aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect app-layer-event: fix tests

Browse Source
pull/2081/head
Victor Julien 9 years ago
parent 80716f860e
commit fbf0a7aa45
1 changed files with 44 additions and 103 deletions
Show Stats Download Patch File Download Diff File

147
src/detect-app-layer-event.c
Unescape Escape View File

@ -44,7 +44,7 @@
#include "util-debug.h" #include "util-debug.h"
#include "util-unittest.h" #include "util-unittest.h"
#include "util-unittest-helper.h" #include "util-unittest-helper.h"
#include "stream-tcp-util.h"
static int DetectAppLayerEventPktMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, static int DetectAppLayerEventPktMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
Packet *p, Signature *s, const SigMatchCtx *ctx); Packet *p, Signature *s, const SigMatchCtx *ctx);
@ -489,7 +489,6 @@ int DetectAppLayerEventTest02(void)
int DetectAppLayerEventTest03(void) int DetectAppLayerEventTest03(void)
{ {
int result = 0;
ThreadVars tv; ThreadVars tv;
TcpReassemblyThreadCtx *ra_ctx = NULL; TcpReassemblyThreadCtx *ra_ctx = NULL;
Packet *p = NULL; Packet *p = NULL;
@ -530,70 +529,53 @@ int DetectAppLayerEventTest03(void)
ssn.data_first_seen_dir = STREAM_TOSERVER; ssn.data_first_seen_dir = STREAM_TOSERVER;
de_ctx = DetectEngineCtxInit(); de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) FAIL_IF(de_ctx == NULL);
goto end;
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(app-layer-event: applayer_mismatch_protocol_both_directions; " "(app-layer-event: applayer_mismatch_protocol_both_directions; "
"sid:1;)"); "sid:1;)");
if (de_ctx->sig_list == NULL) FAIL_IF(de_ctx->sig_list == NULL);
goto end;
SigGroupBuild(de_ctx); SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 200, 220); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 200, 220);
if (f == NULL) FAIL_IF(f == NULL);
goto end;
FLOW_INITIALIZE(f); FLOW_INITIALIZE(f);
f->protoctx = &ssn; f->protoctx = &ssn;
f->proto = IPPROTO_TCP; f->proto = IPPROTO_TCP;
f->flags |= FLOW_IPV4; f->flags |= FLOW_IPV4;
p = PacketGetFromAlloc(); p = PacketGetFromAlloc();
if (unlikely(p == NULL)) FAIL_IF(unlikely(p == NULL));
goto end;
p->flow = f; p->flow = f;
p->src.family = AF_INET; p->src.family = AF_INET;
p->dst.family = AF_INET; p->dst.family = AF_INET;
p->proto = IPPROTO_TCP; p->proto = IPPROTO_TCP;
ra_ctx = StreamTcpReassembleInitThreadCtx(&tv); StreamTcpUTInit(&ra_ctx);
if (ra_ctx == NULL)
goto end;
StreamTcpInitConfig(TRUE);
p->flowflags = FLOW_PKT_TOSERVER; p->flowflags = FLOW_PKT_TOSERVER;
if (AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_ts, buf_ts, FAIL_IF(AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_ts, buf_ts,
sizeof(buf_ts), STREAM_TOSERVER | STREAM_START) < 0) { sizeof(buf_ts), STREAM_TOSERVER | STREAM_START) < 0);
printf("AppLayerHandleTCPData failure\n");
goto end;
}
SigMatchSignatures(&tv, de_ctx, det_ctx, p); SigMatchSignatures(&tv, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) {
printf("sid 1 matched but shouldn't have\n"); FAIL_IF (PacketAlertCheck(p, 1));
goto end;
}
p->flowflags = FLOW_PKT_TOCLIENT; p->flowflags = FLOW_PKT_TOCLIENT;
