/**
* \brief Wrapper for DetectContentLongPatternMatchTest
*/
int DetectReplaceLongPatternMatchTestUDPWrp(char *sig, uint32_t sid, char *sig_rep, uint32_t sid_rep) {
int ret;
/** Real UDP DNS packet with a request A to a1.twimg.com
*/
uint8_t raw_eth_pkt[] = {
0x8c, 0xa9, 0x82, 0x75, 0x5d, 0x62, 0xb4, 0x07,
0xf9, 0xf3, 0xc7, 0x0a, 0x08, 0x00, 0x45, 0x00,
0x00, 0x3a, 0x92, 0x4f, 0x40, 0x00, 0x40, 0x11,
0x31, 0x1a, 0xc0, 0xa8, 0x00, 0x02, 0xc1, 0xbd,
0xf4, 0xe1, 0x3b, 0x7e, 0x00, 0x35, 0x00, 0x26,
0xcb, 0x81, 0x37, 0x62, 0x01, 0x00, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x61,
0x31, 0x05, 0x74, 0x77, 0x69, 0x6d, 0x67, 0x03,
0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01 };
uint8_t p[sizeof(raw_eth_pkt)];
uint16_t psize = sizeof(raw_eth_pkt);
int run_mode_backup = run_mode;
run_mode = RUNMODE_NFQ;
ret = DetectReplaceLongPatternMatchTest(raw_eth_pkt, (uint16_t)sizeof(raw_eth_pkt),
sig, sid, p, &psize);
if (ret == 1) {
SCLogDebug("replace: test1 phase1 ok: %" PRIuMAX" vs %d",(uintmax_t)sizeof(raw_eth_pkt),psize);
ret = DetectReplaceLongPatternMatchTest(p, psize, sig_rep, sid_rep, NULL, NULL);
}
run_mode = run_mode_backup;
return ret;
}
/**
* \brief Wrapper for DetectContentLongPatternMatchTest
*/
int DetectReplaceLongPatternMatchTestWrp(char *sig, uint32_t sid, char *sig_rep, uint32_t sid_rep)
{
int ret;
/** Real packet with the following tcp data:
* "Hi, this is a big test to check content matches of splitted"
* "patterns between multiple chunks!"
* (without quotes! :) )
*/
uint8_t raw_eth_pkt[] = {
0xff,0xff,0xff,0xff,0xff,0xff,0x00,0x00,
0x00,0x00,0x00,0x00,0x08,0x00,0x45,0x00,
0x00,0x85,0x00,0x01,0x00,0x00,0x40,0x06,
0x7c,0x70,0x7f,0x00,0x00,0x01,0x7f,0x00,
0x00,0x01,0x00,0x14,0x00,0x50,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x02,
0x20,0x00,0xc9,0xad,0x00,0x00,0x48,0x69,
0x2c,0x20,0x74,0x68,0x69,0x73,0x20,0x69,
0x73,0x20,0x61,0x20,0x62,0x69,0x67,0x20,
0x74,0x65,0x73,0x74,0x20,0x74,0x6f,0x20,
0x63,0x68,0x65,0x63,0x6b,0x20,0x63,0x6f,
0x6e,0x74,0x65,0x6e,0x74,0x20,0x6d,0x61,
0x74,0x63,0x68,0x65,0x73,0x20,0x6f,0x66,
0x20,0x73,0x70,0x6c,0x69,0x74,0x74,0x65,
0x64,0x20,0x70,0x61,0x74,0x74,0x65,0x72,
0x6e,0x73,0x20,0x62,0x65,0x74,0x77,0x65,
0x65,0x6e,0x20,0x6d,0x75,0x6c,0x74,0x69,
0x70,0x6c,0x65,0x20,0x63,0x68,0x75,0x6e,
0x6b,0x73,0x21 }; /* end raw_eth_pkt */
uint8_t p[sizeof(raw_eth_pkt)];
uint16_t psize = sizeof(raw_eth_pkt);
/* would be unittest */
int run_mode_backup = run_mode;
run_mode = RUNMODE_NFQ;
ret = DetectReplaceLongPatternMatchTest(raw_eth_pkt, (uint16_t)sizeof(raw_eth_pkt),
sig, sid, p, &psize);
if (ret == 1) {
SCLogDebug("replace: test1 phase1");
ret = DetectReplaceLongPatternMatchTest(p, psize, sig_rep, sid_rep, NULL, NULL);
}
run_mode = run_mode_backup;
return ret;
}
