aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect-ssl-state: use new unit test macros

Browse Source
pull/2266/head
Jason Ish 10 years ago committed by Victor Julien
parent 487cdda93d
commit 30c853a304
1 changed files with 62 additions and 150 deletions
Show Stats Download Patch File Download Diff File

212
src/detect-ssl-state.c
Unescape Escape View File

@ -331,50 +331,32 @@ void DetectSslStateFree(void *ptr)
int DetectSslStateTest01(void) int DetectSslStateTest01(void)
{ {
DetectSslStateData *ssd = DetectSslStateParse("client_hello"); DetectSslStateData *ssd = DetectSslStateParse("client_hello");
if (ssd == NULL) { FAIL_IF_NULL(ssd);
printf("ssd == NULL\n"); FAIL_IF_NOT(ssd->flags == DETECT_SSL_STATE_CLIENT_HELLO);
return 0; SCFree(ssd);
} PASS;
if (ssd->flags == DETECT_SSL_STATE_CLIENT_HELLO) {
SCFree(ssd);
return 1;
}
return 0;
} }
int DetectSslStateTest02(void) int DetectSslStateTest02(void)
{ {
DetectSslStateData *ssd = DetectSslStateParse("server_hello , client_hello"); DetectSslStateData *ssd = DetectSslStateParse("server_hello , client_hello");
if (ssd == NULL) { FAIL_IF_NULL(ssd);
printf("ssd == NULL\n"); FAIL_IF_NOT(ssd->flags == (DETECT_SSL_STATE_SERVER_HELLO |
return 0; DETECT_SSL_STATE_CLIENT_HELLO));
} SCFree(ssd);
if (ssd->flags == (DETECT_SSL_STATE_SERVER_HELLO | PASS;
DETECT_SSL_STATE_CLIENT_HELLO)) {
SCFree(ssd);
return 1;
}
return 0;
} }
int DetectSslStateTest03(void) int DetectSslStateTest03(void)
{ {
DetectSslStateData *ssd = DetectSslStateParse("server_hello , client_keyx , " DetectSslStateData *ssd = DetectSslStateParse("server_hello , client_keyx , "
"client_hello"); "client_hello");
if (ssd == NULL) { FAIL_IF_NULL(ssd);
printf("ssd == NULL\n"); FAIL_IF_NOT(ssd->flags == (DETECT_SSL_STATE_SERVER_HELLO |
return 0;
}
if (ssd->flags == (DETECT_SSL_STATE_SERVER_HELLO |
DETECT_SSL_STATE_CLIENT_KEYX | DETECT_SSL_STATE_CLIENT_KEYX |
DETECT_SSL_STATE_CLIENT_HELLO)) { DETECT_SSL_STATE_CLIENT_HELLO));
SCFree(ssd); SCFree(ssd);
return 1; PASS;
}
return 0;
} }
int DetectSslStateTest04(void) int DetectSslStateTest04(void)
@ -382,20 +364,14 @@ int DetectSslStateTest04(void)
DetectSslStateData *ssd = DetectSslStateParse("server_hello , client_keyx , " DetectSslStateData *ssd = DetectSslStateParse("server_hello , client_keyx , "
"client_hello , server_keyx , " "client_hello , server_keyx , "
"unknown"); "unknown");
if (ssd == NULL) { FAIL_IF_NULL(ssd);
printf("ssd == NULL\n"); FAIL_IF_NOT(ssd->flags == (DETECT_SSL_STATE_SERVER_HELLO |
return 0;
}
if (ssd->flags == (DETECT_SSL_STATE_SERVER_HELLO |
DETECT_SSL_STATE_CLIENT_KEYX | DETECT_SSL_STATE_CLIENT_KEYX |
DETECT_SSL_STATE_CLIENT_HELLO | DETECT_SSL_STATE_CLIENT_HELLO |
DETECT_SSL_STATE_SERVER_KEYX | DETECT_SSL_STATE_SERVER_KEYX |
DETECT_SSL_STATE_UNKNOWN)) { DETECT_SSL_STATE_UNKNOWN));
SCFree(ssd); SCFree(ssd);
return 1; PASS;
}
return 0;
} }
int DetectSslStateTest05(void) int DetectSslStateTest05(void)
@ -404,13 +380,8 @@ int DetectSslStateTest05(void)
"client_hello , server_keyx , " "client_hello , server_keyx , "
"unknown"); "unknown");
if (ssd != NULL) { FAIL_IF_NOT_NULL(ssd);
printf("ssd != NULL - failure\n"); PASS;
SCFree(ssd);
return 0;
}
return 1;
} }
int DetectSslStateTest06(void) int DetectSslStateTest06(void)
@ -418,13 +389,8 @@ int DetectSslStateTest06(void)
DetectSslStateData *ssd = DetectSslStateParse("server_hello , client_keyx , " DetectSslStateData *ssd = DetectSslStateParse("server_hello , client_keyx , "
