mirror of https://github.com/OISF/suricata
detect: add (mpm) keyword for tls_sni
Match on server name indication (SNI) extension in TLS using tls_sni
keyword, e.g:
alert tls any any -> any any (msg:"SNI test"; tls_sni;
content:"example.com"; sid:12345;)
pull/2084/merge
Mats Klepsland
9 years ago
committed by
Victor Julien
parent
3da79610af
commit
a13df67864
@ -0,0 +1,145 @@
|
||||
/* Copyright (C) 2016 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/** \file
|
||||
*
|
||||
* \author Mats Klepsland <mats.klepsland@gmail.com>
|
||||
*
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "suricata.h"
|
||||
#include "decode.h"
|
||||
|
||||
#include "detect.h"
|
||||
#include "detect-engine.h"
|
||||
#include "detect-parse.h"
|
||||
#include "detect-engine-state.h"
|
||||
#include "detect-engine-content-inspection.h"
|
||||
|
||||
#include "flow-util.h"
|
||||
#include "util-debug.h"
|
||||
#include "util-print.h"
|
||||
#include "flow.h"
|
||||
|
||||
#include "app-layer.h"
|
||||
#include "app-layer-parser.h"
|
||||
#include "app-layer-protos.h"
|
||||
#include "app-layer-ssl.h"
|
||||
|
||||
#include "util-unittest.h"
|
||||
#include "util-unittest-helper.h"
|
||||
#include "util-validate.h"
|
||||
|
||||
/**
|
||||
* \brief TLS sni match -- searches for one pattern per signature.
|
||||
*
|
||||
* \param det_ctx Detection engine thread ctx
|
||||
* \param hrh Buffer to inspect
|
||||
* \param hrh_len Buffer length
|
||||
* \param flags Flags
|
||||
*
|
||||
* \retval ret Number of matches
|
||||
*/
|
||||
static inline uint32_t TlsSniPatternSearch(DetectEngineThreadCtx *det_ctx,
|
||||
const uint8_t *buffer,
|
||||
const uint32_t buffer_len,
|
||||
const uint8_t flags)
|
||||
{
|
||||
SCEnter();
|
||||
|
||||
uint32_t ret = 0;
|
||||
|
||||
DEBUG_VALIDATE_BUG_ON(flags & STREAM_TOCLIENT);
|
||||
DEBUG_VALIDATE_BUG_ON(det_ctx->sgh->mpm_tlssni_ctx_ts == NULL);
|
||||
|
||||
if (buffer_len >= det_ctx->sgh->mpm_tlssni_ctx_ts->minlen) {
|
||||
ret = mpm_table[det_ctx->sgh->mpm_tlssni_ctx_ts->mpm_type].
|
||||
Search(det_ctx->sgh->mpm_tlssni_ctx_ts, &det_ctx->mtcu,
|
||||
&det_ctx->pmq, buffer, buffer_len);
|
||||
}
|
||||
|
||||
SCReturnUInt(ret);
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Run the pattern matcher against the SNI buffer
|
||||
*
|
||||
* \param det_ctx Detection engine thread ctx
|
||||
* \param f Locked flow
|
||||
* \param dns_state Initialized dns state
|
||||
* \param flags Flags
|
||||
*
|
||||
* \retval cnt Number of matches
|
||||
*/
|
||||
uint32_t DetectTlsSniInspectMpm(DetectEngineThreadCtx *det_ctx, Flow *f,
|
||||
SSLState *ssl_state, uint8_t flags)
|
||||
{
|
||||
SCEnter();
|
||||
|
||||
uint8_t *buffer;
|
||||
uint32_t buffer_len;
|
||||
uint32_t cnt = 0;
|
||||
|
||||
if (ssl_state->client_connp.sni == NULL)
|
||||
return 0;
|
||||
|
||||
buffer = (uint8_t *)ssl_state->client_connp.sni;
|
||||
buffer_len = strlen(ssl_state->client_connp.sni);
|
||||
|
||||
cnt = TlsSniPatternSearch(det_ctx, buffer, buffer_len, flags);
|
||||
|
||||
SCReturnUInt(cnt);
|
||||
}
|
||||
|
||||
/** \brief Do the content inspection and validation for a signature
|
||||
*
|
||||
* \param de_ctx Detection engine context
|
||||
