aboutsummaryrefslogtreecommitdiffstats
path: root/framework/src/suricata/src/detect-detection-filter.c
diff options
context:
space:
mode:
Diffstat (limited to 'framework/src/suricata/src/detect-detection-filter.c')
-rw-r--r--framework/src/suricata/src/detect-detection-filter.c665
1 files changed, 0 insertions, 665 deletions
diff --git a/framework/src/suricata/src/detect-detection-filter.c b/framework/src/suricata/src/detect-detection-filter.c
deleted file mode 100644
index 7e1ee8bc..00000000
--- a/framework/src/suricata/src/detect-detection-filter.c
+++ /dev/null
@@ -1,665 +0,0 @@
-/* Copyright (C) 2007-2010 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/**
- * \file
- *
- * \author Gerardo Iglesias <iglesiasg@gmail.com>
- *
- * Implements the detection_filter keyword
- */
-
-#include "suricata-common.h"
-#include "suricata.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
-
-#include "host.h"
-
-#include "detect-detection-filter.h"
-#include "detect-threshold.h"
-#include "detect-parse.h"
-
-#include "util-byte.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-debug.h"
-
-#define TRACK_DST 1
-#define TRACK_SRC 2
-
-/**
- *\brief Regex for parsing our detection_filter options
- */
-#define PARSE_REGEX "^\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*,\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*,\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*$"
-
-static pcre *parse_regex;
-static pcre_extra *parse_regex_study;
-
-int DetectDetectionFilterMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *);
-static int DetectDetectionFilterSetup(DetectEngineCtx *, Signature *, char *);
-void DetectDetectionFilterRegisterTests(void);
-void DetectDetectionFilterFree(void *);
-
-/**
- * \brief Registration function for detection_filter: keyword
- */
-void DetectDetectionFilterRegister (void)
-{
- sigmatch_table[DETECT_DETECTION_FILTER].name = "detection_filter";
- sigmatch_table[DETECT_DETECTION_FILTER].desc = "alert on every match after a threshold has been reached";
- sigmatch_table[DETECT_DETECTION_FILTER].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule-Thresholding#detection_filter";
- sigmatch_table[DETECT_DETECTION_FILTER].Match = DetectDetectionFilterMatch;
- sigmatch_table[DETECT_DETECTION_FILTER].Setup = DetectDetectionFilterSetup;
- sigmatch_table[DETECT_DETECTION_FILTER].Free = DetectDetectionFilterFree;
- sigmatch_table[DETECT_DETECTION_FILTER].RegisterTests = DetectDetectionFilterRegisterTests;
- /* this is compatible to ip-only signatures */
- sigmatch_table[DETECT_DETECTION_FILTER].flags |= SIGMATCH_IPONLY_COMPAT;
-
- const char *eb;
- int eo;
- int opts = 0;
-
- parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL);
- if(parse_regex == NULL)
- {
- SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", PARSE_REGEX, eo, eb);
- goto error;
- }
-
- parse_regex_study = pcre_study(parse_regex, 0, &eb);
- if(eb != NULL)
- {
- SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
- goto error;
- }
- return;
-
-error:
- return;
-}
-
-int DetectDetectionFilterMatch (ThreadVars *thv, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx)
-{
- return 1;
-}
-
-/**
- * \internal
- * \brief This function is used to parse detection_filter options passed via detection_filter: keyword
- *
- * \param rawstr Pointer to the user provided detection_filter options
- *
- * \retval df pointer to DetectThresholdData on success
- * \retval NULL on failure
- */
-DetectThresholdData *DetectDetectionFilterParse (char *rawstr)
-{
- DetectThresholdData *df = NULL;
-#define MAX_SUBSTRINGS 30
- int ret = 0, res = 0;
- int ov[MAX_SUBSTRINGS];
- const char *str_ptr = NULL;
- char *args[6] = { NULL, NULL, NULL, NULL, NULL, NULL};
- char *copy_str = NULL, *df_opt = NULL;
- int seconds_found = 0, count_found = 0, track_found = 0;
- int seconds_pos = 0, count_pos = 0;
- uint16_t pos = 0;
- int i = 0;
- char *saveptr = NULL;
-
- copy_str = SCStrdup(rawstr);
- if (unlikely(copy_str == NULL)) {
- goto error;
- }
-
- for (pos = 0, df_opt = strtok_r(copy_str,",", &saveptr);
- pos < strlen(copy_str) && df_opt != NULL;
- pos++, df_opt = strtok_r(NULL,",", &saveptr))
- {
- if(strstr(df_opt,"count"))
- count_found++;
- if(strstr(df_opt,"second"))
- seconds_found++;
- if(strstr(df_opt,"track"))
