mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
2819 lines
74 KiB
C
2819 lines
74 KiB
C
/* Copyright (C) 2007-2010 Open Information Security Foundation
|
|
*
|
|
* You can copy, redistribute or modify this Program under the terms of
|
|
* the GNU General Public License version 2 as published by the Free
|
|
* Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* version 2 along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
* 02110-1301, USA.
|
|
*/
|
|
|
|
/**
|
|
* \file
|
|
*
|
|
* \author Victor Julien <victor@inliniac.net>
|
|
*
|
|
* Ports part of the detection engine.
|
|
*
|
|
* \todo move this out of the detection plugin structure
|
|
* \todo more unittesting
|
|
*
|
|
*/
|
|
|
|
#include "suricata-common.h"
|
|
#include "decode.h"
|
|
#include "detect.h"
|
|
#include "flow-var.h"
|
|
|
|
#include "util-cidr.h"
|
|
#include "util-unittest.h"
|
|
#include "util-unittest-helper.h"
|
|
#include "util-rule-vars.h"
|
|
|
|
#include "detect-parse.h"
|
|
#include "detect-engine.h"
|
|
#include "detect-engine-mpm.h"
|
|
|
|
#include "detect-engine-siggroup.h"
|
|
#include "detect-engine-port.h"
|
|
|
|
#include "conf.h"
|
|
#include "util-debug.h"
|
|
#include "util-error.h"
|
|
|
|
#include "pkt-var.h"
|
|
#include "host.h"
|
|
#include "util-profiling.h"
|
|
#include "util-var.h"
|
|
|
|
static int DetectPortCutNot(DetectPort *, DetectPort **);
|
|
static int DetectPortCut(DetectEngineCtx *, DetectPort *, DetectPort *,
|
|
DetectPort **);
|
|
DetectPort *PortParse(const char *str);
|
|
int DetectPortIsValidRange(char *);
|
|
|
|
/**
|
|
* \brief Alloc a DetectPort structure and update counters
|
|
*
|
|
* \retval sgh Pointer to the newly created DetectPort on success; or NULL in
|
|
* case of error.
|
|
*/
|
|
static DetectPort *DetectPortInit(void)
|
|
{
|
|
DetectPort *dp = SCMalloc(sizeof(DetectPort));
|
|
if (unlikely(dp == NULL))
|
|
return NULL;
|
|
memset(dp, 0, sizeof(DetectPort));
|
|
|
|
return dp;
|
|
}
|
|
|
|
/**
|
|
* \brief Free a DetectPort and its members
|
|
*
|
|
* \param dp Pointer to the DetectPort that has to be freed.
|
|
*/
|
|
void DetectPortFree(const DetectEngineCtx *de_ctx, DetectPort *dp)
|
|
{
|
|
if (dp == NULL)
|
|
return;
|
|
|
|
/* only free the head if we have the original */
|
|
if (dp->sh != NULL && !(dp->flags & PORT_SIGGROUPHEAD_COPY)) {
|
|
SigGroupHeadFree(de_ctx, dp->sh);
|
|
}
|
|
dp->sh = NULL;
|
|
|
|
SCFree(dp);
|
|
}
|
|
|
|
/**
|
|
* \brief Helper function used to print the list of ports
|
|
* present in this DetectPort list.
|
|
*
|
|
* \param head Pointer to the DetectPort list head
|
|
*/
|
|
void DetectPortPrintList(DetectPort *head)
|
|
{
|
|
DetectPort *cur;
|
|
uint16_t cnt = 0;
|
|
|
|
SCLogDebug("= list start:");
|
|
if (head != NULL) {
|
|
for (cur = head; cur != NULL; cur = cur->next) {
|
|
DetectPortPrint(cur);
|
|
cnt++;
|
|
}
|
|
SCLogDebug(" ");
|
|
}
|
|
SCLogDebug("= list end (cnt %" PRIu32 ")", cnt);
|
|
}
|
|
|
|
/**
|
|
* \brief Free a DetectPort list and each of its members
|
|
*
|
|
* \param head Pointer to the DetectPort list head
|
|
*/
|
|
void DetectPortCleanupList (const DetectEngineCtx *de_ctx, DetectPort *head)
|
|
{
|
|
if (head == NULL)
|
|
return;
|
|
|
|
DetectPort *cur, *next;
|
|
|
|
for (cur = head; cur != NULL; ) {
|
|
next = cur->next;
|
|
cur->next = NULL;
|
|
DetectPortFree(de_ctx, cur);
|
|
cur = next;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* \brief Copy and insert the new DetectPort, with a copy list of sigs
|
|
*
|
|
* \param de_ctx Pointer to the current detection engine context
|
|
* \param head Pointer to the DetectPort list head
|
|
* \param new Pointer to DetectPort to search in the DetectPort list
|
|
*
|
|
* \retval 0 if dp is added correctly
|
|
*/
|
|
int DetectPortInsertCopy(DetectEngineCtx *de_ctx, DetectPort **head,
|
|
DetectPort *new)
|
|
{
|
|
DetectPort *copy = DetectPortCopySingle(de_ctx,new);
|
|
if (copy == NULL)
|
|
return -1;
|
|
|
|
return DetectPortInsert(de_ctx, head, copy);
|
|
}
|
|
|
|
/**
|
|
* \brief function for inserting a port group object. This also makes sure
|
|
* SigGroupContainer lists are handled correctly.
|
|
*
|
|
* \param de_ctx Pointer to the current detection engine context
|
|
* \param head Pointer to the DetectPort list head
|
|
* \param dp DetectPort to search in the DetectPort list
|
|
*
|
|
* \retval 1 inserted
|
|
* \retval 0 not inserted, memory of new is freed
|
|
* \retval -1 error
|
|
* */
|
|
int DetectPortInsert(DetectEngineCtx *de_ctx, DetectPort **head,
|
|
DetectPort *new)
|
|
{
|
|
if (new == NULL)
|
|
return 0;
|
|
|
|
//BUG_ON(new->next != NULL);
|
|
//BUG_ON(new->prev != NULL);
|
|
|
|
/* see if it already exists or overlaps with existing ag's */
|
|
if (*head != NULL) {
|
|
DetectPort *cur = NULL;
|
|
int r = 0;
|
|
|
|
for (cur = *head; cur != NULL; cur = cur->next) {
|
|
r = DetectPortCmp(new,cur);
|
|
BUG_ON(r == PORT_ER);
|
|
|
|
/* if so, handle that */
|
|
if (r == PORT_EQ) {
|
|
SCLogDebug("PORT_EQ %p %p", cur, new);
|
|
/* exact overlap/match */
|
|
if (cur != new) {
|
|
SigGroupHeadCopySigs(de_ctx, new->sh, &cur->sh);
|
|
DetectPortFree(de_ctx, new);
|
|
return 0;
|
|
}
|
|
return 1;
|
|
} else if (r == PORT_GT) {
|
|
SCLogDebug("PORT_GT (cur->next %p)", cur->next);
|
|
/* only add it now if we are bigger than the last
|
|
* group. Otherwise we'll handle it later. */
|
|
if (cur->next == NULL) {
|
|
SCLogDebug("adding GT");
|
|
/* put in the list */
|
|
new->prev = cur;
|
|
cur->next = new;
|
|
return 1;
|
|
}
|
|
} else if (r == PORT_LT) {
|
|
SCLogDebug("PORT_LT");
|
|
|
|
/* see if we need to insert the ag anywhere */
|
|
/* put in the list */
|
|
if (cur->prev != NULL)
|
|
cur->prev->next = new;
|
|
new->prev = cur->prev;
|
|
new->next = cur;
|
|
cur->prev = new;
|
|
|
|
/* update head if required */
|
|
if (*head == cur) {
|
|
*head = new;
|
|
}
|
|
return 1;
|
|
|
|
/* alright, those were the simple cases,
|
|
* lets handle the more complex ones now */
|
|
|
|
} else {
|
|
DetectPort *c = NULL;
|
|
r = DetectPortCut(de_ctx, cur, new, &c);
|
|
if (r == -1)
|
|
goto error;
|
|
|
|
r = DetectPortInsert(de_ctx, head, new);
|
|
if (r == -1)
|
|
goto error;
|
|
|
|
if (c != NULL) {
|
|
SCLogDebug("inserting C (%p)", c);
|
|
if (SCLogDebugEnabled()) {
|
|
DetectPortPrint(c);
|
|
}
|
|
r = DetectPortInsert(de_ctx, head, c);
|
|
if (r == -1)
|
|
goto error;
|
|
}
|
|
return 1;
|
|
|
|
}
|
|
}
|
|
|
|
/* head is NULL, so get a group and set head to it */
|
|
} else {
|
|
SCLogDebug("setting new head %p", new);
|
|
*head = new;
|
|
}
|
|
|
|
return 1;
|
|
error:
|
|
/* XXX */
|
|
return -1;
|
|
}
|
|
|
|
/**
|
|
* \brief Function that cuts port groups and merge them
|
|
*
|
|
* \param de_ctx Pointer to the current detection engine context
|
|
* \param a pointer to DetectPort "a"
|
|
* \param b pointer to DetectPort "b"
|
|
* \param c pointer to DetectPort "c"
|
|
*
|
|
* \retval 0 ok
|
|
* \retval -1 error
|
|
* */
|
|
static int DetectPortCut(DetectEngineCtx *de_ctx, DetectPort *a,
|
|
DetectPort *b, DetectPort **c)
|
|
{
|
|
uint32_t a_port1 = a->port;
|
|
uint32_t a_port2 = a->port2;
|
|