* \param det_ctx Detection engine thread context
|
||||
* \param s Signature to inspect
|
||||
* \param sm SigMatch to inspect
|
||||
* \param f Flow
|
||||
* \param flags App layer flags
|
||||
* \param state App layer state
|
||||
*
|
||||
* \retval 0 No match
|
||||
* \retval 1 Match
|
||||
*/
|
||||
int DetectEngineInspectTlsSni(ThreadVars *tv, DetectEngineCtx *de_ctx,
|
||||
DetectEngineThreadCtx *det_ctx, Signature *s,
|
||||
Flow *f, uint8_t flags, void *alstate, void *txv,
|
||||
uint64_t tx_id)
|
||||
{
|
||||
uint8_t *buffer;
|
||||
uint16_t buffer_len;
|
||||
int cnt = 0;
|
||||
|
||||
SSLState *ssl_state = (SSLState *)alstate;
|
||||
|
||||
if (ssl_state->client_connp.sni == NULL)
|
||||
return 0;
|
||||
|
||||
buffer = (uint8_t *)ssl_state->client_connp.sni;
|
||||
buffer_len = strlen(ssl_state->client_connp.sni);
|
||||
|
||||
cnt = DetectEngineContentInspection(de_ctx, det_ctx, s,
|
||||
s->sm_lists[DETECT_SM_LIST_TLSSNI_MATCH],
|
||||
f, buffer, buffer_len, 0,
|
||||
DETECT_ENGINE_CONTENT_INSPECTION_MODE_TLSSNI, NULL);
|
||||
|
||||
return cnt;
|
||||
}
|
||||
@ -0,0 +1,31 @@
|
||||
/* Copyright (C) 2016 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/** \file
|
||||
*
|
||||
* \author Mats Klepsland <mats.klepsland@gmail.com>
|
||||
*/
|
||||
|
||||
#ifndef __DETECT_ENGINE_TLS_H__
|
||||
#define __DETECT_ENGINE_TLS_H__
|
||||
|
||||
int DetectEngineInspectTlsSni(ThreadVars *tv, DetectEngineCtx *de_ctx,
|
||||
DetectEngineThreadCtx *det_ctx,
|
||||
Signature *s, Flow *f, uint8_t flags,
|
||||
void *alstate, void *txv, uint64_t tx_id);
|
||||
|
||||
#endif /* __DETECT_ENGINE_TLS_H__ */
|
||||
@ -0,0 +1,341 @@
|
||||
/* Copyright (C) 2007-2016 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Mats Klepsland <mats.klepsland@gmail.com>
|
||||
*
|
||||
* Implements support for tls_sni keyword.
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "threads.h"
|
||||
#include "debug.h"
|
||||
#include "decode.h"
|
||||
#include "detect.h"
|
||||
|
||||
#include "detect-parse.h"
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-mpm.h"
|
||||
#include "detect-content.h"
|
||||
#include "detect-pcre.h"
|
||||
|
||||
#include "flow.h"
|
||||
#include "flow-util.h"
|
||||
#include "flow-var.h"
|
||||
|
||||
#include "util-debug.h"
|
||||
#include "util-unittest.h"
|
||||
#include "util-spm.h"
|
||||
#include "util-print.h"
|
||||
|
||||
#include "stream-tcp.h"
|
||||
|
||||
#include "app-layer.h"
|
||||
#include "app-layer-ssl.h"
|
||||
|
||||
#include "util-unittest.h"
|
||||
#include "util-unittest-helper.h"
|
||||
|
||||
static int DetectTlsSniSetup(DetectEngineCtx *, Signature *, char *);
|
||||
static void DetectTlsSniRegisterTests(void);
|
||||
|
||||
/**
|
||||
* \brief Registration function for keyword: tls_sni
|
||||
*/
|
||||
void DetectTlsSniRegister(void)
|
||||
{
|
||||
sigmatch_table[DETECT_AL_TLS_SNI].name = "tls_sni";
|
||||
sigmatch_table[DETECT_AL_TLS_SNI].desc = "content modifier to match specifically and only on the TLS SNI buffer";
|
||||
sigmatch_table[DETECT_AL_TLS_SNI].Match = NULL;
|
||||
sigmatch_table[DETECT_AL_TLS_SNI].AppLayerMatch = NULL;
|
||||
sigmatch_table[DETECT_AL_TLS_SNI].alproto = ALPROTO_TLS;
