Skip to content

Commit

Permalink
detect/parse: test sig parsing for more actions
Browse files Browse the repository at this point in the history
Our unittests were only covering sig parsing for alert actions. As in
environments without LibNet the reject action will not work, we must
ensure that our parser properly fails in such cases, instead of silently
accepting an unsupported action.

Added tests for the reject and drop action.

Task OISF#5496

(cherry picked from commit c81b78f)
  • Loading branch information
jufajardini authored and victorjulien committed Sep 1, 2022
1 parent 15ec088 commit d21d4c7
Showing 1 changed file with 34 additions and 0 deletions.
34 changes: 34 additions & 0 deletions src/detect-parse.c
Original file line number Diff line number Diff line change
Expand Up @@ -4151,6 +4151,38 @@ static int SigParseBidirWithSameSrcAndDest02(void)
PASS;
}

static int SigParseTestActionReject(void)
{
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);

Signature *sig = DetectEngineAppendSig(
de_ctx, "reject tcp 1.2.3.4 any -> !1.2.3.4 any (msg:\"SigParseTest01\"; sid:1;)");
#ifdef HAVE_LIBNET11
FAIL_IF_NULL(sig);
FAIL_IF_NOT((sig->action & (ACTION_DROP | ACTION_REJECT)) == (ACTION_DROP | ACTION_REJECT));
#else
FAIL_IF_NOT_NULL(sig);
#endif

DetectEngineCtxFree(de_ctx);
PASS;
}

static int SigParseTestActionDrop(void)
{
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);

Signature *sig = DetectEngineAppendSig(
de_ctx, "drop tcp 1.2.3.4 any -> !1.2.3.4 any (msg:\"SigParseTest01\"; sid:1;)");
FAIL_IF_NULL(sig);
FAIL_IF_NOT(sig->action & ACTION_DROP);

DetectEngineCtxFree(de_ctx);
PASS;
}

#endif /* UNITTESTS */

#ifdef UNITTESTS
Expand Down Expand Up @@ -4225,5 +4257,7 @@ void SigParseRegisterTests(void)
SigParseBidirWithSameSrcAndDest01);
UtRegisterTest("SigParseBidirWithSameSrcAndDest02",
SigParseBidirWithSameSrcAndDest02);
UtRegisterTest("SigParseTestActionReject", SigParseTestActionReject);
UtRegisterTest("SigParseTestActionDrop", SigParseTestActionDrop);
#endif /* UNITTESTS */
}

0 comments on commit d21d4c7

Please sign in to comment.