Skip to content
Open
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 16 additions & 46 deletions src/detect-base64-data.c
Original file line number Diff line number Diff line change
Expand Up @@ -69,45 +69,25 @@ static int DetectBase64DataSetupTest01(void)
{
DetectEngineCtx *de_ctx = NULL;
SigMatch *sm;
int retval = 0;

de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
FAIL_IF_NULL(de_ctx);

de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert smtp any any -> any any (msg:\"DetectBase64DataSetupTest\"; "
"base64_decode; base64_data; content:\"content\"; sid:1; rev:1;)");
if (de_ctx->sig_list == NULL) {
printf("SigInit failed: ");
goto end;
}
FAIL_IF_NULL(de_ctx->sig_list);

sm = de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH];
if (sm == NULL) {
printf("DETECT_SM_LIST_PMATCH should not be NULL: ");
goto end;
}
if (sm->type != DETECT_BASE64_DECODE) {
printf("sm->type should be DETECT_BASE64_DECODE: ");
goto end;
}

if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_BASE64_DATA] == NULL) {
printf("DETECT_SM_LIST_BASE64_DATA should not be NULL: ");
goto end;
}

retval = 1;
end:
if (de_ctx != NULL) {
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
}
return retval;
FAIL_IF_NULL(sm);
FAIL_IF_NOT(sm->type == DETECT_BASE64_DECODE);
FAIL_IF_NULL(de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_BASE64_DATA]);

SigGroupCleanup(de_ctx);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

while doing these conversions a few other cleanups can be done:

  • declare variables on first use
  • remove calls to SigGroupCleanup and SigCleanSignatures (redundant as DetectEngineCtxFree handles this)
  • replace SigInit with DetectEngineAppendSig

Could you update these tests to incorporate this?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, I’ll get to it immediately.

SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
PASS;
}

/**
Expand All @@ -117,29 +97,19 @@ static int DetectBase64DataSetupTest01(void)
static int DetectBase64DataSetupTest04(void)
{
DetectEngineCtx *de_ctx = NULL;
int retval = 0;

de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
FAIL_IF_NULL(de_ctx);

de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert tcp any any -> any any (msg:\"some b64thing\"; flow:established,from_server; file_data; content:\"sometext\"; fast_pattern; base64_decode:relative; base64_data; content:\"foobar\"; nocase; tag:session,120,seconds; sid:1111111; rev:1;)");
if (de_ctx->sig_list == NULL) {
printf("SigInit failed: ");
goto end;
}
FAIL_IF_NULL(de_ctx->sig_list);

retval = 1;
end:
if (de_ctx != NULL) {
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
}
return retval;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
PASS;
}

static void DetectBase64DataRegisterTests(void)
Expand Down
Loading