|
||||
sigmatch_table[DETECT_AL_TLS_SNI].Setup = DetectTlsSniSetup;
|
||||
sigmatch_table[DETECT_AL_TLS_SNI].Free = NULL;
|
||||
sigmatch_table[DETECT_AL_TLS_SNI].RegisterTests = DetectTlsSniRegisterTests;
|
||||
|
||||
sigmatch_table[DETECT_AL_TLS_SNI].flags |= SIGMATCH_NOOPT;
|
||||
sigmatch_table[DETECT_AL_TLS_SNI].flags |= SIGMATCH_PAYLOAD;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* \brief this function setup the tls_sni modifier keyword used in the rule
|
||||
*
|
||||
* \param de_ctx Pointer to the Detection Engine Context
|
||||
* \param s Pointer to the Signature to which the current keyword belongs
|
||||
* \param str Should hold an empty string always
|
||||
*
|
||||
* \retval 0 On success
|
||||
*/
|
||||
static int DetectTlsSniSetup(DetectEngineCtx *de_ctx, Signature *s, char *str)
|
||||
{
|
||||
s->list = DETECT_SM_LIST_TLSSNI_MATCH;
|
||||
s->alproto = ALPROTO_TLS;
|
||||
return 0;
|
||||
}
|
||||
|
||||
#ifdef UNITTESTS
|
||||
|
||||
/**
|
||||
* \test Test matching on a simple google.com SNI
|
||||
*/
|
||||
static int DetectTlsSniTest01(void)
|
||||
{
|
||||
/* client hello */
|
||||
uint8_t buf[] = { 0x16, 0x03, 0x03, 0x00, 0xAE, 0x01, 0x00, 0x00, 0xAA,
|
||||
0x03, 0x03, 0x57, 0x04, 0x9F, 0x5D, 0xC9, 0x5C, 0x87,
|
||||
0xAE, 0xF2, 0xA7, 0x4A, 0xFC, 0x59, 0x78, 0x23, 0x31,
|
||||
0x61, 0x2D, 0x29, 0x92, 0xB6, 0x70, 0xA5, 0xA1, 0xFC,
|
||||
0x0E, 0x79, 0xFE, 0xC3, 0x97, 0x37, 0xC0, 0x00, 0x00,
|
||||
0x44, 0x00, 0x04, 0x00, 0x05, 0x00, 0x0A, 0x00, 0x0D,
|
||||
0x00, 0x10, 0x00, 0x13, 0x00, 0x16, 0x00, 0x2F, 0x00,
|
||||
0x30, 0x00, 0x31, 0x00, 0x32, 0x00, 0x33, 0x00, 0x35,
|
||||
0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, 0x39, 0x00,
|
||||
0x3C, 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x40,
|
||||
0x00, 0x41, 0x00, 0x44, 0x00, 0x45, 0x00, 0x66, 0x00,
|
||||
0x67, 0x00, 0x68, 0x00, 0x69, 0x00, 0x6A, 0x00, 0x6B,
|
||||
0x00, 0x84, 0x00, 0x87, 0x00, 0xFF, 0x01, 0x00, 0x00,
|
||||
0x13, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x0D, 0x00, 0x00,
|
||||
0x0A, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x2E, 0x63,
|
||||
0x6F, 0x6D, };
|
||||
|
||||
int result = 0;
|
||||
Flow f;
|
||||
SSLState *ssl_state = NULL;
|
||||
Packet *p = NULL;
|
||||
Signature *s = NULL;
|
||||
ThreadVars tv;
|
||||
DetectEngineThreadCtx *det_ctx = NULL;
|
||||
TcpSession ssn;
|
||||
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
|
||||
|
||||
memset(&tv, 0, sizeof(ThreadVars));
|
||||
memset(&f, 0, sizeof(Flow));
|
||||
memset(&ssn, 0, sizeof(TcpSession));
|
||||
|
||||
p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP,
|
||||
"192.168.1.5", "192.168.1.1",
|
||||
41424, 443);
|
||||
|
||||
FLOW_INITIALIZE(&f);
|
||||
f.protoctx = (void *)&ssn;
|
||||
f.flags |= FLOW_IPV4;
|
||||
f.proto = IPPROTO_TCP;
|
||||
f.protomap = FlowGetProtoMapping(f.proto);
|
||||
|
||||
p->flow = &f;
|
||||
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
||||
p->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED;
|
||||
f.alproto = ALPROTO_TLS;
|
||||
|
||||
StreamTcpInitConfig(TRUE);
|
||||
|
||||
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
||||
if (de_ctx == NULL) {
|
||||
goto end;
|
||||
