCleanSignatures(de_ctx);
  9400. DetectEngineCtxFree(de_ctx);
  9401. return result;
  9402. }
  9403. int DetectFastPatternTest394(void)
  9404. {
  9405. DetectEngineCtx *de_ctx = NULL;
  9406. int result = 0;
  9407. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9408. goto end;
  9409. de_ctx->flags |= DE_QUIET;
  9410. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9411. "(content:\"one\"; http_stat_msg; "
  9412. "content:\"two\"; offset:10; fast_pattern:only; http_stat_msg; sid:1;)");
  9413. if (de_ctx->sig_list != NULL)
  9414. goto end;
  9415. result = 1;
  9416. end:
  9417. SigCleanSignatures(de_ctx);
  9418. DetectEngineCtxFree(de_ctx);
  9419. return result;
  9420. }
  9421. int DetectFastPatternTest395(void)
  9422. {
  9423. DetectEngineCtx *de_ctx = NULL;
  9424. int result = 0;
  9425. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9426. goto end;
  9427. de_ctx->flags |= DE_QUIET;
  9428. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9429. "(content:\"one\"; http_stat_msg; "
  9430. "content:\"two\"; fast_pattern:only; http_stat_msg; depth:10; sid:1;)");
  9431. if (de_ctx->sig_list != NULL)
  9432. goto end;
  9433. result = 1;
  9434. end:
  9435. SigCleanSignatures(de_ctx);
  9436. DetectEngineCtxFree(de_ctx);
  9437. return result;
  9438. }
  9439. int DetectFastPatternTest396(void)
  9440. {
  9441. DetectEngineCtx *de_ctx = NULL;
  9442. int result = 0;
  9443. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9444. goto end;
  9445. de_ctx->flags |= DE_QUIET;
  9446. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9447. "(content:\"one\"; http_stat_msg; "
  9448. "content:\"two\"; depth:10; fast_pattern:only; http_stat_msg; sid:1;)");
  9449. if (de_ctx->sig_list != NULL)
  9450. goto end;
  9451. result = 1;
  9452. end:
  9453. SigCleanSignatures(de_ctx);
  9454. DetectEngineCtxFree(de_ctx);
  9455. return result;
  9456. }
  9457. int DetectFastPatternTest397(void)
  9458. {
  9459. DetectEngineCtx *de_ctx = NULL;
  9460. int result = 0;
  9461. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9462. goto end;
  9463. de_ctx->flags |= DE_QUIET;
  9464. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9465. "(content:\"one\"; http_stat_msg; "
  9466. "content:!\"two\"; fast_pattern:only; http_stat_msg; sid:1;)");
  9467. if (de_ctx->sig_list != NULL)
  9468. goto end;
  9469. result = 1;
  9470. end:
  9471. SigCleanSignatures(de_ctx);
  9472. DetectEngineCtxFree(de_ctx);
  9473. return result;
  9474. }
  9475. int DetectFastPatternTest398(void)
  9476. {
  9477. DetectEngineCtx *de_ctx = NULL;
  9478. int result = 0;
  9479. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9480. goto end;
  9481. de_ctx->flags |= DE_QUIET;
  9482. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9483. "(content:\" one\"; http_stat_msg; "
  9484. "content:\"two\"; http_stat_msg; distance:30; "
  9485. "content:\"two\"; fast_pattern:only; http_stat_msg; sid:1;)");
  9486. if (de_ctx->sig_list == NULL)
  9487. goto end;
  9488. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx;
  9489. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9490. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  9491. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  9492. ud->fp_chop_offset == 0 &&
  9493. ud->fp_chop_len == 0) {
  9494. result = 1;
  9495. } else {
  9496. result = 0;
  9497. }
  9498. end:
  9499. SigCleanSignatures(de_ctx);
  9500. DetectEngineCtxFree(de_ctx);
  9501. return result;
  9502. }
  9503. int DetectFastPatternTest399(void)
  9504. {
  9505. DetectEngineCtx *de_ctx = NULL;
  9506. int result = 0;
  9507. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9508. goto end;
  9509. de_ctx->flags |= DE_QUIET;
  9510. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9511. "(content:\"one\"; http_stat_msg; "
  9512. "content:\"two\"; http_stat_msg; within:30; "
  9513. "content:\"two\"; fast_pattern:only; http_stat_msg; sid:1;)");
  9514. if (de_ctx->sig_list == NULL)
  9515. goto end;
  9516. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx;
  9517. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9518. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  9519. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  9520. ud->fp_chop_offset == 0 &&
  9521. ud->fp_chop_len == 0) {
  9522. result = 1;
  9523. } else {
  9524. result = 0;
  9525. }
  9526. end:
  9527. SigCleanSignatures(de_ctx);
  9528. DetectEngineCtxFree(de_ctx);
  9529. return result;
  9530. }
  9531. int DetectFastPatternTest400(void)
  9532. {
  9533. DetectEngineCtx *de_ctx = NULL;
  9534. int result = 0;
  9535. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9536. goto end;
  9537. de_ctx->flags |= DE_QUIET;
  9538. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9539. "(content:\"one\"; http_stat_msg; "
  9540. "content:\"two\"; http_stat_msg; offset:30; "
  9541. "content:\"two\"; fast_pattern:only; http_stat_msg; sid:1;)");
  9542. if (de_ctx->sig_list == NULL)
  9543. goto end;
  9544. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx;
  9545. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9546. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  9547. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  9548. ud->fp_chop_offset == 0 &&
  9549. ud->fp_chop_len == 0) {
  9550. result = 1;
  9551. } else {
  9552. result = 0;
  9553. }
  9554. end:
  9555. SigCleanSignatures(de_ctx);
  9556. DetectEngineCtxFree(de_ctx);
  9557. return result;
  9558. }
  9559. int DetectFastPatternTest401(void)
  9560. {
  9561. DetectEngineCtx *de_ctx = NULL;
  9562. int result = 0;
  9563. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9564. goto end;
  9565. de_ctx->flags |= DE_QUIET;
  9566. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9567. "(content:\"one\"; http_stat_msg; "
  9568. "content:\"two\"; http_stat_msg; depth:30; "
  9569. "content:\"two\"; fast_pattern:only; http_stat_msg; sid:1;)");
  9570. if (de_ctx->sig_list == NULL)
  9571. goto end;
  9572. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx;
  9573. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9574. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  9575. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  9576. ud->fp_chop_offset == 0 &&
  9577. ud->fp_chop_len == 0) {
  9578. result = 1;
  9579. } else {
  9580. result = 0;
  9581. }
  9582. end:
  9583. SigCleanSignatures(de_ctx);
  9584. DetectEngineCtxFree(de_ctx);
  9585. return result;
  9586. }
  9587. int DetectFastPatternTest402(void)
  9588. {
  9589. DetectEngineCtx *de_ctx = NULL;
  9590. int result = 0;
  9591. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9592. goto end;
  9593. de_ctx->flags |= DE_QUIET;
  9594. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9595. "(content:!\"one\"; fast_pattern; http_stat_msg; "
  9596. "content:\"two\"; http_stat_msg; sid:1;)");
  9597. if (de_ctx->sig_list == NULL)
  9598. goto end;
  9599. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx;
  9600. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9601. ud->flags & DETECT_CONTENT_NEGATED &&
  9602. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  9603. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  9604. ud->fp_chop_offset == 0 &&
  9605. ud->fp_chop_len == 0) {
  9606. result = 1;
  9607. } else {
  9608. result = 0;
  9609. }
  9610. end:
  9611. SigCleanSignatures(de_ctx);
  9612. DetectEngineCtxFree(de_ctx);
  9613. return result;
  9614. }
  9615. int DetectFastPatternTest403(void)
  9616. {
  9617. DetectEngineCtx *de_ctx = NULL;
  9618. int result = 0;
  9619. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9620. goto end;
  9621. de_ctx->flags |= DE_QUIET;
  9622. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9623. "(content:\"two\"; http_stat_msg; "
  9624. "content:!\"one\"; fast_pattern; http_stat_msg; distance:20; sid:1;)");
  9625. if (de_ctx->sig_list != NULL)
  9626. goto end;
  9627. result = 1;
  9628. end:
  9629. SigCleanSignatures(de_ctx);
  9630. DetectEngineCtxFree(de_ctx);
  9631. return result;
  9632. }
  9633. int DetectFastPatternTest404(void)
  9634. {
  9635. DetectEngineCtx *de_ctx = NULL;
  9636. int result = 0;
  9637. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9638. goto end;
  9639. de_ctx->flags |= DE_QUIET;
  9640. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9641. "(content:\"two\"; http_stat_msg; "
  9642. "content:!\"one\"; fast_pattern; http_stat_msg; within:20; sid:1;)");
  9643. if (de_ctx->sig_list != NULL)
  9644. goto end;
  9645. result = 1;
  9646. end:
  9647. SigCleanSignatures(de_ctx);
  9648. DetectEngineCtxFree(de_ctx);
  9649. return result;
  9650. }
  9651. int DetectFastPatternTest405(void)
  9652. {
  9653. DetectEngineCtx *de_ctx = NULL;
  9654. int result = 0;
  9655. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9656. goto end;
  9657. de_ctx->flags |= DE_QUIET;
  9658. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9659. "(content:\"two\"; http_stat_msg; "
  9660. "content:!\"one\"; fast_pattern; http_stat_msg; offset:20; sid:1;)");
  9661. if (de_ctx->sig_list != NULL)
  9662. goto end;
  9663. result = 1;
  9664. end:
  9665. SigCleanSignatures(de_ctx);
  9666. DetectEngineCtxFree(de_ctx);
  9667. return result;
  9668. }
  9669. int DetectFastPatternTest406(void)
  9670. {
  9671. DetectEngineCtx *de_ctx = NULL;
  9672. int result = 0;
  9673. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9674. goto end;
  9675. de_ctx->flags |= DE_QUIET;
  9676. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9677. "(content:\"two\"; http_stat_msg; "
  9678. "content:!\"one\"; fast_pattern; http_stat_msg; depth:20; sid:1;)");
  9679. if (de_ctx->sig_list != NULL)
  9680. goto end;
  9681. result = 1;
  9682. end:
  9683. SigCleanSignatures(de_ctx);
  9684. DetectEngineCtxFree(de_ctx);
  9685. return result;
  9686. }
  9687. int DetectFastPatternTest407(void)
  9688. {
  9689. DetectEngineCtx *de_ctx = NULL;
  9690. int result = 0;
  9691. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9692. goto end;
  9693. de_ctx->flags |= DE_QUIET;
  9694. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9695. "(content:\"one\"; http_stat_msg; "
  9696. "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
  9697. "content:\"three\"; http_stat_msg; sid:1;)");
  9698. if (de_ctx->sig_list == NULL)
  9699. goto end;
  9700. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx;
  9701. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9702. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  9703. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  9704. ud->fp_chop_offset == 3 &&
  9705. ud->fp_chop_len == 4) {
  9706. result = 1;
  9707. } else {
  9708. result = 0;
  9709. }
  9710. end:
  9711. SigCleanSignatures(de_ctx);
  9712. DetectEngineCtxFree(de_ctx);
  9713. return result;
  9714. }
  9715. int DetectFastPatternTest408(void)
  9716. {
  9717. DetectEngineCtx *de_ctx = NULL;
  9718. int result = 0;
  9719. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9720. goto end;
  9721. de_ctx->flags |= DE_QUIET;
  9722. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9723. "(content:\"one\"; http_stat_msg; "
  9724. "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
  9725. "content:\"three\"; http_stat_msg; distance:30; sid:1;)");
  9726. if (de_ctx->sig_list == NULL)
  9727. goto end;
  9728. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx;
  9729. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9730. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  9731. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  9732. ud->fp_chop_offset == 3 &&
  9733. ud->fp_chop_len == 4) {
  9734. result = 1;
  9735. } else {
  9736. result = 0;
  9737. }
  9738. end:
  9739. SigCleanSignatures(de_ctx);
  9740. DetectEngineCtxFree(de_ctx);
  9741. return result;
  9742. }
  9743. int DetectFastPatternTest409(void)
  9744. {
  9745. DetectEngineCtx *de_ctx = NULL;
  9746. int result = 0;
  9747. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9748. goto end;
  9749. de_ctx->flags |= DE_QUIET;
  9750. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9751. "(content:\"one\"; http_stat_msg; "
  9752. "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
  9753. "content:\"three\"; http_stat_msg; within:30; sid:1;)");
  9754. if (de_ctx->sig_list == NULL)
  9755. goto end;
  9756. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx;
  9757. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9758. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  9759. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  9760. ud->fp_chop_offset == 3 &&
  9761. ud->fp_chop_len == 4) {
  9762. result = 1;
  9763. } else {
  9764. result = 0;
  9765. }
  9766. end:
  9767. SigCleanSignatures(de_ctx);
  9768. DetectEngineCtxFree(de_ctx);
  9769. return result;
  9770. }
  9771. int DetectFastPatternTest410(void)
  9772. {
  9773. DetectEngineCtx *de_ctx = NULL;
  9774. int result = 0;
  9775. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9776. goto end;
  9777. de_ctx->flags |= DE_QUIET;
  9778. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9779. "(content:\"one\"; http_stat_msg; "
  9780. "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
  9781. "content:\"three\"; http_stat_msg; offset:30; sid:1;)");
  9782. if (de_ctx->sig_list == NULL)
  9783. goto end;
  9784. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx;
  9785. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9786. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  9787. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  9788. ud->fp_chop_offset == 3 &&
  9789. ud->fp_chop_len == 4) {
  9790. result = 1;
  9791. } else {
  9792. result = 0;
  9793. }
  9794. end:
  9795. SigCleanSignatures(de_ctx);
  9796. DetectEngineCtxFree(de_ctx);
  9797. return result;
  9798. }
  9799. int DetectFastPatternTest411(void)
  9800. {
  9801. DetectEngineCtx *de_ctx = NULL;
  9802. int result = 0;
  9803. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9804. goto end;
  9805. de_ctx->flags |= DE_QUIET;
  9806. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9807. "(content:\"one\"; http_stat_msg; "
  9808. "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
  9809. "content:\"three\"; http_stat_msg; depth:30; sid:1;)");
  9810. if (de_ctx->sig_list == NULL)
  9811. goto end;
  9812. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx;
  9813. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9814. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  9815. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  9816. ud->fp_chop_offset == 3 &&
  9817. ud->fp_chop_len == 4) {
  9818. result = 1;
  9819. } else {
  9820. result = 0;
  9821. }
  9822. end:
  9823. SigCleanSignatures(de_ctx);
  9824. DetectEngineCtxFree(de_ctx);
  9825. return result;
  9826. }
  9827. int DetectFastPatternTest412(void)
  9828. {
  9829. DetectEngineCtx *de_ctx = NULL;
  9830. int result = 0;
  9831. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9832. goto end;
  9833. de_ctx->flags |= DE_QUIET;
  9834. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9835. "(content:\"one\"; http_stat_msg; "
  9836. "content:\"two\"; http_stat_msg; distance:10; "
  9837. "content:\"oneonethree\"; fast_pattern:3,4; http_stat_msg; sid:1;)");
  9838. if (de_ctx->sig_list == NULL)
  9839. goto end;
  9840. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx;
  9841. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9842. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  9843. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  9844. ud->fp_chop_offset == 3 &&
  9845. ud->fp_chop_len == 4) {
  9846. result = 1;
  9847. } else {
  9848. result = 0;
  9849. }
  9850. end:
  9851. SigCleanSignatures(de_ctx);
  9852. DetectEngineCtxFree(de_ctx);
  9853. return result;
  9854. }
  9855. int DetectFastPatternTest413(void)
  9856. {
  9857. DetectEngineCtx *de_ctx = NULL;
  9858. int result = 0;
  9859. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9860. goto end;
  9861. de_ctx->flags |= DE_QUIET;
  9862. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9863. "(content:\"one\"; http_stat_msg; "
  9864. "content:\"two\"; http_stat_msg; within:10; "
  9865. "content:\"oneonethree\"; fast_pattern:3,4; http_stat_msg; sid:1;)");
  9866. if (de_ctx->sig_list == NULL)
  9867. goto end;
  9868. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx;
  9869. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9870. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  9871. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  9872. ud->fp_chop_offset == 3 &&
  9873. ud->fp_chop_len == 4) {
  9874. result = 1;
  9875. } else {
  9876. result = 0;
  9877. }
  9878. end:
  9879. SigCleanSignatures(de_ctx);
  9880. DetectEngineCtxFree(de_ctx);
  9881. return result;
  9882. }
  9883. int DetectFastPatternTest414(void)
  9884. {
  9885. DetectEngineCtx *de_ctx = NULL;
  9886. int result = 0;
  9887. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9888. goto end;
  9889. de_ctx->flags |= DE_QUIET;
  9890. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9891. "(content:\"one\"; http_stat_msg; "
  9892. "content:\"two\"; http_stat_msg; offset:10; "
  9893. "content:\"oneonethree\"; fast_pattern:3,4; http_stat_msg; sid:1;)");
  9894. if (de_ctx->sig_list == NULL)
  9895. goto end;
  9896. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx;
  9897. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9898. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  9899. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  9900. ud->fp_chop_offset == 3 &&
  9901. ud->fp_chop_len == 4) {
  9902. result = 1;
  9903. } else {
  9904. result = 0;
  9905. }
  9906. end:
  9907. SigCleanSignatures(de_ctx);
  9908. DetectEngineCtxFree(de_ctx);
  9909. return result;
  9910. }
  9911. int DetectFastPatternTest415(void)
  9912. {
  9913. DetectEngineCtx *de_ctx = NULL;
  9914. int result = 0;
  9915. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9916. goto end;
  9917. de_ctx->flags |= DE_QUIET;
  9918. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9919. "(content:\"one\"; http_stat_msg; "
  9920. "content:\"two\"; http_stat_msg; depth:10; "
  9921. "content:\"oneonethree\"; fast_pattern:3,4; http_stat_msg; sid:1;)");
  9922. if (de_ctx->sig_list == NULL)
  9923. goto end;
  9924. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx;
  9925. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  9926. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  9927. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  9928. ud->fp_chop_offset == 3 &&
  9929. ud->fp_chop_len == 4) {
  9930. result = 1;
  9931. } else {
  9932. result = 0;
  9933. }
  9934. result = 1;
  9935. end:
  9936. SigCleanSignatures(de_ctx);
  9937. DetectEngineCtxFree(de_ctx);
  9938. return result;
  9939. }
  9940. int DetectFastPatternTest416(void)
  9941. {
  9942. DetectEngineCtx *de_ctx = NULL;
  9943. int result = 0;
  9944. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9945. goto end;
  9946. de_ctx->flags |= DE_QUIET;
  9947. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9948. "(content:\"one\"; http_stat_msg; "
  9949. "content:\"two\"; fast_pattern:65977,4; http_stat_msg; "
  9950. "content:\"three\"; http_stat_msg; distance:10; sid:1;)");
  9951. if (de_ctx->sig_list != NULL)
  9952. goto end;
  9953. result = 1;
  9954. end:
  9955. SigCleanSignatures(de_ctx);
  9956. DetectEngineCtxFree(de_ctx);
  9957. return result;
  9958. }
  9959. int DetectFastPatternTest417(void)
  9960. {
  9961. DetectEngineCtx *de_ctx = NULL;
  9962. int result = 0;
  9963. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9964. goto end;
  9965. de_ctx->flags |= DE_QUIET;
  9966. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9967. "(content:\"one\"; http_stat_msg; "
  9968. "content:\"oneonetwo\"; fast_pattern:3,65977; http_stat_msg; "
  9969. "content:\"three\"; distance:10; http_stat_msg; sid:1;)");
  9970. if (de_ctx->sig_list != NULL)
  9971. goto end;
  9972. result = 1;
  9973. end:
  9974. SigCleanSignatures(de_ctx);
  9975. DetectEngineCtxFree(de_ctx);
  9976. return result;
  9977. }
  9978. int DetectFastPatternTest418(void)
  9979. {
  9980. DetectEngineCtx *de_ctx = NULL;
  9981. int result = 0;
  9982. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  9983. goto end;
  9984. de_ctx->flags |= DE_QUIET;
  9985. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  9986. "(content:\"one\"; http_stat_msg; "
  9987. "content:\"two\"; fast_pattern:65534,4; http_stat_msg; "
  9988. "content:\"three\"; http_stat_msg; distance:10; sid:1;)");
  9989. if (de_ctx->sig_list != NULL)
  9990. goto end;
  9991. result = 1;
  9992. end:
  9993. SigCleanSignatures(de_ctx);
  9994. DetectEngineCtxFree(de_ctx);
  9995. return result;
  9996. }
  9997. int DetectFastPatternTest419(void)
  9998. {
  9999. DetectEngineCtx *de_ctx = NULL;
  10000. int result = 0;
  10001. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10002. goto end;
  10003. de_ctx->flags |= DE_QUIET;
  10004. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10005. "(content:\"one\"; http_stat_msg; "
  10006. "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
  10007. "content:\"three\"; http_stat_msg; sid:1;)");
  10008. if (de_ctx->sig_list == NULL)
  10009. goto end;
  10010. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx;
  10011. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10012. ud->flags & DETECT_CONTENT_NEGATED &&
  10013. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10014. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  10015. ud->fp_chop_offset == 3 &&
  10016. ud->fp_chop_len == 4) {
  10017. result = 1;
  10018. } else {
  10019. result = 0;
  10020. }
  10021. end:
  10022. SigCleanSignatures(de_ctx);
  10023. DetectEngineCtxFree(de_ctx);
  10024. return result;
  10025. }
  10026. int DetectFastPatternTest420(void)
  10027. {
  10028. DetectEngineCtx *de_ctx = NULL;
  10029. int result = 0;
  10030. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10031. goto end;
  10032. de_ctx->flags |= DE_QUIET;
  10033. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10034. "(content:\"one\"; http_stat_msg; "
  10035. "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; distance:10; "
  10036. "content:\"three\"; http_stat_msg; sid:1;)");
  10037. if (de_ctx->sig_list != NULL)
  10038. goto end;
  10039. result = 1;
  10040. end:
  10041. SigCleanSignatures(de_ctx);
  10042. DetectEngineCtxFree(de_ctx);
  10043. return result;
  10044. }
  10045. int DetectFastPatternTest421(void)
  10046. {
  10047. DetectEngineCtx *de_ctx = NULL;
  10048. int result = 0;
  10049. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10050. goto end;
  10051. de_ctx->flags |= DE_QUIET;
  10052. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10053. "(content:\"one\"; http_stat_msg; "
  10054. "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; within:10; "
  10055. "content:\"three\"; http_stat_msg; sid:1;)");
  10056. if (de_ctx->sig_list != NULL)
  10057. goto end;
  10058. result = 1;
  10059. end:
  10060. SigCleanSignatures(de_ctx);
  10061. DetectEngineCtxFree(de_ctx);
  10062. return result;
  10063. }
  10064. int DetectFastPatternTest422(void)
  10065. {
  10066. DetectEngineCtx *de_ctx = NULL;
  10067. int result = 0;
  10068. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10069. goto end;
  10070. de_ctx->flags |= DE_QUIET;
  10071. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10072. "(content:\"one\"; http_stat_msg; "
  10073. "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; offset:10; "
  10074. "content:\"three\"; http_stat_msg; sid:1;)");
  10075. if (de_ctx->sig_list != NULL)
  10076. goto end;
  10077. result = 1;
  10078. end:
  10079. SigCleanSignatures(de_ctx);
  10080. DetectEngineCtxFree(de_ctx);
  10081. return result;
  10082. }
  10083. int DetectFastPatternTest423(void)
  10084. {
  10085. DetectEngineCtx *de_ctx = NULL;
  10086. int result = 0;
  10087. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10088. goto end;
  10089. de_ctx->flags |= DE_QUIET;
  10090. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10091. "(content:\"one\"; http_stat_msg; "
  10092. "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; depth:10; "
  10093. "content:\"three\"; http_stat_msg; sid:1;)");
  10094. if (de_ctx->sig_list != NULL)
  10095. goto end;
  10096. result = 1;
  10097. end:
  10098. SigCleanSignatures(de_ctx);
  10099. DetectEngineCtxFree(de_ctx);
  10100. return result;
  10101. }
  10102. int DetectFastPatternTest424(void)
  10103. {
  10104. DetectEngineCtx *de_ctx = NULL;
  10105. int result = 0;
  10106. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10107. goto end;
  10108. de_ctx->flags |= DE_QUIET;
  10109. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10110. "(content:\"one\"; http_stat_msg; "
  10111. "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; "
  10112. "content:\"three\"; http_stat_msg; sid:1;)");
  10113. if (de_ctx->sig_list == NULL)
  10114. goto end;
  10115. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx;
  10116. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10117. ud->flags & DETECT_CONTENT_NEGATED &&
  10118. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10119. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  10120. ud->fp_chop_offset == 3 &&
  10121. ud->fp_chop_len == 4) {
  10122. result = 1;
  10123. } else {
  10124. result = 0;
  10125. }
  10126. end:
  10127. SigCleanSignatures(de_ctx);
  10128. DetectEngineCtxFree(de_ctx);
  10129. return result;
  10130. }
  10131. /* http_stat_msg fast_pattern tests ^ */
  10132. /* http_stat_code fast_pattern tests v */
  10133. int DetectFastPatternTest425(void)
  10134. {
  10135. DetectEngineCtx *de_ctx = NULL;
  10136. int result = 0;
  10137. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10138. goto end;
  10139. de_ctx->flags |= DE_QUIET;
  10140. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10141. "(content:\"one\"; http_stat_code; "
  10142. "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
  10143. "content:\"three\"; http_stat_code; sid:1;)");
  10144. if (de_ctx->sig_list == NULL)
  10145. goto end;
  10146. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
  10147. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10148. ud->flags & DETECT_CONTENT_NEGATED &&
  10149. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10150. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  10151. ud->fp_chop_offset == 3 &&
  10152. ud->fp_chop_len == 4) {
  10153. result = 1;
  10154. } else {
  10155. result = 0;
  10156. }
  10157. end:
  10158. SigCleanSignatures(de_ctx);
  10159. DetectEngineCtxFree(de_ctx);
  10160. return result;
  10161. }
  10162. /**
  10163. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  10164. */
  10165. int DetectFastPatternTest426(void)
  10166. {
  10167. SigMatch *sm = NULL;
  10168. DetectEngineCtx *de_ctx = NULL;
  10169. int result = 0;
  10170. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10171. goto end;
  10172. de_ctx->flags |= DE_QUIET;
  10173. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10174. "(content:\"one\"; fast_pattern:only; http_stat_code; "
  10175. "msg:\"Testing fast_pattern\"; sid:1;)");
  10176. if (de_ctx->sig_list == NULL)
  10177. goto end;
  10178. result = 0;
  10179. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSCDMATCH];
  10180. if (sm != NULL) {
  10181. if ( ((DetectContentData *)sm->ctx)->flags &
  10182. DETECT_CONTENT_FAST_PATTERN) {
  10183. result = 1;
  10184. } else {
  10185. result = 0;
  10186. }
  10187. }
  10188. end:
  10189. SigCleanSignatures(de_ctx);
  10190. DetectEngineCtxFree(de_ctx);
  10191. return result;
  10192. }
  10193. /**
  10194. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  10195. */
  10196. int DetectFastPatternTest427(void)
  10197. {
  10198. SigMatch *sm = NULL;
  10199. DetectEngineCtx *de_ctx = NULL;
  10200. int result = 0;
  10201. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10202. goto end;
  10203. de_ctx->flags |= DE_QUIET;
  10204. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10205. "(content:\"oneoneone\"; fast_pattern:3,4; http_stat_code; "
  10206. "msg:\"Testing fast_pattern\"; sid:1;)");
  10207. if (de_ctx->sig_list == NULL)
  10208. goto end;
  10209. result = 0;
  10210. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSCDMATCH];
  10211. if (sm != NULL) {
  10212. if ( ((DetectContentData *)sm->ctx)->flags &
  10213. DETECT_CONTENT_FAST_PATTERN) {
  10214. result = 1;
  10215. } else {
  10216. result = 0;
  10217. }
  10218. }
  10219. end:
  10220. SigCleanSignatures(de_ctx);
  10221. DetectEngineCtxFree(de_ctx);
  10222. return result;
  10223. }
  10224. int DetectFastPatternTest428(void)
  10225. {
  10226. SigMatch *sm = NULL;
  10227. DetectEngineCtx *de_ctx = NULL;
  10228. int result = 0;
  10229. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10230. goto end;
  10231. de_ctx->flags |= DE_QUIET;
  10232. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10233. "(content:\"one\"; fast_pattern:only; http_stat_code; sid:1;)");
  10234. if (de_ctx->sig_list == NULL)
  10235. goto end;
  10236. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSCDMATCH];
  10237. if (sm == NULL) {
  10238. goto end;
  10239. }
  10240. DetectContentData *ud = sm->ctx;
  10241. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10242. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  10243. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  10244. ud->fp_chop_offset == 0 &&
  10245. ud->fp_chop_len == 0) {
  10246. result = 1;
  10247. } else {
  10248. result = 0;
  10249. }
  10250. end:
  10251. SigCleanSignatures(de_ctx);
  10252. DetectEngineCtxFree(de_ctx);
  10253. return result;
  10254. }
  10255. int DetectFastPatternTest429(void)
  10256. {
  10257. SigMatch *sm = NULL;
  10258. DetectEngineCtx *de_ctx = NULL;
  10259. int result = 0;
  10260. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10261. goto end;
  10262. de_ctx->flags |= DE_QUIET;
  10263. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10264. "(content:\"oneoneone\"; fast_pattern:3,4; http_stat_code; sid:1;)");
  10265. if (de_ctx->sig_list == NULL)
  10266. goto end;
  10267. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSCDMATCH];
  10268. if (sm == NULL) {
  10269. goto end;
  10270. }
  10271. DetectContentData *ud = sm->ctx;
  10272. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10273. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10274. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  10275. ud->fp_chop_offset == 3 &&
  10276. ud->fp_chop_len == 4) {
  10277. result = 1;
  10278. } else {
  10279. result = 0;
  10280. }
  10281. end:
  10282. SigCleanSignatures(de_ctx);
  10283. DetectEngineCtxFree(de_ctx);
  10284. return result;
  10285. }
  10286. int DetectFastPatternTest430(void)
  10287. {
  10288. DetectEngineCtx *de_ctx = NULL;
  10289. int result = 0;
  10290. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10291. goto end;
  10292. de_ctx->flags |= DE_QUIET;
  10293. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10294. "(content:\"one\"; http_stat_code; "
  10295. "content:\"two\"; fast_pattern:only; http_stat_code; distance:10; sid:1;)");
  10296. if (de_ctx->sig_list != NULL)
  10297. goto end;
  10298. result = 1;
  10299. end:
  10300. SigCleanSignatures(de_ctx);
  10301. DetectEngineCtxFree(de_ctx);
  10302. return result;
  10303. }
  10304. int DetectFastPatternTest431(void)
  10305. {
  10306. DetectEngineCtx *de_ctx = NULL;
  10307. int result = 0;
  10308. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10309. goto end;
  10310. de_ctx->flags |= DE_QUIET;
  10311. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10312. "(content:\"one\"; http_stat_code; "
  10313. "content:\"two\"; distance:10; fast_pattern:only; http_stat_code; sid:1;)");
  10314. if (de_ctx->sig_list != NULL)
  10315. goto end;
  10316. result = 1;
  10317. end:
  10318. SigCleanSignatures(de_ctx);
  10319. DetectEngineCtxFree(de_ctx);
  10320. return result;
  10321. }
  10322. int DetectFastPatternTest432(void)
  10323. {
  10324. DetectEngineCtx *de_ctx = NULL;
  10325. int result = 0;
  10326. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10327. goto end;
  10328. de_ctx->flags |= DE_QUIET;
  10329. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10330. "(content:\"one\"; http_stat_code; "
  10331. "content:\"two\"; fast_pattern:only; http_stat_code; within:10; sid:1;)");
  10332. if (de_ctx->sig_list != NULL)
  10333. goto end;
  10334. result = 1;
  10335. end:
  10336. SigCleanSignatures(de_ctx);
  10337. DetectEngineCtxFree(de_ctx);
  10338. return result;
  10339. }
  10340. int DetectFastPatternTest433(void)
  10341. {
  10342. DetectEngineCtx *de_ctx = NULL;
  10343. int result = 0;
  10344. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10345. goto end;
  10346. de_ctx->flags |= DE_QUIET;
  10347. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10348. "(content:\"one\"; http_stat_code; "
  10349. "content:\"two\"; within:10; fast_pattern:only; http_stat_code; sid:1;)");
  10350. if (de_ctx->sig_list != NULL)
  10351. goto end;
  10352. result = 1;
  10353. end:
  10354. SigCleanSignatures(de_ctx);
  10355. DetectEngineCtxFree(de_ctx);
  10356. return result;
  10357. }
  10358. int DetectFastPatternTest434(void)
  10359. {
  10360. DetectEngineCtx *de_ctx = NULL;
  10361. int result = 0;
  10362. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10363. goto end;
  10364. de_ctx->flags |= DE_QUIET;
  10365. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10366. "(content:\"one\"; http_stat_code; "
  10367. "content:\"two\"; fast_pattern:only; http_stat_code; offset:10; sid:1;)");
  10368. if (de_ctx->sig_list != NULL)
  10369. goto end;
  10370. result = 1;
  10371. end:
  10372. SigCleanSignatures(de_ctx);
  10373. DetectEngineCtxFree(de_ctx);
  10374. return result;
  10375. }
  10376. int DetectFastPatternTest435(void)
  10377. {
  10378. DetectEngineCtx *de_ctx = NULL;
  10379. int result = 0;
  10380. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10381. goto end;
  10382. de_ctx->flags |= DE_QUIET;
  10383. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10384. "(content:\"one\"; http_stat_code; "
  10385. "content:\"two\"; offset:10; fast_pattern:only; http_stat_code; sid:1;)");
  10386. if (de_ctx->sig_list != NULL)
  10387. goto end;
  10388. result = 1;
  10389. end:
  10390. SigCleanSignatures(de_ctx);
  10391. DetectEngineCtxFree(de_ctx);
  10392. return result;
  10393. }
  10394. int DetectFastPatternTest436(void)
  10395. {
  10396. DetectEngineCtx *de_ctx = NULL;
  10397. int result = 0;
  10398. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10399. goto end;
  10400. de_ctx->flags |= DE_QUIET;
  10401. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10402. "(content:\"one\"; http_stat_code; "
  10403. "content:\"two\"; fast_pattern:only; http_stat_code; depth:10; sid:1;)");
  10404. if (de_ctx->sig_list != NULL)
  10405. goto end;
  10406. result = 1;
  10407. end:
  10408. SigCleanSignatures(de_ctx);
  10409. DetectEngineCtxFree(de_ctx);
  10410. return result;
  10411. }
  10412. int DetectFastPatternTest437(void)
  10413. {
  10414. DetectEngineCtx *de_ctx = NULL;
  10415. int result = 0;
  10416. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10417. goto end;
  10418. de_ctx->flags |= DE_QUIET;
  10419. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10420. "(content:\"one\"; http_stat_code; "
  10421. "content:\"two\"; depth:10; fast_pattern:only; http_stat_code; sid:1;)");
  10422. if (de_ctx->sig_list != NULL)
  10423. goto end;
  10424. result = 1;
  10425. end:
  10426. SigCleanSignatures(de_ctx);
  10427. DetectEngineCtxFree(de_ctx);
  10428. return result;
  10429. }
  10430. int DetectFastPatternTest438(void)
  10431. {
  10432. DetectEngineCtx *de_ctx = NULL;
  10433. int result = 0;
  10434. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10435. goto end;
  10436. de_ctx->flags |= DE_QUIET;
  10437. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10438. "(content:\"one\"; http_stat_code; "
  10439. "content:!\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
  10440. if (de_ctx->sig_list != NULL)
  10441. goto end;
  10442. result = 1;
  10443. end:
  10444. SigCleanSignatures(de_ctx);
  10445. DetectEngineCtxFree(de_ctx);
  10446. return result;
  10447. }
  10448. int DetectFastPatternTest439(void)
  10449. {
  10450. DetectEngineCtx *de_ctx = NULL;
  10451. int result = 0;
  10452. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10453. goto end;
  10454. de_ctx->flags |= DE_QUIET;
  10455. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10456. "(content:\" one\"; http_stat_code; "
  10457. "content:\"two\"; http_stat_code; distance:30; "
  10458. "content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
  10459. if (de_ctx->sig_list == NULL)
  10460. goto end;
  10461. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
  10462. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10463. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  10464. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  10465. ud->fp_chop_offset == 0 &&
  10466. ud->fp_chop_len == 0) {
  10467. result = 1;
  10468. } else {
  10469. result = 0;
  10470. }
  10471. end:
  10472. SigCleanSignatures(de_ctx);
  10473. DetectEngineCtxFree(de_ctx);
  10474. return result;
  10475. }
  10476. int DetectFastPatternTest440(void)
  10477. {
  10478. DetectEngineCtx *de_ctx = NULL;
  10479. int result = 0;
  10480. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10481. goto end;
  10482. de_ctx->flags |= DE_QUIET;
  10483. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10484. "(content:\"one\"; http_stat_code; "
  10485. "content:\"two\"; http_stat_code; within:30; "
  10486. "content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
  10487. if (de_ctx->sig_list == NULL)
  10488. goto end;
  10489. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
  10490. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10491. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  10492. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  10493. ud->fp_chop_offset == 0 &&
  10494. ud->fp_chop_len == 0) {
  10495. result = 1;
  10496. } else {
  10497. result = 0;
  10498. }
  10499. end:
  10500. SigCleanSignatures(de_ctx);
  10501. DetectEngineCtxFree(de_ctx);
  10502. return result;
  10503. }
  10504. int DetectFastPatternTest441(void)
  10505. {
  10506. DetectEngineCtx *de_ctx = NULL;
  10507. int result = 0;
  10508. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10509. goto end;
  10510. de_ctx->flags |= DE_QUIET;
  10511. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10512. "(content:\"one\"; http_stat_code; "
  10513. "content:\"two\"; http_stat_code; offset:30; "
  10514. "content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
  10515. if (de_ctx->sig_list == NULL)
  10516. goto end;
  10517. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
  10518. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10519. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  10520. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  10521. ud->fp_chop_offset == 0 &&
  10522. ud->fp_chop_len == 0) {
  10523. result = 1;
  10524. } else {
  10525. result = 0;
  10526. }
  10527. end:
  10528. SigCleanSignatures(de_ctx);
  10529. DetectEngineCtxFree(de_ctx);
  10530. return result;
  10531. }
  10532. int DetectFastPatternTest442(void)
  10533. {
  10534. DetectEngineCtx *de_ctx = NULL;
  10535. int result = 0;
  10536. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10537. goto end;
  10538. de_ctx->flags |= DE_QUIET;
  10539. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10540. "(content:\"one\"; http_stat_code; "