- track_found++;
- }
- SCFree(copy_str);
- copy_str = NULL;
-
- if (count_found != 1 || seconds_found != 1 || track_found != 1)
- goto error;
-
- ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS);
- if (ret < 5) {
- SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, rawstr);
- goto error;
- }
-
- df = SCMalloc(sizeof(DetectThresholdData));
- if (unlikely(df == NULL))
- goto error;
-
- memset(df,0,sizeof(DetectThresholdData));
-
- df->type = TYPE_DETECTION;
-
- for (i = 0; i < (ret - 1); i++) {
- res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, i + 1, &str_ptr);
- if (res < 0) {
- SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
- goto error;
- }
-
- args[i] = (char *)str_ptr;
-
- if (strncasecmp(args[i],"by_dst",strlen("by_dst")) == 0)
- df->track = TRACK_DST;
- if (strncasecmp(args[i],"by_src",strlen("by_src")) == 0)
- df->track = TRACK_SRC;
- if (strncasecmp(args[i],"count",strlen("count")) == 0)
- count_pos = i+1;
- if (strncasecmp(args[i],"seconds",strlen("seconds")) == 0)
- seconds_pos = i+1;
- }
-
- if (args[count_pos] == NULL || args[seconds_pos] == NULL) {
- goto error;
- }
-
- if (ByteExtractStringUint32(&df->count, 10, strlen(args[count_pos]),
- args[count_pos]) <= 0) {
- goto error;
- }
-
- if (ByteExtractStringUint32(&df->seconds, 10, strlen(args[seconds_pos]),
- args[seconds_pos]) <= 0) {
- goto error;
- }
-
- if (df->count == 0 || df->seconds == 0) {
- SCLogError(SC_ERR_INVALID_VALUE, "found an invalid value");
- goto error;
- }
-
- for (i = 0; i < 6; i++){
- if (args[i] != NULL)
- SCFree(args[i]);
- }
- return df;
-
-error:
- for (i = 0; i < 6; i++){
- if (args[i] != NULL)
- SCFree(args[i]);
- }
- if (df != NULL)
- SCFree(df);
- return NULL;
-}
-
-/**
- * \internal
- * \brief this function is used to add the parsed detection_filter into the current signature
- *
- * \param de_ctx pointer to the Detection Engine Context
- * \param s pointer to the Current Signature
- * \param m pointer to the Current SigMatch
- * \param rawstr pointer to the user provided detection_filter options
- *
- * \retval 0 on Success
- * \retval -1 on Failure
- */
-int DetectDetectionFilterSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
-{
- SCEnter();
- DetectThresholdData *df = NULL;
- SigMatch *sm = NULL;
- SigMatch *tmpm = NULL;
-
- /* checks if there's a previous instance of threshold */
- tmpm = SigMatchGetLastSMFromLists(s, 2,
- DETECT_THRESHOLD, s->sm_lists_tail[DETECT_SM_LIST_MATCH]);
- if (tmpm != NULL) {
- SCLogError(SC_ERR_INVALID_SIGNATURE, "\"detection_filter\" and \"threshold\" are not allowed in the same rule");
- SCReturnInt(-1);
- }
- /* checks there's no previous instance of detection_filter */
- tmpm = SigMatchGetLastSMFromLists(s, 2,
- DETECT_DETECTION_FILTER, s->sm_lists_tail[DETECT_SM_LIST_MATCH]);
- if (tmpm != NULL) {
- SCLogError(SC_ERR_INVALID_SIGNATURE, "At most one \"detection_filter\" is allowed per rule");
- SCReturnInt(-1);
- }
-
- df = DetectDetectionFilterParse(rawstr);
- if (df == NULL)
- goto error;
-
- sm = SigMatchAlloc();
- if (sm == NULL)
- goto error;
-
- sm->type = DETECT_DETECTION_FILTER;
- sm->ctx = (SigMatchCtx *)df;
-
- SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD);
-
- return 0;
-
-error:
- if (df) SCFree(df);
- if (sm) SCFree(sm);
- return -1;
-}
-
-/**
- * \internal
- * \brief this function will free memory associated with DetectThresholdData
- *
- * \param df_ptr pointer to DetectDetectionFilterData
- */
-void DetectDetectionFilterFree(void *df_ptr)
-{
- DetectThresholdData *df = (DetectThresholdData *)df_ptr;
- if (df) SCFree(df);
-}
-
-/*
- * ONLY TESTS BELOW THIS COMMENT
- */
-#ifdef UNITTESTS
-
-#include "detect-parse.h"
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-threshold.h"
-#include "util-time.h"
-#include "util-hashlist.h"
-
-/**
- * \test DetectDetectionFilterTestParse01 is a test for a valid detection_filter options
- *
- * \retval 1 on succces
- * \retval 0 on failure
- */
-int DetectDetectionFilterTestParse01 (void)
-{
- DetectThresholdData *df = NULL;
- df = DetectDetectionFilterParse("track by_dst,count 10,seconds 60");
- if (df && (df->track == TRACK_DST) && (df->count == 10) && (df->seconds == 60)) {
- DetectDetectionFilterFree(df);
- return 1;
- }
-
- return 0;
-}
-
-/**