}
|
||||
de_ctx->mpm_matcher = DEFAULT_MPM;
|
||||
de_ctx->flags |= DE_QUIET;
|
||||
|
||||
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
|
||||
"(msg:\"Test tls_sni option\"; "
|
||||
"tls_sni; content:\"google.com\"; sid:1;)");
|
||||
if (s == NULL) {
|
||||
goto end;
|
||||
}
|
||||
|
||||
SigGroupBuild(de_ctx);
|
||||
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
||||
|
||||
SCMutexLock(&f.m);
|
||||
int r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf, sizeof(buf));
|
||||
if (r != 0) {
|
||||
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
||||
SCMutexUnlock(&f.m);
|
||||
goto end;
|
||||
}
|
||||
SCMutexUnlock(&f.m);
|
||||
|
||||
ssl_state = f.alstate;
|
||||
if (ssl_state == NULL) {
|
||||
printf("no ssl state: ");
|
||||
goto end;
|
||||
}
|
||||
|
||||
/* do detect */
|
||||
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
|
||||
|
||||
if (!(PacketAlertCheck(p, 1))) {
|
||||
printf("sig 1 didn't alert, but it should have: ");
|
||||
goto end;
|
||||
}
|
||||
|
||||
result = 1;
|
||||
|
||||
end:
|
||||
if (alp_tctx != NULL)
|
||||
AppLayerParserThreadCtxFree(alp_tctx);
|
||||
if (det_ctx != NULL)
|
||||
DetectEngineThreadCtxDeinit(&tv, det_ctx);
|
||||
if (de_ctx != NULL)
|
||||
SigGroupCleanup(de_ctx);
|
||||
if (de_ctx != NULL)
|
||||
DetectEngineCtxFree(de_ctx);
|
||||
|
||||
StreamTcpFreeConfig(TRUE);
|
||||
FLOW_DESTROY(&f);
|
||||
UTHFreePacket(p);
|
||||
return result;
|
||||
}
|
||||
|
||||
/**
|
||||
* \test Test matching on a simple google.com SNI with pcre
|
||||
*/
|
||||
static int DetectTlsSniTest02(void)
|
||||
{
|
||||
/* client hello */
|
||||
uint8_t buf[] = { 0x16, 0x03, 0x03, 0x00, 0xAE, 0x01, 0x00, 0x00, 0xAA,
|
||||
0x03, 0x03, 0x57, 0x04, 0x9F, 0x5D, 0xC9, 0x5C, 0x87,
|
||||
0xAE, 0xF2, 0xA7, 0x4A, 0xFC, 0x59, 0x78, 0x23, 0x31,
|
||||
0x61, 0x2D, 0x29, 0x92, 0xB6, 0x70, 0xA5, 0xA1, 0xFC,
|
||||
0x0E, 0x79, 0xFE, 0xC3, 0x97, 0x37, 0xC0, 0x00, 0x00,
|
||||
0x44, 0x00, 0x04, 0x00, 0x05, 0x00, 0x0A, 0x00, 0x0D,
|
||||
0x00, 0x10, 0x00, 0x13, 0x00, 0x16, 0x00, 0x2F, 0x00,
|
||||
0x30, 0x00, 0x31, 0x00, 0x32, 0x00, 0x33, 0x00, 0x35,
|
||||
0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, 0x39, 0x00,
|
||||
0x3C, 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x40,
|
||||
0x00, 0x41, 0x00, 0x44, 0x00, 0x45, 0x00, 0x66, 0x00,
|
||||
0x67, 0x00, 0x68, 0x00, 0x69, 0x00, 0x6A, 0x00, 0x6B,
|
||||
0x00, 0x84, 0x00, 0x87, 0x00, 0xFF, 0x01, 0x00, 0x00,
|
||||
0x13, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x0D, 0x00, 0x00,
|
||||
0x0A, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x2E, 0x63,
|
||||
0x6F, 0x6D, };
|
||||
|
||||
int result = 0;
|
||||
Flow f;
|
||||
SSLState *ssl_state = NULL;
|
||||
Packet *p = NULL;
|
||||
Signature *s = NULL;
|
||||
ThreadVars tv;
|
||||
DetectEngineThreadCtx *det_ctx = NULL;
|
||||
TcpSession ssn;
|
||||
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
|
||||
|
||||
memset(&tv, 0, sizeof(ThreadVars));
|
||||
memset(&f, 0, sizeof(Flow));
|
||||
memset(&ssn, 0, sizeof(TcpSession));
|
||||
|
||||
p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP,
|
||||
"192.168.1.5", "192.168.1.1",
|
||||
41424, 443);
|
||||
|
||||