  10541. "content:\"two\"; http_stat_code; depth:30; "
  10542. "content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)");
  10543. if (de_ctx->sig_list == NULL)
  10544. goto end;
  10545. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
  10546. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10547. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  10548. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  10549. ud->fp_chop_offset == 0 &&
  10550. ud->fp_chop_len == 0) {
  10551. result = 1;
  10552. } else {
  10553. result = 0;
  10554. }
  10555. end:
  10556. SigCleanSignatures(de_ctx);
  10557. DetectEngineCtxFree(de_ctx);
  10558. return result;
  10559. }
  10560. int DetectFastPatternTest443(void)
  10561. {
  10562. DetectEngineCtx *de_ctx = NULL;
  10563. int result = 0;
  10564. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10565. goto end;
  10566. de_ctx->flags |= DE_QUIET;
  10567. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10568. "(content:!\"one\"; fast_pattern; http_stat_code; "
  10569. "content:\"two\"; http_stat_code; sid:1;)");
  10570. if (de_ctx->sig_list == NULL)
  10571. goto end;
  10572. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
  10573. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10574. ud->flags & DETECT_CONTENT_NEGATED &&
  10575. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10576. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  10577. ud->fp_chop_offset == 0 &&
  10578. ud->fp_chop_len == 0) {
  10579. result = 1;
  10580. } else {
  10581. result = 0;
  10582. }
  10583. end:
  10584. SigCleanSignatures(de_ctx);
  10585. DetectEngineCtxFree(de_ctx);
  10586. return result;
  10587. }
  10588. int DetectFastPatternTest444(void)
  10589. {
  10590. DetectEngineCtx *de_ctx = NULL;
  10591. int result = 0;
  10592. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10593. goto end;
  10594. de_ctx->flags |= DE_QUIET;
  10595. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10596. "(content:\"two\"; http_stat_code; "
  10597. "content:!\"one\"; fast_pattern; http_stat_code; distance:20; sid:1;)");
  10598. if (de_ctx->sig_list != NULL)
  10599. goto end;
  10600. result = 1;
  10601. end:
  10602. SigCleanSignatures(de_ctx);
  10603. DetectEngineCtxFree(de_ctx);
  10604. return result;
  10605. }
  10606. int DetectFastPatternTest445(void)
  10607. {
  10608. DetectEngineCtx *de_ctx = NULL;
  10609. int result = 0;
  10610. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10611. goto end;
  10612. de_ctx->flags |= DE_QUIET;
  10613. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10614. "(content:\"two\"; http_stat_code; "
  10615. "content:!\"one\"; fast_pattern; http_stat_code; within:20; sid:1;)");
  10616. if (de_ctx->sig_list != NULL)
  10617. goto end;
  10618. result = 1;
  10619. end:
  10620. SigCleanSignatures(de_ctx);
  10621. DetectEngineCtxFree(de_ctx);
  10622. return result;
  10623. }
  10624. int DetectFastPatternTest446(void)
  10625. {
  10626. DetectEngineCtx *de_ctx = NULL;
  10627. int result = 0;
  10628. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10629. goto end;
  10630. de_ctx->flags |= DE_QUIET;
  10631. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10632. "(content:\"two\"; http_stat_code; "
  10633. "content:!\"one\"; fast_pattern; http_stat_code; offset:20; sid:1;)");
  10634. if (de_ctx->sig_list != NULL)
  10635. goto end;
  10636. result = 1;
  10637. end:
  10638. SigCleanSignatures(de_ctx);
  10639. DetectEngineCtxFree(de_ctx);
  10640. return result;
  10641. }
  10642. int DetectFastPatternTest447(void)
  10643. {
  10644. DetectEngineCtx *de_ctx = NULL;
  10645. int result = 0;
  10646. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10647. goto end;
  10648. de_ctx->flags |= DE_QUIET;
  10649. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10650. "(content:\"two\"; http_stat_code; "
  10651. "content:!\"one\"; fast_pattern; http_stat_code; depth:20; sid:1;)");
  10652. if (de_ctx->sig_list != NULL)
  10653. goto end;
  10654. result = 1;
  10655. end:
  10656. SigCleanSignatures(de_ctx);
  10657. DetectEngineCtxFree(de_ctx);
  10658. return result;
  10659. }
  10660. int DetectFastPatternTest448(void)
  10661. {
  10662. DetectEngineCtx *de_ctx = NULL;
  10663. int result = 0;
  10664. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10665. goto end;
  10666. de_ctx->flags |= DE_QUIET;
  10667. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10668. "(content:\"one\"; http_stat_code; "
  10669. "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
  10670. "content:\"three\"; http_stat_code; sid:1;)");
  10671. if (de_ctx->sig_list == NULL)
  10672. goto end;
  10673. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
  10674. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10675. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10676. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  10677. ud->fp_chop_offset == 3 &&
  10678. ud->fp_chop_len == 4) {
  10679. result = 1;
  10680. } else {
  10681. result = 0;
  10682. }
  10683. end:
  10684. SigCleanSignatures(de_ctx);
  10685. DetectEngineCtxFree(de_ctx);
  10686. return result;
  10687. }
  10688. int DetectFastPatternTest449(void)
  10689. {
  10690. DetectEngineCtx *de_ctx = NULL;
  10691. int result = 0;
  10692. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10693. goto end;
  10694. de_ctx->flags |= DE_QUIET;
  10695. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10696. "(content:\"one\"; http_stat_code; "
  10697. "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
  10698. "content:\"three\"; http_stat_code; distance:30; sid:1;)");
  10699. if (de_ctx->sig_list == NULL)
  10700. goto end;
  10701. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
  10702. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10703. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10704. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  10705. ud->fp_chop_offset == 3 &&
  10706. ud->fp_chop_len == 4) {
  10707. result = 1;
  10708. } else {
  10709. result = 0;
  10710. }
  10711. end:
  10712. SigCleanSignatures(de_ctx);
  10713. DetectEngineCtxFree(de_ctx);
  10714. return result;
  10715. }
  10716. int DetectFastPatternTest450(void)
  10717. {
  10718. DetectEngineCtx *de_ctx = NULL;
  10719. int result = 0;
  10720. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10721. goto end;
  10722. de_ctx->flags |= DE_QUIET;
  10723. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10724. "(content:\"one\"; http_stat_code; "
  10725. "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
  10726. "content:\"three\"; http_stat_code; within:30; sid:1;)");
  10727. if (de_ctx->sig_list == NULL)
  10728. goto end;
  10729. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
  10730. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10731. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10732. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  10733. ud->fp_chop_offset == 3 &&
  10734. ud->fp_chop_len == 4) {
  10735. result = 1;
  10736. } else {
  10737. result = 0;
  10738. }
  10739. end:
  10740. SigCleanSignatures(de_ctx);
  10741. DetectEngineCtxFree(de_ctx);
  10742. return result;
  10743. }
  10744. int DetectFastPatternTest451(void)
  10745. {
  10746. DetectEngineCtx *de_ctx = NULL;
  10747. int result = 0;
  10748. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10749. goto end;
  10750. de_ctx->flags |= DE_QUIET;
  10751. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10752. "(content:\"one\"; http_stat_code; "
  10753. "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
  10754. "content:\"three\"; http_stat_code; offset:30; sid:1;)");
  10755. if (de_ctx->sig_list == NULL)
  10756. goto end;
  10757. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
  10758. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10759. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10760. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  10761. ud->fp_chop_offset == 3 &&
  10762. ud->fp_chop_len == 4) {
  10763. result = 1;
  10764. } else {
  10765. result = 0;
  10766. }
  10767. end:
  10768. SigCleanSignatures(de_ctx);
  10769. DetectEngineCtxFree(de_ctx);
  10770. return result;
  10771. }
  10772. int DetectFastPatternTest452(void)
  10773. {
  10774. DetectEngineCtx *de_ctx = NULL;
  10775. int result = 0;
  10776. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10777. goto end;
  10778. de_ctx->flags |= DE_QUIET;
  10779. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10780. "(content:\"one\"; http_stat_code; "
  10781. "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
  10782. "content:\"three\"; http_stat_code; depth:30; sid:1;)");
  10783. if (de_ctx->sig_list == NULL)
  10784. goto end;
  10785. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
  10786. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10787. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10788. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  10789. ud->fp_chop_offset == 3 &&
  10790. ud->fp_chop_len == 4) {
  10791. result = 1;
  10792. } else {
  10793. result = 0;
  10794. }
  10795. end:
  10796. SigCleanSignatures(de_ctx);
  10797. DetectEngineCtxFree(de_ctx);
  10798. return result;
  10799. }
  10800. int DetectFastPatternTest453(void)
  10801. {
  10802. DetectEngineCtx *de_ctx = NULL;
  10803. int result = 0;
  10804. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10805. goto end;
  10806. de_ctx->flags |= DE_QUIET;
  10807. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10808. "(content:\"one\"; http_stat_code; "
  10809. "content:\"two\"; http_stat_code; distance:10; "
  10810. "content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)");
  10811. if (de_ctx->sig_list == NULL)
  10812. goto end;
  10813. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
  10814. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10815. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10816. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  10817. ud->fp_chop_offset == 3 &&
  10818. ud->fp_chop_len == 4) {
  10819. result = 1;
  10820. } else {
  10821. result = 0;
  10822. }
  10823. end:
  10824. SigCleanSignatures(de_ctx);
  10825. DetectEngineCtxFree(de_ctx);
  10826. return result;
  10827. }
  10828. int DetectFastPatternTest454(void)
  10829. {
  10830. DetectEngineCtx *de_ctx = NULL;
  10831. int result = 0;
  10832. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10833. goto end;
  10834. de_ctx->flags |= DE_QUIET;
  10835. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10836. "(content:\"one\"; http_stat_code; "
  10837. "content:\"two\"; http_stat_code; within:10; "
  10838. "content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)");
  10839. if (de_ctx->sig_list == NULL)
  10840. goto end;
  10841. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
  10842. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10843. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10844. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  10845. ud->fp_chop_offset == 3 &&
  10846. ud->fp_chop_len == 4) {
  10847. result = 1;
  10848. } else {
  10849. result = 0;
  10850. }
  10851. end:
  10852. SigCleanSignatures(de_ctx);
  10853. DetectEngineCtxFree(de_ctx);
  10854. return result;
  10855. }
  10856. int DetectFastPatternTest455(void)
  10857. {
  10858. DetectEngineCtx *de_ctx = NULL;
  10859. int result = 0;
  10860. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10861. goto end;
  10862. de_ctx->flags |= DE_QUIET;
  10863. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10864. "(content:\"one\"; http_stat_code; "
  10865. "content:\"two\"; http_stat_code; offset:10; "
  10866. "content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)");
  10867. if (de_ctx->sig_list == NULL)
  10868. goto end;
  10869. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
  10870. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10871. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10872. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  10873. ud->fp_chop_offset == 3 &&
  10874. ud->fp_chop_len == 4) {
  10875. result = 1;
  10876. } else {
  10877. result = 0;
  10878. }
  10879. end:
  10880. SigCleanSignatures(de_ctx);
  10881. DetectEngineCtxFree(de_ctx);
  10882. return result;
  10883. }
  10884. int DetectFastPatternTest456(void)
  10885. {
  10886. DetectEngineCtx *de_ctx = NULL;
  10887. int result = 0;
  10888. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10889. goto end;
  10890. de_ctx->flags |= DE_QUIET;
  10891. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10892. "(content:\"one\"; http_stat_code; "
  10893. "content:\"two\"; http_stat_code; depth:10; "
  10894. "content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)");
  10895. if (de_ctx->sig_list == NULL)
  10896. goto end;
  10897. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx;
  10898. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10899. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10900. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  10901. ud->fp_chop_offset == 3 &&
  10902. ud->fp_chop_len == 4) {
  10903. result = 1;
  10904. } else {
  10905. result = 0;
  10906. }
  10907. result = 1;
  10908. end:
  10909. SigCleanSignatures(de_ctx);
  10910. DetectEngineCtxFree(de_ctx);
  10911. return result;
  10912. }
  10913. int DetectFastPatternTest457(void)
  10914. {
  10915. DetectEngineCtx *de_ctx = NULL;
  10916. int result = 0;
  10917. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10918. goto end;
  10919. de_ctx->flags |= DE_QUIET;
  10920. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10921. "(content:\"one\"; http_stat_code; "
  10922. "content:\"two\"; fast_pattern:65977,4; http_stat_code; "
  10923. "content:\"three\"; http_stat_code; distance:10; sid:1;)");
  10924. if (de_ctx->sig_list != NULL)
  10925. goto end;
  10926. result = 1;
  10927. end:
  10928. SigCleanSignatures(de_ctx);
  10929. DetectEngineCtxFree(de_ctx);
  10930. return result;
  10931. }
  10932. int DetectFastPatternTest458(void)
  10933. {
  10934. DetectEngineCtx *de_ctx = NULL;
  10935. int result = 0;
  10936. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10937. goto end;
  10938. de_ctx->flags |= DE_QUIET;
  10939. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10940. "(content:\"one\"; http_stat_code; "
  10941. "content:\"oneonetwo\"; fast_pattern:3,65977; http_stat_code; "
  10942. "content:\"three\"; distance:10; http_stat_code; sid:1;)");
  10943. if (de_ctx->sig_list != NULL)
  10944. goto end;
  10945. result = 1;
  10946. end:
  10947. SigCleanSignatures(de_ctx);
  10948. DetectEngineCtxFree(de_ctx);
  10949. return result;
  10950. }
  10951. int DetectFastPatternTest459(void)
  10952. {
  10953. DetectEngineCtx *de_ctx = NULL;
  10954. int result = 0;
  10955. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10956. goto end;
  10957. de_ctx->flags |= DE_QUIET;
  10958. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10959. "(content:\"one\"; http_stat_code; "
  10960. "content:\"two\"; fast_pattern:65534,4; http_stat_code; "
  10961. "content:\"three\"; http_stat_code; distance:10; sid:1;)");
  10962. if (de_ctx->sig_list != NULL)
  10963. goto end;
  10964. result = 1;
  10965. end:
  10966. SigCleanSignatures(de_ctx);
  10967. DetectEngineCtxFree(de_ctx);
  10968. return result;
  10969. }
  10970. int DetectFastPatternTest460(void)
  10971. {
  10972. DetectEngineCtx *de_ctx = NULL;
  10973. int result = 0;
  10974. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  10975. goto end;
  10976. de_ctx->flags |= DE_QUIET;
  10977. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  10978. "(content:\"one\"; http_stat_code; "
  10979. "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
  10980. "content:\"three\"; http_stat_code; sid:1;)");
  10981. if (de_ctx->sig_list == NULL)
  10982. goto end;
  10983. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
  10984. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  10985. ud->flags & DETECT_CONTENT_NEGATED &&
  10986. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  10987. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  10988. ud->fp_chop_offset == 3 &&
  10989. ud->fp_chop_len == 4) {
  10990. result = 1;
  10991. } else {
  10992. result = 0;
  10993. }
  10994. end:
  10995. SigCleanSignatures(de_ctx);
  10996. DetectEngineCtxFree(de_ctx);
  10997. return result;
  10998. }
  10999. int DetectFastPatternTest461(void)
  11000. {
  11001. DetectEngineCtx *de_ctx = NULL;
  11002. int result = 0;
  11003. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11004. goto end;
  11005. de_ctx->flags |= DE_QUIET;
  11006. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11007. "(content:\"one\"; http_stat_code; "
  11008. "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; distance:10; "
  11009. "content:\"three\"; http_stat_code; sid:1;)");
  11010. if (de_ctx->sig_list != NULL)
  11011. goto end;
  11012. result = 1;
  11013. end:
  11014. SigCleanSignatures(de_ctx);
  11015. DetectEngineCtxFree(de_ctx);
  11016. return result;
  11017. }
  11018. int DetectFastPatternTest462(void)
  11019. {
  11020. DetectEngineCtx *de_ctx = NULL;
  11021. int result = 0;
  11022. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11023. goto end;
  11024. de_ctx->flags |= DE_QUIET;
  11025. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11026. "(content:\"one\"; http_stat_code; "
  11027. "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; within:10; "
  11028. "content:\"three\"; http_stat_code; sid:1;)");
  11029. if (de_ctx->sig_list != NULL)
  11030. goto end;
  11031. result = 1;
  11032. end:
  11033. SigCleanSignatures(de_ctx);
  11034. DetectEngineCtxFree(de_ctx);
  11035. return result;
  11036. }
  11037. int DetectFastPatternTest463(void)
  11038. {
  11039. DetectEngineCtx *de_ctx = NULL;
  11040. int result = 0;
  11041. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11042. goto end;
  11043. de_ctx->flags |= DE_QUIET;
  11044. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11045. "(content:\"one\"; http_stat_code; "
  11046. "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; offset:10; "
  11047. "content:\"three\"; http_stat_code; sid:1;)");
  11048. if (de_ctx->sig_list != NULL)
  11049. goto end;
  11050. result = 1;
  11051. end:
  11052. SigCleanSignatures(de_ctx);
  11053. DetectEngineCtxFree(de_ctx);
  11054. return result;
  11055. }
  11056. int DetectFastPatternTest464(void)
  11057. {
  11058. DetectEngineCtx *de_ctx = NULL;
  11059. int result = 0;
  11060. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11061. goto end;
  11062. de_ctx->flags |= DE_QUIET;
  11063. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11064. "(content:\"one\"; http_stat_code; "
  11065. "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; depth:10; "
  11066. "content:\"three\"; http_stat_code; sid:1;)");
  11067. if (de_ctx->sig_list != NULL)
  11068. goto end;
  11069. result = 1;
  11070. end:
  11071. SigCleanSignatures(de_ctx);
  11072. DetectEngineCtxFree(de_ctx);
  11073. return result;
  11074. }
  11075. int DetectFastPatternTest465(void)
  11076. {
  11077. DetectEngineCtx *de_ctx = NULL;
  11078. int result = 0;
  11079. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11080. goto end;
  11081. de_ctx->flags |= DE_QUIET;
  11082. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11083. "(content:\"one\"; http_stat_code; "
  11084. "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; "
  11085. "content:\"three\"; http_stat_code; sid:1;)");
  11086. if (de_ctx->sig_list == NULL)
  11087. goto end;
  11088. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx;
  11089. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11090. ud->flags & DETECT_CONTENT_NEGATED &&
  11091. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  11092. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  11093. ud->fp_chop_offset == 3 &&
  11094. ud->fp_chop_len == 4) {
  11095. result = 1;
  11096. } else {
  11097. result = 0;
  11098. }
  11099. end:
  11100. SigCleanSignatures(de_ctx);
  11101. DetectEngineCtxFree(de_ctx);
  11102. return result;
  11103. }
  11104. /* http_stat_code fast_pattern tests ^ */
  11105. /* http_server_body fast_pattern tests v */
  11106. int DetectFastPatternTest466(void)
  11107. {
  11108. DetectEngineCtx *de_ctx = NULL;
  11109. int result = 0;
  11110. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11111. goto end;
  11112. de_ctx->flags |= DE_QUIET;
  11113. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11114. "(content:\"one\"; http_server_body; "
  11115. "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
  11116. "content:\"three\"; http_server_body; sid:1;)");
  11117. if (de_ctx->sig_list == NULL)
  11118. goto end;
  11119. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  11120. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11121. ud->flags & DETECT_CONTENT_NEGATED &&
  11122. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  11123. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  11124. ud->fp_chop_offset == 3 &&
  11125. ud->fp_chop_len == 4) {
  11126. result = 1;
  11127. } else {
  11128. result = 0;
  11129. }
  11130. end:
  11131. SigCleanSignatures(de_ctx);
  11132. DetectEngineCtxFree(de_ctx);
  11133. return result;
  11134. }
  11135. /**
  11136. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  11137. */
  11138. int DetectFastPatternTest467(void)
  11139. {
  11140. SigMatch *sm = NULL;
  11141. DetectEngineCtx *de_ctx = NULL;
  11142. int result = 0;
  11143. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11144. goto end;
  11145. de_ctx->flags |= DE_QUIET;
  11146. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11147. "(content:\"one\"; fast_pattern:only; http_server_body; "
  11148. "msg:\"Testing fast_pattern\"; sid:1;)");
  11149. if (de_ctx->sig_list == NULL)
  11150. goto end;
  11151. result = 0;
  11152. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
  11153. if (sm != NULL) {
  11154. if ( ((DetectContentData *)sm->ctx)->flags &
  11155. DETECT_CONTENT_FAST_PATTERN) {
  11156. result = 1;
  11157. } else {
  11158. result = 0;
  11159. }
  11160. }
  11161. end:
  11162. SigCleanSignatures(de_ctx);
  11163. DetectEngineCtxFree(de_ctx);
  11164. return result;
  11165. }
  11166. /**
  11167. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  11168. */
  11169. int DetectFastPatternTest468(void)
  11170. {
  11171. SigMatch *sm = NULL;
  11172. DetectEngineCtx *de_ctx = NULL;
  11173. int result = 0;
  11174. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11175. goto end;
  11176. de_ctx->flags |= DE_QUIET;
  11177. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11178. "(content:\"oneoneone\"; fast_pattern:3,4; http_server_body; "
  11179. "msg:\"Testing fast_pattern\"; sid:1;)");
  11180. if (de_ctx->sig_list == NULL)
  11181. goto end;
  11182. result = 0;
  11183. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
  11184. if (sm != NULL) {
  11185. if ( ((DetectContentData *)sm->ctx)->flags &
  11186. DETECT_CONTENT_FAST_PATTERN) {
  11187. result = 1;
  11188. } else {
  11189. result = 0;
  11190. }
  11191. }
  11192. end:
  11193. SigCleanSignatures(de_ctx);
  11194. DetectEngineCtxFree(de_ctx);
  11195. return result;
  11196. }
  11197. int DetectFastPatternTest469(void)
  11198. {
  11199. SigMatch *sm = NULL;
  11200. DetectEngineCtx *de_ctx = NULL;
  11201. int result = 0;
  11202. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11203. goto end;
  11204. de_ctx->flags |= DE_QUIET;
  11205. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11206. "(content:\"one\"; fast_pattern:only; http_server_body; sid:1;)");
  11207. if (de_ctx->sig_list == NULL)
  11208. goto end;
  11209. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
  11210. if (sm == NULL) {
  11211. goto end;
  11212. }
  11213. DetectContentData *ud = sm->ctx;
  11214. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11215. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  11216. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  11217. ud->fp_chop_offset == 0 &&
  11218. ud->fp_chop_len == 0) {
  11219. result = 1;
  11220. } else {
  11221. result = 0;
  11222. }
  11223. end:
  11224. SigCleanSignatures(de_ctx);
  11225. DetectEngineCtxFree(de_ctx);
  11226. return result;
  11227. }
  11228. int DetectFastPatternTest470(void)
  11229. {
  11230. SigMatch *sm = NULL;
  11231. DetectEngineCtx *de_ctx = NULL;
  11232. int result = 0;
  11233. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11234. goto end;
  11235. de_ctx->flags |= DE_QUIET;
  11236. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11237. "(content:\"oneoneone\"; fast_pattern:3,4; http_server_body; sid:1;)");
  11238. if (de_ctx->sig_list == NULL)
  11239. goto end;
  11240. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
  11241. if (sm == NULL) {
  11242. goto end;
  11243. }
  11244. DetectContentData *ud = sm->ctx;
  11245. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11246. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  11247. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  11248. ud->fp_chop_offset == 3 &&
  11249. ud->fp_chop_len == 4) {
  11250. result = 1;
  11251. } else {
  11252. result = 0;
  11253. }
  11254. end:
  11255. SigCleanSignatures(de_ctx);
  11256. DetectEngineCtxFree(de_ctx);
  11257. return result;
  11258. }
  11259. int DetectFastPatternTest471(void)
  11260. {
  11261. DetectEngineCtx *de_ctx = NULL;
  11262. int result = 0;
  11263. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11264. goto end;
  11265. de_ctx->flags |= DE_QUIET;
  11266. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11267. "(content:\"one\"; http_server_body; "
  11268. "content:\"two\"; fast_pattern:only; http_server_body; distance:10; sid:1;)");
  11269. if (de_ctx->sig_list != NULL)
  11270. goto end;
  11271. result = 1;
  11272. end:
  11273. SigCleanSignatures(de_ctx);
  11274. DetectEngineCtxFree(de_ctx);
  11275. return result;
  11276. }
  11277. int DetectFastPatternTest472(void)
  11278. {
  11279. DetectEngineCtx *de_ctx = NULL;
  11280. int result = 0;
  11281. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11282. goto end;
  11283. de_ctx->flags |= DE_QUIET;
  11284. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11285. "(content:\"one\"; http_server_body; "
  11286. "content:\"two\"; distance:10; fast_pattern:only; http_server_body; sid:1;)");
  11287. if (de_ctx->sig_list != NULL)
  11288. goto end;
  11289. result = 1;
  11290. end:
  11291. SigCleanSignatures(de_ctx);
  11292. DetectEngineCtxFree(de_ctx);
  11293. return result;
  11294. }
  11295. int DetectFastPatternTest473(void)
  11296. {
  11297. DetectEngineCtx *de_ctx = NULL;
  11298. int result = 0;
  11299. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11300. goto end;
  11301. de_ctx->flags |= DE_QUIET;
  11302. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11303. "(content:\"one\"; http_server_body; "
  11304. "content:\"two\"; fast_pattern:only; http_server_body; within:10; sid:1;)");
  11305. if (de_ctx->sig_list != NULL)
  11306. goto end;
  11307. result = 1;
  11308. end:
  11309. SigCleanSignatures(de_ctx);
  11310. DetectEngineCtxFree(de_ctx);
  11311. return result;
  11312. }
  11313. int DetectFastPatternTest474(void)
  11314. {
  11315. DetectEngineCtx *de_ctx = NULL;
  11316. int result = 0;
  11317. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11318. goto end;
  11319. de_ctx->flags |= DE_QUIET;
  11320. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11321. "(content:\"one\"; http_server_body; "
  11322. "content:\"two\"; within:10; fast_pattern:only; http_server_body; sid:1;)");
  11323. if (de_ctx->sig_list != NULL)
  11324. goto end;
  11325. result = 1;
  11326. end:
  11327. SigCleanSignatures(de_ctx);
  11328. DetectEngineCtxFree(de_ctx);
  11329. return result;
  11330. }
  11331. int DetectFastPatternTest475(void)
  11332. {
  11333. DetectEngineCtx *de_ctx = NULL;
  11334. int result = 0;
  11335. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11336. goto end;
  11337. de_ctx->flags |= DE_QUIET;
  11338. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11339. "(content:\"one\"; http_server_body; "
  11340. "content:\"two\"; fast_pattern:only; http_server_body; offset:10; sid:1;)");
  11341. if (de_ctx->sig_list != NULL)
  11342. goto end;
  11343. result = 1;
  11344. end:
  11345. SigCleanSignatures(de_ctx);
  11346. DetectEngineCtxFree(de_ctx);
  11347. return result;
  11348. }
  11349. int DetectFastPatternTest476(void)
  11350. {
  11351. DetectEngineCtx *de_ctx = NULL;
  11352. int result = 0;
  11353. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11354. goto end;
  11355. de_ctx->flags |= DE_QUIET;
  11356. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11357. "(content:\"one\"; http_server_body; "
  11358. "content:\"two\"; offset:10; fast_pattern:only; http_server_body; sid:1;)");
  11359. if (de_ctx->sig_list != NULL)
  11360. goto end;
  11361. result = 1;
  11362. end:
  11363. SigCleanSignatures(de_ctx);
  11364. DetectEngineCtxFree(de_ctx);
  11365. return result;
  11366. }
  11367. int DetectFastPatternTest477(void)
  11368. {
  11369. DetectEngineCtx *de_ctx = NULL;
  11370. int result = 0;
  11371. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11372. goto end;
  11373. de_ctx->flags |= DE_QUIET;
  11374. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11375. "(content:\"one\"; http_server_body; "
  11376. "content:\"two\"; fast_pattern:only; http_server_body; depth:10; sid:1;)");
  11377. if (de_ctx->sig_list != NULL)
  11378. goto end;
  11379. result = 1;
  11380. end:
  11381. SigCleanSignatures(de_ctx);
  11382. DetectEngineCtxFree(de_ctx);
  11383. return result;
  11384. }
  11385. int DetectFastPatternTest478(void)
  11386. {
  11387. DetectEngineCtx *de_ctx = NULL;
  11388. int result = 0;
  11389. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11390. goto end;
  11391. de_ctx->flags |= DE_QUIET;
  11392. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11393. "(content:\"one\"; http_server_body; "
  11394. "content:\"two\"; depth:10; fast_pattern:only; http_server_body; sid:1;)");
  11395. if (de_ctx->sig_list != NULL)
  11396. goto end;
  11397. result = 1;
  11398. end:
  11399. SigCleanSignatures(de_ctx);
  11400. DetectEngineCtxFree(de_ctx);
  11401. return result;
  11402. }
  11403. int DetectFastPatternTest479(void)
  11404. {
  11405. DetectEngineCtx *de_ctx = NULL;
  11406. int result = 0;
  11407. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11408. goto end;
  11409. de_ctx->flags |= DE_QUIET;
  11410. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11411. "(content:\"one\"; http_server_body; "
  11412. "content:!\"two\"; fast_pattern:only; http_server_body; sid:1;)");
  11413. if (de_ctx->sig_list != NULL)
  11414. goto end;
  11415. result = 1;
  11416. end:
  11417. SigCleanSignatures(de_ctx);
  11418. DetectEngineCtxFree(de_ctx);
  11419. return result;
  11420. }
  11421. int DetectFastPatternTest480(void)
  11422. {
  11423. DetectEngineCtx *de_ctx = NULL;
  11424. int result = 0;
  11425. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11426. goto end;
  11427. de_ctx->flags |= DE_QUIET;
  11428. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11429. "(content:\" one\"; http_server_body; "
  11430. "content:\"two\"; http_server_body; distance:30; "
  11431. "content:\"two\"; fast_pattern:only; http_server_body; sid:1;)");
  11432. if (de_ctx->sig_list == NULL)
  11433. goto end;
  11434. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  11435. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11436. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  11437. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  11438. ud->fp_chop_offset == 0 &&
  11439. ud->fp_chop_len == 0) {
  11440. result = 1;
  11441. } else {
  11442. result = 0;
  11443. }
  11444. end:
  11445. SigCleanSignatures(de_ctx);
  11446. DetectEngineCtxFree(de_ctx);
  11447. return result;
  11448. }
  11449. int DetectFastPatternTest481(void)
  11450. {
  11451. DetectEngineCtx *de_ctx = NULL;
  11452. int result = 0;
  11453. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11454. goto end;
  11455. de_ctx->flags |= DE_QUIET;
  11456. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11457. "(content:\"one\"; http_server_body; "
  11458. "content:\"two\"; http_server_body; within:30; "
  11459. "content:\"two\"; fast_pattern:only; http_server_body; sid:1;)");
  11460. if (de_ctx->sig_list == NULL)
  11461. goto end;
  11462. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  11463. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11464. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  11465. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  11466. ud->fp_chop_offset == 0 &&
  11467. ud->fp_chop_len == 0) {
  11468. result = 1;
  11469. } else {
  11470. result = 0;
  11471. }
  11472. end:
  11473. SigCleanSignatures(de_ctx);
  11474. DetectEngineCtxFree(de_ctx);
  11475. return result;
  11476. }
  11477. int DetectFastPatternTest482(void)
  11478. {
  11479. DetectEngineCtx *de_ctx = NULL;
  11480. int result = 0;
  11481. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11482. goto end;
  11483. de_ctx->flags |= DE_QUIET;
  11484. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11485. "(content:\"one\"; http_server_body; "
  11486. "content:\"two\"; http_server_body; offset:30; "
  11487. "content:\"two\"; fast_pattern:only; http_server_body; sid:1;)");
  11488. if (de_ctx->sig_list == NULL)
  11489. goto end;
  11490. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  11491. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11492. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  11493. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  11494. ud->fp_chop_offset == 0 &&
  11495. ud->fp_chop_len == 0) {
  11496. result = 1;
  11497. } else {
  11498. result = 0;
  11499. }
  11500. end:
  11501. SigCleanSignatures(de_ctx);
  11502. DetectEngineCtxFree(de_ctx);
  11503. return result;
  11504. }
  11505. int DetectFastPatternTest483(void)
  11506. {
  11507. DetectEngineCtx *de_ctx = NULL;
  11508. int result = 0;
  11509. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11510. goto end;
  11511. de_ctx->flags |= DE_QUIET;
  11512. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11513. "(content:\"one\"; http_server_body; "
  11514. "content:\"two\"; http_server_body; depth:30; "
  11515. "content:\"two\"; fast_pattern:only; http_server_body; sid:1;)");
  11516. if (de_ctx->sig_list == NULL)
  11517. goto end;
  11518. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  11519. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11520. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  11521. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  11522. ud->fp_chop_offset == 0 &&
  11523. ud->fp_chop_len == 0) {
  11524. result = 1;
  11525. } else {
  11526. result = 0;
  11527. }
  11528. end:
  11529. SigCleanSignatures(de_ctx);
  11530. DetectEngineCtxFree(de_ctx);
  11531. return result;
  11532. }
  11533. int DetectFastPatternTest484(void)
  11534. {
  11535. DetectEngineCtx *de_ctx = NULL;
  11536. int result = 0;
  11537. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11538. goto end;
  11539. de_ctx->flags |= DE_QUIET;
  11540. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11541. "(content:!\"one\"; fast_pattern; http_server_body; "
  11542. "content:\"two\"; http_server_body; sid:1;)");
  11543. if (de_ctx->sig_list == NULL)
  11544. goto end;
  11545. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  11546. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11547. ud->flags & DETECT_CONTENT_NEGATED &&
  11548. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  11549. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  11550. ud->fp_chop_offset == 0 &&
  11551. ud->fp_chop_len == 0) {
  11552. result = 1;
  11553. } else {
  11554. result = 0;
  11555. }
  11556. end:
  11557. SigCleanSignatures(de_ctx);
  11558. DetectEngineCtxFree(de_ctx);
  11559. return result;
  11560. }
  11561. int DetectFastPatternTest485(void)
  11562. {
  11563. DetectEngineCtx *de_ctx = NULL;
  11564. int result = 0;
  11565. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11566. goto end;
  11567. de_ctx->flags |= DE_QUIET;
  11568. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11569. "(content:\"two\"; http_server_body; "
  11570. "content:!\"one\"; fast_pattern; http_server_body; distance:20; sid:1;)");
  11571. if (de_ctx->sig_list != NULL)
  11572. goto end;
  11573. result = 1;
  11574. end:
  11575. SigCleanSignatures(de_ctx);
  11576. DetectEngineCtxFree(de_ctx);
  11577. return result;
  11578. }
  11579. int DetectFastPatternTest486(void)
  11580. {
  11581. DetectEngineCtx *de_ctx = NULL;
  11582. int result = 0;
  11583. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11584. goto end;
  11585. de_ctx->flags |= DE_QUIET;
  11586. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11587. "(content:\"two\"; http_server_body; "
  11588. "content:!\"one\"; fast_pattern; http_server_body; within:20; sid:1;)");
  11589. if (de_ctx->sig_list != NULL)
  11590. goto end;
  11591. result = 1;
  11592. end:
  11593. SigCleanSignatures(de_ctx);
  11594. DetectEngineCtxFree(de_ctx);
  11595. return result;
  11596. }
  11597. int DetectFastPatternTest487(void)
  11598. {
  11599. DetectEngineCtx *de_ctx = NULL;
  11600. int result = 0;
  11601. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11602. goto end;
  11603. de_ctx->flags |= DE_QUIET;
  11604. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11605. "(content:\"two\"; http_server_body; "
  11606. "content:!\"one\"; fast_pattern; http_server_body; offset:20; sid:1;)");
  11607. if (de_ctx->sig_list != NULL)
  11608. goto end;
  11609. result = 1;
  11610. end:
  11611. SigCleanSignatures(de_ctx);
  11612. DetectEngineCtxFree(de_ctx);
  11613. return result;
  11614. }
  11615. int DetectFastPatternTest488(void)
  11616. {
  11617. DetectEngineCtx *de_ctx = NULL;
  11618. int result = 0;
  11619. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11620. goto end;
  11621. de_ctx->flags |= DE_QUIET;
  11622. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11623. "(content:\"two\"; http_server_body; "
  11624. "content:!\"one\"; fast_pattern; http_server_body; depth:20; sid:1;)");
  11625. if (de_ctx->sig_list != NULL)
  11626. goto end;
  11627. result = 1;
  11628. end:
  11629. SigCleanSignatures(de_ctx);
  11630. DetectEngineCtxFree(de_ctx);
  11631. return result;
  11632. }
  11633. int DetectFastPatternTest489(void)
  11634. {
  11635. DetectEngineCtx *de_ctx = NULL;
  11636. int result = 0;
  11637. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11638. goto end;
  11639. de_ctx->flags |= DE_QUIET;
  11640. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11641. "(content:\"one\"; http_server_body; "
  11642. "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
  11643. "content:\"three\"; http_server_body; sid:1;)");
  11644. if (de_ctx->sig_list == NULL)
  11645. goto end;
  11646. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  11647. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11648. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  11649. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  11650. ud->fp_chop_offset == 3 &&
  11651. ud->fp_chop_len == 4) {
  11652. result = 1;
  11653. } else {
  11654. result = 0;
  11655. }
  11656. end:
  11657. SigCleanSignatures(de_ctx);
  11658. DetectEngineCtxFree(de_ctx);
  11659. return result;
  11660. }
  11661. int DetectFastPatternTest490(void)
  11662. {
  11663. DetectEngineCtx *de_ctx = NULL;