- * \test DetectDetectionFilterTestParse02 is a test for a invalid detection_filter options
- *
- * \retval 1 on succces
- * \retval 0 on failure
- */
-int DetectDetectionFilterTestParse02 (void)
-{
- DetectThresholdData *df = NULL;
- df = DetectDetectionFilterParse("track both,count 10,seconds 60");
- if (df && (df->track == TRACK_DST || df->track == TRACK_SRC) && (df->count == 10) && (df->seconds == 60)) {
- DetectDetectionFilterFree(df);
- return 1;
- }
-
- return 0;
-}
-
-/**
- * \test DetectDetectionfilterTestParse03 is a test for a valid detection_filter options in any order
- *
- * \retval 1 on succces
- * \retval 0 on failure
- */
-int DetectDetectionFilterTestParse03 (void)
-{
- DetectThresholdData *df = NULL;
- df = DetectDetectionFilterParse("track by_dst, seconds 60, count 10");
- if (df && (df->track == TRACK_DST) && (df->count == 10) && (df->seconds == 60)) {
- DetectDetectionFilterFree(df);
- return 1;
- }
-
- return 0;
-}
-
-
-/**
- * \test DetectDetectionFilterTestParse04 is a test for an invalid detection_filter options in any order
- *
- * \retval 1 on succces
- * \retval 0 on failure
- */
-int DetectDetectionFilterTestParse04 (void)
-{
- DetectThresholdData *df = NULL;
- df = DetectDetectionFilterParse("count 10, track by_dst, seconds 60, count 10");
- if (df && (df->track == TRACK_DST) && (df->count == 10) && (df->seconds == 60)) {
- DetectDetectionFilterFree(df);
- return 1;
- }
-
- return 0;
-}
-
-/**
- * \test DetectDetectionFilterTestParse05 is a test for a valid detection_filter options in any order
- *
- * \retval 1 on succces
- * \retval 0 on failure
- */
-int DetectDetectionFilterTestParse05 (void)
-{
- DetectThresholdData *df = NULL;
- df = DetectDetectionFilterParse("count 10, track by_dst, seconds 60");
- if (df && (df->track == TRACK_DST) && (df->count == 10) && (df->seconds == 60)) {
- DetectDetectionFilterFree(df);
- return 1;
- }
-
- return 0;
-}
-
-/**
- * \test DetectDetectionFilterTestParse06 is a test for an invalid value in detection_filter
- *
- * \retval 1 on succces
- * \retval 0 on failure
- */
-int DetectDetectionFilterTestParse06 (void)
-{
- DetectThresholdData *df = NULL;
- df = DetectDetectionFilterParse("count 10, track by_dst, seconds 0");
- if (df && (df->track == TRACK_DST) && (df->count == 10) && (df->seconds == 0)) {
- DetectDetectionFilterFree(df);
- return 1;
- }
-
- return 0;
-}
-
-/**
- * \test DetectDetectionFilterTestSig1 is a test for checking the working of detection_filter keyword
- * by setting up the signature and later testing its working by matching
- * the received packet against the sig.
- *
- * \retval 1 on succces
- * \retval 0 on failure
- */
-static int DetectDetectionFilterTestSig1(void)
-{
- Packet *p = NULL;
- Signature *s = NULL;
- ThreadVars th_v;
- DetectEngineThreadCtx *det_ctx;
- int result = 0;
- int alerts = 0;
-
- HostInitConfig(HOST_QUIET);
-
- memset(&th_v, 0, sizeof(th_v));
-
- p = UTHBuildPacketReal(NULL, 0, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80);
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL) {
- goto end;
- }
-
- de_ctx->flags |= DE_QUIET;
-
- s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"detection_filter Test\"; detection_filter: track by_dst, count 4, seconds 60; sid:1;)");
- if (s == NULL) {
- goto end;
- }
-
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
-
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts = PacketAlertCheck(p, 1);
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 1);
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 1);
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 1);
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 1);
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 1);
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 1);
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 1);
-
- if(alerts == 4)
- result = 1;
-
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
-
- DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
- DetectEngineCtxFree(de_ctx);
-
-end:
- UTHFreePackets(&p, 1);
- HostShutdown();
- return result;
-}
-
-/**
- * \test DetectDetectionFilterTestSig2 is a test for checking the working of detection_filter keyword
- * by setting up the signature and later testing its working by matching
- * the received packet against the sig.