"client_hello , server_keyx , " "client_hello , server_keyx , "
"unknown , "); "unknown , ");
if (ssd != NULL) { FAIL_IF_NOT_NULL(ssd);
printf("ssd != NULL - failure\n"); PASS;
SCFree(ssd);
return 0;
}
return 1;
} }
/** /**
@ -677,7 +643,6 @@ static int DetectSslStateTest07(void)
}; };
uint32_t toserver_app_data_buf_len = sizeof(toserver_app_data_buf); uint32_t toserver_app_data_buf_len = sizeof(toserver_app_data_buf);
int result = 0;
Signature *s = NULL; Signature *s = NULL;
ThreadVars th_v; ThreadVars th_v;
Packet *p = NULL; Packet *p = NULL;
@ -708,44 +673,38 @@ static int DetectSslStateTest07(void)
StreamTcpInitConfig(TRUE); StreamTcpInitConfig(TRUE);
de_ctx = DetectEngineCtxInit(); de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) FAIL_IF_NULL(de_ctx);
goto end;
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
"(msg:\"ssl state\"; ssl_state:client_hello; " "(msg:\"ssl state\"; ssl_state:client_hello; "
"sid:1;)"); "sid:1;)");
if (s == NULL) FAIL_IF_NULL(s);
goto end;
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
"(msg:\"ssl state\"; " "(msg:\"ssl state\"; "
"ssl_state:server_hello; " "ssl_state:server_hello; "
"sid:2;)"); "sid:2;)");
if (s == NULL) FAIL_IF_NULL(s);
goto end;
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
"(msg:\"ssl state\"; " "(msg:\"ssl state\"; "
"ssl_state:client_keyx; " "ssl_state:client_keyx; "
"sid:3;)"); "sid:3;)");
if (s == NULL) FAIL_IF_NULL(s);
goto end;
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
"(msg:\"ssl state\"; " "(msg:\"ssl state\"; "
"ssl_state:server_keyx; " "ssl_state:server_keyx; "
"sid:4;)"); "sid:4;)");
if (s == NULL) FAIL_IF_NULL(s);
goto end;
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
"(msg:\"ssl state\"; " "(msg:\"ssl state\"; "
"ssl_state:!client_hello; " "ssl_state:!client_hello; "
"sid:5;)"); "sid:5;)");
if (s == NULL) FAIL_IF_NULL(s);
goto end;
SigGroupBuild(de_ctx); SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
@ -753,134 +712,87 @@ static int DetectSslStateTest07(void)
SCMutexLock(&f.m); SCMutexLock(&f.m);
r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER | STREAM_START, chello_buf, r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER | STREAM_START, chello_buf,
chello_buf_len); chello_buf_len);
if (r != 0) { FAIL_IF(r != 0);
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
SCMutexUnlock(&f.m);
goto end;
}
SCMutexUnlock(&f.m); SCMutexUnlock(&f.m);
ssl_state = f.alstate; ssl_state = f.alstate;
if (ssl_state == NULL) { FAIL_IF(ssl_state == NULL);
printf("no ssl state: ");
goto end;
}
/* do detect */ /* do detect */
p->alerts.cnt = 0; p->alerts.cnt = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (!PacketAlertCheck(p, 1)) FAIL_IF(!PacketAlertCheck(p, 1));
goto end; FAIL_IF(PacketAlertCheck(p, 2));
if (PacketAlertCheck(p, 2)) FAIL_IF(PacketAlertCheck(p, 3));
goto end; FAIL_IF(PacketAlertCheck(p, 4));
if (PacketAlertCheck(p, 3)) FAIL_IF(PacketAlertCheck(p, 5));
goto end;
if (PacketAlertCheck(p, 4))
goto end;
if (PacketAlertCheck(p, 5))
goto end;
SCMutexLock(&f.m); SCMutexLock(&f.m);
r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, shello_buf, r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, shello_buf,
shello_buf_len); shello_buf_len);
if (r != 0) { FAIL_IF(r != 0);
printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r);
SCMutexUnlock(&f.m);
goto end;
}
SCMutexUnlock(&f.m); SCMutexUnlock(&f.m);