  11664. int result = 0;
  11665. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11666. goto end;
  11667. de_ctx->flags |= DE_QUIET;
  11668. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11669. "(content:\"one\"; http_server_body; "
  11670. "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
  11671. "content:\"three\"; http_server_body; distance:30; sid:1;)");
  11672. if (de_ctx->sig_list == NULL)
  11673. goto end;
  11674. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  11675. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11676. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  11677. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  11678. ud->fp_chop_offset == 3 &&
  11679. ud->fp_chop_len == 4) {
  11680. result = 1;
  11681. } else {
  11682. result = 0;
  11683. }
  11684. end:
  11685. SigCleanSignatures(de_ctx);
  11686. DetectEngineCtxFree(de_ctx);
  11687. return result;
  11688. }
  11689. int DetectFastPatternTest491(void)
  11690. {
  11691. DetectEngineCtx *de_ctx = NULL;
  11692. int result = 0;
  11693. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11694. goto end;
  11695. de_ctx->flags |= DE_QUIET;
  11696. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11697. "(content:\"one\"; http_server_body; "
  11698. "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
  11699. "content:\"three\"; http_server_body; within:30; sid:1;)");
  11700. if (de_ctx->sig_list == NULL)
  11701. goto end;
  11702. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  11703. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11704. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  11705. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  11706. ud->fp_chop_offset == 3 &&
  11707. ud->fp_chop_len == 4) {
  11708. result = 1;
  11709. } else {
  11710. result = 0;
  11711. }
  11712. end:
  11713. SigCleanSignatures(de_ctx);
  11714. DetectEngineCtxFree(de_ctx);
  11715. return result;
  11716. }
  11717. int DetectFastPatternTest492(void)
  11718. {
  11719. DetectEngineCtx *de_ctx = NULL;
  11720. int result = 0;
  11721. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11722. goto end;
  11723. de_ctx->flags |= DE_QUIET;
  11724. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11725. "(content:\"one\"; http_server_body; "
  11726. "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
  11727. "content:\"three\"; http_server_body; offset:30; sid:1;)");
  11728. if (de_ctx->sig_list == NULL)
  11729. goto end;
  11730. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  11731. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11732. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  11733. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  11734. ud->fp_chop_offset == 3 &&
  11735. ud->fp_chop_len == 4) {
  11736. result = 1;
  11737. } else {
  11738. result = 0;
  11739. }
  11740. end:
  11741. SigCleanSignatures(de_ctx);
  11742. DetectEngineCtxFree(de_ctx);
  11743. return result;
  11744. }
  11745. int DetectFastPatternTest493(void)
  11746. {
  11747. DetectEngineCtx *de_ctx = NULL;
  11748. int result = 0;
  11749. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11750. goto end;
  11751. de_ctx->flags |= DE_QUIET;
  11752. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11753. "(content:\"one\"; http_server_body; "
  11754. "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
  11755. "content:\"three\"; http_server_body; depth:30; sid:1;)");
  11756. if (de_ctx->sig_list == NULL)
  11757. goto end;
  11758. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  11759. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11760. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  11761. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  11762. ud->fp_chop_offset == 3 &&
  11763. ud->fp_chop_len == 4) {
  11764. result = 1;
  11765. } else {
  11766. result = 0;
  11767. }
  11768. end:
  11769. SigCleanSignatures(de_ctx);
  11770. DetectEngineCtxFree(de_ctx);
  11771. return result;
  11772. }
  11773. int DetectFastPatternTest494(void)
  11774. {
  11775. DetectEngineCtx *de_ctx = NULL;
  11776. int result = 0;
  11777. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11778. goto end;
  11779. de_ctx->flags |= DE_QUIET;
  11780. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11781. "(content:\"one\"; http_server_body; "
  11782. "content:\"two\"; http_server_body; distance:10; "
  11783. "content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)");
  11784. if (de_ctx->sig_list == NULL)
  11785. goto end;
  11786. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  11787. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11788. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  11789. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  11790. ud->fp_chop_offset == 3 &&
  11791. ud->fp_chop_len == 4) {
  11792. result = 1;
  11793. } else {
  11794. result = 0;
  11795. }
  11796. end:
  11797. SigCleanSignatures(de_ctx);
  11798. DetectEngineCtxFree(de_ctx);
  11799. return result;
  11800. }
  11801. int DetectFastPatternTest495(void)
  11802. {
  11803. DetectEngineCtx *de_ctx = NULL;
  11804. int result = 0;
  11805. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11806. goto end;
  11807. de_ctx->flags |= DE_QUIET;
  11808. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11809. "(content:\"one\"; http_server_body; "
  11810. "content:\"two\"; http_server_body; within:10; "
  11811. "content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)");
  11812. if (de_ctx->sig_list == NULL)
  11813. goto end;
  11814. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  11815. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11816. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  11817. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  11818. ud->fp_chop_offset == 3 &&
  11819. ud->fp_chop_len == 4) {
  11820. result = 1;
  11821. } else {
  11822. result = 0;
  11823. }
  11824. end:
  11825. SigCleanSignatures(de_ctx);
  11826. DetectEngineCtxFree(de_ctx);
  11827. return result;
  11828. }
  11829. int DetectFastPatternTest496(void)
  11830. {
  11831. DetectEngineCtx *de_ctx = NULL;
  11832. int result = 0;
  11833. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11834. goto end;
  11835. de_ctx->flags |= DE_QUIET;
  11836. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11837. "(content:\"one\"; http_server_body; "
  11838. "content:\"two\"; http_server_body; offset:10; "
  11839. "content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)");
  11840. if (de_ctx->sig_list == NULL)
  11841. goto end;
  11842. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  11843. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11844. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  11845. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  11846. ud->fp_chop_offset == 3 &&
  11847. ud->fp_chop_len == 4) {
  11848. result = 1;
  11849. } else {
  11850. result = 0;
  11851. }
  11852. end:
  11853. SigCleanSignatures(de_ctx);
  11854. DetectEngineCtxFree(de_ctx);
  11855. return result;
  11856. }
  11857. int DetectFastPatternTest497(void)
  11858. {
  11859. DetectEngineCtx *de_ctx = NULL;
  11860. int result = 0;
  11861. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11862. goto end;
  11863. de_ctx->flags |= DE_QUIET;
  11864. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11865. "(content:\"one\"; http_server_body; "
  11866. "content:\"two\"; http_server_body; depth:10; "
  11867. "content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)");
  11868. if (de_ctx->sig_list == NULL)
  11869. goto end;
  11870. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  11871. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11872. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  11873. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  11874. ud->fp_chop_offset == 3 &&
  11875. ud->fp_chop_len == 4) {
  11876. result = 1;
  11877. } else {
  11878. result = 0;
  11879. }
  11880. result = 1;
  11881. end:
  11882. SigCleanSignatures(de_ctx);
  11883. DetectEngineCtxFree(de_ctx);
  11884. return result;
  11885. }
  11886. int DetectFastPatternTest498(void)
  11887. {
  11888. DetectEngineCtx *de_ctx = NULL;
  11889. int result = 0;
  11890. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11891. goto end;
  11892. de_ctx->flags |= DE_QUIET;
  11893. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11894. "(content:\"one\"; http_server_body; "
  11895. "content:\"two\"; fast_pattern:65977,4; http_server_body; "
  11896. "content:\"three\"; http_server_body; distance:10; sid:1;)");
  11897. if (de_ctx->sig_list != NULL)
  11898. goto end;
  11899. result = 1;
  11900. end:
  11901. SigCleanSignatures(de_ctx);
  11902. DetectEngineCtxFree(de_ctx);
  11903. return result;
  11904. }
  11905. int DetectFastPatternTest499(void)
  11906. {
  11907. DetectEngineCtx *de_ctx = NULL;
  11908. int result = 0;
  11909. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11910. goto end;
  11911. de_ctx->flags |= DE_QUIET;
  11912. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11913. "(content:\"one\"; http_server_body; "
  11914. "content:\"oneonetwo\"; fast_pattern:3,65977; http_server_body; "
  11915. "content:\"three\"; distance:10; http_server_body; sid:1;)");
  11916. if (de_ctx->sig_list != NULL)
  11917. goto end;
  11918. result = 1;
  11919. end:
  11920. SigCleanSignatures(de_ctx);
  11921. DetectEngineCtxFree(de_ctx);
  11922. return result;
  11923. }
  11924. int DetectFastPatternTest500(void)
  11925. {
  11926. DetectEngineCtx *de_ctx = NULL;
  11927. int result = 0;
  11928. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11929. goto end;
  11930. de_ctx->flags |= DE_QUIET;
  11931. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11932. "(content:\"one\"; http_server_body; "
  11933. "content:\"two\"; fast_pattern:65534,4; http_server_body; "
  11934. "content:\"three\"; http_server_body; distance:10; sid:1;)");
  11935. if (de_ctx->sig_list != NULL)
  11936. goto end;
  11937. result = 1;
  11938. end:
  11939. SigCleanSignatures(de_ctx);
  11940. DetectEngineCtxFree(de_ctx);
  11941. return result;
  11942. }
  11943. int DetectFastPatternTest501(void)
  11944. {
  11945. DetectEngineCtx *de_ctx = NULL;
  11946. int result = 0;
  11947. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11948. goto end;
  11949. de_ctx->flags |= DE_QUIET;
  11950. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11951. "(content:\"one\"; http_server_body; "
  11952. "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
  11953. "content:\"three\"; http_server_body; sid:1;)");
  11954. if (de_ctx->sig_list == NULL)
  11955. goto end;
  11956. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  11957. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  11958. ud->flags & DETECT_CONTENT_NEGATED &&
  11959. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  11960. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  11961. ud->fp_chop_offset == 3 &&
  11962. ud->fp_chop_len == 4) {
  11963. result = 1;
  11964. } else {
  11965. result = 0;
  11966. }
  11967. end:
  11968. SigCleanSignatures(de_ctx);
  11969. DetectEngineCtxFree(de_ctx);
  11970. return result;
  11971. }
  11972. int DetectFastPatternTest502(void)
  11973. {
  11974. DetectEngineCtx *de_ctx = NULL;
  11975. int result = 0;
  11976. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11977. goto end;
  11978. de_ctx->flags |= DE_QUIET;
  11979. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11980. "(content:\"one\"; http_server_body; "
  11981. "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; distance:10; "
  11982. "content:\"three\"; http_server_body; sid:1;)");
  11983. if (de_ctx->sig_list != NULL)
  11984. goto end;
  11985. result = 1;
  11986. end:
  11987. SigCleanSignatures(de_ctx);
  11988. DetectEngineCtxFree(de_ctx);
  11989. return result;
  11990. }
  11991. int DetectFastPatternTest503(void)
  11992. {
  11993. DetectEngineCtx *de_ctx = NULL;
  11994. int result = 0;
  11995. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  11996. goto end;
  11997. de_ctx->flags |= DE_QUIET;
  11998. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  11999. "(content:\"one\"; http_server_body; "
  12000. "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; within:10; "
  12001. "content:\"three\"; http_server_body; sid:1;)");
  12002. if (de_ctx->sig_list != NULL)
  12003. goto end;
  12004. result = 1;
  12005. end:
  12006. SigCleanSignatures(de_ctx);
  12007. DetectEngineCtxFree(de_ctx);
  12008. return result;
  12009. }
  12010. int DetectFastPatternTest504(void)
  12011. {
  12012. DetectEngineCtx *de_ctx = NULL;
  12013. int result = 0;
  12014. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12015. goto end;
  12016. de_ctx->flags |= DE_QUIET;
  12017. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12018. "(content:\"one\"; http_server_body; "
  12019. "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; offset:10; "
  12020. "content:\"three\"; http_server_body; sid:1;)");
  12021. if (de_ctx->sig_list != NULL)
  12022. goto end;
  12023. result = 1;
  12024. end:
  12025. SigCleanSignatures(de_ctx);
  12026. DetectEngineCtxFree(de_ctx);
  12027. return result;
  12028. }
  12029. int DetectFastPatternTest505(void)
  12030. {
  12031. DetectEngineCtx *de_ctx = NULL;
  12032. int result = 0;
  12033. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12034. goto end;
  12035. de_ctx->flags |= DE_QUIET;
  12036. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12037. "(content:\"one\"; http_server_body; "
  12038. "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; depth:10; "
  12039. "content:\"three\"; http_server_body; sid:1;)");
  12040. if (de_ctx->sig_list != NULL)
  12041. goto end;
  12042. result = 1;
  12043. end:
  12044. SigCleanSignatures(de_ctx);
  12045. DetectEngineCtxFree(de_ctx);
  12046. return result;
  12047. }
  12048. int DetectFastPatternTest506(void)
  12049. {
  12050. DetectEngineCtx *de_ctx = NULL;
  12051. int result = 0;
  12052. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12053. goto end;
  12054. de_ctx->flags |= DE_QUIET;
  12055. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12056. "(content:\"one\"; http_server_body; "
  12057. "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; "
  12058. "content:\"three\"; http_server_body; sid:1;)");
  12059. if (de_ctx->sig_list == NULL)
  12060. goto end;
  12061. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  12062. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12063. ud->flags & DETECT_CONTENT_NEGATED &&
  12064. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  12065. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  12066. ud->fp_chop_offset == 3 &&
  12067. ud->fp_chop_len == 4) {
  12068. result = 1;
  12069. } else {
  12070. result = 0;
  12071. }
  12072. end:
  12073. SigCleanSignatures(de_ctx);
  12074. DetectEngineCtxFree(de_ctx);
  12075. return result;
  12076. }
  12077. /* http_server_body fast_pattern tests ^ */
  12078. /* file_data fast_pattern tests v */
  12079. int DetectFastPatternTest507(void)
  12080. {
  12081. DetectEngineCtx *de_ctx = NULL;
  12082. int result = 0;
  12083. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12084. goto end;
  12085. de_ctx->flags |= DE_QUIET;
  12086. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12087. "(file_data; content:\"one\"; "
  12088. "content:!\"oneonetwo\"; fast_pattern:3,4; "
  12089. "content:\"three\"; sid:1;)");
  12090. if (de_ctx->sig_list == NULL)
  12091. goto end;
  12092. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  12093. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12094. ud->flags & DETECT_CONTENT_NEGATED &&
  12095. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  12096. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  12097. ud->fp_chop_offset == 3 &&
  12098. ud->fp_chop_len == 4) {
  12099. result = 1;
  12100. } else {
  12101. result = 0;
  12102. }
  12103. end:
  12104. SigCleanSignatures(de_ctx);
  12105. DetectEngineCtxFree(de_ctx);
  12106. return result;
  12107. }
  12108. /**
  12109. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  12110. */
  12111. int DetectFastPatternTest508(void)
  12112. {
  12113. SigMatch *sm = NULL;
  12114. DetectEngineCtx *de_ctx = NULL;
  12115. int result = 0;
  12116. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12117. goto end;
  12118. de_ctx->flags |= DE_QUIET;
  12119. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12120. "(file_data; content:\"one\"; fast_pattern:only; "
  12121. "msg:\"Testing fast_pattern\"; sid:1;)");
  12122. if (de_ctx->sig_list == NULL)
  12123. goto end;
  12124. result = 0;
  12125. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
  12126. if (sm != NULL) {
  12127. if ( ((DetectContentData *)sm->ctx)->flags &
  12128. DETECT_CONTENT_FAST_PATTERN) {
  12129. result = 1;
  12130. } else {
  12131. result = 0;
  12132. }
  12133. }
  12134. end:
  12135. SigCleanSignatures(de_ctx);
  12136. DetectEngineCtxFree(de_ctx);
  12137. return result;
  12138. }
  12139. /**
  12140. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  12141. */
  12142. int DetectFastPatternTest509(void)
  12143. {
  12144. SigMatch *sm = NULL;
  12145. DetectEngineCtx *de_ctx = NULL;
  12146. int result = 0;
  12147. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12148. goto end;
  12149. de_ctx->flags |= DE_QUIET;
  12150. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12151. "(file_data; content:\"oneoneone\"; fast_pattern:3,4; "
  12152. "msg:\"Testing fast_pattern\"; sid:1;)");
  12153. if (de_ctx->sig_list == NULL)
  12154. goto end;
  12155. result = 0;
  12156. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
  12157. if (sm != NULL) {
  12158. if ( ((DetectContentData *)sm->ctx)->flags &
  12159. DETECT_CONTENT_FAST_PATTERN) {
  12160. result = 1;
  12161. } else {
  12162. result = 0;
  12163. }
  12164. }
  12165. end:
  12166. SigCleanSignatures(de_ctx);
  12167. DetectEngineCtxFree(de_ctx);
  12168. return result;
  12169. }
  12170. int DetectFastPatternTest510(void)
  12171. {
  12172. SigMatch *sm = NULL;
  12173. DetectEngineCtx *de_ctx = NULL;
  12174. int result = 0;
  12175. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12176. goto end;
  12177. de_ctx->flags |= DE_QUIET;
  12178. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12179. "(file_data; content:\"one\"; fast_pattern:only; sid:1;)");
  12180. if (de_ctx->sig_list == NULL)
  12181. goto end;
  12182. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
  12183. if (sm == NULL) {
  12184. goto end;
  12185. }
  12186. DetectContentData *ud = sm->ctx;
  12187. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12188. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  12189. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  12190. ud->fp_chop_offset == 0 &&
  12191. ud->fp_chop_len == 0) {
  12192. result = 1;
  12193. } else {
  12194. result = 0;
  12195. }
  12196. end:
  12197. SigCleanSignatures(de_ctx);
  12198. DetectEngineCtxFree(de_ctx);
  12199. return result;
  12200. }
  12201. int DetectFastPatternTest511(void)
  12202. {
  12203. SigMatch *sm = NULL;
  12204. DetectEngineCtx *de_ctx = NULL;
  12205. int result = 0;
  12206. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12207. goto end;
  12208. de_ctx->flags |= DE_QUIET;
  12209. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12210. "(file_data; content:\"oneoneone\"; fast_pattern:3,4; sid:1;)");
  12211. if (de_ctx->sig_list == NULL)
  12212. goto end;
  12213. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSBDMATCH];
  12214. if (sm == NULL) {
  12215. goto end;
  12216. }
  12217. DetectContentData *ud = sm->ctx;
  12218. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12219. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  12220. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  12221. ud->fp_chop_offset == 3 &&
  12222. ud->fp_chop_len == 4) {
  12223. result = 1;
  12224. } else {
  12225. result = 0;
  12226. }
  12227. end:
  12228. SigCleanSignatures(de_ctx);
  12229. DetectEngineCtxFree(de_ctx);
  12230. return result;
  12231. }
  12232. int DetectFastPatternTest512(void)
  12233. {
  12234. DetectEngineCtx *de_ctx = NULL;
  12235. int result = 0;
  12236. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12237. goto end;
  12238. de_ctx->flags |= DE_QUIET;
  12239. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12240. "(file_data; content:\"one\"; "
  12241. "content:\"two\"; fast_pattern:only; distance:10; sid:1;)");
  12242. if (de_ctx->sig_list != NULL)
  12243. goto end;
  12244. result = 1;
  12245. end:
  12246. SigCleanSignatures(de_ctx);
  12247. DetectEngineCtxFree(de_ctx);
  12248. return result;
  12249. }
  12250. int DetectFastPatternTest513(void)
  12251. {
  12252. DetectEngineCtx *de_ctx = NULL;
  12253. int result = 0;
  12254. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12255. goto end;
  12256. de_ctx->flags |= DE_QUIET;
  12257. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12258. "(file_data; content:\"one\"; "
  12259. "content:\"two\"; distance:10; fast_pattern:only; sid:1;)");
  12260. if (de_ctx->sig_list != NULL)
  12261. goto end;
  12262. result = 1;
  12263. end:
  12264. SigCleanSignatures(de_ctx);
  12265. DetectEngineCtxFree(de_ctx);
  12266. return result;
  12267. }
  12268. int DetectFastPatternTest514(void)
  12269. {
  12270. DetectEngineCtx *de_ctx = NULL;
  12271. int result = 0;
  12272. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12273. goto end;
  12274. de_ctx->flags |= DE_QUIET;
  12275. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12276. "(file_data; content:\"one\"; "
  12277. "content:\"two\"; fast_pattern:only; within:10; sid:1;)");
  12278. if (de_ctx->sig_list != NULL)
  12279. goto end;
  12280. result = 1;
  12281. end:
  12282. SigCleanSignatures(de_ctx);
  12283. DetectEngineCtxFree(de_ctx);
  12284. return result;
  12285. }
  12286. int DetectFastPatternTest515(void)
  12287. {
  12288. DetectEngineCtx *de_ctx = NULL;
  12289. int result = 0;
  12290. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12291. goto end;
  12292. de_ctx->flags |= DE_QUIET;
  12293. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12294. "(file_data; content:\"one\"; "
  12295. "content:\"two\"; within:10; fast_pattern:only; sid:1;)");
  12296. if (de_ctx->sig_list != NULL)
  12297. goto end;
  12298. result = 1;
  12299. end:
  12300. SigCleanSignatures(de_ctx);
  12301. DetectEngineCtxFree(de_ctx);
  12302. return result;
  12303. }
  12304. int DetectFastPatternTest516(void)
  12305. {
  12306. DetectEngineCtx *de_ctx = NULL;
  12307. int result = 0;
  12308. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12309. goto end;
  12310. de_ctx->flags |= DE_QUIET;
  12311. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12312. "(file_data; content:\"one\"; "
  12313. "content:\"two\"; fast_pattern:only; offset:10; sid:1;)");
  12314. if (de_ctx->sig_list != NULL)
  12315. goto end;
  12316. result = 1;
  12317. end:
  12318. SigCleanSignatures(de_ctx);
  12319. DetectEngineCtxFree(de_ctx);
  12320. return result;
  12321. }
  12322. int DetectFastPatternTest517(void)
  12323. {
  12324. DetectEngineCtx *de_ctx = NULL;
  12325. int result = 0;
  12326. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12327. goto end;
  12328. de_ctx->flags |= DE_QUIET;
  12329. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12330. "(file_data; content:\"one\"; "
  12331. "content:\"two\"; offset:10; fast_pattern:only; sid:1;)");
  12332. if (de_ctx->sig_list != NULL)
  12333. goto end;
  12334. result = 1;
  12335. end:
  12336. SigCleanSignatures(de_ctx);
  12337. DetectEngineCtxFree(de_ctx);
  12338. return result;
  12339. }
  12340. int DetectFastPatternTest518(void)
  12341. {
  12342. DetectEngineCtx *de_ctx = NULL;
  12343. int result = 0;
  12344. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12345. goto end;
  12346. de_ctx->flags |= DE_QUIET;
  12347. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12348. "(file_data; content:\"one\"; "
  12349. "content:\"two\"; fast_pattern:only; depth:10; sid:1;)");
  12350. if (de_ctx->sig_list != NULL)
  12351. goto end;
  12352. result = 1;
  12353. end:
  12354. SigCleanSignatures(de_ctx);
  12355. DetectEngineCtxFree(de_ctx);
  12356. return result;
  12357. }
  12358. int DetectFastPatternTest519(void)
  12359. {
  12360. DetectEngineCtx *de_ctx = NULL;
  12361. int result = 0;
  12362. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12363. goto end;
  12364. de_ctx->flags |= DE_QUIET;
  12365. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12366. "(file_data; content:\"one\"; "
  12367. "content:\"two\"; depth:10; fast_pattern:only; sid:1;)");
  12368. if (de_ctx->sig_list != NULL)
  12369. goto end;
  12370. result = 1;
  12371. end:
  12372. SigCleanSignatures(de_ctx);
  12373. DetectEngineCtxFree(de_ctx);
  12374. return result;
  12375. }
  12376. int DetectFastPatternTest520(void)
  12377. {
  12378. DetectEngineCtx *de_ctx = NULL;
  12379. int result = 0;
  12380. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12381. goto end;
  12382. de_ctx->flags |= DE_QUIET;
  12383. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12384. "(file_data; content:\"one\"; "
  12385. "content:!\"two\"; fast_pattern:only; sid:1;)");
  12386. if (de_ctx->sig_list != NULL)
  12387. goto end;
  12388. result = 1;
  12389. end:
  12390. SigCleanSignatures(de_ctx);
  12391. DetectEngineCtxFree(de_ctx);
  12392. return result;
  12393. }
  12394. int DetectFastPatternTest521(void)
  12395. {
  12396. DetectEngineCtx *de_ctx = NULL;
  12397. int result = 0;
  12398. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12399. goto end;
  12400. de_ctx->flags |= DE_QUIET;
  12401. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12402. "(file_data; content:\" one\"; "
  12403. "content:\"two\"; distance:30; "
  12404. "content:\"two\"; fast_pattern:only; sid:1;)");
  12405. if (de_ctx->sig_list == NULL)
  12406. goto end;
  12407. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  12408. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12409. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  12410. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  12411. ud->fp_chop_offset == 0 &&
  12412. ud->fp_chop_len == 0) {
  12413. result = 1;
  12414. } else {
  12415. result = 0;
  12416. }
  12417. end:
  12418. SigCleanSignatures(de_ctx);
  12419. DetectEngineCtxFree(de_ctx);
  12420. return result;
  12421. }
  12422. int DetectFastPatternTest522(void)
  12423. {
  12424. DetectEngineCtx *de_ctx = NULL;
  12425. int result = 0;
  12426. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12427. goto end;
  12428. de_ctx->flags |= DE_QUIET;
  12429. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12430. "(file_data; content:\"one\"; "
  12431. "content:\"two\"; within:30; "
  12432. "content:\"two\"; fast_pattern:only; sid:1;)");
  12433. if (de_ctx->sig_list == NULL)
  12434. goto end;
  12435. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  12436. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12437. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  12438. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  12439. ud->fp_chop_offset == 0 &&
  12440. ud->fp_chop_len == 0) {
  12441. result = 1;
  12442. } else {
  12443. result = 0;
  12444. }
  12445. end:
  12446. SigCleanSignatures(de_ctx);
  12447. DetectEngineCtxFree(de_ctx);
  12448. return result;
  12449. }
  12450. int DetectFastPatternTest523(void)
  12451. {
  12452. DetectEngineCtx *de_ctx = NULL;
  12453. int result = 0;
  12454. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12455. goto end;
  12456. de_ctx->flags |= DE_QUIET;
  12457. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12458. "(file_data; content:\"one\"; "
  12459. "content:\"two\"; offset:30; "
  12460. "content:\"two\"; fast_pattern:only; sid:1;)");
  12461. if (de_ctx->sig_list == NULL)
  12462. goto end;
  12463. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  12464. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12465. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  12466. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  12467. ud->fp_chop_offset == 0 &&
  12468. ud->fp_chop_len == 0) {
  12469. result = 1;
  12470. } else {
  12471. result = 0;
  12472. }
  12473. end:
  12474. SigCleanSignatures(de_ctx);
  12475. DetectEngineCtxFree(de_ctx);
  12476. return result;
  12477. }
  12478. int DetectFastPatternTest524(void)
  12479. {
  12480. DetectEngineCtx *de_ctx = NULL;
  12481. int result = 0;
  12482. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12483. goto end;
  12484. de_ctx->flags |= DE_QUIET;
  12485. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12486. "(file_data; content:\"one\"; "
  12487. "content:\"two\"; depth:30; "
  12488. "content:\"two\"; fast_pattern:only; sid:1;)");
  12489. if (de_ctx->sig_list == NULL)
  12490. goto end;
  12491. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  12492. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12493. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  12494. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  12495. ud->fp_chop_offset == 0 &&
  12496. ud->fp_chop_len == 0) {
  12497. result = 1;
  12498. } else {
  12499. result = 0;
  12500. }
  12501. end:
  12502. SigCleanSignatures(de_ctx);
  12503. DetectEngineCtxFree(de_ctx);
  12504. return result;
  12505. }
  12506. int DetectFastPatternTest525(void)
  12507. {
  12508. DetectEngineCtx *de_ctx = NULL;
  12509. int result = 0;
  12510. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12511. goto end;
  12512. de_ctx->flags |= DE_QUIET;
  12513. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12514. "(file_data; content:!\"one\"; fast_pattern; "
  12515. "content:\"two\"; sid:1;)");
  12516. if (de_ctx->sig_list == NULL)
  12517. goto end;
  12518. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  12519. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12520. ud->flags & DETECT_CONTENT_NEGATED &&
  12521. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  12522. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  12523. ud->fp_chop_offset == 0 &&
  12524. ud->fp_chop_len == 0) {
  12525. result = 1;
  12526. } else {
  12527. result = 0;
  12528. }
  12529. end:
  12530. SigCleanSignatures(de_ctx);
  12531. DetectEngineCtxFree(de_ctx);
  12532. return result;
  12533. }
  12534. int DetectFastPatternTest526(void)
  12535. {
  12536. DetectEngineCtx *de_ctx = NULL;
  12537. int result = 0;
  12538. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12539. goto end;
  12540. de_ctx->flags |= DE_QUIET;
  12541. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12542. "(file_data; content:\"two\"; "
  12543. "content:!\"one\"; fast_pattern; distance:20; sid:1;)");
  12544. if (de_ctx->sig_list != NULL)
  12545. goto end;
  12546. result = 1;
  12547. end:
  12548. SigCleanSignatures(de_ctx);
  12549. DetectEngineCtxFree(de_ctx);
  12550. return result;
  12551. }
  12552. int DetectFastPatternTest527(void)
  12553. {
  12554. DetectEngineCtx *de_ctx = NULL;
  12555. int result = 0;
  12556. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12557. goto end;
  12558. de_ctx->flags |= DE_QUIET;
  12559. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12560. "(file_data; content:\"two\"; "
  12561. "content:!\"one\"; fast_pattern; within:20; sid:1;)");
  12562. if (de_ctx->sig_list != NULL)
  12563. goto end;
  12564. result = 1;
  12565. end:
  12566. SigCleanSignatures(de_ctx);
  12567. DetectEngineCtxFree(de_ctx);
  12568. return result;
  12569. }
  12570. int DetectFastPatternTest528(void)
  12571. {
  12572. DetectEngineCtx *de_ctx = NULL;
  12573. int result = 0;
  12574. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12575. goto end;
  12576. de_ctx->flags |= DE_QUIET;
  12577. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12578. "(file_data; content:\"two\"; "
  12579. "content:!\"one\"; fast_pattern; offset:20; sid:1;)");
  12580. if (de_ctx->sig_list != NULL)
  12581. goto end;
  12582. result = 1;
  12583. end:
  12584. SigCleanSignatures(de_ctx);
  12585. DetectEngineCtxFree(de_ctx);
  12586. return result;
  12587. }
  12588. int DetectFastPatternTest529(void)
  12589. {
  12590. DetectEngineCtx *de_ctx = NULL;
  12591. int result = 0;
  12592. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12593. goto end;
  12594. de_ctx->flags |= DE_QUIET;
  12595. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12596. "(file_data; content:\"two\"; "
  12597. "content:!\"one\"; fast_pattern; depth:20; sid:1;)");
  12598. if (de_ctx->sig_list != NULL)
  12599. goto end;
  12600. result = 1;
  12601. end:
  12602. SigCleanSignatures(de_ctx);
  12603. DetectEngineCtxFree(de_ctx);
  12604. return result;
  12605. }
  12606. int DetectFastPatternTest530(void)
  12607. {
  12608. DetectEngineCtx *de_ctx = NULL;
  12609. int result = 0;
  12610. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12611. goto end;
  12612. de_ctx->flags |= DE_QUIET;
  12613. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12614. "(file_data; content:\"one\"; "
  12615. "content:\"oneonetwo\"; fast_pattern:3,4; "
  12616. "content:\"three\"; sid:1;)");
  12617. if (de_ctx->sig_list == NULL)
  12618. goto end;
  12619. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  12620. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12621. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  12622. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  12623. ud->fp_chop_offset == 3 &&
  12624. ud->fp_chop_len == 4) {
  12625. result = 1;
  12626. } else {
  12627. result = 0;
  12628. }
  12629. end:
  12630. SigCleanSignatures(de_ctx);
  12631. DetectEngineCtxFree(de_ctx);
  12632. return result;
  12633. }
  12634. int DetectFastPatternTest531(void)
  12635. {
  12636. DetectEngineCtx *de_ctx = NULL;
  12637. int result = 0;
  12638. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12639. goto end;
  12640. de_ctx->flags |= DE_QUIET;
  12641. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12642. "(file_data; content:\"one\"; "
  12643. "content:\"oneonetwo\"; fast_pattern:3,4; "
  12644. "content:\"three\"; distance:30; sid:1;)");
  12645. if (de_ctx->sig_list == NULL)
  12646. goto end;
  12647. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  12648. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12649. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  12650. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  12651. ud->fp_chop_offset == 3 &&
  12652. ud->fp_chop_len == 4) {
  12653. result = 1;
  12654. } else {
  12655. result = 0;
  12656. }
  12657. end:
  12658. SigCleanSignatures(de_ctx);
  12659. DetectEngineCtxFree(de_ctx);
  12660. return result;
  12661. }
  12662. int DetectFastPatternTest532(void)
  12663. {
  12664. DetectEngineCtx *de_ctx = NULL;
  12665. int result = 0;
  12666. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12667. goto end;
  12668. de_ctx->flags |= DE_QUIET;
  12669. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12670. "(file_data; content:\"one\"; "
  12671. "content:\"oneonetwo\"; fast_pattern:3,4; "
  12672. "content:\"three\"; within:30; sid:1;)");
  12673. if (de_ctx->sig_list == NULL)
  12674. goto end;
  12675. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  12676. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12677. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  12678. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  12679. ud->fp_chop_offset == 3 &&
  12680. ud->fp_chop_len == 4) {
  12681. result = 1;
  12682. } else {
  12683. result = 0;
  12684. }
  12685. end:
  12686. SigCleanSignatures(de_ctx);
  12687. DetectEngineCtxFree(de_ctx);
  12688. return result;
  12689. }
  12690. int DetectFastPatternTest533(void)
  12691. {
  12692. DetectEngineCtx *de_ctx = NULL;
  12693. int result = 0;
  12694. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12695. goto end;
  12696. de_ctx->flags |= DE_QUIET;
  12697. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12698. "(file_data; content:\"one\"; "
  12699. "content:\"oneonetwo\"; fast_pattern:3,4; "
  12700. "content:\"three\"; offset:30; sid:1;)");
  12701. if (de_ctx->sig_list == NULL)
  12702. goto end;
  12703. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  12704. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12705. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  12706. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  12707. ud->fp_chop_offset == 3 &&
  12708. ud->fp_chop_len == 4) {
  12709. result = 1;
  12710. } else {
  12711. result = 0;
  12712. }
  12713. end:
  12714. SigCleanSignatures(de_ctx);
  12715. DetectEngineCtxFree(de_ctx);
  12716. return result;
  12717. }
  12718. int DetectFastPatternTest534(void)
  12719. {
  12720. DetectEngineCtx *de_ctx = NULL;
  12721. int result = 0;
  12722. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12723. goto end;
  12724. de_ctx->flags |= DE_QUIET;
  12725. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12726. "(file_data; content:\"one\"; "
  12727. "content:\"oneonetwo\"; fast_pattern:3,4; "
  12728. "content:\"three\"; depth:30; sid:1;)");
  12729. if (de_ctx->sig_list == NULL)
  12730. goto end;
  12731. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  12732. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12733. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  12734. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  12735. ud->fp_chop_offset == 3 &&
  12736. ud->fp_chop_len == 4) {
  12737. result = 1;
  12738. } else {
  12739. result = 0;
  12740. }
  12741. end:
  12742. SigCleanSignatures(de_ctx);
  12743. DetectEngineCtxFree(de_ctx);
  12744. return result;
  12745. }
  12746. int DetectFastPatternTest535(void)
  12747. {
  12748. DetectEngineCtx *de_ctx = NULL;
  12749. int result = 0;
  12750. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12751. goto end;
  12752. de_ctx->flags |= DE_QUIET;
  12753. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12754. "(file_data; content:\"one\"; "
  12755. "content:\"two\"; distance:10; "
  12756. "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
  12757. if (de_ctx->sig_list == NULL)
  12758. goto end;
  12759. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  12760. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12761. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  12762. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  12763. ud->fp_chop_offset == 3 &&
  12764. ud->fp_chop_len == 4) {
  12765. result = 1;
  12766. } else {
  12767. result = 0;
  12768. }
  12769. end:
  12770. SigCleanSignatures(de_ctx);
  12771. DetectEngineCtxFree(de_ctx);
  12772. return result;
  12773. }
  12774. int DetectFastPatternTest536(void)
  12775. {
  12776. DetectEngineCtx *de_ctx = NULL;
  12777. int result = 0;
  12778. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12779. goto end;
  12780. de_ctx->flags |= DE_QUIET;
  12781. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12782. "(file_data; content:\"one\"; "
  12783. "content:\"two\"; within:10; "
  12784. "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
  12785. if (de_ctx->sig_list == NULL)
  12786. goto end;
  12787. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  12788. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12789. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  12790. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  12791. ud->fp_chop_offset == 3 &&
  12792. ud->fp_chop_len == 4) {
  12793. result = 1;
  12794. } else {
  12795. result = 0;
  12796. }
  12797. end:
  12798. SigCleanSignatures(de_ctx);
  12799. DetectEngineCtxFree(de_ctx);