uint32_t b_port1 = b->port;
|
|
uint32_t b_port2 = b->port2;
|
|
DetectPort *tmp = NULL;
|
|
|
|
/* default to NULL */
|
|
*c = NULL;
|
|
|
|
int r = DetectPortCmp(a,b);
|
|
BUG_ON(r != PORT_ES && r != PORT_EB && r != PORT_LE && r != PORT_GE);
|
|
|
|
/* get a place to temporary put sigs lists */
|
|
tmp = DetectPortInit();
|
|
if (tmp == NULL) {
|
|
goto error;
|
|
}
|
|
memset(tmp, 0, sizeof(DetectPort));
|
|
|
|
/**
|
|
* We have 3 parts: [aaa[abab]bbb]
|
|
* part a: a_port1 <-> b_port1 - 1
|
|
* part b: b_port1 <-> a_port2
|
|
* part c: a_port2 + 1 <-> b_port2
|
|
*/
|
|
if (r == PORT_LE) {
|
|
SCLogDebug("cut r == PORT_LE");
|
|
a->port = a_port1;
|
|
a->port2 = b_port1 - 1;
|
|
|
|
b->port = b_port1;
|
|
b->port2 = a_port2;
|
|
|
|
DetectPort *tmp_c;
|
|
tmp_c = DetectPortInit();
|
|
if (tmp_c == NULL) {
|
|
goto error;
|
|
}
|
|
*c = tmp_c;
|
|
|
|
tmp_c->port = a_port2 + 1;
|
|
tmp_c->port2 = b_port2;
|
|
|
|
SigGroupHeadCopySigs(de_ctx,b->sh,&tmp_c->sh); /* copy old b to c */
|
|
SigGroupHeadCopySigs(de_ctx,a->sh,&b->sh); /* copy a to b */
|
|
|
|
/**
|
|
* We have 3 parts: [bbb[baba]aaa]
|
|
* part a: b_port1 <-> a_port1 - 1
|
|
* part b: a_port1 <-> b_port2
|
|
* part c: b_port2 + 1 <-> a_port2
|
|
*/
|
|
} else if (r == PORT_GE) {
|
|
SCLogDebug("cut r == PORT_GE");
|
|
a->port = b_port1;
|
|
a->port2 = a_port1 - 1;
|
|
|
|
b->port = a_port1;
|
|
b->port2 = b_port2;
|
|
|
|
DetectPort *tmp_c;
|
|
tmp_c = DetectPortInit();
|
|
if (tmp_c == NULL) {
|
|
goto error;
|
|
}
|
|
*c = tmp_c;
|
|
|
|
tmp_c->port = b_port2 + 1;
|
|
tmp_c->port2 = a_port2;
|
|
|
|
/**
|
|
* 'a' gets clean and then 'b' sigs
|
|
* 'b' gets clean, then 'a' then 'b' sigs
|
|
* 'c' gets 'a' sigs
|
|
*/
|
|
SigGroupHeadCopySigs(de_ctx,a->sh,&tmp->sh); /* store old a list */
|
|
SigGroupHeadClearSigs(a->sh); /* clean a list */
|
|
SigGroupHeadCopySigs(de_ctx,tmp->sh,&tmp_c->sh); /* copy old b to c */
|
|
SigGroupHeadCopySigs(de_ctx,b->sh,&a->sh); /* copy old b to a */
|
|
SigGroupHeadCopySigs(de_ctx,tmp->sh,&b->sh);/* prepend old a before b */
|
|
|
|
SigGroupHeadClearSigs(tmp->sh); /* clean tmp list */
|
|
|
|
/**
|
|
* We have 2 or three parts:
|
|
*
|
|
* 2 part: [[abab]bbb] or [bbb[baba]]
|
|
* part a: a_port1 <-> a_port2
|
|
* part b: a_port2 + 1 <-> b_port2
|
|
*
|
|
* part a: b_port1 <-> a_port1 - 1
|
|
* part b: a_port1 <-> a_port2
|
|
*
|
|
* 3 part [bbb[aaa]bbb]
|
|
* becomes[aaa[bbb]ccc]
|
|
*
|
|
* part a: b_port1 <-> a_port1 - 1
|
|
* part b: a_port1 <-> a_port2
|
|
* part c: a_port2 + 1 <-> b_port2
|
|
*/
|
|
} else if (r == PORT_ES) {
|
|
SCLogDebug("cut r == PORT_ES");
|
|
if (a_port1 == b_port1) {
|
|
SCLogDebug("1");
|
|
a->port = a_port1;
|
|
a->port2 = a_port2;
|
|
|
|
b->port = a_port2 + 1;
|
|
b->port2 = b_port2;
|
|
|
|
/** 'b' overlaps 'a' so 'a' needs the 'b' sigs */
|
|
SigGroupHeadCopySigs(de_ctx,b->sh,&a->sh);
|
|
|
|
} else if (a_port2 == b_port2) {
|
|
SCLogDebug("2");
|
|
a->port = b_port1;
|
|
a->port2 = a_port1 - 1;
|
|
|
|
b->port = a_port1;
|
|
b->port2 = a_port2;
|
|
|
|
/* [bbb[baba]] will be transformed into
|
|
* [aaa][bbb]
|
|
* steps: copy b sigs to tmp
|
|
* a overlaps b, so copy a to b
|
|
* clear a
|
|
* copy tmp to a */
|
|
SigGroupHeadCopySigs(de_ctx,b->sh,&tmp->sh); /* store old a list */
|
|
SigGroupHeadCopySigs(de_ctx,a->sh,&b->sh);
|
|
SigGroupHeadClearSigs(a->sh); /* clean a list */
|
|
SigGroupHeadCopySigs(de_ctx,tmp->sh,&a->sh);/* merge old a with b */
|
|
SigGroupHeadClearSigs(tmp->sh); /* clean tmp list */
|
|
} else {
|
|
SCLogDebug("3");
|
|
a->port = b_port1;
|
|
a->port2 = a_port1 - 1;
|
|
|
|
b->port = a_port1;
|
|
b->port2 = a_port2;
|
|
|
|
DetectPort *tmp_c;
|
|
tmp_c = DetectPortInit();
|
|
if (tmp_c == NULL) {
|
|
goto error;
|
|
}
|
|
*c = tmp_c;
|
|
|
|
tmp_c->port = a_port2 + 1;
|
|
tmp_c->port2 = b_port2;
|
|
|
|
/**
|
|
* 'a' gets clean and then 'b' sigs
|
|
* 'b' gets clean, then 'a' then 'b' sigs
|
|
* 'c' gets 'b' sigs
|
|
*/
|
|
SigGroupHeadCopySigs(de_ctx,a->sh,&tmp->sh); /* store old a list */
|
|
SigGroupHeadClearSigs(a->sh); /* clean a list */
|
|
SigGroupHeadCopySigs(de_ctx,b->sh,&tmp_c->sh); /* copy old b to c */
|
|
SigGroupHeadCopySigs(de_ctx,b->sh,&a->sh); /* copy old b to a */
|
|
SigGroupHeadCopySigs(de_ctx,tmp->sh,&b->sh);/* merge old a with b */
|
|
|
|
SigGroupHeadClearSigs(tmp->sh); /* clean tmp list */
|
|
}
|
|
/**
|
|
* We have 2 or three parts:
|
|
*
|
|
* 2 part: [[baba]aaa] or [aaa[abab]]
|
|
* part a: b_port1 <-> b_port2
|
|
* part b: b_port2 + 1 <-> a_port2
|
|
*
|
|
* part a: a_port1 <-> b_port1 - 1
|
|
* part b: b_port1 <-> b_port2
|
|
*
|
|
* 3 part [aaa[bbb]aaa]
|
|
* becomes[aaa[bbb]ccc]
|
|
*
|
|
* part a: a_port1 <-> b_port2 - 1
|
|
* part b: b_port1 <-> b_port2
|
|
* part c: b_port2 + 1 <-> a_port2
|
|
*/
|
|
} else if (r == PORT_EB) {
|
|
SCLogDebug("cut r == PORT_EB");
|
|
if (a_port1 == b_port1) {
|
|
SCLogDebug("1");
|
|
a->port = b_port1;
|
|
a->port2 = b_port2;
|
|
|
|
b->port = b_port2 + 1;
|
|
b->port2 = a_port2;
|
|
|
|
/** 'b' overlaps 'a' so 'a' needs the 'b' sigs */
|
|
SigGroupHeadCopySigs(de_ctx,b->sh,&tmp->sh);
|
|
SigGroupHeadClearSigs(b->sh);
|
|
SigGroupHeadCopySigs(de_ctx,a->sh,&b->sh);
|
|
SigGroupHeadCopySigs(de_ctx,tmp->sh,&a->sh);
|
|
|
|
SigGroupHeadClearSigs(tmp->sh);
|
|
|
|
} else if (a_port2 == b_port2) {
|
|
SCLogDebug("2");
|
|
|
|
a->port = a_port1;
|
|
a->port2 = b_port1 - 1;
|
|
|
|
b->port = b_port1;
|
|
b->port2 = b_port2;
|
|
|
|
/** 'a' overlaps 'b' so 'b' needs the 'a' sigs */
|
|
SigGroupHeadCopySigs(de_ctx,a->sh,&b->sh);
|
|
|
|
} else {
|
|
SCLogDebug("3");
|
|
a->port = a_port1;
|
|
a->port2 = b_port1 - 1;
|
|
|
|
b->port = b_port1;
|
|
b->port2 = b_port2;
|
|
|
|
DetectPort *tmp_c;
|
|
tmp_c = DetectPortInit();
|
|
if (tmp_c == NULL) {
|
|
goto error;
|
|
}
|
|
*c = tmp_c;
|
|
|
|
tmp_c->port = b_port2 + 1;
|
|
tmp_c->port2 = a_port2;
|
|
|
|
SigGroupHeadCopySigs(de_ctx,a->sh,&b->sh);
|
|
SigGroupHeadCopySigs(de_ctx,a->sh,&tmp_c->sh);
|
|
}
|
|
}
|
|
|
|
if (tmp != NULL) {
|
|
DetectPortFree(de_ctx, tmp);
|
|
}
|
|
return 0;
|
|
|
|
error:
|
|
if (tmp != NULL)
|
|
DetectPortFree(de_ctx, tmp);
|
|
return -1;
|
|
}
|
|
|
|
/**
|
|
* \brief Function that cuts port groups implementing group negation
|
|
*
|
|
* \param a pointer to DetectPort "a"
|
|
* \param b pointer to DetectPort "b"
|
|
*
|
|
* \retval 0 ok
|
|
* \retval -1 error
|
|
* */
|
|
static int DetectPortCutNot(DetectPort *a, DetectPort **b)
|
|
{
|
|
uint16_t a_port1 = a->port;
|
|
uint16_t a_port2 = a->port2;
|
|
|
|
/* default to NULL */
|
|
*b = NULL;
|
|
|
|
if (a_port1 != 0x0000 && a_port2 != 0xFFFF) {
|
|
a->port = 0x0000;
|
|
a->port2 = a_port1 - 1;
|
|
|
|
DetectPort *tmp_b;
|
|
tmp_b = DetectPortInit();
|
|
if (tmp_b == NULL) {
|
|
goto error;
|
|
}
|
|
|
|
tmp_b->port = a_port2 + 1;
|
|
tmp_b->port2 = 0xFFFF;
|
|
*b = tmp_b;
|
|
|
|
} else if (a_port1 == 0x0000 && a_port2 != 0xFFFF) {
|
|
a->port = a_port2 + 1;
|
|
a->port2 = 0xFFFF;
|
|
|
|
} else if (a_port1 != 0x0000 && a_port2 == 0xFFFF) {
|
|
a->port = 0x0000;
|
|
a->port2 = a_port1 - 1;
|
|
} else {
|
|
goto error;
|
|
}
|
|
|
|
return 0;