if (AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_tc, buf_tc, FAIL_IF (AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_tc, buf_tc,
sizeof(buf_tc), STREAM_TOCLIENT | STREAM_START) < 0) { sizeof(buf_tc), STREAM_TOCLIENT | STREAM_START) < 0);
printf("AppLayerHandleTCPData failure\n");
goto end;
}
SigMatchSignatures(&tv, de_ctx, det_ctx, p); SigMatchSignatures(&tv, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) {
printf("sid 1 matched but shouldn't have\n");
goto end;
}
result = 1; FAIL_IF(PacketAlertCheck(p, 1));
end:
return result; StreamTcpUTDeinit(ra_ctx);
PASS;
} }
int DetectAppLayerEventTest04(void) int DetectAppLayerEventTest04(void)
{ {
int result = 0;
ThreadVars tv; ThreadVars tv;
TcpReassemblyThreadCtx *ra_ctx = NULL; TcpReassemblyThreadCtx *ra_ctx = NULL;
Packet *p = NULL; Packet *p = NULL;
@ -634,70 +616,49 @@ int DetectAppLayerEventTest04(void)
ssn.data_first_seen_dir = STREAM_TOSERVER; ssn.data_first_seen_dir = STREAM_TOSERVER;
de_ctx = DetectEngineCtxInit(); de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) FAIL_IF (de_ctx == NULL);
goto end;
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(app-layer-event: applayer_detect_protocol_only_one_direction; " "(app-layer-event: applayer_detect_protocol_only_one_direction; "
"sid:1;)"); "sid:1;)");
if (de_ctx->sig_list == NULL) FAIL_IF(de_ctx->sig_list == NULL);
goto end;
SigGroupBuild(de_ctx); SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 200, 220); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 200, 220);
if (f == NULL) FAIL_IF (f == NULL);
goto end;
FLOW_INITIALIZE(f); FLOW_INITIALIZE(f);
f->protoctx = &ssn; f->protoctx = &ssn;
f->proto = IPPROTO_TCP; f->proto = IPPROTO_TCP;
f->flags |= FLOW_IPV4; f->flags |= FLOW_IPV4;
p = PacketGetFromAlloc(); p = PacketGetFromAlloc();
if (unlikely(p == NULL)) FAIL_IF(unlikely(p == NULL));
goto end;
p->flow = f; p->flow = f;
p->src.family = AF_INET; p->src.family = AF_INET;
p->dst.family = AF_INET; p->dst.family = AF_INET;
p->proto = IPPROTO_TCP; p->proto = IPPROTO_TCP;
ra_ctx = StreamTcpReassembleInitThreadCtx(&tv); StreamTcpUTInit(&ra_ctx);
if (ra_ctx == NULL)
goto end;
StreamTcpInitConfig(TRUE);
p->flowflags = FLOW_PKT_TOSERVER; p->flowflags = FLOW_PKT_TOSERVER;
if (AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_ts, buf_ts, FAIL_IF(AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_ts, buf_ts,
sizeof(buf_ts), STREAM_TOSERVER | STREAM_START) < 0) { sizeof(buf_ts), STREAM_TOSERVER | STREAM_START) < 0);
printf("AppLayerHandleTCPData failure\n");
goto end;
}
SigMatchSignatures(&tv, de_ctx, det_ctx, p); SigMatchSignatures(&tv, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) { FAIL_IF (PacketAlertCheck(p, 1));
printf("sid 1 matched but shouldn't have\n");
goto end;
}
p->flowflags = FLOW_PKT_TOCLIENT; p->flowflags = FLOW_PKT_TOCLIENT;
if (AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_tc, buf_tc, FAIL_IF (AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_tc, buf_tc,
sizeof(buf_tc), STREAM_TOCLIENT | STREAM_START) < 0) { sizeof(buf_tc), STREAM_TOCLIENT | STREAM_START) < 0);
printf("AppLayerHandleTCPData failure\n");
goto end;
}
SigMatchSignatures(&tv, de_ctx, det_ctx, p); SigMatchSignatures(&tv, de_ctx, det_ctx, p);