  12800. return result;
  12801. }
  12802. int DetectFastPatternTest537(void)
  12803. {
  12804. DetectEngineCtx *de_ctx = NULL;
  12805. int result = 0;
  12806. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12807. goto end;
  12808. de_ctx->flags |= DE_QUIET;
  12809. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12810. "(file_data; content:\"one\"; "
  12811. "content:\"two\"; offset:10; "
  12812. "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
  12813. if (de_ctx->sig_list == NULL)
  12814. goto end;
  12815. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  12816. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12817. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  12818. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  12819. ud->fp_chop_offset == 3 &&
  12820. ud->fp_chop_len == 4) {
  12821. result = 1;
  12822. } else {
  12823. result = 0;
  12824. }
  12825. end:
  12826. SigCleanSignatures(de_ctx);
  12827. DetectEngineCtxFree(de_ctx);
  12828. return result;
  12829. }
  12830. int DetectFastPatternTest538(void)
  12831. {
  12832. DetectEngineCtx *de_ctx = NULL;
  12833. int result = 0;
  12834. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12835. goto end;
  12836. de_ctx->flags |= DE_QUIET;
  12837. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12838. "(file_data; content:\"one\"; "
  12839. "content:\"two\"; depth:10; "
  12840. "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)");
  12841. if (de_ctx->sig_list == NULL)
  12842. goto end;
  12843. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->ctx;
  12844. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12845. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  12846. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  12847. ud->fp_chop_offset == 3 &&
  12848. ud->fp_chop_len == 4) {
  12849. result = 1;
  12850. } else {
  12851. result = 0;
  12852. }
  12853. result = 1;
  12854. end:
  12855. SigCleanSignatures(de_ctx);
  12856. DetectEngineCtxFree(de_ctx);
  12857. return result;
  12858. }
  12859. int DetectFastPatternTest539(void)
  12860. {
  12861. DetectEngineCtx *de_ctx = NULL;
  12862. int result = 0;
  12863. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12864. goto end;
  12865. de_ctx->flags |= DE_QUIET;
  12866. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12867. "(file_data; content:\"one\"; "
  12868. "content:\"two\"; fast_pattern:65977,4; "
  12869. "content:\"three\"; distance:10; sid:1;)");
  12870. if (de_ctx->sig_list != NULL)
  12871. goto end;
  12872. result = 1;
  12873. end:
  12874. SigCleanSignatures(de_ctx);
  12875. DetectEngineCtxFree(de_ctx);
  12876. return result;
  12877. }
  12878. int DetectFastPatternTest540(void)
  12879. {
  12880. DetectEngineCtx *de_ctx = NULL;
  12881. int result = 0;
  12882. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12883. goto end;
  12884. de_ctx->flags |= DE_QUIET;
  12885. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12886. "(file_data; content:\"one\"; "
  12887. "content:\"oneonetwo\"; fast_pattern:3,65977; "
  12888. "content:\"three\"; distance:10; sid:1;)");
  12889. if (de_ctx->sig_list != NULL)
  12890. goto end;
  12891. result = 1;
  12892. end:
  12893. SigCleanSignatures(de_ctx);
  12894. DetectEngineCtxFree(de_ctx);
  12895. return result;
  12896. }
  12897. int DetectFastPatternTest541(void)
  12898. {
  12899. DetectEngineCtx *de_ctx = NULL;
  12900. int result = 0;
  12901. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12902. goto end;
  12903. de_ctx->flags |= DE_QUIET;
  12904. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12905. "(file_data; content:\"one\"; "
  12906. "content:\"two\"; fast_pattern:65534,4; "
  12907. "content:\"three\"; distance:10; sid:1;)");
  12908. if (de_ctx->sig_list != NULL)
  12909. goto end;
  12910. result = 1;
  12911. end:
  12912. SigCleanSignatures(de_ctx);
  12913. DetectEngineCtxFree(de_ctx);
  12914. return result;
  12915. }
  12916. int DetectFastPatternTest542(void)
  12917. {
  12918. DetectEngineCtx *de_ctx = NULL;
  12919. int result = 0;
  12920. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12921. goto end;
  12922. de_ctx->flags |= DE_QUIET;
  12923. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12924. "(file_data; content:\"one\"; "
  12925. "content:!\"oneonetwo\"; fast_pattern:3,4; "
  12926. "content:\"three\"; sid:1;)");
  12927. if (de_ctx->sig_list == NULL)
  12928. goto end;
  12929. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  12930. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  12931. ud->flags & DETECT_CONTENT_NEGATED &&
  12932. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  12933. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  12934. ud->fp_chop_offset == 3 &&
  12935. ud->fp_chop_len == 4) {
  12936. result = 1;
  12937. } else {
  12938. result = 0;
  12939. }
  12940. end:
  12941. SigCleanSignatures(de_ctx);
  12942. DetectEngineCtxFree(de_ctx);
  12943. return result;
  12944. }
  12945. int DetectFastPatternTest543(void)
  12946. {
  12947. DetectEngineCtx *de_ctx = NULL;
  12948. int result = 0;
  12949. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12950. goto end;
  12951. de_ctx->flags |= DE_QUIET;
  12952. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12953. "(file_data; content:\"one\"; "
  12954. "content:!\"oneonetwo\"; fast_pattern:3,4; distance:10; "
  12955. "content:\"three\"; sid:1;)");
  12956. if (de_ctx->sig_list != NULL)
  12957. goto end;
  12958. result = 1;
  12959. end:
  12960. SigCleanSignatures(de_ctx);
  12961. DetectEngineCtxFree(de_ctx);
  12962. return result;
  12963. }
  12964. int DetectFastPatternTest544(void)
  12965. {
  12966. DetectEngineCtx *de_ctx = NULL;
  12967. int result = 0;
  12968. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12969. goto end;
  12970. de_ctx->flags |= DE_QUIET;
  12971. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12972. "(file_data; content:\"one\"; "
  12973. "content:!\"oneonetwo\"; fast_pattern:3,4; within:10; "
  12974. "content:\"three\"; sid:1;)");
  12975. if (de_ctx->sig_list != NULL)
  12976. goto end;
  12977. result = 1;
  12978. end:
  12979. SigCleanSignatures(de_ctx);
  12980. DetectEngineCtxFree(de_ctx);
  12981. return result;
  12982. }
  12983. int DetectFastPatternTest545(void)
  12984. {
  12985. DetectEngineCtx *de_ctx = NULL;
  12986. int result = 0;
  12987. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  12988. goto end;
  12989. de_ctx->flags |= DE_QUIET;
  12990. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  12991. "(file_data; content:\"one\"; "
  12992. "content:!\"oneonetwo\"; fast_pattern:3,4; offset:10; "
  12993. "content:\"three\"; sid:1;)");
  12994. if (de_ctx->sig_list != NULL)
  12995. goto end;
  12996. result = 1;
  12997. end:
  12998. SigCleanSignatures(de_ctx);
  12999. DetectEngineCtxFree(de_ctx);
  13000. return result;
  13001. }
  13002. int DetectFastPatternTest546(void)
  13003. {
  13004. DetectEngineCtx *de_ctx = NULL;
  13005. int result = 0;
  13006. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13007. goto end;
  13008. de_ctx->flags |= DE_QUIET;
  13009. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13010. "(file_data; content:\"one\"; "
  13011. "content:!\"oneonetwo\"; fast_pattern:3,4; depth:10; "
  13012. "content:\"three\"; sid:1;)");
  13013. if (de_ctx->sig_list != NULL)
  13014. goto end;
  13015. result = 1;
  13016. end:
  13017. SigCleanSignatures(de_ctx);
  13018. DetectEngineCtxFree(de_ctx);
  13019. return result;
  13020. }
  13021. int DetectFastPatternTest547(void)
  13022. {
  13023. DetectEngineCtx *de_ctx = NULL;
  13024. int result = 0;
  13025. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13026. goto end;
  13027. de_ctx->flags |= DE_QUIET;
  13028. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13029. "(file_data; content:\"one\"; "
  13030. "content:!\"oneonetwo\"; fast_pattern:3,4; "
  13031. "content:\"three\"; sid:1;)");
  13032. if (de_ctx->sig_list == NULL)
  13033. goto end;
  13034. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]->prev->ctx;
  13035. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13036. ud->flags & DETECT_CONTENT_NEGATED &&
  13037. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  13038. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  13039. ud->fp_chop_offset == 3 &&
  13040. ud->fp_chop_len == 4) {
  13041. result = 1;
  13042. } else {
  13043. result = 0;
  13044. }
  13045. end:
  13046. SigCleanSignatures(de_ctx);
  13047. DetectEngineCtxFree(de_ctx);
  13048. return result;
  13049. }
  13050. /* file_data fast_pattern tests ^ */
  13051. /* http_user_agent fast_pattern tests v */
  13052. int DetectFastPatternTest548(void)
  13053. {
  13054. DetectEngineCtx *de_ctx = NULL;
  13055. int result = 0;
  13056. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13057. goto end;
  13058. de_ctx->flags |= DE_QUIET;
  13059. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13060. "(content:\"one\"; http_user_agent; "
  13061. "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
  13062. "content:\"three\"; http_user_agent; sid:1;)");
  13063. if (de_ctx->sig_list == NULL)
  13064. goto end;
  13065. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx;
  13066. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13067. ud->flags & DETECT_CONTENT_NEGATED &&
  13068. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  13069. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  13070. ud->fp_chop_offset == 3 &&
  13071. ud->fp_chop_len == 4) {
  13072. result = 1;
  13073. } else {
  13074. result = 0;
  13075. }
  13076. end:
  13077. SigCleanSignatures(de_ctx);
  13078. DetectEngineCtxFree(de_ctx);
  13079. return result;
  13080. }
  13081. /**
  13082. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  13083. */
  13084. int DetectFastPatternTest549(void)
  13085. {
  13086. SigMatch *sm = NULL;
  13087. DetectEngineCtx *de_ctx = NULL;
  13088. int result = 0;
  13089. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13090. goto end;
  13091. de_ctx->flags |= DE_QUIET;
  13092. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13093. "(content:\"one\"; fast_pattern:only; http_user_agent; "
  13094. "msg:\"Testing fast_pattern\"; sid:1;)");
  13095. if (de_ctx->sig_list == NULL)
  13096. goto end;
  13097. result = 0;
  13098. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH];
  13099. if (sm != NULL) {
  13100. if ( ((DetectContentData *)sm->ctx)->flags &
  13101. DETECT_CONTENT_FAST_PATTERN) {
  13102. result = 1;
  13103. } else {
  13104. result = 0;
  13105. }
  13106. }
  13107. end:
  13108. SigCleanSignatures(de_ctx);
  13109. DetectEngineCtxFree(de_ctx);
  13110. return result;
  13111. }
  13112. /**
  13113. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  13114. */
  13115. int DetectFastPatternTest550(void)
  13116. {
  13117. SigMatch *sm = NULL;
  13118. DetectEngineCtx *de_ctx = NULL;
  13119. int result = 0;
  13120. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13121. goto end;
  13122. de_ctx->flags |= DE_QUIET;
  13123. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13124. "(content:\"oneoneone\"; fast_pattern:3,4; http_user_agent; "
  13125. "msg:\"Testing fast_pattern\"; sid:1;)");
  13126. if (de_ctx->sig_list == NULL)
  13127. goto end;
  13128. result = 0;
  13129. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH];
  13130. if (sm != NULL) {
  13131. if ( ((DetectContentData *)sm->ctx)->flags &
  13132. DETECT_CONTENT_FAST_PATTERN) {
  13133. result = 1;
  13134. } else {
  13135. result = 0;
  13136. }
  13137. }
  13138. end:
  13139. SigCleanSignatures(de_ctx);
  13140. DetectEngineCtxFree(de_ctx);
  13141. return result;
  13142. }
  13143. int DetectFastPatternTest551(void)
  13144. {
  13145. SigMatch *sm = NULL;
  13146. DetectEngineCtx *de_ctx = NULL;
  13147. int result = 0;
  13148. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13149. goto end;
  13150. de_ctx->flags |= DE_QUIET;
  13151. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13152. "(content:\"one\"; fast_pattern:only; http_user_agent; sid:1;)");
  13153. if (de_ctx->sig_list == NULL)
  13154. goto end;
  13155. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH];
  13156. if (sm == NULL) {
  13157. goto end;
  13158. }
  13159. DetectContentData *ud = sm->ctx;
  13160. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13161. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  13162. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  13163. ud->fp_chop_offset == 0 &&
  13164. ud->fp_chop_len == 0) {
  13165. result = 1;
  13166. } else {
  13167. result = 0;
  13168. }
  13169. end:
  13170. SigCleanSignatures(de_ctx);
  13171. DetectEngineCtxFree(de_ctx);
  13172. return result;
  13173. }
  13174. int DetectFastPatternTest552(void)
  13175. {
  13176. SigMatch *sm = NULL;
  13177. DetectEngineCtx *de_ctx = NULL;
  13178. int result = 0;
  13179. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13180. goto end;
  13181. de_ctx->flags |= DE_QUIET;
  13182. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13183. "(content:\"oneoneone\"; fast_pattern:3,4; http_user_agent; sid:1;)");
  13184. if (de_ctx->sig_list == NULL)
  13185. goto end;
  13186. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH];
  13187. if (sm == NULL) {
  13188. goto end;
  13189. }
  13190. DetectContentData *ud = sm->ctx;
  13191. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13192. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  13193. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  13194. ud->fp_chop_offset == 3 &&
  13195. ud->fp_chop_len == 4) {
  13196. result = 1;
  13197. } else {
  13198. result = 0;
  13199. }
  13200. end:
  13201. SigCleanSignatures(de_ctx);
  13202. DetectEngineCtxFree(de_ctx);
  13203. return result;
  13204. }
  13205. int DetectFastPatternTest553(void)
  13206. {
  13207. DetectEngineCtx *de_ctx = NULL;
  13208. int result = 0;
  13209. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13210. goto end;
  13211. de_ctx->flags |= DE_QUIET;
  13212. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13213. "(content:\"one\"; http_user_agent; "
  13214. "content:\"two\"; fast_pattern:only; http_user_agent; distance:10; sid:1;)");
  13215. if (de_ctx->sig_list != NULL)
  13216. goto end;
  13217. result = 1;
  13218. end:
  13219. SigCleanSignatures(de_ctx);
  13220. DetectEngineCtxFree(de_ctx);
  13221. return result;
  13222. }
  13223. int DetectFastPatternTest554(void)
  13224. {
  13225. DetectEngineCtx *de_ctx = NULL;
  13226. int result = 0;
  13227. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13228. goto end;
  13229. de_ctx->flags |= DE_QUIET;
  13230. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13231. "(content:\"one\"; http_user_agent; "
  13232. "content:\"two\"; distance:10; fast_pattern:only; http_user_agent; sid:1;)");
  13233. if (de_ctx->sig_list != NULL)
  13234. goto end;
  13235. result = 1;
  13236. end:
  13237. SigCleanSignatures(de_ctx);
  13238. DetectEngineCtxFree(de_ctx);
  13239. return result;
  13240. }
  13241. int DetectFastPatternTest555(void)
  13242. {
  13243. DetectEngineCtx *de_ctx = NULL;
  13244. int result = 0;
  13245. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13246. goto end;
  13247. de_ctx->flags |= DE_QUIET;
  13248. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13249. "(content:\"one\"; http_user_agent; "
  13250. "content:\"two\"; fast_pattern:only; http_user_agent; within:10; sid:1;)");
  13251. if (de_ctx->sig_list != NULL)
  13252. goto end;
  13253. result = 1;
  13254. end:
  13255. SigCleanSignatures(de_ctx);
  13256. DetectEngineCtxFree(de_ctx);
  13257. return result;
  13258. }
  13259. int DetectFastPatternTest556(void)
  13260. {
  13261. DetectEngineCtx *de_ctx = NULL;
  13262. int result = 0;
  13263. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13264. goto end;
  13265. de_ctx->flags |= DE_QUIET;
  13266. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13267. "(content:\"one\"; http_user_agent; "
  13268. "content:\"two\"; within:10; fast_pattern:only; http_user_agent; sid:1;)");
  13269. if (de_ctx->sig_list != NULL)
  13270. goto end;
  13271. result = 1;
  13272. end:
  13273. SigCleanSignatures(de_ctx);
  13274. DetectEngineCtxFree(de_ctx);
  13275. return result;
  13276. }
  13277. int DetectFastPatternTest557(void)
  13278. {
  13279. DetectEngineCtx *de_ctx = NULL;
  13280. int result = 0;
  13281. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13282. goto end;
  13283. de_ctx->flags |= DE_QUIET;
  13284. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13285. "(content:\"one\"; http_user_agent; "
  13286. "content:\"two\"; fast_pattern:only; http_user_agent; offset:10; sid:1;)");
  13287. if (de_ctx->sig_list != NULL)
  13288. goto end;
  13289. result = 1;
  13290. end:
  13291. SigCleanSignatures(de_ctx);
  13292. DetectEngineCtxFree(de_ctx);
  13293. return result;
  13294. }
  13295. int DetectFastPatternTest558(void)
  13296. {
  13297. DetectEngineCtx *de_ctx = NULL;
  13298. int result = 0;
  13299. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13300. goto end;
  13301. de_ctx->flags |= DE_QUIET;
  13302. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13303. "(content:\"one\"; http_user_agent; "
  13304. "content:\"two\"; offset:10; fast_pattern:only; http_user_agent; sid:1;)");
  13305. if (de_ctx->sig_list != NULL)
  13306. goto end;
  13307. result = 1;
  13308. end:
  13309. SigCleanSignatures(de_ctx);
  13310. DetectEngineCtxFree(de_ctx);
  13311. return result;
  13312. }
  13313. int DetectFastPatternTest559(void)
  13314. {
  13315. DetectEngineCtx *de_ctx = NULL;
  13316. int result = 0;
  13317. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13318. goto end;
  13319. de_ctx->flags |= DE_QUIET;
  13320. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13321. "(content:\"one\"; http_user_agent; "
  13322. "content:\"two\"; fast_pattern:only; http_user_agent; depth:10; sid:1;)");
  13323. if (de_ctx->sig_list != NULL)
  13324. goto end;
  13325. result = 1;
  13326. end:
  13327. SigCleanSignatures(de_ctx);
  13328. DetectEngineCtxFree(de_ctx);
  13329. return result;
  13330. }
  13331. int DetectFastPatternTest560(void)
  13332. {
  13333. DetectEngineCtx *de_ctx = NULL;
  13334. int result = 0;
  13335. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13336. goto end;
  13337. de_ctx->flags |= DE_QUIET;
  13338. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13339. "(content:\"one\"; http_user_agent; "
  13340. "content:\"two\"; depth:10; fast_pattern:only; http_user_agent; sid:1;)");
  13341. if (de_ctx->sig_list != NULL)
  13342. goto end;
  13343. result = 1;
  13344. end:
  13345. SigCleanSignatures(de_ctx);
  13346. DetectEngineCtxFree(de_ctx);
  13347. return result;
  13348. }
  13349. int DetectFastPatternTest561(void)
  13350. {
  13351. DetectEngineCtx *de_ctx = NULL;
  13352. int result = 0;
  13353. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13354. goto end;
  13355. de_ctx->flags |= DE_QUIET;
  13356. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13357. "(content:\"one\"; http_user_agent; "
  13358. "content:!\"two\"; fast_pattern:only; http_user_agent; sid:1;)");
  13359. if (de_ctx->sig_list != NULL)
  13360. goto end;
  13361. result = 1;
  13362. end:
  13363. SigCleanSignatures(de_ctx);
  13364. DetectEngineCtxFree(de_ctx);
  13365. return result;
  13366. }
  13367. int DetectFastPatternTest562(void)
  13368. {
  13369. DetectEngineCtx *de_ctx = NULL;
  13370. int result = 0;
  13371. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13372. goto end;
  13373. de_ctx->flags |= DE_QUIET;
  13374. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13375. "(content:\" one\"; http_user_agent; "
  13376. "content:\"two\"; http_user_agent; distance:30; "
  13377. "content:\"two\"; fast_pattern:only; http_user_agent; sid:1;)");
  13378. if (de_ctx->sig_list == NULL)
  13379. goto end;
  13380. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx;
  13381. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13382. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  13383. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  13384. ud->fp_chop_offset == 0 &&
  13385. ud->fp_chop_len == 0) {
  13386. result = 1;
  13387. } else {
  13388. result = 0;
  13389. }
  13390. end:
  13391. SigCleanSignatures(de_ctx);
  13392. DetectEngineCtxFree(de_ctx);
  13393. return result;
  13394. }
  13395. int DetectFastPatternTest563(void)
  13396. {
  13397. DetectEngineCtx *de_ctx = NULL;
  13398. int result = 0;
  13399. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13400. goto end;
  13401. de_ctx->flags |= DE_QUIET;
  13402. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13403. "(content:\"one\"; http_user_agent; "
  13404. "content:\"two\"; http_user_agent; within:30; "
  13405. "content:\"two\"; fast_pattern:only; http_user_agent; sid:1;)");
  13406. if (de_ctx->sig_list == NULL)
  13407. goto end;
  13408. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx;
  13409. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13410. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  13411. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  13412. ud->fp_chop_offset == 0 &&
  13413. ud->fp_chop_len == 0) {
  13414. result = 1;
  13415. } else {
  13416. result = 0;
  13417. }
  13418. end:
  13419. SigCleanSignatures(de_ctx);
  13420. DetectEngineCtxFree(de_ctx);
  13421. return result;
  13422. }
  13423. int DetectFastPatternTest564(void)
  13424. {
  13425. DetectEngineCtx *de_ctx = NULL;
  13426. int result = 0;
  13427. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13428. goto end;
  13429. de_ctx->flags |= DE_QUIET;
  13430. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13431. "(content:\"one\"; http_user_agent; "
  13432. "content:\"two\"; http_user_agent; offset:30; "
  13433. "content:\"two\"; fast_pattern:only; http_user_agent; sid:1;)");
  13434. if (de_ctx->sig_list == NULL)
  13435. goto end;
  13436. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx;
  13437. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13438. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  13439. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  13440. ud->fp_chop_offset == 0 &&
  13441. ud->fp_chop_len == 0) {
  13442. result = 1;
  13443. } else {
  13444. result = 0;
  13445. }
  13446. end:
  13447. SigCleanSignatures(de_ctx);
  13448. DetectEngineCtxFree(de_ctx);
  13449. return result;
  13450. }
  13451. int DetectFastPatternTest565(void)
  13452. {
  13453. DetectEngineCtx *de_ctx = NULL;
  13454. int result = 0;
  13455. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13456. goto end;
  13457. de_ctx->flags |= DE_QUIET;
  13458. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13459. "(content:\"one\"; http_user_agent; "
  13460. "content:\"two\"; http_user_agent; depth:30; "
  13461. "content:\"two\"; fast_pattern:only; http_user_agent; sid:1;)");
  13462. if (de_ctx->sig_list == NULL)
  13463. goto end;
  13464. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx;
  13465. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13466. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  13467. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  13468. ud->fp_chop_offset == 0 &&
  13469. ud->fp_chop_len == 0) {
  13470. result = 1;
  13471. } else {
  13472. result = 0;
  13473. }
  13474. end:
  13475. SigCleanSignatures(de_ctx);
  13476. DetectEngineCtxFree(de_ctx);
  13477. return result;
  13478. }
  13479. int DetectFastPatternTest566(void)
  13480. {
  13481. DetectEngineCtx *de_ctx = NULL;
  13482. int result = 0;
  13483. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13484. goto end;
  13485. de_ctx->flags |= DE_QUIET;
  13486. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13487. "(content:!\"one\"; fast_pattern; http_user_agent; "
  13488. "content:\"two\"; http_user_agent; sid:1;)");
  13489. if (de_ctx->sig_list == NULL)
  13490. goto end;
  13491. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx;
  13492. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13493. ud->flags & DETECT_CONTENT_NEGATED &&
  13494. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  13495. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  13496. ud->fp_chop_offset == 0 &&
  13497. ud->fp_chop_len == 0) {
  13498. result = 1;
  13499. } else {
  13500. result = 0;
  13501. }
  13502. end:
  13503. SigCleanSignatures(de_ctx);
  13504. DetectEngineCtxFree(de_ctx);
  13505. return result;
  13506. }
  13507. int DetectFastPatternTest567(void)
  13508. {
  13509. DetectEngineCtx *de_ctx = NULL;
  13510. int result = 0;
  13511. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13512. goto end;
  13513. de_ctx->flags |= DE_QUIET;
  13514. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13515. "(content:\"two\"; http_user_agent; "
  13516. "content:!\"one\"; fast_pattern; http_user_agent; distance:20; sid:1;)");
  13517. if (de_ctx->sig_list != NULL)
  13518. goto end;
  13519. result = 1;
  13520. end:
  13521. SigCleanSignatures(de_ctx);
  13522. DetectEngineCtxFree(de_ctx);
  13523. return result;
  13524. }
  13525. int DetectFastPatternTest568(void)
  13526. {
  13527. DetectEngineCtx *de_ctx = NULL;
  13528. int result = 0;
  13529. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13530. goto end;
  13531. de_ctx->flags |= DE_QUIET;
  13532. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13533. "(content:\"two\"; http_user_agent; "
  13534. "content:!\"one\"; fast_pattern; http_user_agent; within:20; sid:1;)");
  13535. if (de_ctx->sig_list != NULL)
  13536. goto end;
  13537. result = 1;
  13538. end:
  13539. SigCleanSignatures(de_ctx);
  13540. DetectEngineCtxFree(de_ctx);
  13541. return result;
  13542. }
  13543. int DetectFastPatternTest569(void)
  13544. {
  13545. DetectEngineCtx *de_ctx = NULL;
  13546. int result = 0;
  13547. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13548. goto end;
  13549. de_ctx->flags |= DE_QUIET;
  13550. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13551. "(content:\"two\"; http_user_agent; "
  13552. "content:!\"one\"; fast_pattern; http_user_agent; offset:20; sid:1;)");
  13553. if (de_ctx->sig_list != NULL)
  13554. goto end;
  13555. result = 1;
  13556. end:
  13557. SigCleanSignatures(de_ctx);
  13558. DetectEngineCtxFree(de_ctx);
  13559. return result;
  13560. }
  13561. int DetectFastPatternTest570(void)
  13562. {
  13563. DetectEngineCtx *de_ctx = NULL;
  13564. int result = 0;
  13565. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13566. goto end;
  13567. de_ctx->flags |= DE_QUIET;
  13568. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13569. "(content:\"two\"; http_user_agent; "
  13570. "content:!\"one\"; fast_pattern; http_user_agent; depth:20; sid:1;)");
  13571. if (de_ctx->sig_list != NULL)
  13572. goto end;
  13573. result = 1;
  13574. end:
  13575. SigCleanSignatures(de_ctx);
  13576. DetectEngineCtxFree(de_ctx);
  13577. return result;
  13578. }
  13579. int DetectFastPatternTest571(void)
  13580. {
  13581. DetectEngineCtx *de_ctx = NULL;
  13582. int result = 0;
  13583. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13584. goto end;
  13585. de_ctx->flags |= DE_QUIET;
  13586. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13587. "(content:\"one\"; http_user_agent; "
  13588. "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
  13589. "content:\"three\"; http_user_agent; sid:1;)");
  13590. if (de_ctx->sig_list == NULL)
  13591. goto end;
  13592. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx;
  13593. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13594. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  13595. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  13596. ud->fp_chop_offset == 3 &&
  13597. ud->fp_chop_len == 4) {
  13598. result = 1;
  13599. } else {
  13600. result = 0;
  13601. }
  13602. end:
  13603. SigCleanSignatures(de_ctx);
  13604. DetectEngineCtxFree(de_ctx);
  13605. return result;
  13606. }
  13607. int DetectFastPatternTest572(void)
  13608. {
  13609. DetectEngineCtx *de_ctx = NULL;
  13610. int result = 0;
  13611. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13612. goto end;
  13613. de_ctx->flags |= DE_QUIET;
  13614. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13615. "(content:\"one\"; http_user_agent; "
  13616. "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
  13617. "content:\"three\"; http_user_agent; distance:30; sid:1;)");
  13618. if (de_ctx->sig_list == NULL)
  13619. goto end;
  13620. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx;
  13621. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13622. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  13623. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  13624. ud->fp_chop_offset == 3 &&
  13625. ud->fp_chop_len == 4) {
  13626. result = 1;
  13627. } else {
  13628. result = 0;
  13629. }
  13630. end:
  13631. SigCleanSignatures(de_ctx);
  13632. DetectEngineCtxFree(de_ctx);
  13633. return result;
  13634. }
  13635. int DetectFastPatternTest573(void)
  13636. {
  13637. DetectEngineCtx *de_ctx = NULL;
  13638. int result = 0;
  13639. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13640. goto end;
  13641. de_ctx->flags |= DE_QUIET;
  13642. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13643. "(content:\"one\"; http_user_agent; "
  13644. "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
  13645. "content:\"three\"; http_user_agent; within:30; sid:1;)");
  13646. if (de_ctx->sig_list == NULL)
  13647. goto end;
  13648. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx;
  13649. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13650. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  13651. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  13652. ud->fp_chop_offset == 3 &&
  13653. ud->fp_chop_len == 4) {
  13654. result = 1;
  13655. } else {
  13656. result = 0;
  13657. }
  13658. end:
  13659. SigCleanSignatures(de_ctx);
  13660. DetectEngineCtxFree(de_ctx);
  13661. return result;
  13662. }
  13663. int DetectFastPatternTest574(void)
  13664. {
  13665. DetectEngineCtx *de_ctx = NULL;
  13666. int result = 0;
  13667. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13668. goto end;
  13669. de_ctx->flags |= DE_QUIET;
  13670. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13671. "(content:\"one\"; http_user_agent; "
  13672. "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
  13673. "content:\"three\"; http_user_agent; offset:30; sid:1;)");
  13674. if (de_ctx->sig_list == NULL)
  13675. goto end;
  13676. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx;
  13677. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13678. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  13679. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  13680. ud->fp_chop_offset == 3 &&
  13681. ud->fp_chop_len == 4) {
  13682. result = 1;
  13683. } else {
  13684. result = 0;
  13685. }
  13686. end:
  13687. SigCleanSignatures(de_ctx);
  13688. DetectEngineCtxFree(de_ctx);
  13689. return result;
  13690. }
  13691. int DetectFastPatternTest575(void)
  13692. {
  13693. DetectEngineCtx *de_ctx = NULL;
  13694. int result = 0;
  13695. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13696. goto end;
  13697. de_ctx->flags |= DE_QUIET;
  13698. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13699. "(content:\"one\"; http_user_agent; "
  13700. "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
  13701. "content:\"three\"; http_user_agent; depth:30; sid:1;)");
  13702. if (de_ctx->sig_list == NULL)
  13703. goto end;
  13704. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx;
  13705. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13706. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  13707. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  13708. ud->fp_chop_offset == 3 &&
  13709. ud->fp_chop_len == 4) {
  13710. result = 1;
  13711. } else {
  13712. result = 0;
  13713. }
  13714. end:
  13715. SigCleanSignatures(de_ctx);
  13716. DetectEngineCtxFree(de_ctx);
  13717. return result;
  13718. }
  13719. int DetectFastPatternTest576(void)
  13720. {
  13721. DetectEngineCtx *de_ctx = NULL;
  13722. int result = 0;
  13723. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13724. goto end;
  13725. de_ctx->flags |= DE_QUIET;
  13726. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13727. "(content:\"one\"; http_user_agent; "
  13728. "content:\"two\"; http_user_agent; distance:10; "
  13729. "content:\"oneonethree\"; fast_pattern:3,4; http_user_agent; sid:1;)");
  13730. if (de_ctx->sig_list == NULL)
  13731. goto end;
  13732. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx;
  13733. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13734. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  13735. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  13736. ud->fp_chop_offset == 3 &&
  13737. ud->fp_chop_len == 4) {
  13738. result = 1;
  13739. } else {
  13740. result = 0;
  13741. }
  13742. end:
  13743. SigCleanSignatures(de_ctx);
  13744. DetectEngineCtxFree(de_ctx);
  13745. return result;
  13746. }
  13747. int DetectFastPatternTest577(void)
  13748. {
  13749. DetectEngineCtx *de_ctx = NULL;
  13750. int result = 0;
  13751. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13752. goto end;
  13753. de_ctx->flags |= DE_QUIET;
  13754. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13755. "(content:\"one\"; http_user_agent; "
  13756. "content:\"two\"; http_user_agent; within:10; "
  13757. "content:\"oneonethree\"; fast_pattern:3,4; http_user_agent; sid:1;)");
  13758. if (de_ctx->sig_list == NULL)
  13759. goto end;
  13760. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx;
  13761. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13762. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  13763. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  13764. ud->fp_chop_offset == 3 &&
  13765. ud->fp_chop_len == 4) {
  13766. result = 1;
  13767. } else {
  13768. result = 0;
  13769. }
  13770. end:
  13771. SigCleanSignatures(de_ctx);
  13772. DetectEngineCtxFree(de_ctx);
  13773. return result;
  13774. }
  13775. int DetectFastPatternTest578(void)
  13776. {
  13777. DetectEngineCtx *de_ctx = NULL;
  13778. int result = 0;
  13779. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13780. goto end;
  13781. de_ctx->flags |= DE_QUIET;
  13782. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13783. "(content:\"one\"; http_user_agent; "
  13784. "content:\"two\"; http_user_agent; offset:10; "
  13785. "content:\"oneonethree\"; fast_pattern:3,4; http_user_agent; sid:1;)");
  13786. if (de_ctx->sig_list == NULL)
  13787. goto end;
  13788. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx;
  13789. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13790. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  13791. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  13792. ud->fp_chop_offset == 3 &&
  13793. ud->fp_chop_len == 4) {
  13794. result = 1;
  13795. } else {
  13796. result = 0;
  13797. }
  13798. end:
  13799. SigCleanSignatures(de_ctx);
  13800. DetectEngineCtxFree(de_ctx);
  13801. return result;
  13802. }
  13803. int DetectFastPatternTest579(void)
  13804. {
  13805. DetectEngineCtx *de_ctx = NULL;
  13806. int result = 0;
  13807. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13808. goto end;
  13809. de_ctx->flags |= DE_QUIET;
  13810. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13811. "(content:\"one\"; http_user_agent; "
  13812. "content:\"two\"; http_user_agent; depth:10; "
  13813. "content:\"oneonethree\"; fast_pattern:3,4; http_user_agent; sid:1;)");
  13814. if (de_ctx->sig_list == NULL)
  13815. goto end;
  13816. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx;
  13817. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13818. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  13819. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  13820. ud->fp_chop_offset == 3 &&
  13821. ud->fp_chop_len == 4) {
  13822. result = 1;
  13823. } else {
  13824. result = 0;
  13825. }
  13826. result = 1;
  13827. end:
  13828. SigCleanSignatures(de_ctx);
  13829. DetectEngineCtxFree(de_ctx);
  13830. return result;
  13831. }
  13832. int DetectFastPatternTest580(void)
  13833. {
  13834. DetectEngineCtx *de_ctx = NULL;
  13835. int result = 0;
  13836. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13837. goto end;
  13838. de_ctx->flags |= DE_QUIET;
  13839. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13840. "(content:\"one\"; http_user_agent; "
  13841. "content:\"two\"; fast_pattern:65977,4; http_user_agent; "
  13842. "content:\"three\"; http_user_agent; distance:10; sid:1;)");
  13843. if (de_ctx->sig_list != NULL)
  13844. goto end;
  13845. result = 1;
  13846. end:
  13847. SigCleanSignatures(de_ctx);
  13848. DetectEngineCtxFree(de_ctx);
  13849. return result;
  13850. }
  13851. int DetectFastPatternTest581(void)
  13852. {
  13853. DetectEngineCtx *de_ctx = NULL;
  13854. int result = 0;
  13855. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13856. goto end;
  13857. de_ctx->flags |= DE_QUIET;
  13858. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13859. "(content:\"one\"; http_user_agent; "
  13860. "content:\"oneonetwo\"; fast_pattern:3,65977; http_user_agent; "
  13861. "content:\"three\"; distance:10; http_user_agent; sid:1;)");
  13862. if (de_ctx->sig_list != NULL)
  13863. goto end;
  13864. result = 1;
  13865. end:
  13866. SigCleanSignatures(de_ctx);
  13867. DetectEngineCtxFree(de_ctx);
  13868. return result;
  13869. }
  13870. int DetectFastPatternTest582(void)
  13871. {
  13872. DetectEngineCtx *de_ctx = NULL;
  13873. int result = 0;
  13874. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13875. goto end;
  13876. de_ctx->flags |= DE_QUIET;
  13877. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13878. "(content:\"one\"; http_user_agent; "
  13879. "content:\"two\"; fast_pattern:65534,4; http_user_agent; "
  13880. "content:\"three\"; http_user_agent; distance:10; sid:1;)");
  13881. if (de_ctx->sig_list != NULL)
  13882. goto end;
  13883. result = 1;
  13884. end:
  13885. SigCleanSignatures(de_ctx);
  13886. DetectEngineCtxFree(de_ctx);
  13887. return result;
  13888. }
  13889. int DetectFastPatternTest583(void)
  13890. {
  13891. DetectEngineCtx *de_ctx = NULL;
  13892. int result = 0;
  13893. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13894. goto end;
  13895. de_ctx->flags |= DE_QUIET;
  13896. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13897. "(content:\"one\"; http_user_agent; "
  13898. "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
  13899. "content:\"three\"; http_user_agent; sid:1;)");
  13900. if (de_ctx->sig_list == NULL)
  13901. goto end;
  13902. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx;
  13903. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  13904. ud->flags & DETECT_CONTENT_NEGATED &&
  13905. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  13906. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  13907. ud->fp_chop_offset == 3 &&
  13908. ud->fp_chop_len == 4) {
  13909. result = 1;
  13910. } else {
  13911. result = 0;
  13912. }
  13913. end:
  13914. SigCleanSignatures(de_ctx);
  13915. DetectEngineCtxFree(de_ctx);
  13916. return result;
  13917. }
  13918. int DetectFastPatternTest584(void)
  13919. {
  13920. DetectEngineCtx *de_ctx = NULL;
  13921. int result = 0;
  13922. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13923. goto end;
  13924. de_ctx->flags |= DE_QUIET;
  13925. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13926. "(content:\"one\"; http_user_agent; "
  13927. "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; distance:10; "
