detect/dns-query: Splice UT to rust

src/detect-dns-query.c

@@ -616,336 +616,9 @@ static int DetectDnsQueryTest03(void)
     PASS;
 }
 
-/** \test simple google.com query matching (TCP splicing) */
-static int DetectDnsQueryTest04(void)
-{
-    /* google.com */
-    uint8_t buf1[] = {  0x00, 28,
-                        0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
-                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, };
-    uint8_t buf2[] = {  0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
-                        0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
-                        0x00, 0x10, 0x00, 0x01, };
-    Flow f;
-    void *dns_state = NULL;
-    Packet *p1 = NULL, *p2 = NULL;
-    Signature *s = NULL;
-    ThreadVars tv;
-    DetectEngineThreadCtx *det_ctx = NULL;
-    TcpSession ssn;
-    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
-
-    memset(&tv, 0, sizeof(ThreadVars));
-    memset(&f, 0, sizeof(Flow));
-    memset(&ssn, 0, sizeof(TcpSession));
-
-    p1 = UTHBuildPacketReal(buf1, sizeof(buf1), IPPROTO_TCP,
-                           "192.168.1.5", "192.168.1.1",
-                           41424, 53);
-    p2 = UTHBuildPacketReal(buf2, sizeof(buf2), IPPROTO_TCP,
-                           "192.168.1.5", "192.168.1.1",
-                           41424, 53);
-
-    FLOW_INITIALIZE(&f);
-    f.protoctx = (void *)&ssn;
-    f.flags |= FLOW_IPV4;
-    f.proto = IPPROTO_TCP;
-    f.protomap = FlowGetProtoMapping(f.proto);
-    f.alproto = ALPROTO_DNS;
-
-    p1->flow = &f;
-    p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
-    p1->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED;
-
-    p2->flow = &f;
-    p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
-    p2->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED;
-
-    StreamTcpInitConfig(TRUE);
-
-    DetectEngineCtx *de_ctx = DetectEngineCtxInit();
-    FAIL_IF_NULL(de_ctx);
-    de_ctx->mpm_matcher = mpm_default_matcher;
-    de_ctx->flags |= DE_QUIET;
-
-    s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
-                              "(msg:\"Test dns_query option\"; "
-                              "dns_query; content:\"google\"; nocase; sid:1;)");
-    FAIL_IF_NULL(s);
-
-    SigGroupBuild(de_ctx);
-    DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
-
-    FLOWLOCK_WRLOCK(&f);
-    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS,
-                                STREAM_TOSERVER, buf1, sizeof(buf1));
-    if (r != 0) {
-        printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
-        FLOWLOCK_UNLOCK(&f);
-        FAIL;
-    }
-    FLOWLOCK_UNLOCK(&f);
-
-    dns_state = f.alstate;
-    FAIL_IF_NULL(dns_state);
-
-    /* do detect */
-    SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
-
-    if (PacketAlertCheck(p1, 1)) {
-        printf("sig 1 alerted, but it should not have: ");
-        FAIL;
-    }
-
-    FLOWLOCK_WRLOCK(&f);
-    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER,
-                            buf2, sizeof(buf2));
-    if (r != 0) {
-        printf("toserver chunk 1 returned %" PRId32 ", expected 0\n", r);
-        FLOWLOCK_UNLOCK(&f);
-        FAIL;
-    }
-    FLOWLOCK_UNLOCK(&f);
-
-    /* do detect */
-    SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
-
-    if (!(PacketAlertCheck(p2, 1))) {
-        printf("sig 1 didn't alert, but it should have: ");
-        FAIL;
-    }
-
-    if (alp_tctx != NULL)
-        AppLayerParserThreadCtxFree(alp_tctx);
-    if (det_ctx != NULL)
-        DetectEngineThreadCtxDeinit(&tv, det_ctx);
-    if (de_ctx != NULL)
-        SigGroupCleanup(de_ctx);
-    if (de_ctx != NULL)
-        DetectEngineCtxFree(de_ctx);
-
-    StreamTcpFreeConfig(TRUE);
-    FLOW_DESTROY(&f);
-    UTHFreePacket(p1);
-    UTHFreePacket(p2);
-    PASS;
-}
-
-/** \test simple google.com query matching (TCP splicing) */
-static int DetectDnsQueryTest05(void)
-{
-    /* google.com in 2 chunks (buf1 and buf2) */
-    uint8_t buf1[] = {  0x00, 28,                               /* len 28 */
-                        0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
-                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, };
-
-    uint8_t buf2[] = {  0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
-                        0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
-                        0x00, 0x10, 0x00, 0x01, };
-
-    uint8_t buf3[] = {  0x00, 44,                               /* len 44 */
-                        0x10, 0x32,                             /* tx id */
-                        0x81, 0x80,                             /* flags: resp, recursion desired, recursion available */
-                        0x00, 0x01,                             /* 1 query */
-                        0x00, 0x01,                             /* 1 answer */
-                        0x00, 0x00, 0x00, 0x00,                 /* no auth rr, additional rr */
-                        /* query record */
-                        0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,     /* name */
-                        0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,     /* name cont */
-                        0x00, 0x01, 0x00, 0x01,                 /* type a, class in */
-                        /* answer */
-                        0xc0, 0x0c,                             /* ref to name in query above */
-                        0x00, 0x01, 0x00, 0x01,                 /* type a, class in */
-                        0x00, 0x01, 0x40, 0xef,                 /* ttl */
-                        0x00, 0x04,                             /* data len */
-                        0x01, 0x02, 0x03, 0x04 };               /* addr */
-
-    /* google.net */
-    uint8_t buf4[] = {  0x00, 28,                               /* len 28 */
-                        0x11, 0x33, 0x01, 0x00, 0x00, 0x01,