|
|
|
|
error:
|
|
return -1;
|
|
}
|
|
|
|
/**
|
|
* \brief Function that compare port groups
|
|
*
|
|
* \param a pointer to DetectPort "a"
|
|
* \param b pointer to DetectPort "b"
|
|
*
|
|
* \retval PORT_XX (Port enum value, XX is EQ, ES, EB, LE, etc)
|
|
* \retval PORT_ER on error
|
|
* */
|
|
int DetectPortCmp(DetectPort *a, DetectPort *b)
|
|
{
|
|
/* check any */
|
|
if ((a->flags & PORT_FLAG_ANY) && (b->flags & PORT_FLAG_ANY))
|
|
return PORT_EQ;
|
|
if ((a->flags & PORT_FLAG_ANY) && !(b->flags & PORT_FLAG_ANY))
|
|
return PORT_LT;
|
|
if (!(a->flags & PORT_FLAG_ANY) && (b->flags & PORT_FLAG_ANY))
|
|
return PORT_GT;
|
|
|
|
uint16_t a_port1 = a->port;
|
|
uint16_t a_port2 = a->port2;
|
|
uint16_t b_port1 = b->port;
|
|
uint16_t b_port2 = b->port2;
|
|
|
|
/* PORT_EQ */
|
|
if (a_port1 == b_port1 && a_port2 == b_port2) {
|
|
//SCLogDebug("PORT_EQ");
|
|
return PORT_EQ;
|
|
/* PORT_ES */
|
|
} else if (a_port1 >= b_port1 && a_port1 <= b_port2 && a_port2 <= b_port2) {
|
|
//SCLogDebug("PORT_ES");
|
|
return PORT_ES;
|
|
/* PORT_EB */
|
|
} else if (a_port1 <= b_port1 && a_port2 >= b_port2) {
|
|
//SCLogDebug("PORT_EB");
|
|
return PORT_EB;
|
|
} else if (a_port1 < b_port1 && a_port2 < b_port2 && a_port2 >= b_port1) {
|
|
//SCLogDebug("PORT_LE");
|
|
return PORT_LE;
|
|
} else if (a_port1 < b_port1 && a_port2 < b_port2) {
|
|
//SCLogDebug("PORT_LT");
|
|
return PORT_LT;
|
|
} else if (a_port1 > b_port1 && a_port1 <= b_port2 && a_port2 > b_port2) {
|
|
//SCLogDebug("PORT_GE");
|
|
return PORT_GE;
|
|
} else if (a_port1 > b_port2) {
|
|
//SCLogDebug("PORT_GT");
|
|
return PORT_GT;
|
|
} else {
|
|
/* should be unreachable */
|
|
BUG_ON(1);
|
|
}
|
|
|
|
return PORT_ER;
|
|
}
|
|
|
|
/**
|
|
* \brief Function that return a copy of DetectPort src
|
|
*
|
|
* \param de_ctx Pointer to the current Detection Engine Context
|
|
* \param src Pointer to a DetectPort group to copy
|
|
*
|
|
* \retval Pointer to a DetectPort instance (copy of src)
|
|
* \retval NULL on error
|
|
* */
|
|
DetectPort *DetectPortCopy(DetectEngineCtx *de_ctx, DetectPort *src)
|
|
{
|
|
if (src == NULL)
|
|
return NULL;
|
|
|
|
DetectPort *dst = DetectPortInit();
|
|
if (dst == NULL) {
|
|
goto error;
|
|
}
|
|
|
|
dst->port = src->port;
|
|
dst->port2 = src->port2;
|
|
|
|
if (src->next != NULL) {
|
|
dst->next = DetectPortCopy(de_ctx, src->next);
|
|
if (dst->next != NULL) {
|
|
dst->next->prev = dst;
|
|
}
|
|
}
|
|
|
|
return dst;
|
|
error:
|
|
return NULL;
|
|
}
|
|
|
|
/**
|
|
* \brief Function that return a copy of DetectPort src sigs
|
|
*
|
|
* \param de_ctx Pointer to the current Detection Engine Context
|
|
* \param src Pointer to a DetectPort group to copy
|
|
*
|
|
* \retval Pointer to a DetectPort instance (copy of src)
|
|
* \retval NULL on error
|
|
* */
|
|
DetectPort *DetectPortCopySingle(DetectEngineCtx *de_ctx,DetectPort *src)
|
|
{
|
|
if (src == NULL)
|
|
return NULL;
|
|
|
|
DetectPort *dst = DetectPortInit();
|
|
if (dst == NULL) {
|
|
goto error;
|
|
}
|
|
|
|
dst->port = src->port;
|
|
dst->port2 = src->port2;
|
|
|
|
SigGroupHeadCopySigs(de_ctx,src->sh,&dst->sh);
|
|
|
|
return dst;
|
|
error:
|
|
return NULL;
|
|
}
|
|
|
|
/**
|
|
* \brief Function Match to Match a port against a DetectPort group
|
|
*
|
|
* \param dp Pointer to DetectPort group where we try to match the port
|
|
* \param port To compare/match
|
|
*
|
|
* \retval 1 if port is in the range (it match)
|
|
* \retval 0 if port is not in the range
|
|
* */
|
|
static int DetectPortMatch(DetectPort *dp, uint16_t port)
|
|
{
|
|
if (port >= dp->port &&
|
|
port <= dp->port2) {
|
|
return 1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* \brief Helper function that print the DetectPort info
|
|
* \retval none
|
|
*/
|
|
void DetectPortPrint(DetectPort *dp)
|
|
{
|
|
if (dp == NULL)
|
|
return;
|
|
|
|
if (dp->flags & PORT_FLAG_ANY) {
|
|
SCLogDebug("=> port %p: ANY", dp);
|
|
// printf("ANY");
|
|
} else {
|
|
SCLogDebug("=> port %p %" PRIu32 "-%" PRIu32 "", dp, dp->port, dp->port2);
|
|
// printf("%" PRIu32 "-%" PRIu32 "", dp->port, dp->port2);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* \brief Function that find the group matching address in a group head
|
|
*
|
|
* \param dp Pointer to DetectPort group where we try to find the group
|
|
* \param port port to search/lookup
|
|
*
|
|
* \retval Pointer to the DetectPort group of our port if it matched
|
|
* \retval NULL if port is not in the list
|
|
* */
|
|
DetectPort *
|
|
DetectPortLookupGroup(DetectPort *dp, uint16_t port)
|
|
{
|
|
DetectPort *p = dp;
|
|
|
|
if (dp == NULL)
|
|
return NULL;
|
|
|
|
for ( ; p != NULL; p = p->next) {
|
|
if (DetectPortMatch(p,port) == 1) {
|
|
//SCLogDebug("match, port %" PRIu32 ", dp ", port);
|
|
//DetectPortPrint(p); SCLogDebug("");
|
|
return p;
|
|
}
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
/**
|
|
* \brief Used to check if a DetectPort list contains an instance with
|
|
* a similar DetectPort. The comparison done is not the one that
|
|
* checks the memory for the same instance, but one that checks that the
|
|
* two instances hold the same content.
|
|
*
|
|
* \param head Pointer to the DetectPort list.
|
|
* \param ad Pointer to the DetectPort that has to be checked for in
|
|
* the DetectPort list.
|
|
*
|
|
* \retval cur Returns a pointer to the DetectPort on a match; NULL if
|
|
* no match.
|
|
*/
|
|
DetectPort *DetectPortLookupInList(DetectPort *head, DetectPort *gr)
|
|
{
|
|
DetectPort *cur;
|
|
|
|
if (head != NULL) {
|
|
for (cur = head; cur != NULL; cur = cur->next) {
|
|
if (DetectPortCmp(cur, gr) == PORT_EQ)
|
|
return cur;
|
|
}
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
/**
|
|
* \brief Function to join the source group to the target and its members
|
|
*
|
|
* \param de_ctx Pointer to the current Detection Engine Context
|
|
* \param target Pointer to DetectPort group where the source is joined
|
|
* \param source Pointer to DetectPort group that will join into the target
|
|
*
|
|
* \retval -1 on error
|
|
* \retval 0 on success
|
|
* */
|
|
int DetectPortJoin(DetectEngineCtx *de_ctx, DetectPort *target,
|
|
DetectPort *source)
|
|
{
|
|
if (target == NULL || source == NULL)
|
|
return -1;
|
|
|
|
SigGroupHeadCopySigs(de_ctx,source->sh,&target->sh);
|
|
|
|
if (source->port < target->port)
|
|
target->port = source->port;
|
|
|
|
if (source->port2 > target->port2)
|
|
target->port2 = source->port2;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* \brief Checks if two port group lists are equal.
|
|
*
|
|
* \param list1 Pointer to the first port group list.
|
|
* \param list2 Pointer to the second port group list.
|
|
*
|
|
* \retval true On success.
|
|
* \retval false On failure.
|
|
*/
|
|
bool DetectPortListsAreEqual(DetectPort *list1, DetectPort *list2)
|
|
{
|
|
DetectPort *item = list1;
|
|
DetectPort *it = list2;
|
|
|
|
// First, compare items one by one.
|
|
while (item != NULL && it != NULL) {
|
|
if (DetectPortCmp(item, it) != PORT_EQ) {
|
|
return false;
|
|
}
|
|
|
|
item = item->next;
|
|
it = it->next;
|
|
}
|
|
|
|
// Are the lists of the same size?