  13928. "content:\"three\"; http_user_agent; sid:1;)");
  13929. if (de_ctx->sig_list != NULL)
  13930. goto end;
  13931. result = 1;
  13932. end:
  13933. SigCleanSignatures(de_ctx);
  13934. DetectEngineCtxFree(de_ctx);
  13935. return result;
  13936. }
  13937. int DetectFastPatternTest585(void)
  13938. {
  13939. DetectEngineCtx *de_ctx = NULL;
  13940. int result = 0;
  13941. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13942. goto end;
  13943. de_ctx->flags |= DE_QUIET;
  13944. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13945. "(content:\"one\"; http_user_agent; "
  13946. "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; within:10; "
  13947. "content:\"three\"; http_user_agent; sid:1;)");
  13948. if (de_ctx->sig_list != NULL)
  13949. goto end;
  13950. result = 1;
  13951. end:
  13952. SigCleanSignatures(de_ctx);
  13953. DetectEngineCtxFree(de_ctx);
  13954. return result;
  13955. }
  13956. int DetectFastPatternTest586(void)
  13957. {
  13958. DetectEngineCtx *de_ctx = NULL;
  13959. int result = 0;
  13960. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13961. goto end;
  13962. de_ctx->flags |= DE_QUIET;
  13963. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13964. "(content:\"one\"; http_user_agent; "
  13965. "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; offset:10; "
  13966. "content:\"three\"; http_user_agent; sid:1;)");
  13967. if (de_ctx->sig_list != NULL)
  13968. goto end;
  13969. result = 1;
  13970. end:
  13971. SigCleanSignatures(de_ctx);
  13972. DetectEngineCtxFree(de_ctx);
  13973. return result;
  13974. }
  13975. int DetectFastPatternTest587(void)
  13976. {
  13977. DetectEngineCtx *de_ctx = NULL;
  13978. int result = 0;
  13979. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13980. goto end;
  13981. de_ctx->flags |= DE_QUIET;
  13982. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  13983. "(content:\"one\"; http_user_agent; "
  13984. "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; depth:10; "
  13985. "content:\"three\"; http_user_agent; sid:1;)");
  13986. if (de_ctx->sig_list != NULL)
  13987. goto end;
  13988. result = 1;
  13989. end:
  13990. SigCleanSignatures(de_ctx);
  13991. DetectEngineCtxFree(de_ctx);
  13992. return result;
  13993. }
  13994. int DetectFastPatternTest588(void)
  13995. {
  13996. DetectEngineCtx *de_ctx = NULL;
  13997. int result = 0;
  13998. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  13999. goto end;
  14000. de_ctx->flags |= DE_QUIET;
  14001. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14002. "(content:\"one\"; http_user_agent; "
  14003. "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; "
  14004. "content:\"three\"; http_user_agent; sid:1;)");
  14005. if (de_ctx->sig_list == NULL)
  14006. goto end;
  14007. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx;
  14008. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14009. ud->flags & DETECT_CONTENT_NEGATED &&
  14010. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14011. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  14012. ud->fp_chop_offset == 3 &&
  14013. ud->fp_chop_len == 4) {
  14014. result = 1;
  14015. } else {
  14016. result = 0;
  14017. }
  14018. end:
  14019. SigCleanSignatures(de_ctx);
  14020. DetectEngineCtxFree(de_ctx);
  14021. return result;
  14022. }
  14023. /* http_user_agent fast_pattern tests ^ */
  14024. /* http_host fast_pattern tests v */
  14025. int DetectFastPatternTest589(void)
  14026. {
  14027. DetectEngineCtx *de_ctx = NULL;
  14028. int result = 0;
  14029. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14030. goto end;
  14031. de_ctx->flags |= DE_QUIET;
  14032. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14033. "(content:\"one\"; http_host; "
  14034. "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; "
  14035. "content:\"three\"; http_host; sid:1;)");
  14036. if (de_ctx->sig_list == NULL)
  14037. goto end;
  14038. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx;
  14039. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14040. ud->flags & DETECT_CONTENT_NEGATED &&
  14041. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14042. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  14043. ud->fp_chop_offset == 3 &&
  14044. ud->fp_chop_len == 4) {
  14045. result = 1;
  14046. } else {
  14047. result = 0;
  14048. }
  14049. end:
  14050. SigCleanSignatures(de_ctx);
  14051. DetectEngineCtxFree(de_ctx);
  14052. return result;
  14053. }
  14054. /**
  14055. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  14056. */
  14057. int DetectFastPatternTest590(void)
  14058. {
  14059. SigMatch *sm = NULL;
  14060. DetectEngineCtx *de_ctx = NULL;
  14061. int result = 0;
  14062. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14063. goto end;
  14064. de_ctx->flags |= DE_QUIET;
  14065. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14066. "(content:\"one\"; fast_pattern:only; http_host; "
  14067. "msg:\"Testing fast_pattern\"; sid:1;)");
  14068. if (de_ctx->sig_list == NULL)
  14069. goto end;
  14070. result = 0;
  14071. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH];
  14072. if (sm != NULL) {
  14073. if ( (((DetectContentData *)sm->ctx)->flags &
  14074. DETECT_CONTENT_FAST_PATTERN)) {
  14075. result = 1;
  14076. } else {
  14077. result = 0;
  14078. }
  14079. }
  14080. end:
  14081. SigCleanSignatures(de_ctx);
  14082. DetectEngineCtxFree(de_ctx);
  14083. return result;
  14084. }
  14085. /**
  14086. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  14087. */
  14088. int DetectFastPatternTest591(void)
  14089. {
  14090. SigMatch *sm = NULL;
  14091. DetectEngineCtx *de_ctx = NULL;
  14092. int result = 0;
  14093. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14094. goto end;
  14095. de_ctx->flags |= DE_QUIET;
  14096. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14097. "(content:\"oneoneone\"; fast_pattern:3,4; http_host; "
  14098. "msg:\"Testing fast_pattern\"; sid:1;)");
  14099. if (de_ctx->sig_list == NULL)
  14100. goto end;
  14101. result = 0;
  14102. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH];
  14103. if (sm != NULL) {
  14104. if ( (((DetectContentData *)sm->ctx)->flags &
  14105. DETECT_CONTENT_FAST_PATTERN)) {
  14106. result = 1;
  14107. } else {
  14108. result = 0;
  14109. }
  14110. }
  14111. end:
  14112. SigCleanSignatures(de_ctx);
  14113. DetectEngineCtxFree(de_ctx);
  14114. return result;
  14115. }
  14116. int DetectFastPatternTest592(void)
  14117. {
  14118. SigMatch *sm = NULL;
  14119. DetectEngineCtx *de_ctx = NULL;
  14120. int result = 0;
  14121. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14122. goto end;
  14123. de_ctx->flags |= DE_QUIET;
  14124. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14125. "(content:\"one\"; fast_pattern:only; http_host; sid:1;)");
  14126. if (de_ctx->sig_list == NULL)
  14127. goto end;
  14128. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH];
  14129. if (sm == NULL) {
  14130. goto end;
  14131. }
  14132. DetectContentData *ud = sm->ctx;
  14133. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14134. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  14135. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  14136. ud->fp_chop_offset == 0 &&
  14137. ud->fp_chop_len == 0) {
  14138. result = 1;
  14139. } else {
  14140. result = 0;
  14141. }
  14142. end:
  14143. SigCleanSignatures(de_ctx);
  14144. DetectEngineCtxFree(de_ctx);
  14145. return result;
  14146. }
  14147. int DetectFastPatternTest593(void)
  14148. {
  14149. SigMatch *sm = NULL;
  14150. DetectEngineCtx *de_ctx = NULL;
  14151. int result = 0;
  14152. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14153. goto end;
  14154. de_ctx->flags |= DE_QUIET;
  14155. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14156. "(content:\"oneoneone\"; fast_pattern:3,4; http_host; sid:1;)");
  14157. if (de_ctx->sig_list == NULL)
  14158. goto end;
  14159. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH];
  14160. if (sm == NULL) {
  14161. goto end;
  14162. }
  14163. DetectContentData *ud = sm->ctx;
  14164. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14165. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14166. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  14167. ud->fp_chop_offset == 3 &&
  14168. ud->fp_chop_len == 4) {
  14169. result = 1;
  14170. } else {
  14171. result = 0;
  14172. }
  14173. end:
  14174. SigCleanSignatures(de_ctx);
  14175. DetectEngineCtxFree(de_ctx);
  14176. return result;
  14177. }
  14178. int DetectFastPatternTest594(void)
  14179. {
  14180. DetectEngineCtx *de_ctx = NULL;
  14181. int result = 0;
  14182. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14183. goto end;
  14184. de_ctx->flags |= DE_QUIET;
  14185. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14186. "(content:\"one\"; http_host; "
  14187. "content:\"two\"; fast_pattern:only; http_host; distance:10; sid:1;)");
  14188. if (de_ctx->sig_list != NULL)
  14189. goto end;
  14190. result = 1;
  14191. end:
  14192. SigCleanSignatures(de_ctx);
  14193. DetectEngineCtxFree(de_ctx);
  14194. return result;
  14195. }
  14196. int DetectFastPatternTest595(void)
  14197. {
  14198. DetectEngineCtx *de_ctx = NULL;
  14199. int result = 0;
  14200. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14201. goto end;
  14202. de_ctx->flags |= DE_QUIET;
  14203. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14204. "(content:\"one\"; http_host; "
  14205. "content:\"two\"; distance:10; fast_pattern:only; http_host; sid:1;)");
  14206. if (de_ctx->sig_list != NULL)
  14207. goto end;
  14208. result = 1;
  14209. end:
  14210. SigCleanSignatures(de_ctx);
  14211. DetectEngineCtxFree(de_ctx);
  14212. return result;
  14213. }
  14214. int DetectFastPatternTest596(void)
  14215. {
  14216. DetectEngineCtx *de_ctx = NULL;
  14217. int result = 0;
  14218. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14219. goto end;
  14220. de_ctx->flags |= DE_QUIET;
  14221. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14222. "(content:\"one\"; http_host; "
  14223. "content:\"two\"; fast_pattern:only; http_host; within:10; sid:1;)");
  14224. if (de_ctx->sig_list != NULL)
  14225. goto end;
  14226. result = 1;
  14227. end:
  14228. SigCleanSignatures(de_ctx);
  14229. DetectEngineCtxFree(de_ctx);
  14230. return result;
  14231. }
  14232. int DetectFastPatternTest597(void)
  14233. {
  14234. DetectEngineCtx *de_ctx = NULL;
  14235. int result = 0;
  14236. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14237. goto end;
  14238. de_ctx->flags |= DE_QUIET;
  14239. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14240. "(content:\"one\"; http_host; "
  14241. "content:\"two\"; within:10; fast_pattern:only; http_host; sid:1;)");
  14242. if (de_ctx->sig_list != NULL)
  14243. goto end;
  14244. result = 1;
  14245. end:
  14246. SigCleanSignatures(de_ctx);
  14247. DetectEngineCtxFree(de_ctx);
  14248. return result;
  14249. }
  14250. int DetectFastPatternTest598(void)
  14251. {
  14252. DetectEngineCtx *de_ctx = NULL;
  14253. int result = 0;
  14254. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14255. goto end;
  14256. de_ctx->flags |= DE_QUIET;
  14257. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14258. "(content:\"one\"; http_host; "
  14259. "content:\"two\"; fast_pattern:only; http_host; offset:10; sid:1;)");
  14260. if (de_ctx->sig_list != NULL)
  14261. goto end;
  14262. result = 1;
  14263. end:
  14264. SigCleanSignatures(de_ctx);
  14265. DetectEngineCtxFree(de_ctx);
  14266. return result;
  14267. }
  14268. int DetectFastPatternTest599(void)
  14269. {
  14270. DetectEngineCtx *de_ctx = NULL;
  14271. int result = 0;
  14272. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14273. goto end;
  14274. de_ctx->flags |= DE_QUIET;
  14275. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14276. "(content:\"one\"; http_host; "
  14277. "content:\"two\"; offset:10; fast_pattern:only; http_host; sid:1;)");
  14278. if (de_ctx->sig_list != NULL)
  14279. goto end;
  14280. result = 1;
  14281. end:
  14282. SigCleanSignatures(de_ctx);
  14283. DetectEngineCtxFree(de_ctx);
  14284. return result;
  14285. }
  14286. int DetectFastPatternTest600(void)
  14287. {
  14288. DetectEngineCtx *de_ctx = NULL;
  14289. int result = 0;
  14290. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14291. goto end;
  14292. de_ctx->flags |= DE_QUIET;
  14293. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14294. "(content:\"one\"; http_host; "
  14295. "content:\"two\"; fast_pattern:only; http_host; depth:10; sid:1;)");
  14296. if (de_ctx->sig_list != NULL)
  14297. goto end;
  14298. result = 1;
  14299. end:
  14300. SigCleanSignatures(de_ctx);
  14301. DetectEngineCtxFree(de_ctx);
  14302. return result;
  14303. }
  14304. int DetectFastPatternTest601(void)
  14305. {
  14306. DetectEngineCtx *de_ctx = NULL;
  14307. int result = 0;
  14308. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14309. goto end;
  14310. de_ctx->flags |= DE_QUIET;
  14311. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14312. "(content:\"one\"; http_host; "
  14313. "content:\"two\"; depth:10; fast_pattern:only; http_host; sid:1;)");
  14314. if (de_ctx->sig_list != NULL)
  14315. goto end;
  14316. result = 1;
  14317. end:
  14318. SigCleanSignatures(de_ctx);
  14319. DetectEngineCtxFree(de_ctx);
  14320. return result;
  14321. }
  14322. int DetectFastPatternTest602(void)
  14323. {
  14324. DetectEngineCtx *de_ctx = NULL;
  14325. int result = 0;
  14326. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14327. goto end;
  14328. de_ctx->flags |= DE_QUIET;
  14329. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14330. "(content:\"one\"; http_host; "
  14331. "content:!\"two\"; fast_pattern:only; http_host; sid:1;)");
  14332. if (de_ctx->sig_list != NULL)
  14333. goto end;
  14334. result = 1;
  14335. end:
  14336. SigCleanSignatures(de_ctx);
  14337. DetectEngineCtxFree(de_ctx);
  14338. return result;
  14339. }
  14340. int DetectFastPatternTest603(void)
  14341. {
  14342. DetectEngineCtx *de_ctx = NULL;
  14343. int result = 0;
  14344. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14345. goto end;
  14346. de_ctx->flags |= DE_QUIET;
  14347. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14348. "(content:\" one\"; http_host; "
  14349. "content:\"two\"; http_host; distance:30; "
  14350. "content:\"two\"; fast_pattern:only; http_host; sid:1;)");
  14351. if (de_ctx->sig_list == NULL)
  14352. goto end;
  14353. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx;
  14354. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14355. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  14356. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  14357. ud->fp_chop_offset == 0 &&
  14358. ud->fp_chop_len == 0) {
  14359. result = 1;
  14360. } else {
  14361. result = 0;
  14362. }
  14363. end:
  14364. SigCleanSignatures(de_ctx);
  14365. DetectEngineCtxFree(de_ctx);
  14366. return result;
  14367. }
  14368. int DetectFastPatternTest604(void)
  14369. {
  14370. DetectEngineCtx *de_ctx = NULL;
  14371. int result = 0;
  14372. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14373. goto end;
  14374. de_ctx->flags |= DE_QUIET;
  14375. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14376. "(content:\"one\"; http_host; "
  14377. "content:\"two\"; http_host; within:30; "
  14378. "content:\"two\"; fast_pattern:only; http_host; sid:1;)");
  14379. if (de_ctx->sig_list == NULL)
  14380. goto end;
  14381. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx;
  14382. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14383. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  14384. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  14385. ud->fp_chop_offset == 0 &&
  14386. ud->fp_chop_len == 0) {
  14387. result = 1;
  14388. } else {
  14389. result = 0;
  14390. }
  14391. end:
  14392. SigCleanSignatures(de_ctx);
  14393. DetectEngineCtxFree(de_ctx);
  14394. return result;
  14395. }
  14396. int DetectFastPatternTest605(void)
  14397. {
  14398. DetectEngineCtx *de_ctx = NULL;
  14399. int result = 0;
  14400. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14401. goto end;
  14402. de_ctx->flags |= DE_QUIET;
  14403. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14404. "(content:\"one\"; http_host; "
  14405. "content:\"two\"; http_host; offset:30; "
  14406. "content:\"two\"; fast_pattern:only; http_host; sid:1;)");
  14407. if (de_ctx->sig_list == NULL)
  14408. goto end;
  14409. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx;
  14410. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14411. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  14412. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  14413. ud->fp_chop_offset == 0 &&
  14414. ud->fp_chop_len == 0) {
  14415. result = 1;
  14416. } else {
  14417. result = 0;
  14418. }
  14419. end:
  14420. SigCleanSignatures(de_ctx);
  14421. DetectEngineCtxFree(de_ctx);
  14422. return result;
  14423. }
  14424. int DetectFastPatternTest606(void)
  14425. {
  14426. DetectEngineCtx *de_ctx = NULL;
  14427. int result = 0;
  14428. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14429. goto end;
  14430. de_ctx->flags |= DE_QUIET;
  14431. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14432. "(content:\"one\"; http_host; "
  14433. "content:\"two\"; http_host; depth:30; "
  14434. "content:\"two\"; fast_pattern:only; http_host; sid:1;)");
  14435. if (de_ctx->sig_list == NULL)
  14436. goto end;
  14437. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx;
  14438. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14439. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  14440. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  14441. ud->fp_chop_offset == 0 &&
  14442. ud->fp_chop_len == 0) {
  14443. result = 1;
  14444. } else {
  14445. result = 0;
  14446. }
  14447. end:
  14448. SigCleanSignatures(de_ctx);
  14449. DetectEngineCtxFree(de_ctx);
  14450. return result;
  14451. }
  14452. int DetectFastPatternTest607(void)
  14453. {
  14454. DetectEngineCtx *de_ctx = NULL;
  14455. int result = 0;
  14456. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14457. goto end;
  14458. de_ctx->flags |= DE_QUIET;
  14459. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14460. "(content:!\"one\"; fast_pattern; http_host; "
  14461. "content:\"two\"; http_host; sid:1;)");
  14462. if (de_ctx->sig_list == NULL)
  14463. goto end;
  14464. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx;
  14465. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14466. ud->flags & DETECT_CONTENT_NEGATED &&
  14467. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14468. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  14469. ud->fp_chop_offset == 0 &&
  14470. ud->fp_chop_len == 0) {
  14471. result = 1;
  14472. } else {
  14473. result = 0;
  14474. }
  14475. end:
  14476. SigCleanSignatures(de_ctx);
  14477. DetectEngineCtxFree(de_ctx);
  14478. return result;
  14479. }
  14480. int DetectFastPatternTest608(void)
  14481. {
  14482. DetectEngineCtx *de_ctx = NULL;
  14483. int result = 0;
  14484. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14485. goto end;
  14486. de_ctx->flags |= DE_QUIET;
  14487. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14488. "(content:\"two\"; http_host; "
  14489. "content:!\"one\"; fast_pattern; http_host; distance:20; sid:1;)");
  14490. if (de_ctx->sig_list != NULL)
  14491. goto end;
  14492. result = 1;
  14493. end:
  14494. SigCleanSignatures(de_ctx);
  14495. DetectEngineCtxFree(de_ctx);
  14496. return result;
  14497. }
  14498. int DetectFastPatternTest609(void)
  14499. {
  14500. DetectEngineCtx *de_ctx = NULL;
  14501. int result = 0;
  14502. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14503. goto end;
  14504. de_ctx->flags |= DE_QUIET;
  14505. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14506. "(content:\"two\"; http_host; "
  14507. "content:!\"one\"; fast_pattern; http_host; within:20; sid:1;)");
  14508. if (de_ctx->sig_list != NULL)
  14509. goto end;
  14510. result = 1;
  14511. end:
  14512. SigCleanSignatures(de_ctx);
  14513. DetectEngineCtxFree(de_ctx);
  14514. return result;
  14515. }
  14516. int DetectFastPatternTest610(void)
  14517. {
  14518. DetectEngineCtx *de_ctx = NULL;
  14519. int result = 0;
  14520. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14521. goto end;
  14522. de_ctx->flags |= DE_QUIET;
  14523. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14524. "(content:\"two\"; http_host; "
  14525. "content:!\"one\"; fast_pattern; http_host; offset:20; sid:1;)");
  14526. if (de_ctx->sig_list != NULL)
  14527. goto end;
  14528. result = 1;
  14529. end:
  14530. SigCleanSignatures(de_ctx);
  14531. DetectEngineCtxFree(de_ctx);
  14532. return result;
  14533. }
  14534. int DetectFastPatternTest611(void)
  14535. {
  14536. DetectEngineCtx *de_ctx = NULL;
  14537. int result = 0;
  14538. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14539. goto end;
  14540. de_ctx->flags |= DE_QUIET;
  14541. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14542. "(content:\"two\"; http_host; "
  14543. "content:!\"one\"; fast_pattern; http_host; depth:20; sid:1;)");
  14544. if (de_ctx->sig_list != NULL)
  14545. goto end;
  14546. result = 1;
  14547. end:
  14548. SigCleanSignatures(de_ctx);
  14549. DetectEngineCtxFree(de_ctx);
  14550. return result;
  14551. }
  14552. int DetectFastPatternTest612(void)
  14553. {
  14554. DetectEngineCtx *de_ctx = NULL;
  14555. int result = 0;
  14556. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14557. goto end;
  14558. de_ctx->flags |= DE_QUIET;
  14559. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14560. "(content:\"one\"; http_host; "
  14561. "content:\"oneonetwo\"; fast_pattern:3,4; http_host; "
  14562. "content:\"three\"; http_host; sid:1;)");
  14563. if (de_ctx->sig_list == NULL)
  14564. goto end;
  14565. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx;
  14566. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14567. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14568. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  14569. ud->fp_chop_offset == 3 &&
  14570. ud->fp_chop_len == 4) {
  14571. result = 1;
  14572. } else {
  14573. result = 0;
  14574. }
  14575. end:
  14576. SigCleanSignatures(de_ctx);
  14577. DetectEngineCtxFree(de_ctx);
  14578. return result;
  14579. }
  14580. int DetectFastPatternTest613(void)
  14581. {
  14582. DetectEngineCtx *de_ctx = NULL;
  14583. int result = 0;
  14584. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14585. goto end;
  14586. de_ctx->flags |= DE_QUIET;
  14587. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14588. "(content:\"one\"; http_host; "
  14589. "content:\"oneonetwo\"; fast_pattern:3,4; http_host; "
  14590. "content:\"three\"; http_host; distance:30; sid:1;)");
  14591. if (de_ctx->sig_list == NULL)
  14592. goto end;
  14593. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx;
  14594. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14595. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14596. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  14597. ud->fp_chop_offset == 3 &&
  14598. ud->fp_chop_len == 4) {
  14599. result = 1;
  14600. } else {
  14601. result = 0;
  14602. }
  14603. end:
  14604. SigCleanSignatures(de_ctx);
  14605. DetectEngineCtxFree(de_ctx);
  14606. return result;
  14607. }
  14608. int DetectFastPatternTest614(void)
  14609. {
  14610. DetectEngineCtx *de_ctx = NULL;
  14611. int result = 0;
  14612. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14613. goto end;
  14614. de_ctx->flags |= DE_QUIET;
  14615. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14616. "(content:\"one\"; http_host; "
  14617. "content:\"oneonetwo\"; fast_pattern:3,4; http_host; "
  14618. "content:\"three\"; http_host; within:30; sid:1;)");
  14619. if (de_ctx->sig_list == NULL)
  14620. goto end;
  14621. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx;
  14622. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14623. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14624. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  14625. ud->fp_chop_offset == 3 &&
  14626. ud->fp_chop_len == 4) {
  14627. result = 1;
  14628. } else {
  14629. result = 0;
  14630. }
  14631. end:
  14632. SigCleanSignatures(de_ctx);
  14633. DetectEngineCtxFree(de_ctx);
  14634. return result;
  14635. }
  14636. int DetectFastPatternTest615(void)
  14637. {
  14638. DetectEngineCtx *de_ctx = NULL;
  14639. int result = 0;
  14640. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14641. goto end;
  14642. de_ctx->flags |= DE_QUIET;
  14643. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14644. "(content:\"one\"; http_host; "
  14645. "content:\"oneonetwo\"; fast_pattern:3,4; http_host; "
  14646. "content:\"three\"; http_host; offset:30; sid:1;)");
  14647. if (de_ctx->sig_list == NULL)
  14648. goto end;
  14649. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx;
  14650. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14651. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14652. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  14653. ud->fp_chop_offset == 3 &&
  14654. ud->fp_chop_len == 4) {
  14655. result = 1;
  14656. } else {
  14657. result = 0;
  14658. }
  14659. end:
  14660. SigCleanSignatures(de_ctx);
  14661. DetectEngineCtxFree(de_ctx);
  14662. return result;
  14663. }
  14664. int DetectFastPatternTest616(void)
  14665. {
  14666. DetectEngineCtx *de_ctx = NULL;
  14667. int result = 0;
  14668. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14669. goto end;
  14670. de_ctx->flags |= DE_QUIET;
  14671. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14672. "(content:\"one\"; http_host; "
  14673. "content:\"oneonetwo\"; fast_pattern:3,4; http_host; "
  14674. "content:\"three\"; http_host; depth:30; sid:1;)");
  14675. if (de_ctx->sig_list == NULL)
  14676. goto end;
  14677. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx;
  14678. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14679. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14680. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  14681. ud->fp_chop_offset == 3 &&
  14682. ud->fp_chop_len == 4) {
  14683. result = 1;
  14684. } else {
  14685. result = 0;
  14686. }
  14687. end:
  14688. SigCleanSignatures(de_ctx);
  14689. DetectEngineCtxFree(de_ctx);
  14690. return result;
  14691. }
  14692. int DetectFastPatternTest617(void)
  14693. {
  14694. DetectEngineCtx *de_ctx = NULL;
  14695. int result = 0;
  14696. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14697. goto end;
  14698. de_ctx->flags |= DE_QUIET;
  14699. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14700. "(content:\"one\"; http_host; "
  14701. "content:\"two\"; http_host; distance:10; "
  14702. "content:\"oneonethree\"; fast_pattern:3,4; http_host; sid:1;)");
  14703. if (de_ctx->sig_list == NULL)
  14704. goto end;
  14705. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx;
  14706. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14707. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14708. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  14709. ud->fp_chop_offset == 3 &&
  14710. ud->fp_chop_len == 4) {
  14711. result = 1;
  14712. } else {
  14713. result = 0;
  14714. }
  14715. end:
  14716. SigCleanSignatures(de_ctx);
  14717. DetectEngineCtxFree(de_ctx);
  14718. return result;
  14719. }
  14720. int DetectFastPatternTest618(void)
  14721. {
  14722. DetectEngineCtx *de_ctx = NULL;
  14723. int result = 0;
  14724. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14725. goto end;
  14726. de_ctx->flags |= DE_QUIET;
  14727. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14728. "(content:\"one\"; http_host; "
  14729. "content:\"two\"; http_host; within:10; "
  14730. "content:\"oneonethree\"; fast_pattern:3,4; http_host; sid:1;)");
  14731. if (de_ctx->sig_list == NULL)
  14732. goto end;
  14733. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx;
  14734. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14735. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14736. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  14737. ud->fp_chop_offset == 3 &&
  14738. ud->fp_chop_len == 4) {
  14739. result = 1;
  14740. } else {
  14741. result = 0;
  14742. }
  14743. end:
  14744. SigCleanSignatures(de_ctx);
  14745. DetectEngineCtxFree(de_ctx);
  14746. return result;
  14747. }
  14748. int DetectFastPatternTest619(void)
  14749. {
  14750. DetectEngineCtx *de_ctx = NULL;
  14751. int result = 0;
  14752. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14753. goto end;
  14754. de_ctx->flags |= DE_QUIET;
  14755. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14756. "(content:\"one\"; http_host; "
  14757. "content:\"two\"; http_host; offset:10; "
  14758. "content:\"oneonethree\"; fast_pattern:3,4; http_host; sid:1;)");
  14759. if (de_ctx->sig_list == NULL)
  14760. goto end;
  14761. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx;
  14762. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14763. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14764. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  14765. ud->fp_chop_offset == 3 &&
  14766. ud->fp_chop_len == 4) {
  14767. result = 1;
  14768. } else {
  14769. result = 0;
  14770. }
  14771. end:
  14772. SigCleanSignatures(de_ctx);
  14773. DetectEngineCtxFree(de_ctx);
  14774. return result;
  14775. }
  14776. int DetectFastPatternTest620(void)
  14777. {
  14778. DetectEngineCtx *de_ctx = NULL;
  14779. int result = 0;
  14780. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14781. goto end;
  14782. de_ctx->flags |= DE_QUIET;
  14783. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14784. "(content:\"one\"; http_host; "
  14785. "content:\"two\"; http_host; depth:10; "
  14786. "content:\"oneonethree\"; fast_pattern:3,4; http_host; sid:1;)");
  14787. if (de_ctx->sig_list == NULL)
  14788. goto end;
  14789. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx;
  14790. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14791. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14792. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  14793. ud->fp_chop_offset == 3 &&
  14794. ud->fp_chop_len == 4) {
  14795. result = 1;
  14796. } else {
  14797. result = 0;
  14798. }
  14799. result = 1;
  14800. end:
  14801. SigCleanSignatures(de_ctx);
  14802. DetectEngineCtxFree(de_ctx);
  14803. return result;
  14804. }
  14805. int DetectFastPatternTest621(void)
  14806. {
  14807. DetectEngineCtx *de_ctx = NULL;
  14808. int result = 0;
  14809. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14810. goto end;
  14811. de_ctx->flags |= DE_QUIET;
  14812. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14813. "(content:\"one\"; http_host; "
  14814. "content:\"two\"; fast_pattern:65977,4; http_host; "
  14815. "content:\"three\"; http_host; distance:10; sid:1;)");
  14816. if (de_ctx->sig_list != NULL)
  14817. goto end;
  14818. result = 1;
  14819. end:
  14820. SigCleanSignatures(de_ctx);
  14821. DetectEngineCtxFree(de_ctx);
  14822. return result;
  14823. }
  14824. int DetectFastPatternTest622(void)
  14825. {
  14826. DetectEngineCtx *de_ctx = NULL;
  14827. int result = 0;
  14828. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14829. goto end;
  14830. de_ctx->flags |= DE_QUIET;
  14831. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14832. "(content:\"one\"; http_host; "
  14833. "content:\"oneonetwo\"; fast_pattern:3,65977; http_host; "
  14834. "content:\"three\"; distance:10; http_host; sid:1;)");
  14835. if (de_ctx->sig_list != NULL)
  14836. goto end;
  14837. result = 1;
  14838. end:
  14839. SigCleanSignatures(de_ctx);
  14840. DetectEngineCtxFree(de_ctx);
  14841. return result;
  14842. }
  14843. int DetectFastPatternTest623(void)
  14844. {
  14845. DetectEngineCtx *de_ctx = NULL;
  14846. int result = 0;
  14847. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14848. goto end;
  14849. de_ctx->flags |= DE_QUIET;
  14850. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14851. "(content:\"one\"; http_host; "
  14852. "content:\"two\"; fast_pattern:65534,4; http_host; "
  14853. "content:\"three\"; http_host; distance:10; sid:1;)");
  14854. if (de_ctx->sig_list != NULL)
  14855. goto end;
  14856. result = 1;
  14857. end:
  14858. SigCleanSignatures(de_ctx);
  14859. DetectEngineCtxFree(de_ctx);
  14860. return result;
  14861. }
  14862. int DetectFastPatternTest624(void)
  14863. {
  14864. DetectEngineCtx *de_ctx = NULL;
  14865. int result = 0;
  14866. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14867. goto end;
  14868. de_ctx->flags |= DE_QUIET;
  14869. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14870. "(content:\"one\"; http_host; "
  14871. "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; "
  14872. "content:\"three\"; http_host; sid:1;)");
  14873. if (de_ctx->sig_list == NULL)
  14874. goto end;
  14875. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx;
  14876. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14877. ud->flags & DETECT_CONTENT_NEGATED &&
  14878. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14879. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  14880. ud->fp_chop_offset == 3 &&
  14881. ud->fp_chop_len == 4) {
  14882. result = 1;
  14883. } else {
  14884. result = 0;
  14885. }
  14886. end:
  14887. SigCleanSignatures(de_ctx);
  14888. DetectEngineCtxFree(de_ctx);
  14889. return result;
  14890. }
  14891. int DetectFastPatternTest625(void)
  14892. {
  14893. DetectEngineCtx *de_ctx = NULL;
  14894. int result = 0;
  14895. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14896. goto end;
  14897. de_ctx->flags |= DE_QUIET;
  14898. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14899. "(content:\"one\"; http_host; "
  14900. "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; distance:10; "
  14901. "content:\"three\"; http_host; sid:1;)");
  14902. if (de_ctx->sig_list != NULL)
  14903. goto end;
  14904. result = 1;
  14905. end:
  14906. SigCleanSignatures(de_ctx);
  14907. DetectEngineCtxFree(de_ctx);
  14908. return result;
  14909. }
  14910. int DetectFastPatternTest626(void)
  14911. {
  14912. DetectEngineCtx *de_ctx = NULL;
  14913. int result = 0;
  14914. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14915. goto end;
  14916. de_ctx->flags |= DE_QUIET;
  14917. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14918. "(content:\"one\"; http_host; "
  14919. "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; within:10; "
  14920. "content:\"three\"; http_host; sid:1;)");
  14921. if (de_ctx->sig_list != NULL)
  14922. goto end;
  14923. result = 1;
  14924. end:
  14925. SigCleanSignatures(de_ctx);
  14926. DetectEngineCtxFree(de_ctx);
  14927. return result;
  14928. }
  14929. int DetectFastPatternTest627(void)
  14930. {
  14931. DetectEngineCtx *de_ctx = NULL;
  14932. int result = 0;
  14933. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14934. goto end;
  14935. de_ctx->flags |= DE_QUIET;
  14936. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14937. "(content:\"one\"; http_host; "
  14938. "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; offset:10; "
  14939. "content:\"three\"; http_host; sid:1;)");
  14940. if (de_ctx->sig_list != NULL)
  14941. goto end;
  14942. result = 1;
  14943. end:
  14944. SigCleanSignatures(de_ctx);
  14945. DetectEngineCtxFree(de_ctx);
  14946. return result;
  14947. }
  14948. int DetectFastPatternTest628(void)
  14949. {
  14950. DetectEngineCtx *de_ctx = NULL;
  14951. int result = 0;
  14952. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14953. goto end;
  14954. de_ctx->flags |= DE_QUIET;
  14955. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14956. "(content:\"one\"; http_host; "
  14957. "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; depth:10; "
  14958. "content:\"three\"; http_host; sid:1;)");
  14959. if (de_ctx->sig_list != NULL)
  14960. goto end;
  14961. result = 1;
  14962. end:
  14963. SigCleanSignatures(de_ctx);
  14964. DetectEngineCtxFree(de_ctx);
  14965. return result;
  14966. }
  14967. int DetectFastPatternTest629(void)
  14968. {
  14969. DetectEngineCtx *de_ctx = NULL;
  14970. int result = 0;
  14971. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  14972. goto end;
  14973. de_ctx->flags |= DE_QUIET;
  14974. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  14975. "(content:\"one\"; http_host; "
  14976. "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; "
  14977. "content:\"three\"; http_host; sid:1;)");
  14978. if (de_ctx->sig_list == NULL)
  14979. goto end;
  14980. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx;
  14981. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  14982. ud->flags & DETECT_CONTENT_NEGATED &&
  14983. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  14984. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  14985. ud->fp_chop_offset == 3 &&
  14986. ud->fp_chop_len == 4) {
  14987. result = 1;
  14988. } else {
  14989. result = 0;
  14990. }
  14991. end:
  14992. SigCleanSignatures(de_ctx);
  14993. DetectEngineCtxFree(de_ctx);
  14994. return result;
  14995. }
  14996. /* http_host fast_pattern tests ^ */
  14997. /* http_rawhost fast_pattern tests v */
  14998. int DetectFastPatternTest630(void)
  14999. {
  15000. DetectEngineCtx *de_ctx = NULL;
  15001. int result = 0;
  15002. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15003. goto end;
  15004. de_ctx->flags |= DE_QUIET;
  15005. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15006. "(content:\"one\"; http_raw_host; nocase; "
  15007. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
  15008. "content:\"three\"; http_raw_host; nocase; sid:1;)");
  15009. if (de_ctx->sig_list == NULL)
  15010. goto end;
  15011. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
  15012. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15013. ud->flags & DETECT_CONTENT_NEGATED &&
  15014. ud->flags & DETECT_CONTENT_NOCASE &&
  15015. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  15016. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  15017. ud->fp_chop_offset == 3 &&
  15018. ud->fp_chop_len == 4) {
  15019. result = 1;
  15020. } else {
  15021. result = 0;
  15022. }
  15023. end:
  15024. SigCleanSignatures(de_ctx);
  15025. DetectEngineCtxFree(de_ctx);
  15026. return result;
  15027. }
  15028. /**
  15029. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  15030. */
  15031. int DetectFastPatternTest631(void)
  15032. {
  15033. SigMatch *sm = NULL;
  15034. DetectEngineCtx *de_ctx = NULL;
  15035. int result = 0;
  15036. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15037. goto end;
  15038. de_ctx->flags |= DE_QUIET;
  15039. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15040. "(content:\"one\"; fast_pattern:only; http_raw_host; nocase; "
  15041. "msg:\"Testing fast_pattern\"; sid:1;)");
  15042. if (de_ctx->sig_list == NULL)
  15043. goto end;
  15044. result = 0;
  15045. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH];
  15046. if (sm != NULL) {
  15047. if ( (((DetectContentData *)sm->ctx)->flags &
  15048. DETECT_CONTENT_FAST_PATTERN) &&
  15049. (((DetectContentData *)sm->ctx)->flags &
  15050. DETECT_CONTENT_NOCASE)) {
  15051. result = 1;
  15052. } else {
  15053. result = 0;
  15054. }
  15055. }
  15056. end:
  15057. SigCleanSignatures(de_ctx);
  15058. DetectEngineCtxFree(de_ctx);
  15059. return result;
  15060. }
  15061. /**
  15062. * \test Checks if a fast_pattern is registered in a Signature for uricontent.
