|
|
|
@ -2691,18 +2691,18 @@ static int MimeDecParseLineTest01(void)
|
|
|
|
|
ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state);
|
|
|
|
|
|
|
|
|
|
if (ret != MIME_DEC_OK) {
|
|
|
|
|
return ret;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
/* Completed */
|
|
|
|
|
ret = MimeDecParseComplete(state);
|
|
|
|
|
if (ret != MIME_DEC_OK) {
|
|
|
|
|
return ret;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
MimeDecEntity *msg = state->msg;
|
|
|
|
|
if (msg->next != NULL || msg->child != NULL) {
|
|
|
|
|
SCLogInfo("Error: Invalid sibling or child message");
|
|
|
|
|
return -1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
MimeDecFreeEntity(msg);
|
|
|
|
@ -2715,10 +2715,10 @@ static int MimeDecParseLineTest01(void)
|
|
|
|
|
if (expected_count != line_count) {
|
|
|
|
|
SCLogInfo("Error: Line count is invalid: expected - %d actual - %d",
|
|
|
|
|
expected_count, line_count);
|
|
|
|
|
return -1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Test simple case of EXE URL extraction */
|
|
|
|
@ -2757,19 +2757,19 @@ static int MimeDecParseLineTest02(void)
|
|
|
|
|
ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state);
|
|
|
|
|
|
|
|
|
|
if (ret != MIME_DEC_OK) {
|
|
|
|
|
return ret;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
/* Completed */
|
|
|
|
|
ret = MimeDecParseComplete(state);
|
|
|
|
|
if (ret != MIME_DEC_OK) {
|
|
|
|
|
return ret;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
MimeDecEntity *msg = state->msg;
|
|
|
|
|
if (msg->url_list == NULL || (msg->url_list != NULL &&
|
|
|
|
|
!(msg->url_list->url_flags & URL_IS_EXE))) {
|
|
|
|
|
SCLogInfo("Warning: Expected EXE URL not found");
|
|
|
|
|
return -1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
MimeDecFreeEntity(msg);
|
|
|
|
@ -2782,17 +2782,15 @@ static int MimeDecParseLineTest02(void)
|
|
|
|
|
if (expected_count != line_count) {
|
|
|
|
|
SCLogInfo("Warning: Line count is invalid: expected - %d actual - %d",
|
|
|
|
|
expected_count, line_count);
|
|
|
|
|
return -1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Test full message with linebreaks */
|
|
|
|
|
static int MimeDecParseFullMsgTest01(void)
|
|
|
|
|
{
|
|
|
|
|
int ret = MIME_DEC_OK;
|
|
|
|
|
|
|
|
|
|
uint32_t expected_count = 3;
|
|
|
|
|
uint32_t line_count = 0;
|
|
|
|
|
|
|
|
|
@ -2808,7 +2806,7 @@ static int MimeDecParseFullMsgTest01(void)
|
|
|
|
|
TestDataChunkCallback);
|
|
|
|
|
if (entity == NULL) {
|
|
|
|
|
SCLogInfo("Warning: Message failed to parse");
|
|
|
|
|
return -1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
MimeDecFreeEntity(entity);
|
|
|
|
@ -2816,17 +2814,15 @@ static int MimeDecParseFullMsgTest01(void)
|
|
|
|
|
if (expected_count != line_count) {
|
|
|
|
|
SCLogInfo("Warning: Line count is invalid: expected - %d actual - %d",
|
|
|
|
|
expected_count, line_count);
|
|
|
|
|
return -1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Test full message with linebreaks */
|
|
|
|
|
static int MimeDecParseFullMsgTest02(void)
|
|
|
|
|
{
|
|
|
|
|
int ret = MIME_DEC_OK;
|
|
|
|
|
|
|
|
|
|
uint32_t expected_count = 3;
|
|
|
|
|
uint32_t line_count = 0;
|
|
|
|
|
|
|
|
|
@ -2844,23 +2840,23 @@ static int MimeDecParseFullMsgTest02(void)
|
|
|
|
|
|
|
|
|
|
if (entity == NULL) {
|
|
|
|
|
SCLogInfo("Warning: Message failed to parse");
|
|
|
|
|
return -1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
MimeDecField *field = MimeDecFindField(entity, "subject");
|
|
|
|
|
if (field == NULL) {
|
|
|
|
|
SCLogInfo("Warning: Message failed to parse");
|
|
|
|
|
return -1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (field->value_len != sizeof("subject2") - 1) {
|
|
|
|
|
SCLogInfo("Warning: failed to get subject");
|
|
|
|
|
return -1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (memcmp(field->value, "subject2", field->value_len) != 0) {
|
|
|
|
|
SCLogInfo("Warning: failed to get subject");
|
|
|
|
|
return -1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@ -2869,15 +2865,15 @@ static int MimeDecParseFullMsgTest02(void)
|
|
|
|
|
if (expected_count != line_count) {
|
|
|
|
|
SCLogInfo("Warning: Line count is invalid: expected - %d actual - %d",
|
|
|
|
|
expected_count, line_count);
|
|
|
|
|
return -1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int MimeBase64DecodeTest01(void)
|
|
|
|
|
{
|
|
|