-                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                        0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
-                        0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
-                        0x00, 0x10, 0x00, 0x01, };
-    Flow f;
-    void *dns_state = NULL;
-    Packet *p1 = NULL, *p2 = NULL, *p3 = NULL, *p4 = NULL;
-    Signature *s = NULL;
-    ThreadVars tv;
-    DetectEngineThreadCtx *det_ctx = NULL;
-    TcpSession ssn;
-    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
-
-    memset(&tv, 0, sizeof(ThreadVars));
-    memset(&f, 0, sizeof(Flow));
-    memset(&ssn, 0, sizeof(TcpSession));
-
-    p1 = UTHBuildPacketReal(buf1, sizeof(buf1), IPPROTO_TCP,
-                            "192.168.1.5", "192.168.1.1",
-                            41424, 53);
-    p2 = UTHBuildPacketReal(buf2, sizeof(buf2), IPPROTO_TCP,
-                            "192.168.1.5", "192.168.1.1",
-                            41424, 53);
-    p3 = UTHBuildPacketReal(buf3, sizeof(buf3), IPPROTO_TCP,
-                            "192.168.1.5", "192.168.1.1",
-                            41424, 53);
-    p4 = UTHBuildPacketReal(buf4, sizeof(buf4), IPPROTO_TCP,
-                            "192.168.1.5", "192.168.1.1",
-                            41424, 53);
-
-    FLOW_INITIALIZE(&f);
-    f.protoctx = (void *)&ssn;
-    f.flags |= FLOW_IPV4;
-    f.proto = IPPROTO_TCP;
-    f.protomap = FlowGetProtoMapping(f.proto);
-    f.alproto = ALPROTO_DNS;
-
-    p1->flow = &f;
-    p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
-    p1->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED;
-
-    p2->flow = &f;
-    p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
-    p2->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED;
-
-    p3->flow = &f;
-    p3->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
-    p3->flowflags |= FLOW_PKT_TOCLIENT|FLOW_PKT_ESTABLISHED;
-
-    p4->flow = &f;
-    p4->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
-    p4->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED;
-
-    StreamTcpInitConfig(TRUE);
-
-    DetectEngineCtx *de_ctx = DetectEngineCtxInit();
-    FAIL_IF_NULL(de_ctx);
-    de_ctx->mpm_matcher = mpm_default_matcher;
-    de_ctx->flags |= DE_QUIET;
-
-    s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
-                              "(msg:\"Test dns_query option\"; "
-                              "dns_query; content:\"google.com\"; nocase; sid:1;)");
-    FAIL_IF_NULL(s);
-    s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
-                              "(msg:\"Test dns_query option\"; "
-                              "dns_query; content:\"google.net\"; nocase; sid:2;)");
-    FAIL_IF_NULL(s);
-
-    SigGroupBuild(de_ctx);
-    DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
-
-    FLOWLOCK_WRLOCK(&f);
-    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS,
-                                STREAM_TOSERVER, buf1, sizeof(buf1));
-    if (r != 0) {
-        printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
-        FLOWLOCK_UNLOCK(&f);
-        FAIL;
-    }
-    FLOWLOCK_UNLOCK(&f);
-
-    dns_state = f.alstate;
-    FAIL_IF_NULL(dns_state);
-
-    /* do detect */
-    SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
-
-    if (PacketAlertCheck(p1, 1)) {
-        printf("(p1) sig 1 alerted, but it should not have: ");
-        FAIL;
-    }
-    if (PacketAlertCheck(p1, 2)) {
-        printf("(p1) sig 2 did alert, but it should not have: ");
-        FAIL;
-    }
-
-    FLOWLOCK_WRLOCK(&f);
-    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER,
-                            buf2, sizeof(buf2));
-    if (r != 0) {
-        printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
-        FLOWLOCK_UNLOCK(&f);
-        FAIL;
-    }
-    FLOWLOCK_UNLOCK(&f);
-
-    /* do detect */
-    SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
-
-    if (!(PacketAlertCheck(p2, 1))) {
-        printf("sig 1 didn't alert, but it should have: ");
-        FAIL;
-    }
-    if (PacketAlertCheck(p2, 2)) {
-        printf("(p2) sig 2 did alert, but it should not have: ");
-        FAIL;
-    }
-
-    FLOWLOCK_WRLOCK(&f);
-    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOCLIENT,
-                            buf3, sizeof(buf3));
-    if (r != 0) {
-        printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r);
-        FLOWLOCK_UNLOCK(&f);
-        FAIL;
-    }
-    FLOWLOCK_UNLOCK(&f);
-
-    /* do detect */
-    SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
-
-    if (PacketAlertCheck(p3, 1)) {
-        printf("sig 1 did alert, but it should not have: ");
-        FAIL;
-    }
-    if (PacketAlertCheck(p3, 2)) {
-        printf("(p3) sig 2 did alert, but it should not have: ");
-        FAIL;
-    }
-
-    FLOWLOCK_WRLOCK(&f);
-    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER,
-                            buf4, sizeof(buf4));
-    if (r != 0) {
-        printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
-        FLOWLOCK_UNLOCK(&f);
-        FAIL;
-    }
-    FLOWLOCK_UNLOCK(&f);
-
-    /* do detect */
-    SigMatchSignatures(&tv, de_ctx, det_ctx, p4);
-
-    if (PacketAlertCheck(p4, 1)) {
-        printf("(p4) sig 1 did alert, but it should not have: ");
-        FAIL;
-    }
-    if (!(PacketAlertCheck(p4, 2))) {
-        printf("sig 1 didn't alert, but it should have: ");
-        FAIL;
-    }
-
-    if (alp_tctx != NULL)
-        AppLayerParserThreadCtxFree(alp_tctx);
-    if (det_ctx != NULL)
-        DetectEngineThreadCtxDeinit(&tv, det_ctx);
-    if (de_ctx != NULL)
-        SigGroupCleanup(de_ctx);
-    if (de_ctx != NULL)
-        DetectEngineCtxFree(de_ctx);
-
-    StreamTcpFreeConfig(TRUE);
-    FLOW_DESTROY(&f);
-    UTHFreePacket(p1);
-    UTHFreePacket(p2);
-    UTHFreePacket(p3);
-    UTHFreePacket(p4);
-    PASS;
-}
 