  15063. */
  15064. int DetectFastPatternTest632(void)
  15065. {
  15066. SigMatch *sm = NULL;
  15067. DetectEngineCtx *de_ctx = NULL;
  15068. int result = 0;
  15069. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15070. goto end;
  15071. de_ctx->flags |= DE_QUIET;
  15072. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15073. "(content:\"oneoneone\"; fast_pattern:3,4; http_raw_host; nocase; "
  15074. "msg:\"Testing fast_pattern\"; sid:1;)");
  15075. if (de_ctx->sig_list == NULL)
  15076. goto end;
  15077. result = 0;
  15078. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH];
  15079. if (sm != NULL) {
  15080. if ( (((DetectContentData *)sm->ctx)->flags &
  15081. DETECT_CONTENT_FAST_PATTERN) &&
  15082. (((DetectContentData *)sm->ctx)->flags &
  15083. DETECT_CONTENT_NOCASE)) {
  15084. result = 1;
  15085. } else {
  15086. result = 0;
  15087. }
  15088. }
  15089. end:
  15090. SigCleanSignatures(de_ctx);
  15091. DetectEngineCtxFree(de_ctx);
  15092. return result;
  15093. }
  15094. int DetectFastPatternTest633(void)
  15095. {
  15096. SigMatch *sm = NULL;
  15097. DetectEngineCtx *de_ctx = NULL;
  15098. int result = 0;
  15099. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15100. goto end;
  15101. de_ctx->flags |= DE_QUIET;
  15102. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15103. "(content:\"one\"; fast_pattern:only; http_raw_host; nocase; sid:1;)");
  15104. if (de_ctx->sig_list == NULL)
  15105. goto end;
  15106. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH];
  15107. if (sm == NULL) {
  15108. goto end;
  15109. }
  15110. DetectContentData *ud = sm->ctx;
  15111. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15112. ud->flags & DETECT_CONTENT_NOCASE &&
  15113. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  15114. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  15115. ud->fp_chop_offset == 0 &&
  15116. ud->fp_chop_len == 0) {
  15117. result = 1;
  15118. } else {
  15119. result = 0;
  15120. }
  15121. end:
  15122. SigCleanSignatures(de_ctx);
  15123. DetectEngineCtxFree(de_ctx);
  15124. return result;
  15125. }
  15126. int DetectFastPatternTest634(void)
  15127. {
  15128. SigMatch *sm = NULL;
  15129. DetectEngineCtx *de_ctx = NULL;
  15130. int result = 0;
  15131. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15132. goto end;
  15133. de_ctx->flags |= DE_QUIET;
  15134. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15135. "(content:\"oneoneone\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)");
  15136. if (de_ctx->sig_list == NULL)
  15137. goto end;
  15138. sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH];
  15139. if (sm == NULL) {
  15140. goto end;
  15141. }
  15142. DetectContentData *ud = sm->ctx;
  15143. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15144. ud->flags & DETECT_CONTENT_NOCASE &&
  15145. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  15146. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  15147. ud->fp_chop_offset == 3 &&
  15148. ud->fp_chop_len == 4) {
  15149. result = 1;
  15150. } else {
  15151. result = 0;
  15152. }
  15153. end:
  15154. SigCleanSignatures(de_ctx);
  15155. DetectEngineCtxFree(de_ctx);
  15156. return result;
  15157. }
  15158. int DetectFastPatternTest635(void)
  15159. {
  15160. DetectEngineCtx *de_ctx = NULL;
  15161. int result = 0;
  15162. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15163. goto end;
  15164. de_ctx->flags |= DE_QUIET;
  15165. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15166. "(content:\"one\"; http_raw_host; nocase; "
  15167. "content:\"two\"; fast_pattern:only; http_raw_host; distance:10; nocase; sid:1;)");
  15168. if (de_ctx->sig_list != NULL)
  15169. goto end;
  15170. result = 1;
  15171. end:
  15172. SigCleanSignatures(de_ctx);
  15173. DetectEngineCtxFree(de_ctx);
  15174. return result;
  15175. }
  15176. int DetectFastPatternTest636(void)
  15177. {
  15178. DetectEngineCtx *de_ctx = NULL;
  15179. int result = 0;
  15180. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15181. goto end;
  15182. de_ctx->flags |= DE_QUIET;
  15183. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15184. "(content:\"one\"; http_raw_host; nocase; "
  15185. "content:\"two\"; distance:10; fast_pattern:only; http_raw_host; nocase; sid:1;)");
  15186. if (de_ctx->sig_list != NULL)
  15187. goto end;
  15188. result = 1;
  15189. end:
  15190. SigCleanSignatures(de_ctx);
  15191. DetectEngineCtxFree(de_ctx);
  15192. return result;
  15193. }
  15194. int DetectFastPatternTest637(void)
  15195. {
  15196. DetectEngineCtx *de_ctx = NULL;
  15197. int result = 0;
  15198. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15199. goto end;
  15200. de_ctx->flags |= DE_QUIET;
  15201. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15202. "(content:\"one\"; http_raw_host; nocase; "
  15203. "content:\"two\"; fast_pattern:only; http_raw_host; within:10; nocase; sid:1;)");
  15204. if (de_ctx->sig_list != NULL)
  15205. goto end;
  15206. result = 1;
  15207. end:
  15208. SigCleanSignatures(de_ctx);
  15209. DetectEngineCtxFree(de_ctx);
  15210. return result;
  15211. }
  15212. int DetectFastPatternTest638(void)
  15213. {
  15214. DetectEngineCtx *de_ctx = NULL;
  15215. int result = 0;
  15216. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15217. goto end;
  15218. de_ctx->flags |= DE_QUIET;
  15219. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15220. "(content:\"one\"; http_raw_host; nocase; "
  15221. "content:\"two\"; within:10; fast_pattern:only; http_raw_host; nocase; sid:1;)");
  15222. if (de_ctx->sig_list != NULL)
  15223. goto end;
  15224. result = 1;
  15225. end:
  15226. SigCleanSignatures(de_ctx);
  15227. DetectEngineCtxFree(de_ctx);
  15228. return result;
  15229. }
  15230. int DetectFastPatternTest639(void)
  15231. {
  15232. DetectEngineCtx *de_ctx = NULL;
  15233. int result = 0;
  15234. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15235. goto end;
  15236. de_ctx->flags |= DE_QUIET;
  15237. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15238. "(content:\"one\"; http_raw_host; nocase; "
  15239. "content:\"two\"; fast_pattern:only; http_raw_host; offset:10; nocase; sid:1;)");
  15240. if (de_ctx->sig_list != NULL)
  15241. goto end;
  15242. result = 1;
  15243. end:
  15244. SigCleanSignatures(de_ctx);
  15245. DetectEngineCtxFree(de_ctx);
  15246. return result;
  15247. }
  15248. int DetectFastPatternTest640(void)
  15249. {
  15250. DetectEngineCtx *de_ctx = NULL;
  15251. int result = 0;
  15252. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15253. goto end;
  15254. de_ctx->flags |= DE_QUIET;
  15255. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15256. "(content:\"one\"; http_raw_host; nocase; "
  15257. "content:\"two\"; offset:10; fast_pattern:only; http_raw_host; nocase; sid:1;)");
  15258. if (de_ctx->sig_list != NULL)
  15259. goto end;
  15260. result = 1;
  15261. end:
  15262. SigCleanSignatures(de_ctx);
  15263. DetectEngineCtxFree(de_ctx);
  15264. return result;
  15265. }
  15266. int DetectFastPatternTest641(void)
  15267. {
  15268. DetectEngineCtx *de_ctx = NULL;
  15269. int result = 0;
  15270. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15271. goto end;
  15272. de_ctx->flags |= DE_QUIET;
  15273. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15274. "(content:\"one\"; http_raw_host; nocase; "
  15275. "content:\"two\"; fast_pattern:only; http_raw_host; depth:10; nocase; sid:1;)");
  15276. if (de_ctx->sig_list != NULL)
  15277. goto end;
  15278. result = 1;
  15279. end:
  15280. SigCleanSignatures(de_ctx);
  15281. DetectEngineCtxFree(de_ctx);
  15282. return result;
  15283. }
  15284. int DetectFastPatternTest642(void)
  15285. {
  15286. DetectEngineCtx *de_ctx = NULL;
  15287. int result = 0;
  15288. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15289. goto end;
  15290. de_ctx->flags |= DE_QUIET;
  15291. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15292. "(content:\"one\"; http_raw_host; nocase; "
  15293. "content:\"two\"; depth:10; fast_pattern:only; http_raw_host; nocase; sid:1;)");
  15294. if (de_ctx->sig_list != NULL)
  15295. goto end;
  15296. result = 1;
  15297. end:
  15298. SigCleanSignatures(de_ctx);
  15299. DetectEngineCtxFree(de_ctx);
  15300. return result;
  15301. }
  15302. int DetectFastPatternTest643(void)
  15303. {
  15304. DetectEngineCtx *de_ctx = NULL;
  15305. int result = 0;
  15306. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15307. goto end;
  15308. de_ctx->flags |= DE_QUIET;
  15309. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15310. "(content:\"one\"; http_raw_host; nocase; "
  15311. "content:!\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)");
  15312. if (de_ctx->sig_list != NULL)
  15313. goto end;
  15314. result = 1;
  15315. end:
  15316. SigCleanSignatures(de_ctx);
  15317. DetectEngineCtxFree(de_ctx);
  15318. return result;
  15319. }
  15320. int DetectFastPatternTest644(void)
  15321. {
  15322. DetectEngineCtx *de_ctx = NULL;
  15323. int result = 0;
  15324. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15325. goto end;
  15326. de_ctx->flags |= DE_QUIET;
  15327. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15328. "(content:\" one\"; http_raw_host; nocase; "
  15329. "content:\"two\"; http_raw_host; distance:30; nocase; "
  15330. "content:\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)");
  15331. if (de_ctx->sig_list == NULL)
  15332. goto end;
  15333. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
  15334. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15335. ud->flags & DETECT_CONTENT_NOCASE &&
  15336. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  15337. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  15338. ud->fp_chop_offset == 0 &&
  15339. ud->fp_chop_len == 0) {
  15340. result = 1;
  15341. } else {
  15342. result = 0;
  15343. }
  15344. end:
  15345. SigCleanSignatures(de_ctx);
  15346. DetectEngineCtxFree(de_ctx);
  15347. return result;
  15348. }
  15349. int DetectFastPatternTest645(void)
  15350. {
  15351. DetectEngineCtx *de_ctx = NULL;
  15352. int result = 0;
  15353. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15354. goto end;
  15355. de_ctx->flags |= DE_QUIET;
  15356. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15357. "(content:\"one\"; http_raw_host; nocase; "
  15358. "content:\"two\"; http_raw_host; within:30; nocase; "
  15359. "content:\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)");
  15360. if (de_ctx->sig_list == NULL)
  15361. goto end;
  15362. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
  15363. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15364. ud->flags & DETECT_CONTENT_NOCASE &&
  15365. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  15366. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  15367. ud->fp_chop_offset == 0 &&
  15368. ud->fp_chop_len == 0) {
  15369. result = 1;
  15370. } else {
  15371. result = 0;
  15372. }
  15373. end:
  15374. SigCleanSignatures(de_ctx);
  15375. DetectEngineCtxFree(de_ctx);
  15376. return result;
  15377. }
  15378. int DetectFastPatternTest646(void)
  15379. {
  15380. DetectEngineCtx *de_ctx = NULL;
  15381. int result = 0;
  15382. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15383. goto end;
  15384. de_ctx->flags |= DE_QUIET;
  15385. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15386. "(content:\"one\"; http_raw_host; nocase; "
  15387. "content:\"two\"; http_raw_host; offset:30; nocase; "
  15388. "content:\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)");
  15389. if (de_ctx->sig_list == NULL)
  15390. goto end;
  15391. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
  15392. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15393. ud->flags & DETECT_CONTENT_NOCASE &&
  15394. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  15395. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  15396. ud->fp_chop_offset == 0 &&
  15397. ud->fp_chop_len == 0) {
  15398. result = 1;
  15399. } else {
  15400. result = 0;
  15401. }
  15402. end:
  15403. SigCleanSignatures(de_ctx);
  15404. DetectEngineCtxFree(de_ctx);
  15405. return result;
  15406. }
  15407. int DetectFastPatternTest647(void)
  15408. {
  15409. DetectEngineCtx *de_ctx = NULL;
  15410. int result = 0;
  15411. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15412. goto end;
  15413. de_ctx->flags |= DE_QUIET;
  15414. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15415. "(content:\"one\"; http_raw_host; nocase; "
  15416. "content:\"two\"; http_raw_host; depth:30; nocase; "
  15417. "content:\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)");
  15418. if (de_ctx->sig_list == NULL)
  15419. goto end;
  15420. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
  15421. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15422. ud->flags & DETECT_CONTENT_NOCASE &&
  15423. ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
  15424. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  15425. ud->fp_chop_offset == 0 &&
  15426. ud->fp_chop_len == 0) {
  15427. result = 1;
  15428. } else {
  15429. result = 0;
  15430. }
  15431. end:
  15432. SigCleanSignatures(de_ctx);
  15433. DetectEngineCtxFree(de_ctx);
  15434. return result;
  15435. }
  15436. int DetectFastPatternTest648(void)
  15437. {
  15438. DetectEngineCtx *de_ctx = NULL;
  15439. int result = 0;
  15440. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15441. goto end;
  15442. de_ctx->flags |= DE_QUIET;
  15443. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15444. "(content:!\"one\"; fast_pattern; http_raw_host; nocase; "
  15445. "content:\"two\"; http_raw_host; nocase; sid:1;)");
  15446. if (de_ctx->sig_list == NULL)
  15447. goto end;
  15448. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
  15449. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15450. ud->flags & DETECT_CONTENT_NOCASE &&
  15451. ud->flags & DETECT_CONTENT_NEGATED &&
  15452. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  15453. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
  15454. ud->fp_chop_offset == 0 &&
  15455. ud->fp_chop_len == 0) {
  15456. result = 1;
  15457. } else {
  15458. result = 0;
  15459. }
  15460. end:
  15461. SigCleanSignatures(de_ctx);
  15462. DetectEngineCtxFree(de_ctx);
  15463. return result;
  15464. }
  15465. int DetectFastPatternTest649(void)
  15466. {
  15467. DetectEngineCtx *de_ctx = NULL;
  15468. int result = 0;
  15469. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15470. goto end;
  15471. de_ctx->flags |= DE_QUIET;
  15472. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15473. "(content:\"two\"; http_raw_host; nocase; "
  15474. "content:!\"one\"; fast_pattern; http_raw_host; distance:20; nocase; sid:1;)");
  15475. if (de_ctx->sig_list != NULL)
  15476. goto end;
  15477. result = 1;
  15478. end:
  15479. SigCleanSignatures(de_ctx);
  15480. DetectEngineCtxFree(de_ctx);
  15481. return result;
  15482. }
  15483. int DetectFastPatternTest650(void)
  15484. {
  15485. DetectEngineCtx *de_ctx = NULL;
  15486. int result = 0;
  15487. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15488. goto end;
  15489. de_ctx->flags |= DE_QUIET;
  15490. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15491. "(content:\"two\"; http_raw_host; nocase; "
  15492. "content:!\"one\"; fast_pattern; http_raw_host; within:20; nocase; sid:1;)");
  15493. if (de_ctx->sig_list != NULL)
  15494. goto end;
  15495. result = 1;
  15496. end:
  15497. SigCleanSignatures(de_ctx);
  15498. DetectEngineCtxFree(de_ctx);
  15499. return result;
  15500. }
  15501. int DetectFastPatternTest651(void)
  15502. {
  15503. DetectEngineCtx *de_ctx = NULL;
  15504. int result = 0;
  15505. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15506. goto end;
  15507. de_ctx->flags |= DE_QUIET;
  15508. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15509. "(content:\"two\"; http_raw_host; nocase; "
  15510. "content:!\"one\"; fast_pattern; http_raw_host; offset:20; nocase; sid:1;)");
  15511. if (de_ctx->sig_list != NULL)
  15512. goto end;
  15513. result = 1;
  15514. end:
  15515. SigCleanSignatures(de_ctx);
  15516. DetectEngineCtxFree(de_ctx);
  15517. return result;
  15518. }
  15519. int DetectFastPatternTest652(void)
  15520. {
  15521. DetectEngineCtx *de_ctx = NULL;
  15522. int result = 0;
  15523. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15524. goto end;
  15525. de_ctx->flags |= DE_QUIET;
  15526. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15527. "(content:\"two\"; http_raw_host; nocase; "
  15528. "content:!\"one\"; fast_pattern; http_raw_host; depth:20; nocase; sid:1;)");
  15529. if (de_ctx->sig_list != NULL)
  15530. goto end;
  15531. result = 1;
  15532. end:
  15533. SigCleanSignatures(de_ctx);
  15534. DetectEngineCtxFree(de_ctx);
  15535. return result;
  15536. }
  15537. int DetectFastPatternTest653(void)
  15538. {
  15539. DetectEngineCtx *de_ctx = NULL;
  15540. int result = 0;
  15541. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15542. goto end;
  15543. de_ctx->flags |= DE_QUIET;
  15544. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15545. "(content:\"one\"; http_raw_host; nocase; "
  15546. "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
  15547. "content:\"three\"; http_raw_host; nocase; sid:1;)");
  15548. if (de_ctx->sig_list == NULL)
  15549. goto end;
  15550. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
  15551. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15552. ud->flags & DETECT_CONTENT_NOCASE &&
  15553. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  15554. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  15555. ud->fp_chop_offset == 3 &&
  15556. ud->fp_chop_len == 4) {
  15557. result = 1;
  15558. } else {
  15559. result = 0;
  15560. }
  15561. end:
  15562. SigCleanSignatures(de_ctx);
  15563. DetectEngineCtxFree(de_ctx);
  15564. return result;
  15565. }
  15566. int DetectFastPatternTest654(void)
  15567. {
  15568. DetectEngineCtx *de_ctx = NULL;
  15569. int result = 0;
  15570. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15571. goto end;
  15572. de_ctx->flags |= DE_QUIET;
  15573. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15574. "(content:\"one\"; http_raw_host; nocase; "
  15575. "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
  15576. "content:\"three\"; http_raw_host; distance:30; nocase; sid:1;)");
  15577. if (de_ctx->sig_list == NULL)
  15578. goto end;
  15579. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
  15580. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15581. ud->flags & DETECT_CONTENT_NOCASE &&
  15582. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  15583. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  15584. ud->fp_chop_offset == 3 &&
  15585. ud->fp_chop_len == 4) {
  15586. result = 1;
  15587. } else {
  15588. result = 0;
  15589. }
  15590. end:
  15591. SigCleanSignatures(de_ctx);
  15592. DetectEngineCtxFree(de_ctx);
  15593. return result;
  15594. }
  15595. int DetectFastPatternTest655(void)
  15596. {
  15597. DetectEngineCtx *de_ctx = NULL;
  15598. int result = 0;
  15599. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15600. goto end;
  15601. de_ctx->flags |= DE_QUIET;
  15602. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15603. "(content:\"one\"; http_raw_host; nocase; "
  15604. "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
  15605. "content:\"three\"; http_raw_host; within:30; nocase; sid:1;)");
  15606. if (de_ctx->sig_list == NULL)
  15607. goto end;
  15608. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
  15609. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15610. ud->flags & DETECT_CONTENT_NOCASE &&
  15611. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  15612. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  15613. ud->fp_chop_offset == 3 &&
  15614. ud->fp_chop_len == 4) {
  15615. result = 1;
  15616. } else {
  15617. result = 0;
  15618. }
  15619. end:
  15620. SigCleanSignatures(de_ctx);
  15621. DetectEngineCtxFree(de_ctx);
  15622. return result;
  15623. }
  15624. int DetectFastPatternTest656(void)
  15625. {
  15626. DetectEngineCtx *de_ctx = NULL;
  15627. int result = 0;
  15628. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15629. goto end;
  15630. de_ctx->flags |= DE_QUIET;
  15631. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15632. "(content:\"one\"; http_raw_host; nocase; "
  15633. "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
  15634. "content:\"three\"; http_raw_host; offset:30; nocase; sid:1;)");
  15635. if (de_ctx->sig_list == NULL)
  15636. goto end;
  15637. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
  15638. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15639. ud->flags & DETECT_CONTENT_NOCASE &&
  15640. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  15641. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  15642. ud->fp_chop_offset == 3 &&
  15643. ud->fp_chop_len == 4) {
  15644. result = 1;
  15645. } else {
  15646. result = 0;
  15647. }
  15648. end:
  15649. SigCleanSignatures(de_ctx);
  15650. DetectEngineCtxFree(de_ctx);
  15651. return result;
  15652. }
  15653. int DetectFastPatternTest657(void)
  15654. {
  15655. DetectEngineCtx *de_ctx = NULL;
  15656. int result = 0;
  15657. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15658. goto end;
  15659. de_ctx->flags |= DE_QUIET;
  15660. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15661. "(content:\"one\"; http_raw_host; nocase; "
  15662. "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
  15663. "content:\"three\"; http_raw_host; depth:30; nocase; sid:1;)");
  15664. if (de_ctx->sig_list == NULL)
  15665. goto end;
  15666. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
  15667. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15668. ud->flags & DETECT_CONTENT_NOCASE &&
  15669. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  15670. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  15671. ud->fp_chop_offset == 3 &&
  15672. ud->fp_chop_len == 4) {
  15673. result = 1;
  15674. } else {
  15675. result = 0;
  15676. }
  15677. end:
  15678. SigCleanSignatures(de_ctx);
  15679. DetectEngineCtxFree(de_ctx);
  15680. return result;
  15681. }
  15682. int DetectFastPatternTest658(void)
  15683. {
  15684. DetectEngineCtx *de_ctx = NULL;
  15685. int result = 0;
  15686. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15687. goto end;
  15688. de_ctx->flags |= DE_QUIET;
  15689. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15690. "(content:\"one\"; http_raw_host; nocase; "
  15691. "content:\"two\"; http_raw_host; distance:10; nocase; "
  15692. "content:\"oneonethree\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)");
  15693. if (de_ctx->sig_list == NULL)
  15694. goto end;
  15695. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
  15696. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15697. ud->flags & DETECT_CONTENT_NOCASE &&
  15698. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  15699. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  15700. ud->fp_chop_offset == 3 &&
  15701. ud->fp_chop_len == 4) {
  15702. result = 1;
  15703. } else {
  15704. result = 0;
  15705. }
  15706. end:
  15707. SigCleanSignatures(de_ctx);
  15708. DetectEngineCtxFree(de_ctx);
  15709. return result;
  15710. }
  15711. int DetectFastPatternTest659(void)
  15712. {
  15713. DetectEngineCtx *de_ctx = NULL;
  15714. int result = 0;
  15715. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15716. goto end;
  15717. de_ctx->flags |= DE_QUIET;
  15718. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15719. "(content:\"one\"; http_raw_host; nocase; "
  15720. "content:\"two\"; http_raw_host; within:10; nocase; "
  15721. "content:\"oneonethree\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)");
  15722. if (de_ctx->sig_list == NULL)
  15723. goto end;
  15724. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
  15725. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15726. ud->flags & DETECT_CONTENT_NOCASE &&
  15727. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  15728. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  15729. ud->fp_chop_offset == 3 &&
  15730. ud->fp_chop_len == 4) {
  15731. result = 1;
  15732. } else {
  15733. result = 0;
  15734. }
  15735. end:
  15736. SigCleanSignatures(de_ctx);
  15737. DetectEngineCtxFree(de_ctx);
  15738. return result;
  15739. }
  15740. int DetectFastPatternTest660(void)
  15741. {
  15742. DetectEngineCtx *de_ctx = NULL;
  15743. int result = 0;
  15744. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15745. goto end;
  15746. de_ctx->flags |= DE_QUIET;
  15747. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15748. "(content:\"one\"; http_raw_host; nocase; "
  15749. "content:\"two\"; http_raw_host; offset:10; nocase; "
  15750. "content:\"oneonethree\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)");
  15751. if (de_ctx->sig_list == NULL)
  15752. goto end;
  15753. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
  15754. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15755. ud->flags & DETECT_CONTENT_NOCASE &&
  15756. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  15757. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  15758. ud->fp_chop_offset == 3 &&
  15759. ud->fp_chop_len == 4) {
  15760. result = 1;
  15761. } else {
  15762. result = 0;
  15763. }
  15764. end:
  15765. SigCleanSignatures(de_ctx);
  15766. DetectEngineCtxFree(de_ctx);
  15767. return result;
  15768. }
  15769. int DetectFastPatternTest661(void)
  15770. {
  15771. DetectEngineCtx *de_ctx = NULL;
  15772. int result = 0;
  15773. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15774. goto end;
  15775. de_ctx->flags |= DE_QUIET;
  15776. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15777. "(content:\"one\"; http_raw_host; nocase; "
  15778. "content:\"two\"; http_raw_host; depth:10; nocase; "
  15779. "content:\"oneonethree\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)");
  15780. if (de_ctx->sig_list == NULL)
  15781. goto end;
  15782. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
  15783. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15784. ud->flags & DETECT_CONTENT_NOCASE &&
  15785. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  15786. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  15787. ud->fp_chop_offset == 3 &&
  15788. ud->fp_chop_len == 4) {
  15789. result = 1;
  15790. } else {
  15791. result = 0;
  15792. }
  15793. result = 1;
  15794. end:
  15795. SigCleanSignatures(de_ctx);
  15796. DetectEngineCtxFree(de_ctx);
  15797. return result;
  15798. }
  15799. int DetectFastPatternTest662(void)
  15800. {
  15801. DetectEngineCtx *de_ctx = NULL;
  15802. int result = 0;
  15803. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15804. goto end;
  15805. de_ctx->flags |= DE_QUIET;
  15806. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15807. "(content:\"one\"; http_raw_host; nocase; "
  15808. "content:\"two\"; fast_pattern:65977,4; http_raw_host; nocase; "
  15809. "content:\"three\"; http_raw_host; distance:10; nocase; sid:1;)");
  15810. if (de_ctx->sig_list != NULL)
  15811. goto end;
  15812. result = 1;
  15813. end:
  15814. SigCleanSignatures(de_ctx);
  15815. DetectEngineCtxFree(de_ctx);
  15816. return result;
  15817. }
  15818. int DetectFastPatternTest663(void)
  15819. {
  15820. DetectEngineCtx *de_ctx = NULL;
  15821. int result = 0;
  15822. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15823. goto end;
  15824. de_ctx->flags |= DE_QUIET;
  15825. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15826. "(content:\"one\"; http_raw_host; nocase; "
  15827. "content:\"oneonetwo\"; fast_pattern:3,65977; http_raw_host; nocase; "
  15828. "content:\"three\"; distance:10; http_raw_host; nocase; sid:1;)");
  15829. if (de_ctx->sig_list != NULL)
  15830. goto end;
  15831. result = 1;
  15832. end:
  15833. SigCleanSignatures(de_ctx);
  15834. DetectEngineCtxFree(de_ctx);
  15835. return result;
  15836. }
  15837. int DetectFastPatternTest664(void)
  15838. {
  15839. DetectEngineCtx *de_ctx = NULL;
  15840. int result = 0;
  15841. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15842. goto end;
  15843. de_ctx->flags |= DE_QUIET;
  15844. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15845. "(content:\"one\"; http_raw_host; nocase; "
  15846. "content:\"two\"; fast_pattern:65534,4; http_raw_host; nocase; "
  15847. "content:\"three\"; http_raw_host; distance:10; nocase; sid:1;)");
  15848. if (de_ctx->sig_list != NULL)
  15849. goto end;
  15850. result = 1;
  15851. end:
  15852. SigCleanSignatures(de_ctx);
  15853. DetectEngineCtxFree(de_ctx);
  15854. return result;
  15855. }
  15856. int DetectFastPatternTest665(void)
  15857. {
  15858. DetectEngineCtx *de_ctx = NULL;
  15859. int result = 0;
  15860. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15861. goto end;
  15862. de_ctx->flags |= DE_QUIET;
  15863. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15864. "(content:\"one\"; http_raw_host; nocase; "
  15865. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
  15866. "content:\"three\"; http_raw_host; nocase; sid:1;)");
  15867. if (de_ctx->sig_list == NULL)
  15868. goto end;
  15869. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
  15870. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15871. ud->flags & DETECT_CONTENT_NOCASE &&
  15872. ud->flags & DETECT_CONTENT_NEGATED &&
  15873. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  15874. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  15875. ud->fp_chop_offset == 3 &&
  15876. ud->fp_chop_len == 4) {
  15877. result = 1;
  15878. } else {
  15879. result = 0;
  15880. }
  15881. end:
  15882. SigCleanSignatures(de_ctx);
  15883. DetectEngineCtxFree(de_ctx);
  15884. return result;
