|
|
|
@ -47,8 +47,6 @@
|
|
|
|
|
|
|
|
|
|
/***********************************Unittests**********************************/
|
|
|
|
|
|
|
|
|
|
static int g_http_uri_buffer_id = 0;
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \test Test that the http_cookie content matches against a http request
|
|
|
|
|
* which holds the content.
|
|
|
|
@ -1670,143 +1668,6 @@ end:
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \test Checks if a http_cookie is registered in a Signature
|
|
|
|
|
*/
|
|
|
|
|
static int DetectHttpCookieTest03(void)
|
|
|
|
|
{
|
|
|
|
|
SigMatch *sm = NULL;
|
|
|
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
|
|
|
int result = 0;
|
|
|
|
|
|
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
|
|
|
"(msg:\"Testing http_cookie\"; content:\"one\"; "
|
|
|
|
|
"http_cookie; content:\"two\"; http_cookie; "
|
|
|
|
|
"content:\"two\"; http_cookie; "
|
|
|
|
|
"sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL) {
|
|
|
|
|
printf("sig parse failed: ");
|
|
|
|
|
goto end;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
result = 0;
|
|
|
|
|
sm = de_ctx->sig_list->sm_lists[g_http_cookie_buffer_id];
|
|
|
|
|
if (sm == NULL) {
|
|
|
|
|
printf("no sigmatch(es): ");
|
|
|
|
|
goto end;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
while (sm != NULL) {
|
|
|
|
|
if (sm->type == DETECT_CONTENT) {
|
|
|
|
|
result = 1;
|
|
|
|
|
} else {
|
|
|
|
|
printf("expected DETECT_CONTENT for http_cookie, got %d: ", sm->type);
|
|
|
|
|
goto end;
|
|
|
|
|
}
|
|
|
|
|
sm = sm->next;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
|
if (de_ctx != NULL)
|
|
|
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \test Checks if a http_cookie is registered in a Signature, when fast_pattern
|
|
|
|
|
* is also specified in the signature (now it should)
|
|
|
|
|
*/
|
|
|
|
|
static int DetectHttpCookieTest04(void)
|
|
|
|
|
{
|
|
|
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
|
|
|
int result = 0;
|
|
|
|
|
|
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
|
|
|
"(msg:\"Testing http_cookie\"; content:\"one\"; "
|
|
|
|
|
"fast_pattern; http_cookie; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list != NULL)
|
|
|
|
|
result = 1;
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
|
if (de_ctx != NULL) DetectEngineCtxFree(de_ctx);
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \test Checks if a http_cookie is registered in a Signature, when rawbytes is
|
|
|
|
|
* also specified in the signature
|
|
|
|
|
*/
|
|
|
|
|
static int DetectHttpCookieTest05(void)
|
|
|
|
|
{
|
|
|
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
|
|
|
int result = 0;
|
|
|
|
|
|
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
|
|
|
"(msg:\"Testing http_cookie\"; content:\"one\"; "
|
|
|
|
|
"rawbytes; http_cookie; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
result = 1;
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
|
if (de_ctx != NULL) DetectEngineCtxFree(de_ctx);
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \test Checks if a http_cookie is registered in a Signature, when rawbytes is
|
|
|
|
|
* also specified in the signature
|
|
|
|
|
*/
|
|
|
|
|
static int DetectHttpCookieTest06(void)
|
|
|
|
|
{
|
|
|
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
|
|
|
int result = 0;
|
|
|
|
|
|
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
|
|
|
"(msg:\"Testing http_cookie\"; content:\"one\"; "
|
|
|
|
|
"http_cookie; uricontent:\"abc\"; sid:1;)");
|
|
|
|
|
if (de_ctx->sig_list == NULL)