|
|
if (!(item == NULL && it == NULL)) {
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
/******************* parsing routines ************************/
|
|
|
|
/**
|
|
* \brief Wrapper function that call the internal/real function
|
|
* to insert the new DetectPort
|
|
* \param head Pointer to the head of the DetectPort group list
|
|
* \param new Pointer to the new DetectPort group list
|
|
*
|
|
* \retval 1 inserted
|
|
* \retval 0 not inserted, memory of new is freed
|
|
* \retval -1 error
|
|
*/
|
|
static int DetectPortParseInsert(DetectPort **head, DetectPort *new)
|
|
{
|
|
return DetectPortInsert(NULL, head, new);
|
|
}
|
|
|
|
/**
|
|
* \brief Function to parse and insert the string in the DetectPort head list
|
|
*
|
|
* \param head Pointer to the head of the DetectPort group list
|
|
* \param s Pointer to the port string
|
|
*
|
|
* \retval 0 on success
|
|
* \retval -1 on error
|
|
*/
|
|
static int DetectPortParseInsertString(const DetectEngineCtx *de_ctx,
|
|
DetectPort **head, const char *s)
|
|
{
|
|
DetectPort *ad = NULL, *ad_any = NULL;
|
|
int r = 0;
|
|
char port_any = FALSE;
|
|
|
|
SCLogDebug("head %p, *head %p, s %s", head, *head, s);
|
|
|
|
/** parse the address */
|
|
ad = PortParse(s);
|
|
if (ad == NULL) {
|
|
SCLogError(SC_ERR_INVALID_ARGUMENT," failed to parse port \"%s\"",s);
|
|
return -1;
|
|
}
|
|
|
|
if (ad->flags & PORT_FLAG_ANY) {
|
|
port_any = TRUE;
|
|
}
|
|
|
|
/** handle the not case, we apply the negation then insert the part(s) */
|
|
if (ad->flags & PORT_FLAG_NOT) {
|
|
DetectPort *ad2 = NULL;
|
|
|
|
if (DetectPortCutNot(ad, &ad2) < 0) {
|
|
goto error;
|
|
}
|
|
|
|
/** normally a 'not' will result in two ad's unless the 'not' is on the
|
|
* start or end of the address space(e.g. 0.0.0.0 or 255.255.255.255)
|
|
*/
|
|
if (ad2 != NULL) {
|
|
if (DetectPortParseInsert(head, ad2) < 0) {
|
|
if (ad2 != NULL) SCFree(ad2);
|
|
goto error;
|
|
}
|
|
}
|
|
}
|
|
|
|
r = DetectPortParseInsert(head, ad);
|
|
if (r < 0)
|
|
goto error;
|
|
|
|
/** if any, insert 0.0.0.0/0 and ::/0 as well */
|
|
if (r == 1 && port_any == TRUE) {
|
|
SCLogDebug("inserting 0:65535 as port is \"any\"");
|
|
|
|
ad_any = PortParse("0:65535");
|
|
if (ad_any == NULL)
|
|
goto error;
|
|
|
|
if (DetectPortParseInsert(head, ad_any) < 0)
|
|
goto error;
|
|
}
|
|
|
|
return 0;
|
|
|
|
error:
|
|
SCLogError(SC_ERR_PORT_PARSE_INSERT_STRING,"DetectPortParseInsertString error");
|
|
if (ad != NULL)
|
|
DetectPortCleanupList(de_ctx, ad);
|
|
if (ad_any != NULL)
|
|
DetectPortCleanupList(de_ctx, ad_any);
|
|
return -1;
|
|
}
|
|
|
|
/**
|
|
* \brief Parses a port string and updates the 2 port heads with the
|
|
* port groups.
|
|
*
|
|
* \todo We don't seem to be handling negated cases, like [port,![!port,port]],
|
|
* since we pass around negate without keeping a count of ! with depth.
|
|
* Can solve this by keeping a count of the negations with depth, so that
|
|
* an even no of negations would count as no negation and an odd no of
|
|
* negations would count as a negation.
|
|
*
|
|
* \param gh Pointer to the port group head that should hold port ranges
|
|
* that are not negated.
|
|
* \param ghn Pointer to the port group head that should hold port ranges
|
|
* that are negated.
|
|
* \param s Pointer to the character string holding the port to be
|
|
* parsed.
|
|
* \param negate Flag that indicates if the received address string is negated
|
|
* or not. 0 if it is not, 1 it it is.
|
|
*
|
|
* \retval 0 On successfully parsing.
|
|
* \retval -1 On failure.
|
|
*/
|
|
static int DetectPortParseDo(const DetectEngineCtx *de_ctx,
|
|
DetectPort **head, DetectPort **nhead,
|
|
const char *s, int negate,
|
|
ResolvedVariablesList *var_list)
|
|
{
|
|
size_t u = 0;
|
|
size_t x = 0;
|
|
int o_set = 0, n_set = 0, d_set = 0;
|
|
int range = 0;
|
|
int depth = 0;
|
|
size_t size = strlen(s);
|
|
char address[1024] = "";
|
|
const char *rule_var_port = NULL;
|
|
int r = 0;
|
|
|
|
SCLogDebug("head %p, *head %p, negate %d", head, *head, negate);
|
|
|
|
for (u = 0, x = 0; u < size && x < sizeof(address); u++) {
|
|
address[x] = s[u];
|
|
x++;
|
|
|
|
if (s[u] == ':')
|
|
range = 1;
|
|
|
|
if (range == 1 && s[u] == '!') {
|
|
SCLogError(SC_ERR_NEGATED_VALUE_IN_PORT_RANGE,"Can't have a negated value in a range.");
|
|
return -1;
|
|
} else if (!o_set && s[u] == '!') {
|
|
SCLogDebug("negation encountered");
|
|
n_set = 1;
|
|
x--;
|
|
} else if (s[u] == '[') {
|
|
if (!o_set) {
|
|
o_set = 1;
|
|
x = 0;
|
|
}
|
|
depth++;
|
|
} else if (s[u] == ']') {
|
|
if (depth == 1) {
|
|
address[x - 1] = '\0';
|
|
SCLogDebug("Parsed port from DetectPortParseDo - %s", address);
|
|
x = 0;
|
|
|
|
r = DetectPortParseDo(de_ctx, head, nhead, address, negate? negate: n_set, var_list);
|
|
if (r == -1)
|
|
goto error;
|
|
|
|
n_set = 0;
|
|
}
|
|
depth--;
|
|
range = 0;
|
|
} else if (depth == 0 && s[u] == ',') {
|
|
if (o_set == 1) {
|
|
o_set = 0;
|
|
} else if (d_set == 1) {
|
|
char *temp_rule_var_port = NULL,
|
|
*alloc_rule_var_port = NULL;
|
|
|
|
address[x - 1] = '\0';
|
|
|
|
rule_var_port = SCRuleVarsGetConfVar(de_ctx, address,
|
|
SC_RULE_VARS_PORT_GROUPS);
|
|
if (rule_var_port == NULL)
|
|
goto error;
|
|
if (strlen(rule_var_port) == 0) {
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "variable %s resolved "
|
|
"to nothing. This is likely a misconfiguration. "
|
|
"Note that a negated port needs to be quoted, "
|
|
"\"!$HTTP_PORTS\" instead of !$HTTP_PORTS. See issue #295.", s);
|
|
goto error;
|
|
}
|
|
if (negate == 1 || n_set == 1) {
|
|
alloc_rule_var_port = SCMalloc(strlen(rule_var_port) + 3);
|
|
if (unlikely(alloc_rule_var_port == NULL))
|
|
goto error;
|
|
snprintf(alloc_rule_var_port, strlen(rule_var_port) + 3,
|
|
"[%s]", rule_var_port);
|
|
} else {
|
|
alloc_rule_var_port = SCStrdup(rule_var_port);
|
|
if (unlikely(alloc_rule_var_port == NULL))
|
|
goto error;
|
|
}
|
|
temp_rule_var_port = alloc_rule_var_port;
|
|
r = DetectPortParseDo(de_ctx, head, nhead, temp_rule_var_port,
|
|
(negate + n_set) % 2, var_list);//negate? negate: n_set);
|
|
if (r == -1) {
|
|
SCFree(alloc_rule_var_port);
|
|
goto error;
|
|
}
|
|
d_set = 0;
|
|
n_set = 0;
|
|
SCFree(alloc_rule_var_port);
|
|
} else {
|
|
address[x - 1] = '\0';
|
|
SCLogDebug("Parsed port from DetectPortParseDo - %s", address);
|
|
|
|
if (negate == 0 && n_set == 0) {
|
|
r = DetectPortParseInsertString(de_ctx, head, address);
|
|
} else {
|
|
r = DetectPortParseInsertString(de_ctx, nhead, address);
|
|
}
|
|
if (r == -1)
|
|
goto error;
|
|
|
|
n_set = 0;
|
|
}
|
|
x = 0;
|
|
range = 0;
|
|
} else if (depth == 0 && s[u] == '$') {
|
|
d_set = 1;
|
|
} else if (depth == 0 && u == size-1) {
|
|
range = 0;
|
|
if (x == 1024) {
|
|
address[x - 1] = '\0';
|
|
} else {
|
|
address[x] = '\0';
|
|
}
|
|
SCLogDebug("%s", address);
|
|
|
|
if (AddVariableToResolveList(var_list, address) == -1) {
|
|
SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Found a loop in a port "
|
|
"groups declaration. This is likely a misconfiguration.");
|
|
goto error;
|
|
}
|
|
|
|
x = 0;
|
|
if (d_set == 1) {
|
|
char *temp_rule_var_port = NULL,
|
|
*alloc_rule_var_port = NULL;
|
|
|
|
rule_var_port = SCRuleVarsGetConfVar(de_ctx, address,
|
|
SC_RULE_VARS_PORT_GROUPS);
|
|
if (rule_var_port == NULL)
|
|
goto error;
|
|
if (strlen(rule_var_port) == 0) {
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "variable %s resolved "
|
|
"to nothing. This is likely a misconfiguration. "
|
|
"Note that a negated port needs to be quoted, "
|
|
"\"!$HTTP_PORTS\" instead of !$HTTP_PORTS. See issue #295.", s);
|
|
goto error;
|
|
}
|
|
if ((negate + n_set) % 2) {
|
|
alloc_rule_var_port = SCMalloc(strlen(rule_var_port) + 3);
|
|
if (unlikely(alloc_rule_var_port == NULL))
|
|
goto error;
|
|
snprintf(alloc_rule_var_port, strlen(rule_var_port) + 3,
|
|
"[%s]", rule_var_port);
|
|
} else {
|
|
alloc_rule_var_port = SCStrdup(rule_var_port);
|
|
if (unlikely(alloc_rule_var_port == NULL))
|
|
goto error;
|
|
}
|
|
temp_rule_var_port = alloc_rule_var_port;
|
|
r = DetectPortParseDo(de_ctx, head, nhead, temp_rule_var_port,
|
|
(negate + n_set) % 2, var_list);
|
|
SCFree(alloc_rule_var_port);
|
|
if (r == -1)
|
|
goto error;
|
|
|
|
d_set = 0;
|
|
} else {
|
|
if (!((negate + n_set) % 2)) {
|
|
r = DetectPortParseInsertString(de_ctx, head,address);
|
|
} else {
|
|
r = DetectPortParseInsertString(de_ctx, nhead,address);
|
|
}
|
|
if (r == -1)
|
|
goto error;
|
|
}
|
|
n_set = 0;
|
|
} else if (depth == 1 && s[u] == ',') {
|
|
range = 0;
|
|
}
|
|
}
|
|
|
|
if (depth > 0) {
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "not every port block was "
|
|
"properly closed in \"%s\", %d missing closing brackets (]). "
|
|
"Note: problem might be in a variable.", s, depth);
|
|
goto error;
|
|
} else if (depth < 0) {
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "not every port block was "
|
|
"properly opened in \"%s\", %d missing opening brackets ([). "
|
|
"Note: problem might be in a variable.", s, depth*-1);
|
|
goto error;
|
|
}
|
|
|
|
return 0;
|
|
error:
|
|
return -1;
|
|
}
|
|
|
|
/**
|
|
* \brief Check if the port group list covers the complete port space.