if (!PacketAlertCheck(p, 1)) { FAIL_IF (!PacketAlertCheck(p, 1));
printf("sid 1 didn't match but should have\n");
goto end;
}
result = 1; StreamTcpUTDeinit(ra_ctx);
end: PASS;
return result;
} }
int DetectAppLayerEventTest05(void) int DetectAppLayerEventTest05(void)
{ {
int result = 0;
ThreadVars tv; ThreadVars tv;
TcpReassemblyThreadCtx *ra_ctx = NULL; TcpReassemblyThreadCtx *ra_ctx = NULL;
Packet *p = NULL; Packet *p = NULL;
@ -754,65 +715,45 @@ int DetectAppLayerEventTest05(void)
ssn.data_first_seen_dir = STREAM_TOSERVER; ssn.data_first_seen_dir = STREAM_TOSERVER;
de_ctx = DetectEngineCtxInit(); de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) FAIL_IF (de_ctx == NULL);
goto end;
de_ctx->flags |= DE_QUIET; de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(app-layer-event: applayer_mismatch_protocol_both_directions; " "(app-layer-event: applayer_mismatch_protocol_both_directions; "
"sid:1;)"); "sid:1;)");
if (de_ctx->sig_list == NULL) FAIL_IF (de_ctx->sig_list == NULL);
goto end;
SigGroupBuild(de_ctx); SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 200, 220); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 200, 220);
if (f == NULL) FAIL_IF (f == NULL);
goto end;
FLOW_INITIALIZE(f); FLOW_INITIALIZE(f);
f->protoctx = &ssn; f->protoctx = &ssn;
f->proto = IPPROTO_TCP; f->proto = IPPROTO_TCP;
f->flags |= FLOW_IPV4; f->flags |= FLOW_IPV4;
p = PacketGetFromAlloc(); p = PacketGetFromAlloc();
if (unlikely(p == NULL)) FAIL_IF (unlikely(p == NULL));
goto end;
p->flow = f; p->flow = f;
p->src.family = AF_INET; p->src.family = AF_INET;
p->dst.family = AF_INET; p->dst.family = AF_INET;
p->proto = IPPROTO_TCP; p->proto = IPPROTO_TCP;
ra_ctx = StreamTcpReassembleInitThreadCtx(&tv); StreamTcpUTInit(&ra_ctx);
if (ra_ctx == NULL)
goto end;
StreamTcpInitConfig(TRUE);
p->flowflags = FLOW_PKT_TOSERVER; p->flowflags = FLOW_PKT_TOSERVER;
if (AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_ts, buf_ts, FAIL_IF (AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_ts, buf_ts,
sizeof(buf_ts), STREAM_TOSERVER | STREAM_START) < 0) { sizeof(buf_ts), STREAM_TOSERVER | STREAM_START) < 0);
printf("AppLayerHandleTCPData failure\n");
goto end;
}
SigMatchSignatures(&tv, de_ctx, det_ctx, p); SigMatchSignatures(&tv, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) { FAIL_IF (PacketAlertCheck(p, 1));
printf("sid 1 matched but shouldn't have\n");
goto end;
}
p->flowflags = FLOW_PKT_TOCLIENT; p->flowflags = FLOW_PKT_TOCLIENT;
if (AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_tc, buf_tc, FAIL_IF (AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_tc, buf_tc,
sizeof(buf_tc), STREAM_TOCLIENT | STREAM_START) < 0) { sizeof(buf_tc), STREAM_TOCLIENT | STREAM_START) < 0);
printf("AppLayerHandleTCPData failure\n");
goto end;
}
SigMatchSignatures(&tv, de_ctx, det_ctx, p); SigMatchSignatures(&tv, de_ctx, det_ctx, p);
if (!PacketAlertCheck(p, 1)) { FAIL_IF (!PacketAlertCheck(p, 1));
printf("sid 1 didn't match but should have\n");
goto end;
}
result = 1; StreamTcpUTDeinit(ra_ctx);
end: PASS;
return result;
} }
#endif /* UNITTESTS */ #endif /* UNITTESTS */

Write Preview
Loading…
Cancel
Save