- *
- * \retval 1 on succces
- * \retval 0 on failure
- */
-
-static int DetectDetectionFilterTestSig2(void)
-{
- Packet *p = NULL;
- Signature *s = NULL;
- ThreadVars th_v;
- DetectEngineThreadCtx *det_ctx;
- int result = 0;
- int alerts = 0;
- struct timeval ts;
-
- HostInitConfig(HOST_QUIET);
-
- memset (&ts, 0, sizeof(struct timeval));
- TimeGet(&ts);
-
- memset(&th_v, 0, sizeof(th_v));
-
- p = UTHBuildPacketReal(NULL, 0, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80);
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL) {
- goto end;
- }
-
- de_ctx->flags |= DE_QUIET;
-
- s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"detection_filter Test 2\"; detection_filter: track by_dst, count 4, seconds 60; sid:10;)");
- if (s == NULL) {
- goto end;
- }
-
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
-
- TimeGet(&p->ts);
-
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts = PacketAlertCheck(p, 10);
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 10);
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 10);
-
- TimeSetIncrementTime(200);
- TimeGet(&p->ts);
-
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 10);
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 10);
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 10);
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 10);
-
- if (alerts == 0)
- result = 1;
-
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
-
- DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
- DetectEngineCtxFree(de_ctx);
-end:
- UTHFreePackets(&p, 1);
- HostShutdown();
- return result;
-}
-
-/**
- * \test drops
- */
-static int DetectDetectionFilterTestSig3(void)
-{
- Packet *p = NULL;
- Signature *s = NULL;
- ThreadVars th_v;
- DetectEngineThreadCtx *det_ctx;
- int result = 0;
- int alerts = 0;
- int drops = 0;
- struct timeval ts;
-
- HostInitConfig(HOST_QUIET);
-
- memset (&ts, 0, sizeof(struct timeval));
- TimeGet(&ts);
-
- memset(&th_v, 0, sizeof(th_v));
-
- p = UTHBuildPacketReal(NULL, 0, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80);
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL) {
- goto end;
- }
-
- de_ctx->flags |= DE_QUIET;
-
- s = de_ctx->sig_list = SigInit(de_ctx,"drop tcp any any -> any 80 (msg:\"detection_filter Test 2\"; detection_filter: track by_dst, count 2, seconds 60; sid:10;)");
- if (s == NULL) {
- goto end;
- }
-
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
-
- TimeGet(&p->ts);
-
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts = PacketAlertCheck(p, 10);
- drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
- p->action = 0;
-
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 10);
- drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
- p->action = 0;
-
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 10);
- drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
- p->action = 0;
-
- TimeSetIncrementTime(200);
- TimeGet(&p->ts);
-
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 10);
- drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
- p->action = 0;
-
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 10);
- drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
- p->action = 0;
-
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 10);
- drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
- p->action = 0;
-
- SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
- alerts += PacketAlertCheck(p, 10);
- drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
- p->action = 0;
-
- if (alerts == 3 && drops == 3)
- result = 1;
- else {
- if (alerts != 3)
- printf("alerts: %d != 3: ", alerts);
- if (drops != 3)
- printf("drops: %d != 3: ", drops);
- }
-
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
-
- DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
- DetectEngineCtxFree(de_ctx);
-end:
- UTHFreePackets(&p, 1);
- HostShutdown();
- return result;
-}
-#endif /* UNITTESTS */
-
-void DetectDetectionFilterRegisterTests(void)
-{
-#ifdef UNITTESTS
- UtRegisterTest("DetectDetectionFilterTestParse01", DetectDetectionFilterTestParse01, 1);
- UtRegisterTest("DetectDetectionFilterTestParse02", DetectDetectionFilterTestParse02, 0);
- UtRegisterTest("DetectDetectionFilterTestParse03", DetectDetectionFilterTestParse03, 1);
- UtRegisterTest("DetectDetectionFilterTestParse04", DetectDetectionFilterTestParse04, 0);
- UtRegisterTest("DetectDetectionFilterTestParse05", DetectDetectionFilterTestParse05, 1);
- UtRegisterTest("DetectDetectionFilterTestParse06", DetectDetectionFilterTestParse06, 0);
- UtRegisterTest("DetectDetectionFilterTestSig1", DetectDetectionFilterTestSig1, 1);
- UtRegisterTest("DetectDetectionFilterTestSig2", DetectDetectionFilterTestSig2, 1);
- UtRegisterTest("DetectDetectionFilterTestSig3", DetectDetectionFilterTestSig3, 1);
-#endif /* UNITTESTS */
-}
-