/* do detect */ /* do detect */
p->alerts.cnt = 0; p->alerts.cnt = 0;
p->flowflags = (FLOW_PKT_TOCLIENT | FLOW_PKT_ESTABLISHED);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) FAIL_IF(PacketAlertCheck(p, 1));
goto end; FAIL_IF(!PacketAlertCheck(p, 2));
if (!PacketAlertCheck(p, 2)) FAIL_IF(PacketAlertCheck(p, 3));
goto end; FAIL_IF(PacketAlertCheck(p, 4));
if (PacketAlertCheck(p, 3)) FAIL_IF(!PacketAlertCheck(p, 5));
goto end;
if (PacketAlertCheck(p, 4)) PASS;
goto end;
if (!PacketAlertCheck(p, 5))
goto end;
SCMutexLock(&f.m); SCMutexLock(&f.m);
r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_change_cipher_spec_buf, r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_change_cipher_spec_buf,
client_change_cipher_spec_buf_len); client_change_cipher_spec_buf_len);
if (r != 0) { FAIL_IF(r != 0);
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
result = 0;
SCMutexUnlock(&f.m);
goto end;
}
SCMutexUnlock(&f.m); SCMutexUnlock(&f.m);
/* do detect */ /* do detect */
p->alerts.cnt = 0; p->alerts.cnt = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) FAIL_IF(PacketAlertCheck(p, 1));
goto end; FAIL_IF(PacketAlertCheck(p, 2));
if (PacketAlertCheck(p, 2)) FAIL_IF(!PacketAlertCheck(p, 3));
goto end; FAIL_IF(PacketAlertCheck(p, 4));
if (!PacketAlertCheck(p, 3))
goto end;
if (PacketAlertCheck(p, 4))
goto end;
SCMutexLock(&f.m); SCMutexLock(&f.m);
r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_change_cipher_spec_buf, r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_change_cipher_spec_buf,
server_change_cipher_spec_buf_len); server_change_cipher_spec_buf_len);
if (r != 0) { FAIL_IF(r != 0);
printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r);
result = 0;
SCMutexUnlock(&f.m);
goto end;
}
SCMutexUnlock(&f.m); SCMutexUnlock(&f.m);
/* do detect */ /* do detect */
p->alerts.cnt = 0; p->alerts.cnt = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) FAIL_IF(PacketAlertCheck(p, 1));
goto end; FAIL_IF(PacketAlertCheck(p, 2));
if (PacketAlertCheck(p, 2)) FAIL_IF(PacketAlertCheck(p, 3));
goto end; FAIL_IF(PacketAlertCheck(p, 4));
if (PacketAlertCheck(p, 3))
goto end;
if (PacketAlertCheck(p, 4))
goto end;
SCMutexLock(&f.m); SCMutexLock(&f.m);
r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, toserver_app_data_buf, r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, toserver_app_data_buf,
toserver_app_data_buf_len); toserver_app_data_buf_len);
if (r != 0) { FAIL_IF(r != 0);
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
result = 0;
SCMutexUnlock(&f.m);
goto end;
}
SCMutexUnlock(&f.m); SCMutexUnlock(&f.m);
/* do detect */ /* do detect */
p->alerts.cnt = 0; p->alerts.cnt = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) FAIL_IF(PacketAlertCheck(p, 1));
goto end; FAIL_IF(PacketAlertCheck(p, 2));
if (PacketAlertCheck(p, 2)) FAIL_IF(PacketAlertCheck(p, 3));
goto end; FAIL_IF(PacketAlertCheck(p, 4));
if (PacketAlertCheck(p, 3))
goto end;
if (PacketAlertCheck(p, 4))
goto end;
result = 1;
end:
if (alp_tctx != NULL) if (alp_tctx != NULL)
AppLayerParserThreadCtxFree(alp_tctx); AppLayerParserThreadCtxFree(alp_tctx);
SigGroupCleanup(de_ctx); SigGroupCleanup(de_ctx);
@ -892,7 +804,7 @@ static int DetectSslStateTest07(void)
StreamTcpFreeConfig(TRUE); StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f); FLOW_DESTROY(&f);
UTHFreePackets(&p, 1); UTHFreePackets(&p, 1);
return result; PASS;
} }
/** /**

Write Preview
Loading…
Cancel
Save