 /** \test simple google.com query matching, pcre */
-static int DetectDnsQueryTest06(void)
+static int DetectDnsQueryTest04(void)
 {
     /* google.com */
     uint8_t buf[] = {   0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
@@ -1038,7 +711,7 @@ static int DetectDnsQueryTest06(void)
 
 /** \test multi tx google.(com|net) query matching +
  *        app layer event */
-static int DetectDnsQueryTest07(void)
+static int DetectDnsQueryTest05(void)
 {
     /* google.com */
     uint8_t buf1[] = {  0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
@@ -1257,13 +930,9 @@ static void DetectDnsQueryRegisterTests(void)
     UtRegisterTest("DetectDnsQueryTest01", DetectDnsQueryTest01);
     UtRegisterTest("DetectDnsQueryTest02", DetectDnsQueryTest02);
     UtRegisterTest("DetectDnsQueryTest03 -- tcp", DetectDnsQueryTest03);
-    UtRegisterTest("DetectDnsQueryTest04 -- tcp splicing",
+    UtRegisterTest("DetectDnsQueryTest04 -- pcre", DetectDnsQueryTest04);
-                   DetectDnsQueryTest04);
+    UtRegisterTest("DetectDnsQueryTest05 -- app layer event",
-    UtRegisterTest("DetectDnsQueryTest05 -- tcp splicing/multi tx",
                    DetectDnsQueryTest05);
-    UtRegisterTest("DetectDnsQueryTest06 -- pcre", DetectDnsQueryTest06);
-    UtRegisterTest("DetectDnsQueryTest07 -- app layer event",
-                   DetectDnsQueryTest07);
 
     UtRegisterTest("DetectDnsQueryIsdataatParseTest",
             DetectDnsQueryIsdataatParseTest);