  15885. }
  15886. int DetectFastPatternTest666(void)
  15887. {
  15888. DetectEngineCtx *de_ctx = NULL;
  15889. int result = 0;
  15890. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15891. goto end;
  15892. de_ctx->flags |= DE_QUIET;
  15893. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15894. "(content:\"one\"; http_raw_host; nocase; "
  15895. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; distance:10; nocase; "
  15896. "content:\"three\"; http_raw_host; nocase; sid:1;)");
  15897. if (de_ctx->sig_list != NULL)
  15898. goto end;
  15899. result = 1;
  15900. end:
  15901. SigCleanSignatures(de_ctx);
  15902. DetectEngineCtxFree(de_ctx);
  15903. return result;
  15904. }
  15905. int DetectFastPatternTest667(void)
  15906. {
  15907. DetectEngineCtx *de_ctx = NULL;
  15908. int result = 0;
  15909. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15910. goto end;
  15911. de_ctx->flags |= DE_QUIET;
  15912. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15913. "(content:\"one\"; http_raw_host; nocase; "
  15914. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; within:10; nocase; "
  15915. "content:\"three\"; http_raw_host; nocase; sid:1;)");
  15916. if (de_ctx->sig_list != NULL)
  15917. goto end;
  15918. result = 1;
  15919. end:
  15920. SigCleanSignatures(de_ctx);
  15921. DetectEngineCtxFree(de_ctx);
  15922. return result;
  15923. }
  15924. int DetectFastPatternTest668(void)
  15925. {
  15926. DetectEngineCtx *de_ctx = NULL;
  15927. int result = 0;
  15928. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15929. goto end;
  15930. de_ctx->flags |= DE_QUIET;
  15931. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15932. "(content:\"one\"; http_raw_host; nocase; "
  15933. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; offset:10; nocase; "
  15934. "content:\"three\"; http_raw_host; nocase; sid:1;)");
  15935. if (de_ctx->sig_list != NULL)
  15936. goto end;
  15937. result = 1;
  15938. end:
  15939. SigCleanSignatures(de_ctx);
  15940. DetectEngineCtxFree(de_ctx);
  15941. return result;
  15942. }
  15943. int DetectFastPatternTest669(void)
  15944. {
  15945. DetectEngineCtx *de_ctx = NULL;
  15946. int result = 0;
  15947. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15948. goto end;
  15949. de_ctx->flags |= DE_QUIET;
  15950. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15951. "(content:\"one\"; http_raw_host; nocase; "
  15952. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; depth:10; nocase; "
  15953. "content:\"three\"; http_raw_host; nocase; sid:1;)");
  15954. if (de_ctx->sig_list != NULL)
  15955. goto end;
  15956. result = 1;
  15957. end:
  15958. SigCleanSignatures(de_ctx);
  15959. DetectEngineCtxFree(de_ctx);
  15960. return result;
  15961. }
  15962. int DetectFastPatternTest670(void)
  15963. {
  15964. DetectEngineCtx *de_ctx = NULL;
  15965. int result = 0;
  15966. if ( (de_ctx = DetectEngineCtxInit()) == NULL)
  15967. goto end;
  15968. de_ctx->flags |= DE_QUIET;
  15969. de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
  15970. "(content:\"one\"; http_raw_host; nocase; "
  15971. "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; "
  15972. "content:\"three\"; http_raw_host; nocase; sid:1;)");
  15973. if (de_ctx->sig_list == NULL)
  15974. goto end;
  15975. DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
  15976. if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
  15977. ud->flags & DETECT_CONTENT_NOCASE &&
  15978. ud->flags & DETECT_CONTENT_NEGATED &&
  15979. !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
  15980. ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
  15981. ud->fp_chop_offset == 3 &&
  15982. ud->fp_chop_len == 4) {
  15983. result = 1;
  15984. } else {
  15985. result = 0;
  15986. }
  15987. end:
  15988. SigCleanSignatures(de_ctx);
  15989. DetectEngineCtxFree(de_ctx);
  15990. return result;
  15991. }
  15992. #endif
  15993. void DetectFastPatternRegisterTests(void)
  15994. {
  15995. #ifdef UNITTESTS
  15996. UtRegisterTest("DetectFastPatternTest01", DetectFastPatternTest01, 1);
  15997. UtRegisterTest("DetectFastPatternTest02", DetectFastPatternTest02, 1);
  15998. UtRegisterTest("DetectFastPatternTest03", DetectFastPatternTest03, 1);
  15999. UtRegisterTest("DetectFastPatternTest04", DetectFastPatternTest04, 1);
  16000. UtRegisterTest("DetectFastPatternTest05", DetectFastPatternTest05, 1);
  16001. UtRegisterTest("DetectFastPatternTest06", DetectFastPatternTest06, 1);
  16002. UtRegisterTest("DetectFastPatternTest07", DetectFastPatternTest07, 1);
  16003. UtRegisterTest("DetectFastPatternTest08", DetectFastPatternTest08, 1);
  16004. UtRegisterTest("DetectFastPatternTest09", DetectFastPatternTest09, 1);
  16005. UtRegisterTest("DetectFastPatternTest10", DetectFastPatternTest10, 1);
  16006. UtRegisterTest("DetectFastPatternTest11", DetectFastPatternTest11, 1);
  16007. UtRegisterTest("DetectFastPatternTest12", DetectFastPatternTest12, 1);
  16008. UtRegisterTest("DetectFastPatternTest13", DetectFastPatternTest13, 1);
  16009. UtRegisterTest("DetectFastPatternTest14", DetectFastPatternTest14, 1);
  16010. UtRegisterTest("DetectFastPatternTest15", DetectFastPatternTest15, 1);
  16011. UtRegisterTest("DetectFastPatternTest16", DetectFastPatternTest16, 1);
  16012. UtRegisterTest("DetectFastPatternTest17", DetectFastPatternTest17, 1);
  16013. UtRegisterTest("DetectFastPatternTest18", DetectFastPatternTest18, 1);
  16014. UtRegisterTest("DetectFastPatternTest19", DetectFastPatternTest19, 1);
  16015. UtRegisterTest("DetectFastPatternTest20", DetectFastPatternTest20, 1);
  16016. UtRegisterTest("DetectFastPatternTest21", DetectFastPatternTest21, 1);
  16017. UtRegisterTest("DetectFastPatternTest22", DetectFastPatternTest22, 1);
  16018. UtRegisterTest("DetectFastPatternTest23", DetectFastPatternTest23, 1);
  16019. UtRegisterTest("DetectFastPatternTest24", DetectFastPatternTest24, 1);
  16020. UtRegisterTest("DetectFastPatternTest25", DetectFastPatternTest25, 1);
  16021. UtRegisterTest("DetectFastPatternTest26", DetectFastPatternTest26, 1);
  16022. UtRegisterTest("DetectFastPatternTest27", DetectFastPatternTest27, 1);
  16023. UtRegisterTest("DetectFastPatternTest28", DetectFastPatternTest28, 1);
  16024. UtRegisterTest("DetectFastPatternTest29", DetectFastPatternTest29, 1);
  16025. UtRegisterTest("DetectFastPatternTest30", DetectFastPatternTest30, 1);
  16026. UtRegisterTest("DetectFastPatternTest31", DetectFastPatternTest31, 1);
  16027. UtRegisterTest("DetectFastPatternTest32", DetectFastPatternTest32, 1);
  16028. UtRegisterTest("DetectFastPatternTest33", DetectFastPatternTest33, 1);
  16029. UtRegisterTest("DetectFastPatternTest34", DetectFastPatternTest34, 1);
  16030. UtRegisterTest("DetectFastPatternTest35", DetectFastPatternTest35, 1);
  16031. UtRegisterTest("DetectFastPatternTest36", DetectFastPatternTest36, 1);
  16032. UtRegisterTest("DetectFastPatternTest37", DetectFastPatternTest37, 1);
  16033. UtRegisterTest("DetectFastPatternTest38", DetectFastPatternTest38, 1);
  16034. UtRegisterTest("DetectFastPatternTest39", DetectFastPatternTest39, 1);
  16035. UtRegisterTest("DetectFastPatternTest40", DetectFastPatternTest40, 1);
  16036. UtRegisterTest("DetectFastPatternTest41", DetectFastPatternTest41, 1);
  16037. UtRegisterTest("DetectFastPatternTest42", DetectFastPatternTest42, 1);
  16038. UtRegisterTest("DetectFastPatternTest43", DetectFastPatternTest43, 1);
  16039. UtRegisterTest("DetectFastPatternTest44", DetectFastPatternTest44, 1);
  16040. UtRegisterTest("DetectFastPatternTest45", DetectFastPatternTest45, 1);
  16041. UtRegisterTest("DetectFastPatternTest46", DetectFastPatternTest46, 1);
  16042. UtRegisterTest("DetectFastPatternTest47", DetectFastPatternTest47, 1);
  16043. UtRegisterTest("DetectFastPatternTest48", DetectFastPatternTest48, 1);
  16044. UtRegisterTest("DetectFastPatternTest49", DetectFastPatternTest49, 1);
  16045. UtRegisterTest("DetectFastPatternTest50", DetectFastPatternTest50, 1);
  16046. UtRegisterTest("DetectFastPatternTest51", DetectFastPatternTest51, 1);
  16047. UtRegisterTest("DetectFastPatternTest52", DetectFastPatternTest52, 1);
  16048. UtRegisterTest("DetectFastPatternTest53", DetectFastPatternTest53, 1);
  16049. /* content fast_pattern tests ^ */
  16050. /* uricontent fast_pattern tests v */
  16051. UtRegisterTest("DetectFastPatternTest54", DetectFastPatternTest54, 1);
  16052. UtRegisterTest("DetectFastPatternTest55", DetectFastPatternTest55, 1);
  16053. UtRegisterTest("DetectFastPatternTest56", DetectFastPatternTest56, 1);
  16054. UtRegisterTest("DetectFastPatternTest57", DetectFastPatternTest57, 1);
  16055. UtRegisterTest("DetectFastPatternTest58", DetectFastPatternTest58, 1);
  16056. UtRegisterTest("DetectFastPatternTest59", DetectFastPatternTest59, 1);
  16057. UtRegisterTest("DetectFastPatternTest60", DetectFastPatternTest60, 1);
  16058. UtRegisterTest("DetectFastPatternTest61", DetectFastPatternTest61, 1);
  16059. UtRegisterTest("DetectFastPatternTest62", DetectFastPatternTest62, 1);
  16060. UtRegisterTest("DetectFastPatternTest63", DetectFastPatternTest63, 1);
  16061. UtRegisterTest("DetectFastPatternTest64", DetectFastPatternTest64, 1);
  16062. UtRegisterTest("DetectFastPatternTest65", DetectFastPatternTest65, 1);
  16063. UtRegisterTest("DetectFastPatternTest66", DetectFastPatternTest66, 1);
  16064. UtRegisterTest("DetectFastPatternTest67", DetectFastPatternTest67, 1);
  16065. UtRegisterTest("DetectFastPatternTest68", DetectFastPatternTest68, 1);
  16066. UtRegisterTest("DetectFastPatternTest69", DetectFastPatternTest69, 1);
  16067. UtRegisterTest("DetectFastPatternTest70", DetectFastPatternTest70, 1);
  16068. UtRegisterTest("DetectFastPatternTest71", DetectFastPatternTest71, 1);
  16069. UtRegisterTest("DetectFastPatternTest72", DetectFastPatternTest72, 1);
  16070. UtRegisterTest("DetectFastPatternTest73", DetectFastPatternTest73, 1);
  16071. UtRegisterTest("DetectFastPatternTest74", DetectFastPatternTest74, 1);
  16072. UtRegisterTest("DetectFastPatternTest75", DetectFastPatternTest75, 1);
  16073. UtRegisterTest("DetectFastPatternTest76", DetectFastPatternTest76, 1);
  16074. UtRegisterTest("DetectFastPatternTest77", DetectFastPatternTest77, 1);
  16075. UtRegisterTest("DetectFastPatternTest78", DetectFastPatternTest78, 1);
  16076. UtRegisterTest("DetectFastPatternTest79", DetectFastPatternTest79, 1);
  16077. UtRegisterTest("DetectFastPatternTest80", DetectFastPatternTest80, 1);
  16078. UtRegisterTest("DetectFastPatternTest81", DetectFastPatternTest81, 1);
  16079. UtRegisterTest("DetectFastPatternTest82", DetectFastPatternTest82, 1);
  16080. UtRegisterTest("DetectFastPatternTest83", DetectFastPatternTest83, 1);
  16081. UtRegisterTest("DetectFastPatternTest84", DetectFastPatternTest84, 1);
  16082. UtRegisterTest("DetectFastPatternTest85", DetectFastPatternTest85, 1);
  16083. UtRegisterTest("DetectFastPatternTest86", DetectFastPatternTest86, 1);
  16084. UtRegisterTest("DetectFastPatternTest87", DetectFastPatternTest87, 1);
  16085. UtRegisterTest("DetectFastPatternTest88", DetectFastPatternTest88, 1);
  16086. UtRegisterTest("DetectFastPatternTest89", DetectFastPatternTest89, 1);
  16087. UtRegisterTest("DetectFastPatternTest90", DetectFastPatternTest90, 1);
  16088. UtRegisterTest("DetectFastPatternTest91", DetectFastPatternTest91, 1);
  16089. UtRegisterTest("DetectFastPatternTest92", DetectFastPatternTest92, 1);
  16090. /* uricontent fast_pattern tests ^ */
  16091. /* http_uri fast_pattern tests v */
  16092. UtRegisterTest("DetectFastPatternTest93", DetectFastPatternTest93, 1);
  16093. UtRegisterTest("DetectFastPatternTest94", DetectFastPatternTest94, 1);
  16094. UtRegisterTest("DetectFastPatternTest95", DetectFastPatternTest95, 1);
  16095. UtRegisterTest("DetectFastPatternTest96", DetectFastPatternTest96, 1);
  16096. UtRegisterTest("DetectFastPatternTest97", DetectFastPatternTest97, 1);
  16097. UtRegisterTest("DetectFastPatternTest98", DetectFastPatternTest98, 1);
  16098. UtRegisterTest("DetectFastPatternTest99", DetectFastPatternTest99, 1);
  16099. UtRegisterTest("DetectFastPatternTest100", DetectFastPatternTest100, 1);
  16100. UtRegisterTest("DetectFastPatternTest101", DetectFastPatternTest101, 1);
  16101. UtRegisterTest("DetectFastPatternTest102", DetectFastPatternTest102, 1);
  16102. UtRegisterTest("DetectFastPatternTest103", DetectFastPatternTest103, 1);
  16103. UtRegisterTest("DetectFastPatternTest104", DetectFastPatternTest104, 1);
  16104. UtRegisterTest("DetectFastPatternTest105", DetectFastPatternTest105, 1);
  16105. UtRegisterTest("DetectFastPatternTest106", DetectFastPatternTest106, 1);
  16106. UtRegisterTest("DetectFastPatternTest107", DetectFastPatternTest107, 1);
  16107. UtRegisterTest("DetectFastPatternTest108", DetectFastPatternTest108, 1);
  16108. UtRegisterTest("DetectFastPatternTest109", DetectFastPatternTest109, 1);
  16109. UtRegisterTest("DetectFastPatternTest110", DetectFastPatternTest110, 1);
  16110. UtRegisterTest("DetectFastPatternTest111", DetectFastPatternTest111, 1);
  16111. UtRegisterTest("DetectFastPatternTest112", DetectFastPatternTest112, 1);
  16112. UtRegisterTest("DetectFastPatternTest113", DetectFastPatternTest113, 1);
  16113. UtRegisterTest("DetectFastPatternTest114", DetectFastPatternTest114, 1);
  16114. UtRegisterTest("DetectFastPatternTest115", DetectFastPatternTest115, 1);
  16115. UtRegisterTest("DetectFastPatternTest116", DetectFastPatternTest116, 1);
  16116. UtRegisterTest("DetectFastPatternTest117", DetectFastPatternTest117, 1);
  16117. UtRegisterTest("DetectFastPatternTest118", DetectFastPatternTest118, 1);
  16118. UtRegisterTest("DetectFastPatternTest119", DetectFastPatternTest119, 1);
  16119. UtRegisterTest("DetectFastPatternTest120", DetectFastPatternTest120, 1);
  16120. UtRegisterTest("DetectFastPatternTest121", DetectFastPatternTest121, 1);
  16121. UtRegisterTest("DetectFastPatternTest122", DetectFastPatternTest122, 1);
  16122. UtRegisterTest("DetectFastPatternTest123", DetectFastPatternTest123, 1);
  16123. UtRegisterTest("DetectFastPatternTest124", DetectFastPatternTest124, 1);
  16124. UtRegisterTest("DetectFastPatternTest125", DetectFastPatternTest125, 1);
  16125. UtRegisterTest("DetectFastPatternTest126", DetectFastPatternTest126, 1);
  16126. UtRegisterTest("DetectFastPatternTest127", DetectFastPatternTest127, 1);
  16127. UtRegisterTest("DetectFastPatternTest128", DetectFastPatternTest128, 1);
  16128. UtRegisterTest("DetectFastPatternTest129", DetectFastPatternTest129, 1);
  16129. UtRegisterTest("DetectFastPatternTest130", DetectFastPatternTest130, 1);
  16130. UtRegisterTest("DetectFastPatternTest131", DetectFastPatternTest131, 1);
  16131. UtRegisterTest("DetectFastPatternTest132", DetectFastPatternTest132, 1);
  16132. UtRegisterTest("DetectFastPatternTest133", DetectFastPatternTest133, 1);
  16133. /* http_uri fast_pattern tests ^ */
  16134. /* http_client_body fast_pattern tests v */
  16135. UtRegisterTest("DetectFastPatternTest134", DetectFastPatternTest134, 1);
  16136. UtRegisterTest("DetectFastPatternTest135", DetectFastPatternTest135, 1);
  16137. UtRegisterTest("DetectFastPatternTest136", DetectFastPatternTest136, 1);
  16138. UtRegisterTest("DetectFastPatternTest137", DetectFastPatternTest137, 1);
  16139. UtRegisterTest("DetectFastPatternTest138", DetectFastPatternTest138, 1);
  16140. UtRegisterTest("DetectFastPatternTest139", DetectFastPatternTest139, 1);
  16141. UtRegisterTest("DetectFastPatternTest140", DetectFastPatternTest140, 1);
  16142. UtRegisterTest("DetectFastPatternTest141", DetectFastPatternTest141, 1);
  16143. UtRegisterTest("DetectFastPatternTest142", DetectFastPatternTest142, 1);
  16144. UtRegisterTest("DetectFastPatternTest143", DetectFastPatternTest143, 1);
  16145. UtRegisterTest("DetectFastPatternTest144", DetectFastPatternTest144, 1);
  16146. UtRegisterTest("DetectFastPatternTest145", DetectFastPatternTest145, 1);
  16147. UtRegisterTest("DetectFastPatternTest146", DetectFastPatternTest146, 1);
  16148. UtRegisterTest("DetectFastPatternTest147", DetectFastPatternTest147, 1);
  16149. UtRegisterTest("DetectFastPatternTest148", DetectFastPatternTest148, 1);
  16150. UtRegisterTest("DetectFastPatternTest149", DetectFastPatternTest149, 1);
  16151. UtRegisterTest("DetectFastPatternTest150", DetectFastPatternTest150, 1);
  16152. UtRegisterTest("DetectFastPatternTest151", DetectFastPatternTest151, 1);
  16153. UtRegisterTest("DetectFastPatternTest152", DetectFastPatternTest152, 1);
  16154. UtRegisterTest("DetectFastPatternTest153", DetectFastPatternTest153, 1);
  16155. UtRegisterTest("DetectFastPatternTest154", DetectFastPatternTest154, 1);
  16156. UtRegisterTest("DetectFastPatternTest155", DetectFastPatternTest155, 1);
  16157. UtRegisterTest("DetectFastPatternTest156", DetectFastPatternTest156, 1);
  16158. UtRegisterTest("DetectFastPatternTest157", DetectFastPatternTest157, 1);
  16159. UtRegisterTest("DetectFastPatternTest158", DetectFastPatternTest158, 1);
  16160. UtRegisterTest("DetectFastPatternTest159", DetectFastPatternTest159, 1);
  16161. UtRegisterTest("DetectFastPatternTest160", DetectFastPatternTest160, 1);
  16162. UtRegisterTest("DetectFastPatternTest161", DetectFastPatternTest161, 1);
  16163. UtRegisterTest("DetectFastPatternTest162", DetectFastPatternTest162, 1);
  16164. UtRegisterTest("DetectFastPatternTest163", DetectFastPatternTest163, 1);
  16165. UtRegisterTest("DetectFastPatternTest164", DetectFastPatternTest164, 1);
  16166. UtRegisterTest("DetectFastPatternTest165", DetectFastPatternTest165, 1);
  16167. UtRegisterTest("DetectFastPatternTest166", DetectFastPatternTest166, 1);
  16168. UtRegisterTest("DetectFastPatternTest167", DetectFastPatternTest167, 1);
  16169. UtRegisterTest("DetectFastPatternTest168", DetectFastPatternTest168, 1);
  16170. UtRegisterTest("DetectFastPatternTest169", DetectFastPatternTest169, 1);
  16171. UtRegisterTest("DetectFastPatternTest170", DetectFastPatternTest170, 1);
  16172. UtRegisterTest("DetectFastPatternTest171", DetectFastPatternTest171, 1);
  16173. UtRegisterTest("DetectFastPatternTest172", DetectFastPatternTest172, 1);
  16174. UtRegisterTest("DetectFastPatternTest173", DetectFastPatternTest173, 1);
  16175. UtRegisterTest("DetectFastPatternTest174", DetectFastPatternTest174, 1);
  16176. /* http_client_body fast_pattern tests ^ */
  16177. /* content fast_pattern tests v */
  16178. UtRegisterTest("DetectFastPatternTest175", DetectFastPatternTest175, 1);
  16179. UtRegisterTest("DetectFastPatternTest176", DetectFastPatternTest176, 1);
  16180. UtRegisterTest("DetectFastPatternTest177", DetectFastPatternTest177, 1);
  16181. UtRegisterTest("DetectFastPatternTest178", DetectFastPatternTest178, 1);
  16182. /* content fast_pattern tests ^ */
  16183. /* http_header fast_pattern tests v */
  16184. UtRegisterTest("DetectFastPatternTest179", DetectFastPatternTest179, 1);
  16185. UtRegisterTest("DetectFastPatternTest180", DetectFastPatternTest180, 1);
  16186. UtRegisterTest("DetectFastPatternTest181", DetectFastPatternTest181, 1);
  16187. UtRegisterTest("DetectFastPatternTest182", DetectFastPatternTest182, 1);
  16188. UtRegisterTest("DetectFastPatternTest183", DetectFastPatternTest183, 1);
  16189. UtRegisterTest("DetectFastPatternTest184", DetectFastPatternTest184, 1);
  16190. UtRegisterTest("DetectFastPatternTest185", DetectFastPatternTest185, 1);
  16191. UtRegisterTest("DetectFastPatternTest186", DetectFastPatternTest186, 1);
  16192. UtRegisterTest("DetectFastPatternTest187", DetectFastPatternTest187, 1);
  16193. UtRegisterTest("DetectFastPatternTest188", DetectFastPatternTest188, 1);
  16194. UtRegisterTest("DetectFastPatternTest189", DetectFastPatternTest189, 1);
  16195. UtRegisterTest("DetectFastPatternTest190", DetectFastPatternTest190, 1);
  16196. UtRegisterTest("DetectFastPatternTest191", DetectFastPatternTest191, 1);
  16197. UtRegisterTest("DetectFastPatternTest192", DetectFastPatternTest192, 1);
  16198. UtRegisterTest("DetectFastPatternTest193", DetectFastPatternTest193, 1);
  16199. UtRegisterTest("DetectFastPatternTest194", DetectFastPatternTest194, 1);
  16200. UtRegisterTest("DetectFastPatternTest195", DetectFastPatternTest195, 1);
  16201. UtRegisterTest("DetectFastPatternTest196", DetectFastPatternTest196, 1);
  16202. UtRegisterTest("DetectFastPatternTest197", DetectFastPatternTest197, 1);
  16203. UtRegisterTest("DetectFastPatternTest198", DetectFastPatternTest198, 1);
  16204. UtRegisterTest("DetectFastPatternTest199", DetectFastPatternTest199, 1);
  16205. UtRegisterTest("DetectFastPatternTest200", DetectFastPatternTest200, 1);
  16206. UtRegisterTest("DetectFastPatternTest201", DetectFastPatternTest201, 1);
  16207. UtRegisterTest("DetectFastPatternTest202", DetectFastPatternTest202, 1);
  16208. UtRegisterTest("DetectFastPatternTest203", DetectFastPatternTest203, 1);
  16209. UtRegisterTest("DetectFastPatternTest204", DetectFastPatternTest204, 1);
  16210. UtRegisterTest("DetectFastPatternTest205", DetectFastPatternTest205, 1);
  16211. UtRegisterTest("DetectFastPatternTest206", DetectFastPatternTest206, 1);
  16212. UtRegisterTest("DetectFastPatternTest207", DetectFastPatternTest207, 1);
  16213. UtRegisterTest("DetectFastPatternTest208", DetectFastPatternTest208, 1);
  16214. UtRegisterTest("DetectFastPatternTest209", DetectFastPatternTest209, 1);
  16215. UtRegisterTest("DetectFastPatternTest210", DetectFastPatternTest210, 1);
  16216. UtRegisterTest("DetectFastPatternTest211", DetectFastPatternTest211, 1);
  16217. UtRegisterTest("DetectFastPatternTest212", DetectFastPatternTest212, 1);
  16218. UtRegisterTest("DetectFastPatternTest213", DetectFastPatternTest213, 1);
  16219. UtRegisterTest("DetectFastPatternTest214", DetectFastPatternTest214, 1);
  16220. UtRegisterTest("DetectFastPatternTest215", DetectFastPatternTest215, 1);
  16221. UtRegisterTest("DetectFastPatternTest216", DetectFastPatternTest216, 1);
  16222. UtRegisterTest("DetectFastPatternTest217", DetectFastPatternTest217, 1);
  16223. UtRegisterTest("DetectFastPatternTest218", DetectFastPatternTest218, 1);
  16224. UtRegisterTest("DetectFastPatternTest219", DetectFastPatternTest219, 1);
  16225. /* http_header fast_pattern tests ^ */
  16226. /* http_raw_header fast_pattern tests v */
  16227. UtRegisterTest("DetectFastPatternTest220", DetectFastPatternTest220, 1);
  16228. UtRegisterTest("DetectFastPatternTest221", DetectFastPatternTest221, 1);
  16229. UtRegisterTest("DetectFastPatternTest222", DetectFastPatternTest222, 1);
  16230. UtRegisterTest("DetectFastPatternTest223", DetectFastPatternTest223, 1);
  16231. UtRegisterTest("DetectFastPatternTest224", DetectFastPatternTest224, 1);
  16232. UtRegisterTest("DetectFastPatternTest225", DetectFastPatternTest225, 1);
  16233. UtRegisterTest("DetectFastPatternTest226", DetectFastPatternTest226, 1);
  16234. UtRegisterTest("DetectFastPatternTest227", DetectFastPatternTest227, 1);
  16235. UtRegisterTest("DetectFastPatternTest228", DetectFastPatternTest228, 1);
  16236. UtRegisterTest("DetectFastPatternTest229", DetectFastPatternTest229, 1);
  16237. UtRegisterTest("DetectFastPatternTest230", DetectFastPatternTest230, 1);
  16238. UtRegisterTest("DetectFastPatternTest231", DetectFastPatternTest231, 1);
  16239. UtRegisterTest("DetectFastPatternTest232", DetectFastPatternTest232, 1);
  16240. UtRegisterTest("DetectFastPatternTest233", DetectFastPatternTest233, 1);
  16241. UtRegisterTest("DetectFastPatternTest234", DetectFastPatternTest234, 1);
  16242. UtRegisterTest("DetectFastPatternTest235", DetectFastPatternTest235, 1);
  16243. UtRegisterTest("DetectFastPatternTest236", DetectFastPatternTest236, 1);
  16244. UtRegisterTest("DetectFastPatternTest237", DetectFastPatternTest237, 1);
  16245. UtRegisterTest("DetectFastPatternTest238", DetectFastPatternTest238, 1);
  16246. UtRegisterTest("DetectFastPatternTest239", DetectFastPatternTest239, 1);
  16247. UtRegisterTest("DetectFastPatternTest240", DetectFastPatternTest240, 1);
  16248. UtRegisterTest("DetectFastPatternTest241", DetectFastPatternTest241, 1);
  16249. UtRegisterTest("DetectFastPatternTest242", DetectFastPatternTest242, 1);
  16250. UtRegisterTest("DetectFastPatternTest243", DetectFastPatternTest243, 1);
  16251. UtRegisterTest("DetectFastPatternTest244", DetectFastPatternTest244, 1);
  16252. UtRegisterTest("DetectFastPatternTest245", DetectFastPatternTest245, 1);
  16253. UtRegisterTest("DetectFastPatternTest246", DetectFastPatternTest246, 1);
  16254. UtRegisterTest("DetectFastPatternTest247", DetectFastPatternTest247, 1);
  16255. UtRegisterTest("DetectFastPatternTest248", DetectFastPatternTest248, 1);
  16256. UtRegisterTest("DetectFastPatternTest249", DetectFastPatternTest249, 1);
  16257. UtRegisterTest("DetectFastPatternTest250", DetectFastPatternTest250, 1);
  16258. UtRegisterTest("DetectFastPatternTest251", DetectFastPatternTest251, 1);
  16259. UtRegisterTest("DetectFastPatternTest252", DetectFastPatternTest252, 1);
  16260. UtRegisterTest("DetectFastPatternTest253", DetectFastPatternTest253, 1);
  16261. UtRegisterTest("DetectFastPatternTest254", DetectFastPatternTest254, 1);
  16262. UtRegisterTest("DetectFastPatternTest255", DetectFastPatternTest255, 1);
  16263. UtRegisterTest("DetectFastPatternTest256", DetectFastPatternTest256, 1);
  16264. UtRegisterTest("DetectFastPatternTest257", DetectFastPatternTest257, 1);
  16265. UtRegisterTest("DetectFastPatternTest258", DetectFastPatternTest258, 1);
  16266. UtRegisterTest("DetectFastPatternTest259", DetectFastPatternTest259, 1);
  16267. UtRegisterTest("DetectFastPatternTest260", DetectFastPatternTest260, 1);
  16268. /* http_raw_header fast_pattern tests ^ */
  16269. /* http_method fast_pattern tests v */
  16270. UtRegisterTest("DetectFastPatternTest261", DetectFastPatternTest261, 1);
  16271. UtRegisterTest("DetectFastPatternTest262", DetectFastPatternTest262, 1);
  16272. UtRegisterTest("DetectFastPatternTest263", DetectFastPatternTest263, 1);
  16273. UtRegisterTest("DetectFastPatternTest264", DetectFastPatternTest264, 1);
  16274. UtRegisterTest("DetectFastPatternTest265", DetectFastPatternTest265, 1);
  16275. UtRegisterTest("DetectFastPatternTest266", DetectFastPatternTest266, 1);
  16276. UtRegisterTest("DetectFastPatternTest267", DetectFastPatternTest267, 1);
  16277. UtRegisterTest("DetectFastPatternTest268", DetectFastPatternTest268, 1);
  16278. UtRegisterTest("DetectFastPatternTest269", DetectFastPatternTest269, 1);
  16279. UtRegisterTest("DetectFastPatternTest270", DetectFastPatternTest270, 1);
  16280. UtRegisterTest("DetectFastPatternTest271", DetectFastPatternTest271, 1);
  16281. UtRegisterTest("DetectFastPatternTest272", DetectFastPatternTest272, 1);
  16282. UtRegisterTest("DetectFastPatternTest273", DetectFastPatternTest273, 1);
  16283. UtRegisterTest("DetectFastPatternTest274", DetectFastPatternTest274, 1);
  16284. UtRegisterTest("DetectFastPatternTest275", DetectFastPatternTest275, 1);
  16285. UtRegisterTest("DetectFastPatternTest276", DetectFastPatternTest276, 1);
  16286. UtRegisterTest("DetectFastPatternTest277", DetectFastPatternTest277, 1);
  16287. UtRegisterTest("DetectFastPatternTest278", DetectFastPatternTest278, 1);
  16288. UtRegisterTest("DetectFastPatternTest279", DetectFastPatternTest279, 1);
  16289. UtRegisterTest("DetectFastPatternTest280", DetectFastPatternTest280, 1);
  16290. UtRegisterTest("DetectFastPatternTest281", DetectFastPatternTest281, 1);
  16291. UtRegisterTest("DetectFastPatternTest282", DetectFastPatternTest282, 1);
  16292. UtRegisterTest("DetectFastPatternTest283", DetectFastPatternTest283, 1);
  16293. UtRegisterTest("DetectFastPatternTest284", DetectFastPatternTest284, 1);
  16294. UtRegisterTest("DetectFastPatternTest285", DetectFastPatternTest285, 1);
  16295. UtRegisterTest("DetectFastPatternTest286", DetectFastPatternTest286, 1);
  16296. UtRegisterTest("DetectFastPatternTest287", DetectFastPatternTest287, 1);
  16297. UtRegisterTest("DetectFastPatternTest288", DetectFastPatternTest288, 1);
  16298. UtRegisterTest("DetectFastPatternTest289", DetectFastPatternTest289, 1);
  16299. UtRegisterTest("DetectFastPatternTest290", DetectFastPatternTest290, 1);
  16300. UtRegisterTest("DetectFastPatternTest291", DetectFastPatternTest291, 1);
  16301. UtRegisterTest("DetectFastPatternTest292", DetectFastPatternTest292, 1);
  16302. UtRegisterTest("DetectFastPatternTest293", DetectFastPatternTest293, 1);
  16303. UtRegisterTest("DetectFastPatternTest294", DetectFastPatternTest294, 1);
  16304. UtRegisterTest("DetectFastPatternTest295", DetectFastPatternTest295, 1);
  16305. UtRegisterTest("DetectFastPatternTest296", DetectFastPatternTest296, 1);
  16306. UtRegisterTest("DetectFastPatternTest297", DetectFastPatternTest297, 1);
  16307. UtRegisterTest("DetectFastPatternTest298", DetectFastPatternTest298, 1);
  16308. UtRegisterTest("DetectFastPatternTest299", DetectFastPatternTest299, 1);
  16309. UtRegisterTest("DetectFastPatternTest300", DetectFastPatternTest300, 1);
  16310. UtRegisterTest("DetectFastPatternTest301", DetectFastPatternTest301, 1);
  16311. /* http_method fast_pattern tests ^ */
  16312. /* http_cookie fast_pattern tests v */
  16313. UtRegisterTest("DetectFastPatternTest302", DetectFastPatternTest302, 1);
  16314. UtRegisterTest("DetectFastPatternTest303", DetectFastPatternTest303, 1);
  16315. UtRegisterTest("DetectFastPatternTest304", DetectFastPatternTest304, 1);
  16316. UtRegisterTest("DetectFastPatternTest305", DetectFastPatternTest305, 1);
  16317. UtRegisterTest("DetectFastPatternTest306", DetectFastPatternTest306, 1);
  16318. UtRegisterTest("DetectFastPatternTest307", DetectFastPatternTest307, 1);
  16319. UtRegisterTest("DetectFastPatternTest308", DetectFastPatternTest308, 1);
  16320. UtRegisterTest("DetectFastPatternTest309", DetectFastPatternTest309, 1);
  16321. UtRegisterTest("DetectFastPatternTest310", DetectFastPatternTest310, 1);
  16322. UtRegisterTest("DetectFastPatternTest311", DetectFastPatternTest311, 1);
  16323. UtRegisterTest("DetectFastPatternTest312", DetectFastPatternTest312, 1);