|
|
* \retval 0 no
|
|
* \retval 1 yes
|
|
*/
|
|
static int DetectPortIsCompletePortSpace(DetectPort *p)
|
|
{
|
|
uint16_t next_port = 0;
|
|
|
|
if (p == NULL)
|
|
return 0;
|
|
|
|
if (p->port != 0x0000)
|
|
return 0;
|
|
|
|
/* if we're ending with 0xFFFF while we know
|
|
we started with 0x0000 it's the complete space */
|
|
if (p->port2 == 0xFFFF)
|
|
return 1;
|
|
|
|
next_port = p->port2 + 1;
|
|
p = p->next;
|
|
|
|
for ( ; p != NULL; p = p->next) {
|
|
if (p->port != next_port)
|
|
return 0;
|
|
|
|
if (p->port2 == 0xFFFF)
|
|
return 1;
|
|
|
|
next_port = p->port2 + 1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* \brief Helper function for the parsing process
|
|
*
|
|
* \param head Pointer to the head of the DetectPort group list
|
|
* \param nhead Pointer to the new head of the DetectPort group list
|
|
*
|
|
* \retval 0 on success
|
|
* \retval -1 on error
|
|
*/
|
|
static int DetectPortParseMergeNotPorts(const DetectEngineCtx *de_ctx,
|
|
DetectPort **head, DetectPort **nhead)
|
|
{
|
|
DetectPort *ad = NULL;
|
|
DetectPort *ag, *ag2;
|
|
int r = 0;
|
|
|
|
/** check if the full port space is negated */
|
|
if (DetectPortIsCompletePortSpace(*nhead) == 1) {
|
|
SCLogError(SC_ERR_COMPLETE_PORT_SPACE_NEGATED,"Complete port space is negated");
|
|
goto error;
|
|
}
|
|
|
|
/**
|
|
* step 0: if the head list is empty, but the nhead list isn't
|
|
* we have a pure not thingy. In that case we add a 0:65535
|
|
* first.
|
|
*/
|
|
if (*head == NULL && *nhead != NULL) {
|
|
SCLogDebug("inserting 0:65535 into head");
|
|
r = DetectPortParseInsertString(de_ctx, head,"0:65535");
|
|
if (r < 0) {
|
|
goto error;
|
|
}
|
|
}
|
|
|
|
/** step 1: insert our ghn members into the gh list */
|
|
for (ag = *nhead; ag != NULL; ag = ag->next) {
|
|
/** work with a copy of the ad so we can easily clean up
|
|
* the ghn group later.
|
|
*/
|
|
ad = DetectPortCopySingle(NULL, ag);
|
|
if (ad == NULL) {
|
|
goto error;
|
|
}
|
|
r = DetectPortParseInsert(head, ad);
|
|
if (r < 0) {
|
|
goto error;
|
|
}
|
|
ad = NULL;
|
|
}
|
|
|
|
/** step 2: pull the address blocks that match our 'not' blocks */
|
|
for (ag = *nhead; ag != NULL; ag = ag->next) {
|
|
SCLogDebug("ag %p", ag);
|
|
DetectPortPrint(ag);
|
|
|
|
for (ag2 = *head; ag2 != NULL; ) {
|
|
SCLogDebug("ag2 %p", ag2);
|
|
DetectPortPrint(ag2);
|
|
|
|
r = DetectPortCmp(ag, ag2);
|
|
if (r == PORT_EQ || r == PORT_EB) { /* XXX more ??? */
|
|
if (ag2->prev == NULL) {
|
|
*head = ag2->next;
|
|
} else {
|
|
ag2->prev->next = ag2->next;
|
|
}
|
|
|
|
if (ag2->next != NULL) {
|
|
ag2->next->prev = ag2->prev;
|
|
}
|
|
/** store the next ptr and remove the group */
|
|
DetectPort *next_ag2 = ag2->next;
|
|
DetectPortFree(de_ctx,ag2);
|
|
ag2 = next_ag2;
|
|
} else {
|
|
ag2 = ag2->next;
|
|
}
|
|
}
|
|
}
|
|
|
|
for (ag2 = *head; ag2 != NULL; ag2 = ag2->next) {
|
|
SCLogDebug("ag2 %p", ag2);
|
|
DetectPortPrint(ag2);
|
|
}
|
|
|
|
if (*head == NULL) {
|
|
SCLogError(SC_ERR_NO_PORTS_LEFT_AFTER_MERGE,"no ports left after merging ports with negated ports");
|
|
goto error;
|
|
}
|
|
|
|
return 0;
|
|
error:
|
|
if (ad != NULL)
|
|
DetectPortFree(de_ctx, ad);
|
|
return -1;
|
|
}
|
|
|
|
int DetectPortTestConfVars(void)
|
|
{
|
|
SCLogDebug("Testing port conf vars for any misconfigured values");
|
|
|
|
ResolvedVariablesList var_list = TAILQ_HEAD_INITIALIZER(var_list);
|
|
|
|
ConfNode *port_vars_node = ConfGetNode("vars.port-groups");
|
|
if (port_vars_node == NULL) {
|
|
return 0;
|
|
}
|
|
|
|
ConfNode *seq_node;
|
|
TAILQ_FOREACH(seq_node, &port_vars_node->head, next) {
|
|
SCLogDebug("Testing %s - %s\n", seq_node->name, seq_node->val);
|
|
|
|
DetectPort *gh = DetectPortInit();
|
|
if (gh == NULL) {
|
|
goto error;
|
|
}
|
|
DetectPort *ghn = NULL;
|
|
|
|
if (seq_node->val == NULL) {
|
|
SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY,
|
|
"Port var \"%s\" probably has a sequence(something "
|
|
"in brackets) value set without any quotes. Please "
|
|
"quote it using \"..\".", seq_node->name);
|
|
DetectPortCleanupList(NULL, gh);
|
|
goto error;
|
|
}
|
|
|
|
int r = DetectPortParseDo(NULL, &gh, &ghn, seq_node->val, /* start with negate no */0, &var_list);
|
|
|
|
CleanVariableResolveList(&var_list);
|
|
|
|
if (r < 0) {
|
|
DetectPortCleanupList(NULL, gh);
|
|
SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY,
|
|
"failed to parse port var \"%s\" with value \"%s\". "
|
|
"Please check it's syntax", seq_node->name, seq_node->val);
|
|
goto error;
|
|
}
|
|
|
|
if (DetectPortIsCompletePortSpace(ghn)) {
|
|
SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY,
|
|
"Port var - \"%s\" has the complete Port range negated "
|
|
"with it's value \"%s\". Port space range is NIL. "
|
|
"Probably have a !any or a port range that supplies "
|
|
"a NULL address range", seq_node->name, seq_node->val);
|
|
DetectPortCleanupList(NULL, gh);
|
|
DetectPortCleanupList(NULL, ghn);
|
|
goto error;
|
|
}
|
|
|
|
if (gh != NULL)
|
|
DetectPortCleanupList(NULL, gh);
|
|
if (ghn != NULL)
|
|
DetectPortCleanupList(NULL, ghn);
|
|
}
|
|
|
|
return 0;
|
|
error:
|
|
return -1;
|
|
}
|
|
|
|
|
|
/**
|
|
* \brief Function for parsing port strings
|
|
*
|
|
* \param head Pointer to the head of the DetectPort group list
|
|
* \param str Pointer to the port string
|
|
*
|
|
* \retval 0 on success
|
|
* \retval -1 on error
|
|
*/
|
|
int DetectPortParse(const DetectEngineCtx *de_ctx,
|
|
DetectPort **head, const char *str)
|
|
{
|
|
int r;
|
|
|
|
SCLogDebug("Port string to be parsed - str %s", str);
|
|
|
|
/* negate port list */
|
|
DetectPort *nhead = NULL;
|
|
|
|
r = DetectPortParseDo(de_ctx, head, &nhead, str,/* start with negate no */0, NULL);
|
|
if (r < 0)
|
|
goto error;
|
|
|
|
SCLogDebug("head %p %p, nhead %p", head, *head, nhead);
|
|
|
|
/* merge the 'not' address groups */
|
|
if (DetectPortParseMergeNotPorts(de_ctx, head, &nhead) < 0)
|
|
goto error;
|
|
|
|
/* free the temp negate head */
|
|
DetectPortCleanupList(de_ctx, nhead);
|
|
return 0;
|
|
|
|
error:
|
|
DetectPortCleanupList(de_ctx, nhead);
|
|
return -1;
|
|
}
|
|
|
|
/**
|
|
* \brief Helper function for parsing port strings
|
|
*
|
|
* \param str Pointer to the port string
|
|
*
|
|
* \retval DetectPort pointer of the parse string on success
|
|
* \retval NULL on error
|
|
*/
|
|
DetectPort *PortParse(const char *str)
|
|
{
|
|
char *port2 = NULL;
|
|
DetectPort *dp = NULL;
|
|
|
|
char portstr[16];
|
|
strlcpy(portstr, str, sizeof(portstr));
|
|
|
|
dp = DetectPortInit();
|
|
if (dp == NULL)
|
|
goto error;
|
|
|
|
/* XXX better input validation */
|
|
|
|
/* we dup so we can put a nul-termination in it later */
|
|
char *port = portstr;
|
|
|
|
/* handle the negation case */
|
|
if (port[0] == '!') {
|
|
dp->flags |= PORT_FLAG_NOT;
|
|
port++;
|
|
}
|
|
|
|
/* see if the address is an ipv4 or ipv6 address */
|
|
if ((port2 = strchr(port, ':')) != NULL) {
|
|
/* 80:81 range format */
|
|
port2[0] = '\0';
|
|
port2++;
|
|
|
|
if(DetectPortIsValidRange(port))
|
|
dp->port = atoi(port);
|
|
else
|
|
goto error;
|
|
|
|
if (strcmp(port2, "") != 0) {
|
|
if (DetectPortIsValidRange(port2))
|
|
dp->port2 = atoi(port2);
|
|
else
|
|
goto error;
|
|
} else {
|
|
dp->port2 = 65535;
|
|
}
|
|
|
|
/* a > b is illegal, a == b is ok */
|
|
if (dp->port > dp->port2)
|
|
goto error;
|
|
} else {
|
|
if (strcasecmp(port,"any") == 0) {
|
|
dp->port = 0;
|
|
dp->port2 = 65535;
|
|
} else if(DetectPortIsValidRange(port)){
|
|
dp->port = dp->port2 = atoi(port);
|
|
} else {
|
|
goto error;
|
|
}
|
|
}
|
|
|
|
return dp;
|
|
|
|
error:
|
|
if (dp != NULL)
|
|
DetectPortCleanupList(NULL, dp);
|
|
return NULL;
|
|
}
|
|
|
|
/**
|
|
* \brief Helper function to check if a parsed port is in the valid range
|
|
* of available ports
|
|
*
|
|
* \param str Pointer to the port string
|
|
*
|
|
* \retval 1 if port is in the valid range
|
|
* \retval 0 if invalid
|
|
*/
|
|
int DetectPortIsValidRange(char *port)
|
|
{
|
|
if(atoi(port) >= 0 && atoi(port) <= 65535)
|
|
return 1;
|
|
else
|
|
return 0;
|
|
}
|
|
/********************** End parsing routines ********************/
|
|
|
|
/* hash table */
|
|
|
|
/**
|
|
* \brief The hash function to be the used by the hash table -
|
|
* DetectEngineCtx->dport_hash_table.
