4 * Copyright(c) 2010-2013 Intel Corporation. All rights reserved.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * * Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * * Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in
15 * the documentation and/or other materials provided with the
17 * * Neither the name of Intel Corporation nor the names of its
18 * contributors may be used to endorse or promote products derived
19 * from this software without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
24 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
25 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
26 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
27 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
31 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35 #ifndef TEST_PMAC_PM_H_
36 #define TEST_PMAC_PM_H_
43 * clean ASCII patterns
45 #define MAX_PATTERN_LEN 256
46 const char clean_patterns[][MAX_PATTERN_LEN] = {
48 "Bad command or filename",
53 "subject=FrEaK+SERVER",
55 "/scripts/WWPMsg.dll",
56 "body=JJ+BackDoor+-+v",
58 "subject=Insurrection+Page",
63 "# Nova CGI Notification Script",
64 /* test NOT converting to binary */
66 /* test adding same pattern twice - should result in two matches */
71 * mixed ASCII-binary patterns
73 const char mixed_patterns[][MAX_PATTERN_LEN] = {
74 "1 file|28|s|29| copied",
77 "|7C 32 33 7C 00|", /* gives |23| */
78 /* test converter not converting stuff erroneously */
84 * (P1 is used when having only one pattern)
86 const char P1_patterns[][MAX_PATTERN_LEN] = {
93 * BUFFERS TO LOOK PATTERNS IN
95 #define MAX_MATCH_COUNT 3
97 struct pm_test_buffer {
99 const char string[MAX_PATTERN_LEN];
100 /* strings that should be found marching.
101 * for our test we allow no more than 3 matches.
102 * the number is completely arbitrary */
103 const char * matched_str[MAX_MATCH_COUNT];
104 /* number of matches with and without case sensitivity */
106 uint8_t n_matches_with_case_sense;
109 struct pm_test_buffer clean_buffers[] = {
110 {"abcCommand completedcde",
111 {clean_patterns[0], NULL, NULL},
113 {"jsljelkwlefwe|23|igu5o0",
114 {clean_patterns[16], NULL, NULL},
116 {"Invalid URLwww.kOrnpUterS.comfRiEnD_niCKname=",
117 {clean_patterns[3], clean_patterns[14], clean_patterns[7]},
122 {"abcfrOmemail=y3kcde",
123 {clean_patterns[13], clean_patterns[17], NULL},
125 {"FANOUTsubject=FrEaK+SERVERFANOUT",
126 {clean_patterns[6], NULL, NULL},
128 {"Bad command or filenam",
131 {"Bad command or filename",
132 {clean_patterns[1], NULL, NULL},
134 {"845hyut8hji51 FILE(S) COPIED934ui45",
135 {clean_patterns[2], NULL, NULL},
137 {"HTTP/1.1 403IndEx of /cgi-bin/",
138 {clean_patterns[5], clean_patterns[4], NULL},
140 {"mail.php?subject=Mail&body=JJ+BackDoor+-+v&id=2357874",
141 {clean_patterns[9], NULL, NULL},
143 {"/var/www/site/scripts/WWPMsg.dll",
144 {clean_patterns[8], NULL, NULL},
146 {"backtrust.com/mail.cgi?subject=Insurrection+Page&body=JJ+BackDoor+-+v",
147 {clean_patterns[11], clean_patterns[10], clean_patterns[9]},
149 {"User-Agent: Mozilla/6.0 (Windows NT 6.2; WOW64; rv:16.0.1)",
150 {clean_patterns[12], NULL, NULL},
152 {"User-agent: Mozilla/6.0 (Windows NT 6.2; WOW64; rv:16.0.1)",
153 {clean_patterns[12], NULL, NULL},
155 {"http://www.kornputers.com/index.php",
156 {clean_patterns[14], NULL, NULL},
158 {"\r\n# Nova CGI Notification Script",
159 {clean_patterns[15], NULL, NULL},
161 {"\r\n# Nova CGI Notification Scrupt",
164 {"User Agent: Mozilla/6.0 (Windows NT 6.2; WOW64; rv:16.0.1)",
167 {"abcfromemail=y3dcde",
172 struct pm_test_buffer mixed_buffers[] = {
173 {"jsljelkwlefwe|23|igu5o0",
174 {mixed_patterns[3], NULL, NULL},
177 {mixed_patterns[1], NULL, NULL},
180 {mixed_patterns[2], NULL, NULL},
183 {mixed_patterns[1], NULL, NULL},
185 {"www.kornputers.com",
186 {mixed_patterns[4], NULL, NULL},
188 {"1 file(s) copied from www.kornputers.com ",
189 {mixed_patterns[0], mixed_patterns[4], NULL},
191 {"www.kornputers.com: 1 File(s) Copied",
192 {mixed_patterns[4], mixed_patterns[0], NULL},
195 {mixed_patterns[0], NULL, NULL},
201 {mixed_patterns[0], NULL, NULL},
203 {"iwrhf34890yuhh *Y89#9ireirgf",
204 {mixed_patterns[2], NULL, NULL},
208 struct pm_test_buffer P1_buffers[] = {
210 {P1_patterns[0], NULL, NULL},
213 {P1_patterns[0], NULL, NULL},
224 {"1111aA1111111111aA111111",
225 {P1_patterns[0], P1_patterns[0], NULL},
230 #endif /* TEST_PMAC_PM_H_ */