FLOW_INITIALIZE(&f);
|
||||
f.protoctx = (void *)&ssn;
|
||||
f.flags |= FLOW_IPV4;
|
||||
f.proto = IPPROTO_TCP;
|
||||
f.protomap = FlowGetProtoMapping(f.proto);
|
||||
|
||||
p->flow = &f;
|
||||
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
||||
p->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED;
|
||||
f.alproto = ALPROTO_TLS;
|
||||
|
||||
StreamTcpInitConfig(TRUE);
|
||||
|
||||
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
||||
if (de_ctx == NULL) {
|
||||
goto end;
|
||||
}
|
||||
de_ctx->mpm_matcher = DEFAULT_MPM;
|
||||
de_ctx->flags |= DE_QUIET;
|
||||
|
||||
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
|
||||
"(msg:\"Test tls_sni option\"; "
|
||||
"tls_sni; content:\"google\"; nocase; "
|
||||
"pcre:\"/google\\.com$/i\"; sid:1;)");
|
||||
if (s == NULL) {
|
||||
goto end;
|
||||
}
|
||||
|
||||
s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
|
||||
"(msg:\"Test tls_sni option\"; "
|
||||
"tls_sni; content:\"google\"; nocase; "
|
||||
"pcre:\"/^\\.[a-z]{2,3}$/iR\"; sid:2;)");
|
||||
if (s == NULL) {
|
||||
goto end;
|
||||
}
|
||||
|
||||
SigGroupBuild(de_ctx);
|
||||
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
||||
|
||||
SCMutexLock(&f.m);
|
||||
int r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf, sizeof(buf));
|
||||
if (r != 0) {
|
||||
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
||||
SCMutexUnlock(&f.m);
|
||||
goto end;
|
||||
}
|
||||
SCMutexUnlock(&f.m);
|
||||
|
||||
ssl_state = f.alstate;
|
||||
if (ssl_state == NULL) {
|
||||
printf("no ssl state: ");
|
||||
goto end;
|
||||
}
|
||||
|
||||
/* do detect */
|
||||
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
|
||||
|
||||
if (!(PacketAlertCheck(p, 1))) {
|
||||
printf("sig 1 didn't alert, but it should have: ");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (!(PacketAlertCheck(p, 2))) {
|
||||
printf("sig 2 didn't alert, but it should have: ");
|
||||
goto end;
|
||||
}
|
||||
|
||||
result = 1;
|
||||
|
||||
end:
|
||||
if (alp_tctx != NULL)
|
||||
AppLayerParserThreadCtxFree(alp_tctx);
|
||||
if (det_ctx != NULL)
|
||||
DetectEngineThreadCtxDeinit(&tv, det_ctx);
|
||||
if (de_ctx != NULL)
|
||||
SigGroupCleanup(de_ctx);
|
||||
if (de_ctx != NULL)
|
||||
DetectEngineCtxFree(de_ctx);
|
||||
|
||||
StreamTcpFreeConfig(TRUE);
|
||||
FLOW_DESTROY(&f);
|
||||
UTHFreePacket(p);
|
||||
return result;
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
static void DetectTlsSniRegisterTests(void)
|
||||
{
|
||||
#ifdef UNITTESTS
|
||||
UtRegisterTest("DetectTlsSniTest01", DetectTlsSniTest01);
|
||||
UtRegisterTest("DetectTlsSniTest02", DetectTlsSniTest02);
|
||||
#endif
|
||||
}
|
||||
@ -0,0 +1,33 @@
|
||||
/* Copyright (C) 2016 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Mats Klepsland <mats.klepsland@gmail.com>
|
||||
*/
|
||||
|
||||
#ifndef __DETECT_TLS_SNI_H__
|
||||
#define __DETECT_TLS_SNI_H__
|
||||
|
||||
#include "app-layer-ssl.h"
|
||||
|
||||
void DetectTlsSniRegister(void);
|
||||
uint32_t DetectTlsSniInspectMpm(DetectEngineThreadCtx *det_ctx, Flow *f,
|
||||
SSLState *ssl_state, uint8_t flags);
|
||||
|
||||
#endif /* __DETECT_TLS_SNI_H__ */
|
||||
Loading…
Reference in New Issue