|
|
*
|
|
* \param ht Pointer to the hash table.
|
|
* \param data Pointer to the DetectPort.
|
|
* \param datalen Not used in our case.
|
|
*
|
|
* \retval hash The generated hash value.
|
|
*/
|
|
static uint32_t DetectPortHashFunc(HashListTable *ht, void *data, uint16_t datalen)
|
|
{
|
|
DetectPort *p = (DetectPort *)data;
|
|
uint32_t hash = 0;
|
|
|
|
SCLogDebug("hashing sgh %p", p);
|
|
|
|
hash = ((uint32_t)p->port << 16) | p->port2;
|
|
|
|
hash %= ht->array_size;
|
|
SCLogDebug("hash %"PRIu32, hash);
|
|
return hash;
|
|
}
|
|
|
|
/**
|
|
* \brief The Compare function to be used by the DetectPort hash table -
|
|
* DetectEngineCtx->dport_hash_table.
|
|
*
|
|
* \param data1 Pointer to the first DetectPort.
|
|
* \param len1 Not used.
|
|
* \param data2 Pointer to the second DetectPort.
|
|
* \param len2 Not used.
|
|
*
|
|
* \retval 1 If the 2 DetectPort sent as args match.
|
|
* \retval 0 If the 2 DetectPort sent as args do not match.
|
|
*/
|
|
static char DetectPortCompareFunc(void *data1, uint16_t len1,
|
|
void *data2, uint16_t len2)
|
|
{
|
|
DetectPort *dp1 = (DetectPort *)data1;
|
|
DetectPort *dp2 = (DetectPort *)data2;
|
|
|
|
if (data1 == NULL || data2 == NULL)
|
|
return 0;
|
|
|
|
if (dp1->port == dp2->port && dp1->port2 == dp2->port2)
|
|
return 1;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void DetectPortHashFreeFunc(void *ptr)
|
|
{
|
|
DetectPort *p = ptr;
|
|
DetectPortFree(NULL, p);
|
|
}
|
|
|
|
/**
|
|
* \brief Initializes the hash table in the detection engine context to hold the
|
|
* DetectPort hash.
|
|
*
|
|
* \param de_ctx Pointer to the detection engine context.
|
|
*
|
|
* \retval 0 On success.
|
|
* \retval -1 On failure.
|
|
*/
|
|
int DetectPortHashInit(DetectEngineCtx *de_ctx)
|
|
{
|
|
de_ctx->dport_hash_table = HashListTableInit(4096, DetectPortHashFunc,
|
|
DetectPortCompareFunc,
|
|
DetectPortHashFreeFunc);
|
|
if (de_ctx->dport_hash_table == NULL)
|
|
goto error;
|
|
|
|
return 0;
|
|
|
|
error:
|
|
return -1;
|
|
}
|
|
|
|
/**
|
|
* \brief Adds a DetectPort to the detection engine context DetectPort
|
|
* hash table.
|
|
*
|
|
* \param de_ctx Pointer to the detection engine context.
|
|
* \param dp Pointer to the DetectPort.
|
|
*
|
|
* \retval ret 0 on Successfully adding the DetectPort; -1 on failure.
|
|
*/
|
|
int DetectPortHashAdd(DetectEngineCtx *de_ctx, DetectPort *dp)
|
|
{
|
|
int ret = HashListTableAdd(de_ctx->dport_hash_table, (void *)dp, 0);
|
|
return ret;
|
|
}
|
|
|
|
/**
|
|
* \brief Used to lookup a DetectPort hash from the detection engine context
|
|
* DetectPort hash table.
|
|
*
|
|
* \param de_ctx Pointer to the detection engine context.
|
|
* \param sgh Pointer to the DetectPort.
|
|
*
|
|
* \retval rsgh On success a pointer to the DetectPort if the DetectPort is
|
|
* found in the hash table; NULL on failure.
|
|
*/
|
|
DetectPort *DetectPortHashLookup(DetectEngineCtx *de_ctx, DetectPort *dp)
|
|
{
|
|
SCEnter();
|
|
|
|
DetectPort *rdp = HashListTableLookup(de_ctx->dport_hash_table, (void *)dp, 0);
|
|
|
|
SCReturnPtr(rdp, "DetectPort");
|
|
}
|
|
|
|
/**
|
|
* \brief Frees the hash table - DetectEngineCtx->sgh_hash_table, allocated by
|
|
* DetectPortInit() function.
|
|
*
|
|
* \param de_ctx Pointer to the detection engine context.
|
|
*/
|
|
void DetectPortHashFree(DetectEngineCtx *de_ctx)
|
|
{
|
|
if (de_ctx->sgh_hash_table == NULL)
|
|
return;
|
|
|
|
HashListTableFree(de_ctx->dport_hash_table);
|
|
de_ctx->dport_hash_table = NULL;
|
|
|
|
return;
|
|
}
|
|
|
|
/*---------------------- Unittests -------------------------*/
|
|
|
|
#ifdef UNITTESTS
|
|
/**
|
|
* \brief Do a sorted insert, where the top of the list should be the biggest
|
|
* port range.
|
|
*
|
|
* \todo XXX current sorting only works for overlapping ranges
|
|
*
|
|
* \param head Pointer to the DetectPort list head
|
|
* \param dp Pointer to DetectPort to search in the DetectPort list
|
|
* \retval 0 if dp is added correctly
|
|
*/
|
|
static int PortTestDetectPortAdd(DetectPort **head, DetectPort *dp)
|
|
{
|
|
DetectPort *cur, *prev_cur = NULL;
|
|
|
|
//SCLogDebug("DetectPortAdd: adding "); DetectPortPrint(ag); SCLogDebug("");
|
|
|
|
if (*head != NULL) {
|
|
for (cur = *head; cur != NULL; cur = cur->next) {
|
|
prev_cur = cur;
|
|
int r = DetectPortCmp(dp,cur);
|
|
if (r == PORT_EB) {
|
|
/* insert here */
|
|
dp->prev = cur->prev;
|
|
dp->next = cur;
|
|
|
|
cur->prev = dp;
|
|
if (*head == cur) {
|
|
*head = dp;
|
|
} else {
|
|
dp->prev->next = dp;
|
|
}
|
|
return 0;
|
|
}
|
|
}
|
|
dp->prev = prev_cur;
|
|
if (prev_cur != NULL)
|
|
prev_cur->next = dp;
|
|
} else {
|
|
*head = dp;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
/**
|
|
* \test Check if a DetectPort is properly allocated
|
|
*/
|
|
static int PortTestParse01 (void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"80");
|
|
if (r == 0) {
|
|
DetectPortFree(NULL, dd);
|
|
return 1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* \test Check if two ports are properly allocated in the DetectPort group
|
|
*/
|
|
static int PortTestParse02 (void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"80");
|
|
if (r == 0) {
|
|
r = DetectPortParse(NULL,&dd,"22");
|
|
if (r == 0) {
|
|
result = 1;
|
|
}
|
|
|
|
DetectPortCleanupList(NULL, dd);
|
|
return result;
|
|
}
|
|
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Check if two port ranges are properly allocated in the DetectPort group
|
|
*/
|
|
static int PortTestParse03 (void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"80:88");
|
|
if (r == 0) {
|
|
r = DetectPortParse(NULL,&dd,"85:100");
|
|
if (r == 0) {
|
|
result = 1;
|
|
}
|
|
|
|
DetectPortCleanupList(NULL, dd);
|
|
|
|
return result;
|
|
}
|
|
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Check if a negated port range is properly allocated in the DetectPort
|
|
*/
|
|
static int PortTestParse04 (void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"!80:81");
|
|
if (r == 0) {
|
|
DetectPortCleanupList(NULL, dd);
|
|
return 1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* \test Check if a negated port range is properly fragmented in the allowed
|
|
* real groups, ex !80:81 should allow 0:79 and 82:65535
|
|
*/
|
|
static int PortTestParse05 (void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"!80:81");
|
|
if (r != 0)
|
|
goto end;
|
|
|
|
if (dd->next == NULL)
|
|
goto end;
|
|
|
|
if (dd->port != 0 || dd->port2 != 79)
|
|
goto end;
|
|
|
|
if (dd->next->port != 82 || dd->next->port2 != 65535)
|
|
goto end;
|
|
|
|
DetectPortCleanupList(NULL, dd);
|
|
result = 1;
|
|
end:
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Check if we copy a DetectPort correctly
|
|
*/
|
|
static int PortTestParse06 (void)
|
|
{
|
|
DetectPort *dd = NULL, *copy = NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"22");
|
|
if (r != 0)
|
|
goto end;
|
|
|
|
r = DetectPortParse(NULL,&dd,"80");
|
|
if (r != 0)
|
|
goto end;
|
|
|
|
r = DetectPortParse(NULL,&dd,"143");
|
|
if (r != 0)
|
|
goto end;
|
|
|
|
copy = DetectPortCopy(NULL,dd);
|
|
if (copy == NULL)
|
|
goto end;
|
|
|
|
if (DetectPortCmp(dd,copy) != PORT_EQ)
|
|
goto end;
|
|
|
|
if (copy->next == NULL)
|
|
goto end;
|
|
|
|
if (DetectPortCmp(dd->next,copy->next) != PORT_EQ)
|
|
goto end;
|
|
|
|
if (copy->next->next == NULL)
|
|
goto end;
|
|
|
|
if (DetectPortCmp(dd->next->next,copy->next->next) != PORT_EQ)