  16324. UtRegisterTest("DetectFastPatternTest313", DetectFastPatternTest313, 1);
  16325. UtRegisterTest("DetectFastPatternTest314", DetectFastPatternTest314, 1);
  16326. UtRegisterTest("DetectFastPatternTest315", DetectFastPatternTest315, 1);
  16327. UtRegisterTest("DetectFastPatternTest316", DetectFastPatternTest316, 1);
  16328. UtRegisterTest("DetectFastPatternTest317", DetectFastPatternTest317, 1);
  16329. UtRegisterTest("DetectFastPatternTest318", DetectFastPatternTest318, 1);
  16330. UtRegisterTest("DetectFastPatternTest319", DetectFastPatternTest319, 1);
  16331. UtRegisterTest("DetectFastPatternTest320", DetectFastPatternTest320, 1);
  16332. UtRegisterTest("DetectFastPatternTest321", DetectFastPatternTest321, 1);
  16333. UtRegisterTest("DetectFastPatternTest322", DetectFastPatternTest322, 1);
  16334. UtRegisterTest("DetectFastPatternTest323", DetectFastPatternTest323, 1);
  16335. UtRegisterTest("DetectFastPatternTest324", DetectFastPatternTest324, 1);
  16336. UtRegisterTest("DetectFastPatternTest325", DetectFastPatternTest325, 1);
  16337. UtRegisterTest("DetectFastPatternTest326", DetectFastPatternTest326, 1);
  16338. UtRegisterTest("DetectFastPatternTest327", DetectFastPatternTest327, 1);
  16339. UtRegisterTest("DetectFastPatternTest328", DetectFastPatternTest328, 1);
  16340. UtRegisterTest("DetectFastPatternTest329", DetectFastPatternTest329, 1);
  16341. UtRegisterTest("DetectFastPatternTest330", DetectFastPatternTest330, 1);
  16342. UtRegisterTest("DetectFastPatternTest331", DetectFastPatternTest331, 1);
  16343. UtRegisterTest("DetectFastPatternTest332", DetectFastPatternTest332, 1);
  16344. UtRegisterTest("DetectFastPatternTest333", DetectFastPatternTest333, 1);
  16345. UtRegisterTest("DetectFastPatternTest334", DetectFastPatternTest334, 1);
  16346. UtRegisterTest("DetectFastPatternTest335", DetectFastPatternTest335, 1);
  16347. UtRegisterTest("DetectFastPatternTest336", DetectFastPatternTest336, 1);
  16348. UtRegisterTest("DetectFastPatternTest337", DetectFastPatternTest337, 1);
  16349. UtRegisterTest("DetectFastPatternTest338", DetectFastPatternTest338, 1);
  16350. UtRegisterTest("DetectFastPatternTest339", DetectFastPatternTest339, 1);
  16351. UtRegisterTest("DetectFastPatternTest340", DetectFastPatternTest340, 1);
  16352. UtRegisterTest("DetectFastPatternTest341", DetectFastPatternTest341, 1);
  16353. UtRegisterTest("DetectFastPatternTest342", DetectFastPatternTest342, 1);
  16354. /* http_cookie fast_pattern tests ^ */
  16355. /* http_raw_uri fast_pattern tests v */
  16356. UtRegisterTest("DetectFastPatternTest343", DetectFastPatternTest343, 1);
  16357. UtRegisterTest("DetectFastPatternTest344", DetectFastPatternTest344, 1);
  16358. UtRegisterTest("DetectFastPatternTest345", DetectFastPatternTest345, 1);
  16359. UtRegisterTest("DetectFastPatternTest346", DetectFastPatternTest346, 1);
  16360. UtRegisterTest("DetectFastPatternTest347", DetectFastPatternTest347, 1);
  16361. UtRegisterTest("DetectFastPatternTest348", DetectFastPatternTest348, 1);
  16362. UtRegisterTest("DetectFastPatternTest349", DetectFastPatternTest349, 1);
  16363. UtRegisterTest("DetectFastPatternTest350", DetectFastPatternTest350, 1);
  16364. UtRegisterTest("DetectFastPatternTest351", DetectFastPatternTest351, 1);
  16365. UtRegisterTest("DetectFastPatternTest352", DetectFastPatternTest352, 1);
  16366. UtRegisterTest("DetectFastPatternTest353", DetectFastPatternTest353, 1);
  16367. UtRegisterTest("DetectFastPatternTest354", DetectFastPatternTest354, 1);
  16368. UtRegisterTest("DetectFastPatternTest355", DetectFastPatternTest355, 1);
  16369. UtRegisterTest("DetectFastPatternTest356", DetectFastPatternTest356, 1);
  16370. UtRegisterTest("DetectFastPatternTest357", DetectFastPatternTest357, 1);
  16371. UtRegisterTest("DetectFastPatternTest358", DetectFastPatternTest358, 1);
  16372. UtRegisterTest("DetectFastPatternTest359", DetectFastPatternTest359, 1);
  16373. UtRegisterTest("DetectFastPatternTest360", DetectFastPatternTest360, 1);
  16374. UtRegisterTest("DetectFastPatternTest361", DetectFastPatternTest361, 1);
  16375. UtRegisterTest("DetectFastPatternTest362", DetectFastPatternTest362, 1);
  16376. UtRegisterTest("DetectFastPatternTest363", DetectFastPatternTest363, 1);
  16377. UtRegisterTest("DetectFastPatternTest364", DetectFastPatternTest364, 1);
  16378. UtRegisterTest("DetectFastPatternTest365", DetectFastPatternTest365, 1);
  16379. UtRegisterTest("DetectFastPatternTest366", DetectFastPatternTest366, 1);
  16380. UtRegisterTest("DetectFastPatternTest367", DetectFastPatternTest367, 1);
  16381. UtRegisterTest("DetectFastPatternTest368", DetectFastPatternTest368, 1);
  16382. UtRegisterTest("DetectFastPatternTest369", DetectFastPatternTest369, 1);
  16383. UtRegisterTest("DetectFastPatternTest370", DetectFastPatternTest370, 1);
  16384. UtRegisterTest("DetectFastPatternTest371", DetectFastPatternTest371, 1);
  16385. UtRegisterTest("DetectFastPatternTest372", DetectFastPatternTest372, 1);
  16386. UtRegisterTest("DetectFastPatternTest373", DetectFastPatternTest373, 1);
  16387. UtRegisterTest("DetectFastPatternTest374", DetectFastPatternTest374, 1);
  16388. UtRegisterTest("DetectFastPatternTest375", DetectFastPatternTest375, 1);
  16389. UtRegisterTest("DetectFastPatternTest376", DetectFastPatternTest376, 1);
  16390. UtRegisterTest("DetectFastPatternTest377", DetectFastPatternTest377, 1);
  16391. UtRegisterTest("DetectFastPatternTest378", DetectFastPatternTest378, 1);
  16392. UtRegisterTest("DetectFastPatternTest379", DetectFastPatternTest379, 1);
  16393. UtRegisterTest("DetectFastPatternTest380", DetectFastPatternTest380, 1);
  16394. UtRegisterTest("DetectFastPatternTest381", DetectFastPatternTest381, 1);
  16395. UtRegisterTest("DetectFastPatternTest382", DetectFastPatternTest382, 1);
  16396. UtRegisterTest("DetectFastPatternTest383", DetectFastPatternTest383, 1);
  16397. /* http_raw_uri fast_pattern tests ^ */
  16398. /* http_stat_msg fast_pattern tests v */
  16399. UtRegisterTest("DetectFastPatternTest384", DetectFastPatternTest384, 1);
  16400. UtRegisterTest("DetectFastPatternTest385", DetectFastPatternTest385, 1);
  16401. UtRegisterTest("DetectFastPatternTest386", DetectFastPatternTest386, 1);
  16402. UtRegisterTest("DetectFastPatternTest387", DetectFastPatternTest387, 1);
  16403. UtRegisterTest("DetectFastPatternTest388", DetectFastPatternTest388, 1);
  16404. UtRegisterTest("DetectFastPatternTest389", DetectFastPatternTest389, 1);
  16405. UtRegisterTest("DetectFastPatternTest390", DetectFastPatternTest390, 1);
  16406. UtRegisterTest("DetectFastPatternTest391", DetectFastPatternTest391, 1);
  16407. UtRegisterTest("DetectFastPatternTest392", DetectFastPatternTest392, 1);
  16408. UtRegisterTest("DetectFastPatternTest393", DetectFastPatternTest393, 1);
  16409. UtRegisterTest("DetectFastPatternTest394", DetectFastPatternTest394, 1);
  16410. UtRegisterTest("DetectFastPatternTest395", DetectFastPatternTest395, 1);
  16411. UtRegisterTest("DetectFastPatternTest396", DetectFastPatternTest396, 1);
  16412. UtRegisterTest("DetectFastPatternTest397", DetectFastPatternTest397, 1);
  16413. UtRegisterTest("DetectFastPatternTest398", DetectFastPatternTest398, 1);
  16414. UtRegisterTest("DetectFastPatternTest399", DetectFastPatternTest399, 1);
  16415. UtRegisterTest("DetectFastPatternTest400", DetectFastPatternTest400, 1);
  16416. UtRegisterTest("DetectFastPatternTest401", DetectFastPatternTest401, 1);
  16417. UtRegisterTest("DetectFastPatternTest402", DetectFastPatternTest402, 1);
  16418. UtRegisterTest("DetectFastPatternTest403", DetectFastPatternTest403, 1);
  16419. UtRegisterTest("DetectFastPatternTest404", DetectFastPatternTest404, 1);
  16420. UtRegisterTest("DetectFastPatternTest405", DetectFastPatternTest405, 1);
  16421. UtRegisterTest("DetectFastPatternTest406", DetectFastPatternTest406, 1);
  16422. UtRegisterTest("DetectFastPatternTest407", DetectFastPatternTest407, 1);
  16423. UtRegisterTest("DetectFastPatternTest408", DetectFastPatternTest408, 1);
  16424. UtRegisterTest("DetectFastPatternTest409", DetectFastPatternTest409, 1);
  16425. UtRegisterTest("DetectFastPatternTest410", DetectFastPatternTest410, 1);
  16426. UtRegisterTest("DetectFastPatternTest411", DetectFastPatternTest411, 1);
  16427. UtRegisterTest("DetectFastPatternTest412", DetectFastPatternTest412, 1);
  16428. UtRegisterTest("DetectFastPatternTest413", DetectFastPatternTest413, 1);
  16429. UtRegisterTest("DetectFastPatternTest414", DetectFastPatternTest414, 1);
  16430. UtRegisterTest("DetectFastPatternTest415", DetectFastPatternTest415, 1);
  16431. UtRegisterTest("DetectFastPatternTest416", DetectFastPatternTest415, 1);
  16432. UtRegisterTest("DetectFastPatternTest417", DetectFastPatternTest417, 1);
  16433. UtRegisterTest("DetectFastPatternTest418", DetectFastPatternTest418, 1);
  16434. UtRegisterTest("DetectFastPatternTest419", DetectFastPatternTest419, 1);
  16435. UtRegisterTest("DetectFastPatternTest420", DetectFastPatternTest420, 1);
  16436. UtRegisterTest("DetectFastPatternTest421", DetectFastPatternTest421, 1);
  16437. UtRegisterTest("DetectFastPatternTest422", DetectFastPatternTest422, 1);
  16438. UtRegisterTest("DetectFastPatternTest423", DetectFastPatternTest423, 1);
  16439. UtRegisterTest("DetectFastPatternTest424", DetectFastPatternTest424, 1);
  16440. /* http_stat_msg fast_pattern tests ^ */
  16441. /* http_stat_code fast_pattern tests v */
  16442. UtRegisterTest("DetectFastPatternTest425", DetectFastPatternTest425, 1);
  16443. UtRegisterTest("DetectFastPatternTest426", DetectFastPatternTest426, 1);
  16444. UtRegisterTest("DetectFastPatternTest427", DetectFastPatternTest427, 1);
  16445. UtRegisterTest("DetectFastPatternTest428", DetectFastPatternTest428, 1);
  16446. UtRegisterTest("DetectFastPatternTest429", DetectFastPatternTest429, 1);
  16447. UtRegisterTest("DetectFastPatternTest430", DetectFastPatternTest430, 1);
  16448. UtRegisterTest("DetectFastPatternTest431", DetectFastPatternTest431, 1);
  16449. UtRegisterTest("DetectFastPatternTest432", DetectFastPatternTest432, 1);
  16450. UtRegisterTest("DetectFastPatternTest433", DetectFastPatternTest433, 1);
  16451. UtRegisterTest("DetectFastPatternTest434", DetectFastPatternTest434, 1);
  16452. UtRegisterTest("DetectFastPatternTest435", DetectFastPatternTest435, 1);
  16453. UtRegisterTest("DetectFastPatternTest436", DetectFastPatternTest436, 1);
  16454. UtRegisterTest("DetectFastPatternTest437", DetectFastPatternTest437, 1);
  16455. UtRegisterTest("DetectFastPatternTest438", DetectFastPatternTest438, 1);
  16456. UtRegisterTest("DetectFastPatternTest439", DetectFastPatternTest439, 1);
  16457. UtRegisterTest("DetectFastPatternTest440", DetectFastPatternTest440, 1);
  16458. UtRegisterTest("DetectFastPatternTest441", DetectFastPatternTest441, 1);
  16459. UtRegisterTest("DetectFastPatternTest442", DetectFastPatternTest442, 1);
  16460. UtRegisterTest("DetectFastPatternTest443", DetectFastPatternTest443, 1);
  16461. UtRegisterTest("DetectFastPatternTest444", DetectFastPatternTest444, 1);
  16462. UtRegisterTest("DetectFastPatternTest445", DetectFastPatternTest445, 1);
  16463. UtRegisterTest("DetectFastPatternTest446", DetectFastPatternTest446, 1);
  16464. UtRegisterTest("DetectFastPatternTest447", DetectFastPatternTest447, 1);
  16465. UtRegisterTest("DetectFastPatternTest448", DetectFastPatternTest448, 1);
  16466. UtRegisterTest("DetectFastPatternTest449", DetectFastPatternTest449, 1);
  16467. UtRegisterTest("DetectFastPatternTest450", DetectFastPatternTest450, 1);
  16468. UtRegisterTest("DetectFastPatternTest451", DetectFastPatternTest451, 1);
  16469. UtRegisterTest("DetectFastPatternTest452", DetectFastPatternTest452, 1);
  16470. UtRegisterTest("DetectFastPatternTest453", DetectFastPatternTest453, 1);
  16471. UtRegisterTest("DetectFastPatternTest454", DetectFastPatternTest454, 1);
  16472. UtRegisterTest("DetectFastPatternTest455", DetectFastPatternTest455, 1);
  16473. UtRegisterTest("DetectFastPatternTest456", DetectFastPatternTest456, 1);
  16474. UtRegisterTest("DetectFastPatternTest457", DetectFastPatternTest457, 1);
  16475. UtRegisterTest("DetectFastPatternTest458", DetectFastPatternTest458, 1);
  16476. UtRegisterTest("DetectFastPatternTest459", DetectFastPatternTest459, 1);
  16477. UtRegisterTest("DetectFastPatternTest460", DetectFastPatternTest460, 1);
  16478. UtRegisterTest("DetectFastPatternTest461", DetectFastPatternTest461, 1);
  16479. UtRegisterTest("DetectFastPatternTest462", DetectFastPatternTest462, 1);
  16480. UtRegisterTest("DetectFastPatternTest463", DetectFastPatternTest463, 1);
  16481. UtRegisterTest("DetectFastPatternTest464", DetectFastPatternTest464, 1);
  16482. UtRegisterTest("DetectFastPatternTest465", DetectFastPatternTest465, 1);
  16483. /* http_stat_code fast_pattern tests ^ */
  16484. /* http_server_body fast_pattern tests v */
  16485. UtRegisterTest("DetectFastPatternTest466", DetectFastPatternTest466, 1);
  16486. UtRegisterTest("DetectFastPatternTest467", DetectFastPatternTest467, 1);
  16487. UtRegisterTest("DetectFastPatternTest468", DetectFastPatternTest468, 1);
  16488. UtRegisterTest("DetectFastPatternTest469", DetectFastPatternTest469, 1);
  16489. UtRegisterTest("DetectFastPatternTest470", DetectFastPatternTest470, 1);
  16490. UtRegisterTest("DetectFastPatternTest471", DetectFastPatternTest471, 1);
  16491. UtRegisterTest("DetectFastPatternTest472", DetectFastPatternTest472, 1);
  16492. UtRegisterTest("DetectFastPatternTest473", DetectFastPatternTest473, 1);
  16493. UtRegisterTest("DetectFastPatternTest474", DetectFastPatternTest474, 1);
  16494. UtRegisterTest("DetectFastPatternTest475", DetectFastPatternTest475, 1);
  16495. UtRegisterTest("DetectFastPatternTest476", DetectFastPatternTest476, 1);
  16496. UtRegisterTest("DetectFastPatternTest477", DetectFastPatternTest477, 1);
  16497. UtRegisterTest("DetectFastPatternTest478", DetectFastPatternTest478, 1);
  16498. UtRegisterTest("DetectFastPatternTest479", DetectFastPatternTest479, 1);
  16499. UtRegisterTest("DetectFastPatternTest480", DetectFastPatternTest480, 1);
  16500. UtRegisterTest("DetectFastPatternTest481", DetectFastPatternTest481, 1);
  16501. UtRegisterTest("DetectFastPatternTest482", DetectFastPatternTest482, 1);
  16502. UtRegisterTest("DetectFastPatternTest483", DetectFastPatternTest483, 1);
  16503. UtRegisterTest("DetectFastPatternTest484", DetectFastPatternTest484, 1);
  16504. UtRegisterTest("DetectFastPatternTest485", DetectFastPatternTest485, 1);
  16505. UtRegisterTest("DetectFastPatternTest486", DetectFastPatternTest486, 1);
  16506. UtRegisterTest("DetectFastPatternTest487", DetectFastPatternTest487, 1);
  16507. UtRegisterTest("DetectFastPatternTest488", DetectFastPatternTest488, 1);
  16508. UtRegisterTest("DetectFastPatternTest489", DetectFastPatternTest489, 1);
  16509. UtRegisterTest("DetectFastPatternTest490", DetectFastPatternTest490, 1);
  16510. UtRegisterTest("DetectFastPatternTest491", DetectFastPatternTest491, 1);
  16511. UtRegisterTest("DetectFastPatternTest492", DetectFastPatternTest492, 1);
  16512. UtRegisterTest("DetectFastPatternTest493", DetectFastPatternTest493, 1);
  16513. UtRegisterTest("DetectFastPatternTest494", DetectFastPatternTest494, 1);
  16514. UtRegisterTest("DetectFastPatternTest495", DetectFastPatternTest495, 1);
  16515. UtRegisterTest("DetectFastPatternTest496", DetectFastPatternTest496, 1);
  16516. UtRegisterTest("DetectFastPatternTest497", DetectFastPatternTest497, 1);
  16517. UtRegisterTest("DetectFastPatternTest498", DetectFastPatternTest498, 1);
  16518. UtRegisterTest("DetectFastPatternTest499", DetectFastPatternTest499, 1);
  16519. UtRegisterTest("DetectFastPatternTest500", DetectFastPatternTest500, 1);
  16520. UtRegisterTest("DetectFastPatternTest501", DetectFastPatternTest501, 1);
  16521. UtRegisterTest("DetectFastPatternTest502", DetectFastPatternTest502, 1);
  16522. UtRegisterTest("DetectFastPatternTest503", DetectFastPatternTest503, 1);
  16523. UtRegisterTest("DetectFastPatternTest504", DetectFastPatternTest504, 1);
  16524. UtRegisterTest("DetectFastPatternTest505", DetectFastPatternTest505, 1);
  16525. UtRegisterTest("DetectFastPatternTest506", DetectFastPatternTest506, 1);
  16526. /* http_server_body fast_pattern tests ^ */
  16527. /* file_data fast_pattern tests v */
  16528. UtRegisterTest("DetectFastPatternTest507", DetectFastPatternTest507, 1);
  16529. UtRegisterTest("DetectFastPatternTest508", DetectFastPatternTest508, 1);
  16530. UtRegisterTest("DetectFastPatternTest509", DetectFastPatternTest509, 1);
  16531. UtRegisterTest("DetectFastPatternTest510", DetectFastPatternTest510, 1);
  16532. UtRegisterTest("DetectFastPatternTest511", DetectFastPatternTest511, 1);
  16533. UtRegisterTest("DetectFastPatternTest512", DetectFastPatternTest512, 1);
  16534. UtRegisterTest("DetectFastPatternTest513", DetectFastPatternTest513, 1);
  16535. UtRegisterTest("DetectFastPatternTest514", DetectFastPatternTest514, 1);
  16536. UtRegisterTest("DetectFastPatternTest515", DetectFastPatternTest515, 1);
  16537. UtRegisterTest("DetectFastPatternTest516", DetectFastPatternTest516, 1);
  16538. UtRegisterTest("DetectFastPatternTest517", DetectFastPatternTest517, 1);
  16539. UtRegisterTest("DetectFastPatternTest518", DetectFastPatternTest518, 1);
  16540. UtRegisterTest("DetectFastPatternTest519", DetectFastPatternTest519, 1);
  16541. UtRegisterTest("DetectFastPatternTest520", DetectFastPatternTest520, 1);
  16542. UtRegisterTest("DetectFastPatternTest521", DetectFastPatternTest521, 1);
  16543. UtRegisterTest("DetectFastPatternTest522", DetectFastPatternTest522, 1);
  16544. UtRegisterTest("DetectFastPatternTest523", DetectFastPatternTest523, 1);
  16545. UtRegisterTest("DetectFastPatternTest524", DetectFastPatternTest524, 1);
  16546. UtRegisterTest("DetectFastPatternTest525", DetectFastPatternTest525, 1);
  16547. UtRegisterTest("DetectFastPatternTest526", DetectFastPatternTest526, 1);
  16548. UtRegisterTest("DetectFastPatternTest527", DetectFastPatternTest527, 1);
  16549. UtRegisterTest("DetectFastPatternTest528", DetectFastPatternTest528, 1);
  16550. UtRegisterTest("DetectFastPatternTest529", DetectFastPatternTest529, 1);
  16551. UtRegisterTest("DetectFastPatternTest530", DetectFastPatternTest530, 1);
  16552. UtRegisterTest("DetectFastPatternTest531", DetectFastPatternTest531, 1);
  16553. UtRegisterTest("DetectFastPatternTest532", DetectFastPatternTest532, 1);
  16554. UtRegisterTest("DetectFastPatternTest533", DetectFastPatternTest533, 1);
  16555. UtRegisterTest("DetectFastPatternTest534", DetectFastPatternTest534, 1);
  16556. UtRegisterTest("DetectFastPatternTest535", DetectFastPatternTest535, 1);
  16557. UtRegisterTest("DetectFastPatternTest536", DetectFastPatternTest536, 1);
  16558. UtRegisterTest("DetectFastPatternTest537", DetectFastPatternTest537, 1);
  16559. UtRegisterTest("DetectFastPatternTest538", DetectFastPatternTest538, 1);
  16560. UtRegisterTest("DetectFastPatternTest539", DetectFastPatternTest539, 1);
  16561. UtRegisterTest("DetectFastPatternTest540", DetectFastPatternTest540, 1);
  16562. UtRegisterTest("DetectFastPatternTest541", DetectFastPatternTest541, 1);
  16563. UtRegisterTest("DetectFastPatternTest542", DetectFastPatternTest542, 1);
  16564. UtRegisterTest("DetectFastPatternTest543", DetectFastPatternTest543, 1);
  16565. UtRegisterTest("DetectFastPatternTest544", DetectFastPatternTest544, 1);
  16566. UtRegisterTest("DetectFastPatternTest545", DetectFastPatternTest545, 1);
  16567. UtRegisterTest("DetectFastPatternTest546", DetectFastPatternTest546, 1);
  16568. UtRegisterTest("DetectFastPatternTest547", DetectFastPatternTest547, 1);
  16569. /* file_data fast_pattern tests ^ */
  16570. /* http_user_agent fast_pattern tests v */
  16571. UtRegisterTest("DetectFastPatternTest548", DetectFastPatternTest548, 1);
  16572. UtRegisterTest("DetectFastPatternTest549", DetectFastPatternTest549, 1);
  16573. UtRegisterTest("DetectFastPatternTest550", DetectFastPatternTest550, 1);
  16574. UtRegisterTest("DetectFastPatternTest551", DetectFastPatternTest551, 1);
  16575. UtRegisterTest("DetectFastPatternTest552", DetectFastPatternTest552, 1);
  16576. UtRegisterTest("DetectFastPatternTest553", DetectFastPatternTest553, 1);
  16577. UtRegisterTest("DetectFastPatternTest554", DetectFastPatternTest554, 1);
  16578. UtRegisterTest("DetectFastPatternTest555", DetectFastPatternTest555, 1);
  16579. UtRegisterTest("DetectFastPatternTest556", DetectFastPatternTest556, 1);
  16580. UtRegisterTest("DetectFastPatternTest557", DetectFastPatternTest557, 1);
  16581. UtRegisterTest("DetectFastPatternTest558", DetectFastPatternTest558, 1);
  16582. UtRegisterTest("DetectFastPatternTest559", DetectFastPatternTest559, 1);
  16583. UtRegisterTest("DetectFastPatternTest560", DetectFastPatternTest560, 1);
  16584. UtRegisterTest("DetectFastPatternTest561", DetectFastPatternTest561, 1);
  16585. UtRegisterTest("DetectFastPatternTest562", DetectFastPatternTest562, 1);
  16586. UtRegisterTest("DetectFastPatternTest563", DetectFastPatternTest563, 1);
  16587. UtRegisterTest("DetectFastPatternTest564", DetectFastPatternTest564, 1);
  16588. UtRegisterTest("DetectFastPatternTest565", DetectFastPatternTest565, 1);
  16589. UtRegisterTest("DetectFastPatternTest566", DetectFastPatternTest566, 1);
  16590. UtRegisterTest("DetectFastPatternTest567", DetectFastPatternTest567, 1);
  16591. UtRegisterTest("DetectFastPatternTest568", DetectFastPatternTest568, 1);
  16592. UtRegisterTest("DetectFastPatternTest569", DetectFastPatternTest569, 1);
  16593. UtRegisterTest("DetectFastPatternTest570", DetectFastPatternTest570, 1);
  16594. UtRegisterTest("DetectFastPatternTest571", DetectFastPatternTest571, 1);
  16595. UtRegisterTest("DetectFastPatternTest572", DetectFastPatternTest572, 1);
  16596. UtRegisterTest("DetectFastPatternTest573", DetectFastPatternTest573, 1);
  16597. UtRegisterTest("DetectFastPatternTest574", DetectFastPatternTest574, 1);
  16598. UtRegisterTest("DetectFastPatternTest575", DetectFastPatternTest575, 1);
  16599. UtRegisterTest("DetectFastPatternTest576", DetectFastPatternTest576, 1);
  16600. UtRegisterTest("DetectFastPatternTest577", DetectFastPatternTest577, 1);
  16601. UtRegisterTest("DetectFastPatternTest578", DetectFastPatternTest578, 1);
  16602. UtRegisterTest("DetectFastPatternTest579", DetectFastPatternTest579, 1);
  16603. UtRegisterTest("DetectFastPatternTest580", DetectFastPatternTest580, 1);
  16604. UtRegisterTest("DetectFastPatternTest581", DetectFastPatternTest581, 1);
  16605. UtRegisterTest("DetectFastPatternTest582", DetectFastPatternTest582, 1);
  16606. UtRegisterTest("DetectFastPatternTest583", DetectFastPatternTest583, 1);
  16607. UtRegisterTest("DetectFastPatternTest584", DetectFastPatternTest584, 1);
  16608. UtRegisterTest("DetectFastPatternTest585", DetectFastPatternTest585, 1);
  16609. UtRegisterTest("DetectFastPatternTest586", DetectFastPatternTest586, 1);
  16610. UtRegisterTest("DetectFastPatternTest587", DetectFastPatternTest587, 1);
  16611. UtRegisterTest("DetectFastPatternTest588", DetectFastPatternTest588, 1);
  16612. /* http_user_agent fast_pattern tests ^ */
  16613. /* http_host fast_pattern tests v */
  16614. UtRegisterTest("DetectFastPatternTest589", DetectFastPatternTest589, 1);
  16615. UtRegisterTest("DetectFastPatternTest590", DetectFastPatternTest590, 1);
  16616. UtRegisterTest("DetectFastPatternTest591", DetectFastPatternTest591, 1);
  16617. UtRegisterTest("DetectFastPatternTest592", DetectFastPatternTest592, 1);
  16618. UtRegisterTest("DetectFastPatternTest593", DetectFastPatternTest593, 1);
  16619. UtRegisterTest("DetectFastPatternTest594", DetectFastPatternTest594, 1);
  16620. UtRegisterTest("DetectFastPatternTest595", DetectFastPatternTest595, 1);
  16621. UtRegisterTest("DetectFastPatternTest596", DetectFastPatternTest596, 1);
  16622. UtRegisterTest("DetectFastPatternTest597", DetectFastPatternTest597, 1);
  16623. UtRegisterTest("DetectFastPatternTest598", DetectFastPatternTest598, 1);
  16624. UtRegisterTest("DetectFastPatternTest599", DetectFastPatternTest599, 1);
  16625. UtRegisterTest("DetectFastPatternTest600", DetectFastPatternTest600, 1);
  16626. UtRegisterTest("DetectFastPatternTest601", DetectFastPatternTest601, 1);
  16627. UtRegisterTest("DetectFastPatternTest602", DetectFastPatternTest602, 1);
  16628. UtRegisterTest("DetectFastPatternTest603", DetectFastPatternTest603, 1);
  16629. UtRegisterTest("DetectFastPatternTest604", DetectFastPatternTest604, 1);
  16630. UtRegisterTest("DetectFastPatternTest605", DetectFastPatternTest605, 1);
  16631. UtRegisterTest("DetectFastPatternTest606", DetectFastPatternTest606, 1);
  16632. UtRegisterTest("DetectFastPatternTest607", DetectFastPatternTest607, 1);
  16633. UtRegisterTest("DetectFastPatternTest608", DetectFastPatternTest608, 1);
  16634. UtRegisterTest("DetectFastPatternTest609", DetectFastPatternTest609, 1);
  16635. UtRegisterTest("DetectFastPatternTest610", DetectFastPatternTest610, 1);
  16636. UtRegisterTest("DetectFastPatternTest611", DetectFastPatternTest611, 1);
  16637. UtRegisterTest("DetectFastPatternTest612", DetectFastPatternTest612, 1);
  16638. UtRegisterTest("DetectFastPatternTest613", DetectFastPatternTest613, 1);
  16639. UtRegisterTest("DetectFastPatternTest614", DetectFastPatternTest614, 1);
  16640. UtRegisterTest("DetectFastPatternTest615", DetectFastPatternTest615, 1);
  16641. UtRegisterTest("DetectFastPatternTest616", DetectFastPatternTest616, 1);
  16642. UtRegisterTest("DetectFastPatternTest617", DetectFastPatternTest617, 1);
  16643. UtRegisterTest("DetectFastPatternTest618", DetectFastPatternTest618, 1);
  16644. UtRegisterTest("DetectFastPatternTest619", DetectFastPatternTest619, 1);
  16645. UtRegisterTest("DetectFastPatternTest620", DetectFastPatternTest620, 1);
  16646. UtRegisterTest("DetectFastPatternTest621", DetectFastPatternTest621, 1);
  16647. UtRegisterTest("DetectFastPatternTest622", DetectFastPatternTest622, 1);
  16648. UtRegisterTest("DetectFastPatternTest623", DetectFastPatternTest623, 1);
  16649. UtRegisterTest("DetectFastPatternTest624", DetectFastPatternTest624, 1);
  16650. UtRegisterTest("DetectFastPatternTest625", DetectFastPatternTest625, 1);
  16651. UtRegisterTest("DetectFastPatternTest626", DetectFastPatternTest626, 1);
  16652. UtRegisterTest("DetectFastPatternTest627", DetectFastPatternTest627, 1);
  16653. UtRegisterTest("DetectFastPatternTest628", DetectFastPatternTest628, 1);
  16654. UtRegisterTest("DetectFastPatternTest629", DetectFastPatternTest629, 1);
  16655. /* http_host fast_pattern tests ^ */
  16656. /* http_rawhost fast_pattern tests v */
  16657. UtRegisterTest("DetectFastPatternTest630", DetectFastPatternTest630, 1);
  16658. UtRegisterTest("DetectFastPatternTest631", DetectFastPatternTest631, 1);
  16659. UtRegisterTest("DetectFastPatternTest632", DetectFastPatternTest632, 1);
  16660. UtRegisterTest("DetectFastPatternTest633", DetectFastPatternTest633, 1);
  16661. UtRegisterTest("DetectFastPatternTest634", DetectFastPatternTest634, 1);
  16662. UtRegisterTest("DetectFastPatternTest635", DetectFastPatternTest635, 1);
  16663. UtRegisterTest("DetectFastPatternTest636", DetectFastPatternTest636, 1);
  16664. UtRegisterTest("DetectFastPatternTest637", DetectFastPatternTest637, 1);
  16665. UtRegisterTest("DetectFastPatternTest638", DetectFastPatternTest638, 1);
  16666. UtRegisterTest("DetectFastPatternTest639", DetectFastPatternTest639, 1);
  16667. UtRegisterTest("DetectFastPatternTest640", DetectFastPatternTest640, 1);
  16668. UtRegisterTest("DetectFastPatternTest641", DetectFastPatternTest641, 1);
  16669. UtRegisterTest("DetectFastPatternTest642", DetectFastPatternTest642, 1);
  16670. UtRegisterTest("DetectFastPatternTest643", DetectFastPatternTest643, 1);
  16671. UtRegisterTest("DetectFastPatternTest644", DetectFastPatternTest644, 1);
  16672. UtRegisterTest("DetectFastPatternTest645", DetectFastPatternTest645, 1);
  16673. UtRegisterTest("DetectFastPatternTest646", DetectFastPatternTest646, 1);
  16674. UtRegisterTest("DetectFastPatternTest647", DetectFastPatternTest647, 1);
  16675. UtRegisterTest("DetectFastPatternTest648", DetectFastPatternTest648, 1);
  16676. UtRegisterTest("DetectFastPatternTest649", DetectFastPatternTest649, 1);
  16677. UtRegisterTest("DetectFastPatternTest650", DetectFastPatternTest650, 1);
  16678. UtRegisterTest("DetectFastPatternTest651", DetectFastPatternTest651, 1);
  16679. UtRegisterTest("DetectFastPatternTest652", DetectFastPatternTest652, 1);
  16680. UtRegisterTest("DetectFastPatternTest653", DetectFastPatternTest653, 1);
  16681. UtRegisterTest("DetectFastPatternTest654", DetectFastPatternTest654, 1);
  16682. UtRegisterTest("DetectFastPatternTest655", DetectFastPatternTest655, 1);
  16683. UtRegisterTest("DetectFastPatternTest656", DetectFastPatternTest656, 1);
  16684. UtRegisterTest("DetectFastPatternTest657", DetectFastPatternTest657, 1);
  16685. UtRegisterTest("DetectFastPatternTest658", DetectFastPatternTest658, 1);
  16686. UtRegisterTest("DetectFastPatternTest659", DetectFastPatternTest659, 1);
  16687. UtRegisterTest("DetectFastPatternTest660", DetectFastPatternTest660, 1);
  16688. UtRegisterTest("DetectFastPatternTest661", DetectFastPatternTest661, 1);
  16689. UtRegisterTest("DetectFastPatternTest662", DetectFastPatternTest662, 1);
  16690. UtRegisterTest("DetectFastPatternTest663", DetectFastPatternTest663, 1);
  16691. UtRegisterTest("DetectFastPatternTest664", DetectFastPatternTest664, 1);
  16692. UtRegisterTest("DetectFastPatternTest665", DetectFastPatternTest665, 1);
  16693. UtRegisterTest("DetectFastPatternTest666", DetectFastPatternTest666, 1);
  16694. UtRegisterTest("DetectFastPatternTest667", DetectFastPatternTest667, 1);
  16695. UtRegisterTest("DetectFastPatternTest668", DetectFastPatternTest668, 1);
  16696. UtRegisterTest("DetectFastPatternTest669", DetectFastPatternTest669, 1);
  16697. UtRegisterTest("DetectFastPatternTest670", DetectFastPatternTest670, 1);
  16698. #endif
  16699. return;
  16700. }