|
|
int ret = -1;
|
|
|
|
|
int ret = 0;
|
|
|
|
|
|
|
|
|
|
char *msg = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890@"
|
|
|
|
|
"#$%^&*()-=_+,./;'[]<>?:";
|
|
|
|
@ -2891,7 +2887,7 @@ static int MimeBase64DecodeTest01(void)
|
|
|
|
|
ret = DecodeBase64(dst, (const uint8_t *)base64msg, strlen(base64msg), 1);
|
|
|
|
|
|
|
|
|
|
if (memcmp(dst, msg, strlen(msg)) == 0) {
|
|
|
|
|
ret = 0;
|
|
|
|
|
ret = 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
SCFree(dst);
|
|
|
|
@ -2901,7 +2897,7 @@ static int MimeBase64DecodeTest01(void)
|
|
|
|
|
|
|
|
|
|
static int MimeIsExeURLTest01(void)
|
|
|
|
|
{
|
|
|
|
|
int ret = -1;
|
|
|
|
|
int ret = 0;
|
|
|
|
|
char *url1 = "http://www.google.com/";
|
|
|
|
|
char *url2 = "http://www.google.com/test.exe";
|
|
|
|
|
|
|
|
|
@ -2913,7 +2909,7 @@ static int MimeIsExeURLTest01(void)
|
|
|
|
|
SCLogDebug("Debug: URL2 error");
|
|
|
|
|
goto end;
|
|
|
|
|
}
|
|
|
|
|
ret = 0;
|
|
|
|
|
ret = 1;
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
|
|
|
|
|
@ -2923,67 +2919,67 @@ static int MimeIsExeURLTest01(void)
|
|
|
|
|
static int MimeIsIpv4HostTest01(void)
|
|
|
|
|
{
|
|
|
|
|
if(IsIpv4Host((const uint8_t *)"192.168.1.1", 11) != 1) {
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if(IsIpv4Host((const uint8_t *)"999.oogle.com", 14) != 0) {
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if(IsIpv4Host((const uint8_t *)"0:0:0:0:0:0:0:0", 15) != 0) {
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (IsIpv4Host((const uint8_t *)"192.168.255.255", 15) != 1) {
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (IsIpv4Host((const uint8_t *)"192.168.255.255/testurl.html", 28) != 1) {
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (IsIpv4Host((const uint8_t *)"www.google.com", 14) != 0) {
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int MimeIsIpv6HostTest01(void)
|
|
|
|
|
{
|
|
|
|
|
if(IsIpv6Host((const uint8_t *)"0:0:0:0:0:0:0:0", 19) != 1) {
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if(IsIpv6Host((const uint8_t *)"0000:0000:0000:0000:0000:0000:0000:0000", 39) != 1) {
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if(IsIpv6Host((const uint8_t *)"0:0:0:0:0:0:0:0", 19) != 1) {
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if(IsIpv6Host((const uint8_t *)"192:168:1:1:0:0:0:0", 19) != 1) {
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if(IsIpv6Host((const uint8_t *)"999.oogle.com", 14) != 0) {
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (IsIpv6Host((const uint8_t *)"192.168.255.255", 15) != 0) {
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (IsIpv6Host((const uint8_t *)"192.168.255.255/testurl.html", 28) != 0) {
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (IsIpv6Host((const uint8_t *)"www.google.com", 14) != 0) {
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#endif /* UNITTESTS */
|
|
|
|
@ -2991,13 +2987,13 @@ static int MimeIsIpv6HostTest01(void)
|
|
|
|
|
void MimeDecRegisterTests(void)
|
|
|
|
|
{
|
|
|
|
|
#ifdef UNITTESTS
|
|
|
|
|
UtRegisterTest("MimeDecParseLineTest01", MimeDecParseLineTest01, 0);
|
|
|
|
|
UtRegisterTest("MimeDecParseLineTest02", MimeDecParseLineTest02, 0);
|
|
|
|
|
UtRegisterTest("MimeDecParseFullMsgTest01", MimeDecParseFullMsgTest01, 0);
|
|
|
|
|
UtRegisterTest("MimeDecParseFullMsgTest02", MimeDecParseFullMsgTest02, 0);
|
|
|
|
|
UtRegisterTest("MimeBase64DecodeTest01", MimeBase64DecodeTest01, 0);
|
|
|
|
|
UtRegisterTest("MimeIsExeURLTest01", MimeIsExeURLTest01, 0);
|
|
|
|
|
UtRegisterTest("MimeIsIpv4HostTest01", MimeIsIpv4HostTest01, 0);
|
|
|
|
|
UtRegisterTest("MimeIsIpv6HostTest01", MimeIsIpv6HostTest01, 0);
|
|
|
|
|
UtRegisterTest("MimeDecParseLineTest01", MimeDecParseLineTest01, 1);
|
|
|
|
|
UtRegisterTest("MimeDecParseLineTest02", MimeDecParseLineTest02, 1);
|
|
|
|
|
UtRegisterTest("MimeDecParseFullMsgTest01", MimeDecParseFullMsgTest01, 1);
|
|
|
|
|
UtRegisterTest("MimeDecParseFullMsgTest02", MimeDecParseFullMsgTest02, 1);
|
|
|
|
|
UtRegisterTest("MimeBase64DecodeTest01", MimeBase64DecodeTest01, 1);
|
|
|
|
|
UtRegisterTest("MimeIsExeURLTest01", MimeIsExeURLTest01, 1);
|
|
|
|
|
UtRegisterTest("MimeIsIpv4HostTest01", MimeIsIpv4HostTest01, 1);
|
|
|
|
|
UtRegisterTest("MimeIsIpv6HostTest01", MimeIsIpv6HostTest01, 1);
|
|
|
|
|
#endif /* UNITTESTS */
|
|
|
|
|
}
|
|
|
|
|