|
|
goto end;
|
|
|
|
if (copy->port != 22 || copy->next->port != 80 ||
|
|
copy->next->next->port != 143)
|
|
goto end;
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
if (copy != NULL)
|
|
DetectPortCleanupList(NULL, copy);
|
|
if (dd != NULL)
|
|
DetectPortCleanupList(NULL, dd);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Check if a negated port range is properly fragmented in the allowed
|
|
* real groups
|
|
*/
|
|
static int PortTestParse07 (void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"!21:902");
|
|
if (r != 0)
|
|
goto end;
|
|
|
|
if (dd->next == NULL)
|
|
goto end;
|
|
|
|
if (dd->port != 0 || dd->port2 != 20)
|
|
goto end;
|
|
|
|
if (dd->next->port != 903 || dd->next->port2 != 65535)
|
|
goto end;
|
|
|
|
DetectPortCleanupList(NULL, dd);
|
|
result = 1;
|
|
end:
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Check if we dont allow invalid port range specification
|
|
*/
|
|
static int PortTestParse08 (void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"[80:!80]");
|
|
if (r == 0)
|
|
goto end;
|
|
|
|
DetectPortCleanupList(NULL, dd);
|
|
result = 1;
|
|
end:
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Check if we autocomplete correctly an open range
|
|
*/
|
|
static int PortTestParse09 (void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"1024:");
|
|
if (r != 0)
|
|
goto end;
|
|
|
|
if (dd == NULL)
|
|
goto end;
|
|
|
|
if (dd->port != 1024 || dd->port2 != 0xffff)
|
|
goto end;
|
|
|
|
DetectPortCleanupList(NULL, dd);
|
|
result = 1;
|
|
end:
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test we don't allow a port that is too big
|
|
*/
|
|
static int PortTestParse10 (void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"77777777777777777777777777777777777777777777");
|
|
if (r != 0) {
|
|
result = 1 ;
|
|
goto end;
|
|
}
|
|
|
|
DetectPortFree(NULL, dd);
|
|
|
|
end:
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test second port of range being too big
|
|
*/
|
|
static int PortTestParse11 (void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"1024:65536");
|
|
if (r != 0) {
|
|
result = 1 ;
|
|
goto end;
|
|
}
|
|
|
|
DetectPortFree(NULL, dd);
|
|
|
|
end:
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test second port of range being just right
|
|
*/
|
|
static int PortTestParse12 (void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"1024:65535");
|
|
if (r != 0) {
|
|
goto end;
|
|
}
|
|
|
|
DetectPortFree(NULL, dd);
|
|
|
|
result = 1 ;
|
|
end:
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test first port of range being too big
|
|
*/
|
|
static int PortTestParse13 (void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"65536:65535");
|
|
if (r != 0) {
|
|
result = 1 ;
|
|
goto end;
|
|
}
|
|
|
|
DetectPortFree(NULL, dd);
|
|
|
|
end:
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test merging port groups
|
|
*/
|
|
static int PortTestParse14 (void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParseInsertString(NULL, &dd, "0:100");
|
|
if (r != 0)
|
|
goto end;
|
|
r = DetectPortParseInsertString(NULL, &dd, "1000:65535");
|
|
if (r != 0 || dd->next == NULL)
|
|
goto end;
|
|
|
|
result = 1;
|
|
result &= (dd->port == 0) ? 1 : 0;
|
|
result &= (dd->port2 == 100) ? 1 : 0;
|
|
result &= (dd->next->port == 1000) ? 1 : 0;
|
|
result &= (dd->next->port2 == 65535) ? 1 : 0;
|
|
|
|
DetectPortFree(NULL, dd);
|
|
|
|
end:
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test merging negated port groups
|
|
*/
|
|
static int PortTestParse15 (void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"![0:100,1000:3000]");
|
|
if (r != 0 || dd->next == NULL)
|
|
goto end;
|
|
|
|
result = 1;
|
|
result &= (dd->port == 101) ? 1 : 0;
|
|
result &= (dd->port2 == 999) ? 1 : 0;
|
|
result &= (dd->next->port == 3001) ? 1 : 0;
|
|
result &= (dd->next->port2 == 65535) ? 1 : 0;
|
|
|
|
DetectPortFree(NULL, dd);
|
|
|
|
end:
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test parse, copy and cmp functions
|
|
*/
|
|
static int PortTestParse16 (void)
|
|
{
|
|
DetectPort *dd = NULL, *copy = NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL,&dd,"22");
|
|
if (r != 0)
|
|
goto end;
|
|
|
|
r = DetectPortParse(NULL,&dd,"80");
|
|
if (r != 0)
|
|
goto end;
|
|
|
|
r = DetectPortParse(NULL,&dd,"143");
|
|
if (r != 0)
|
|
goto end;
|
|
|
|
copy = DetectPortCopy(NULL,dd);
|
|
if (copy == NULL)
|
|
goto end;
|
|
|
|
if (DetectPortCmp(dd,copy) != PORT_EQ)
|
|
goto end;
|
|
|
|
if (copy->next == NULL)
|
|
goto end;
|
|
|
|
if (DetectPortCmp(dd->next,copy->next) != PORT_EQ)
|
|
goto end;
|
|
|
|
if (copy->next->next == NULL)
|
|
goto end;
|
|
|
|
if (DetectPortCmp(dd->next->next,copy->next->next) != PORT_EQ)
|
|
goto end;
|
|
|
|
if (copy->port != 22 || copy->next->port != 80 || copy->next->next->port != 143)
|
|
goto end;
|
|
|
|
if (copy->next->prev != copy)
|
|
goto end;
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
if (copy != NULL)
|
|
DetectPortCleanupList(NULL, copy);
|
|
if (dd != NULL)
|
|
DetectPortCleanupList(NULL, dd);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test general functions
|
|
*/
|
|
static int PortTestFunctions01(void)
|
|
{
|
|
DetectPort *head = NULL;
|
|
DetectPort *dp1= NULL;
|
|
int result = 0;
|
|
|
|
/* Parse */
|
|
int r = DetectPortParse(NULL,&head,"![0:100,1000:65535]");
|
|
if (r != 0 || head->next != NULL)
|
|
goto end;
|
|
|
|
/* We should have only one DetectPort */
|
|
if (!(head->port == 101))
|
|
goto end;
|
|
if (!(head->port2 == 999))
|
|
goto end;
|
|
if (!(head->next == NULL))
|
|
goto end;
|
|
|
|
r = DetectPortParse(NULL, &dp1,"2000:3000");
|
|
if (r != 0 || dp1->next != NULL)
|
|
goto end;
|
|
if (!(dp1->port == 2000))
|
|
goto end;
|
|
if (!(dp1->port2 == 3000))
|
|
goto end;
|
|
|
|
/* Add */
|
|
r = PortTestDetectPortAdd(&head, dp1);
|
|
if (r != 0 || head->next == NULL)
|
|
goto end;
|
|
if (!(head->port == 101))
|
|
goto end;
|
|
if (!(head->port2 == 999))
|
|
goto end;
|
|
if (!(head->next->port == 2000))
|
|
goto end;
|
|
if (!(head->next->port2 == 3000))
|
|
goto end;
|
|
|
|
/* Match */
|
|
if (!DetectPortMatch(head, 150))
|
|
goto end;
|
|
if (DetectPortMatch(head->next, 1500))
|
|
goto end;
|
|
if ((DetectPortMatch(head, 3500)))
|
|
goto end;
|
|
if ((DetectPortMatch(head, 50)))
|
|
goto end;
|
|
|
|
result = 1;
|
|
end:
|
|
if (dp1 != NULL)
|
|
DetectPortFree(NULL, dp1);
|
|
if (head != NULL)
|
|
DetectPortFree(NULL, head);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test general functions
|
|
*/
|
|
static int PortTestFunctions02(void)
|
|
{
|
|
DetectPort *head = NULL;
|
|
DetectPort *dp1= NULL;
|
|
DetectPort *dp2= NULL;
|
|
int result = 0;
|
|
|
|
/* Parse */
|
|
int r = DetectPortParse(NULL,&head, "![0:100,1000:65535]");
|
|
if (r != 0 || head->next != NULL)
|
|
goto end;
|
|
|
|
r = DetectPortParse(NULL, &dp1, "!200:300");
|
|
if (r != 0 || dp1->next == NULL)
|
|
goto end;
|
|
|
|
/* Merge Nots */
|
|
r = DetectPortParseMergeNotPorts(NULL, &head, &dp1);
|
|
if (r != 0 || head->next != NULL)
|
|
goto end;
|
|
|
|
r = DetectPortParse(NULL, &dp2, "!100:500");
|
|
if (r != 0 || dp2->next == NULL)
|
|
goto end;
|
|
|
|
/* Merge Nots */
|
|
r = DetectPortParseMergeNotPorts(NULL, &head, &dp2);
|
|
if (r != 0 || head->next != NULL)
|
|
goto end;
|
|
|
|
if (!(head->port == 200))
|
|
goto end;
|
|
if (!(head->port2 == 300))