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
|
|
Signature *s = de_ctx->sig_list;
|
|
|
|
|
|
|
|
|
|
BUG_ON(s->sm_lists[g_http_cookie_buffer_id] == NULL);
|
|
|
|
|
|
|
|
|
|
if (s->sm_lists[g_http_cookie_buffer_id]->type != DETECT_CONTENT)
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
|
|
if (s->sm_lists[g_http_uri_buffer_id] == NULL) {
|
|
|
|
|
printf("expected another SigMatch, got NULL: ");
|
|
|
|
|
goto end;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (s->sm_lists[g_http_uri_buffer_id]->type != DETECT_CONTENT) {
|
|
|
|
|
goto end;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
result = 1;
|
|
|
|
|
end:
|
|
|
|
|
if (de_ctx != NULL) {
|
|
|
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
|
}
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/** \test Check the signature working to alert when http_cookie is matched . */
|
|
|
|
|
static int DetectHttpCookieSigTest01(void)
|
|
|
|
|
{
|
|
|
|
@ -2706,44 +2567,13 @@ end:
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int DetectHttpCookieIsdataatParseTest(void)
|
|
|
|
|
{
|
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
|
FAIL_IF_NULL(de_ctx);
|
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
|
|
|
|
|
|
Signature *s = DetectEngineAppendSig(de_ctx,
|
|
|
|
|
"alert tcp any any -> any any ("
|
|
|
|
|
"content:\"one\"; http_cookie; "
|
|
|
|
|
"isdataat:!4,relative; sid:1;)");
|
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
|
|
|
|
|
|
SigMatch *sm = s->init_data->smlists_tail[g_http_cookie_buffer_id];
|
|
|
|
|
FAIL_IF_NULL(sm);
|
|
|
|
|
FAIL_IF_NOT(sm->type == DETECT_ISDATAAT);
|
|
|
|
|
|
|
|
|
|
DetectIsdataatData *data = (DetectIsdataatData *)sm->ctx;
|
|
|
|
|
FAIL_IF_NOT(data->flags & ISDATAAT_RELATIVE);
|
|
|
|
|
FAIL_IF_NOT(data->flags & ISDATAAT_NEGATED);
|
|
|
|
|
FAIL_IF(data->flags & ISDATAAT_RAWBYTES);
|
|
|
|
|
|
|
|
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
|
PASS;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \brief Register the UNITTESTS for the http_cookie keyword
|
|
|
|
|
*/
|
|
|
|
|
void DetectHttpCookieRegisterTests (void)
|
|
|
|
|
{
|
|
|
|
|
g_http_uri_buffer_id = DetectBufferTypeGetByName("http_uri");
|
|
|
|
|
|
|
|
|
|
UtRegisterTest("DetectHttpCookieTest01", DetectHttpCookieTest01);
|
|
|
|
|
UtRegisterTest("DetectHttpCookieTest02", DetectHttpCookieTest02);
|
|
|
|
|
UtRegisterTest("DetectHttpCookieTest03", DetectHttpCookieTest03);
|
|
|
|
|
UtRegisterTest("DetectHttpCookieTest04", DetectHttpCookieTest04);
|
|
|
|
|
UtRegisterTest("DetectHttpCookieTest05", DetectHttpCookieTest05);
|
|
|
|
|
UtRegisterTest("DetectHttpCookieTest06", DetectHttpCookieTest06);
|
|
|
|
|
UtRegisterTest("DetectHttpCookieSigTest01", DetectHttpCookieSigTest01);
|
|
|
|
|
UtRegisterTest("DetectHttpCookieSigTest02", DetectHttpCookieSigTest02);
|
|
|
|
|
UtRegisterTest("DetectHttpCookieSigTest03", DetectHttpCookieSigTest03);
|
|
|
|
@ -2753,8 +2583,6 @@ void DetectHttpCookieRegisterTests (void)
|
|
|
|
|
UtRegisterTest("DetectHttpCookieSigTest07", DetectHttpCookieSigTest07);
|
|
|
|
|
UtRegisterTest("DetectHttpCookieSigTest08", DetectHttpCookieSigTest08);
|
|
|
|
|
UtRegisterTest("DetectHttpCookieSigTest09", DetectHttpCookieSigTest09);
|
|
|
|
|
UtRegisterTest("DetectHttpCookieIsdataatParseTest",
|
|
|
|
|
DetectHttpCookieIsdataatParseTest);
|
|
|
|
|
UtRegisterTest("DetectEngineHttpCookieTest01",
|
|
|
|
|
DetectEngineHttpCookieTest01);
|
|
|
|
|
UtRegisterTest("DetectEngineHttpCookieTest02",
|
|
|
|
|