|
|
goto end;
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
if (dp1 != NULL)
|
|
DetectPortFree(NULL, dp1);
|
|
if (dp2 != NULL)
|
|
DetectPortFree(NULL, dp2);
|
|
if (head != NULL)
|
|
DetectPortFree(NULL, head);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test general functions
|
|
*/
|
|
static int PortTestFunctions03(void)
|
|
{
|
|
DetectPort *dp1= NULL;
|
|
DetectPort *dp2= NULL;
|
|
DetectPort *dp3= NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL, &dp1, "200:300");
|
|
if (r != 0)
|
|
goto end;
|
|
|
|
r = DetectPortParse(NULL, &dp2, "250:300");
|
|
if (r != 0)
|
|
goto end;
|
|
|
|
/* Cut */
|
|
DetectPortCut(NULL, dp1, dp2, &dp3);
|
|
if (r != 0)
|
|
goto end;
|
|
|
|
if (!(dp1->port == 200))
|
|
goto end;
|
|
if (!(dp1->port2 == 249))
|
|
goto end;
|
|
if (!(dp2->port == 250))
|
|
goto end;
|
|
if (!(dp2->port2 == 300))
|
|
goto end;
|
|
|
|
dp1->port = 0;
|
|
dp1->port2 = 500;
|
|
dp2->port = 250;
|
|
dp2->port2 = 750;
|
|
|
|
/* Cut */
|
|
DetectPortCut(NULL, dp1, dp2, &dp3);
|
|
if (r != 0)
|
|
goto end;
|
|
if (!(dp1->port == 0))
|
|
goto end;
|
|
if (!(dp1->port2 == 249))
|
|
goto end;
|
|
if (!(dp2->port == 250))
|
|
goto end;
|
|
if (!(dp2->port2 == 500))
|
|
goto end;
|
|
if (!(dp3->port == 501))
|
|
goto end;
|
|
if (!(dp3->port2 == 750))
|
|
goto end;
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
if (dp1 != NULL)
|
|
DetectPortFree(NULL, dp1);
|
|
if (dp2 != NULL)
|
|
DetectPortFree(NULL, dp2);
|
|
if (dp3 != NULL)
|
|
DetectPortFree(NULL, dp3);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test general functions
|
|
*/
|
|
static int PortTestFunctions04(void)
|
|
{
|
|
DetectPort *dp1= NULL;
|
|
DetectPort *dp2= NULL;
|
|
int result = 0;
|
|
|
|
int r = DetectPortParse(NULL, &dp1, "200:300");
|
|
if (r != 0)
|
|
goto end;
|
|
|
|
dp2 = DetectPortInit();
|
|
|
|
/* Cut Not */
|
|
DetectPortCutNot(dp1, &dp2);
|
|
if (r != 0)
|
|
goto end;
|
|
|
|
if (!(dp1->port == 0))
|
|
goto end;
|
|
if (!(dp1->port2 == 199))
|
|
goto end;
|
|
if (!(dp2->port == 301))
|
|
goto end;
|
|
if (!(dp2->port2 == 65535))
|
|
goto end;
|
|
|
|
result = 1;
|
|
end:
|
|
if (dp1 != NULL)
|
|
DetectPortFree(NULL, dp1);
|
|
if (dp2 != NULL)
|
|
DetectPortFree(NULL, dp2);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test general functions
|
|
*/
|
|
static int PortTestFunctions05(void)
|
|
{
|
|
DetectPort *dp1 = NULL;
|
|
DetectPort *dp2 = NULL;
|
|
DetectPort *dp3 = NULL;
|
|
int result = 0;
|
|
int r = 0;
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
Signature s[2];
|
|
memset(s,0x00,sizeof(s));
|
|
|
|
s[0].num = 0;
|
|
s[1].num = 1;
|
|
|
|
r = DetectPortParse(NULL, &dp1, "1024:65535");
|
|
if (r != 0) {
|
|
printf("r != 0 but %d: ", r);
|
|
goto end;
|
|
}
|
|
SigGroupHeadAppendSig(de_ctx, &dp1->sh, &s[0]);
|
|
|
|
r = DetectPortParse(NULL, &dp2, "any");
|
|
if (r != 0) {
|
|
printf("r != 0 but %d: ", r);
|
|
goto end;
|
|
}
|
|
SigGroupHeadAppendSig(de_ctx, &dp2->sh, &s[1]);
|
|
|
|
SCLogDebug("dp1");
|
|
DetectPortPrint(dp1);
|
|
SCLogDebug("dp2");
|
|
DetectPortPrint(dp2);
|
|
|
|
DetectPortInsert(de_ctx, &dp3, dp1);
|
|
DetectPortInsert(de_ctx, &dp3, dp2);
|
|
|
|
if (dp3 == NULL)
|
|
goto end;
|
|
|
|
SCLogDebug("dp3");
|
|
DetectPort *x = dp3;
|
|
for ( ; x != NULL; x = x->next) {
|
|
DetectPortPrint(x);
|
|
//SigGroupHeadPrintSigs(de_ctx, x->sh);
|
|
}
|
|
|
|
DetectPort *one = dp3;
|
|
DetectPort *two = dp3->next;
|
|
|
|
int sig = 0;
|
|
if ((one->sh->init->sig_array[sig / 8] & (1 << (sig % 8)))) {
|
|
printf("sig %d part of 'one', but it shouldn't: ", sig);
|
|
goto end;
|
|
}
|
|
sig = 1;
|
|
if (!(one->sh->init->sig_array[sig / 8] & (1 << (sig % 8)))) {
|
|
printf("sig %d part of 'one', but it shouldn't: ", sig);
|
|
goto end;
|
|
}
|
|
sig = 1;
|
|
if (!(two->sh->init->sig_array[sig / 8] & (1 << (sig % 8)))) {
|
|
printf("sig %d part of 'two', but it shouldn't: ", sig);
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (dp1 != NULL)
|
|
DetectPortFree(NULL, dp1);
|
|
if (dp2 != NULL)
|
|
DetectPortFree(NULL, dp2);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test general functions
|
|
*/
|
|
static int PortTestFunctions06(void)
|
|
{
|
|
DetectPort *dp1 = NULL;
|
|
DetectPort *dp2 = NULL;
|
|
DetectPort *dp3 = NULL;
|
|
int result = 0;
|
|
int r = 0;
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
Signature s[2];
|
|
memset(s,0x00,sizeof(s));
|
|
|
|
s[0].num = 0;
|
|
s[1].num = 1;
|
|
|
|
r = DetectPortParse(NULL, &dp1, "1024:65535");
|
|
if (r != 0) {
|
|
printf("r != 0 but %d: ", r);
|
|
goto end;
|
|
}
|
|
SigGroupHeadAppendSig(de_ctx, &dp1->sh, &s[0]);
|
|
|
|
r = DetectPortParse(NULL, &dp2, "any");
|
|
if (r != 0) {
|
|
printf("r != 0 but %d: ", r);
|
|
goto end;
|
|
}
|
|
SigGroupHeadAppendSig(de_ctx, &dp2->sh, &s[1]);
|
|
|
|
SCLogDebug("dp1");
|
|
DetectPortPrint(dp1);
|
|
SCLogDebug("dp2");
|
|
DetectPortPrint(dp2);
|
|
|
|
DetectPortInsert(de_ctx, &dp3, dp2);
|
|
DetectPortInsert(de_ctx, &dp3, dp1);
|
|
|
|
if (dp3 == NULL)
|
|
goto end;
|
|
|
|
SCLogDebug("dp3");
|
|
DetectPort *x = dp3;
|
|
for ( ; x != NULL; x = x->next) {
|
|
DetectPortPrint(x);
|
|
//SigGroupHeadPrintSigs(de_ctx, x->sh);
|
|
}
|
|
|
|
DetectPort *one = dp3;
|
|
DetectPort *two = dp3->next;
|
|
|
|
int sig = 0;
|
|
if ((one->sh->init->sig_array[sig / 8] & (1 << (sig % 8)))) {
|
|
printf("sig %d part of 'one', but it shouldn't: ", sig);
|
|
goto end;
|
|
}
|
|
sig = 1;
|
|
if (!(one->sh->init->sig_array[sig / 8] & (1 << (sig % 8)))) {
|
|
printf("sig %d part of 'one', but it shouldn't: ", sig);
|
|
goto end;
|
|
}
|
|
sig = 1;
|
|
if (!(two->sh->init->sig_array[sig / 8] & (1 << (sig % 8)))) {
|
|
printf("sig %d part of 'two', but it shouldn't: ", sig);
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (dp1 != NULL)
|
|
DetectPortFree(NULL, dp1);
|
|
if (dp2 != NULL)
|
|
DetectPortFree(NULL, dp2);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test general functions
|
|
*/
|
|
static int PortTestFunctions07(void)
|
|
{
|
|
DetectPort *dd = NULL;
|
|
|
|
// This one should fail due to negation in a range
|
|
FAIL_IF(DetectPortParse(NULL, &dd, "[80:!99]") == 0);
|
|
|
|
// Correct: from 80 till 100 but 99 excluded
|
|
FAIL_IF_NOT(DetectPortParse(NULL, &dd, "[80:100,!99]") == 0);
|
|
FAIL_IF_NULL(dd->next);
|
|
FAIL_IF_NOT(dd->port == 80);
|
|
FAIL_IF_NOT(dd->port2 == 98);
|
|
FAIL_IF_NOT(dd->next->port == 100);
|
|
|
|
// Also good: from 1 till 80 except of 2 and 4
|
|
FAIL_IF_NOT(DetectPortParse(NULL, &dd, "[1:80,![2,4]]") == 0);
|
|
FAIL_IF_NOT(dd->port == 1);
|
|
FAIL_IF_NULL(DetectPortLookupGroup(dd, 3));
|
|
FAIL_IF_NOT_NULL(DetectPortLookupGroup(dd, 2));
|
|
FAIL_IF_NULL(DetectPortLookupGroup(dd, 80));
|
|
|
|
DetectPortCleanupList(NULL, dd);
|
|
PASS;
|
|
}
|
|
|
|
/**
|
|
* \test Test packet Matches
|
|
* \param raw_eth_pkt pointer to the ethernet packet
|
|
* \param pktsize size of the packet
|
|
* \param sig pointer to the signature to test
|
|
* \param sid sid number of the signature
|
|
* \retval return 1 if match
|
|
* \retval return 0 if not
|
|
*/
|
|
static int PortTestMatchReal(uint8_t *raw_eth_pkt, uint16_t pktsize, const char *sig,
|
|
uint32_t sid)
|
|
{
|
|
int result = 0;
|
|
FlowInitConfig(FLOW_QUIET);
|
|
Packet *p = UTHBuildPacketFromEth(raw_eth_pkt, pktsize);
|
|
result = UTHPacketMatchSig(p, sig);
|
|
PACKET_RECYCLE(p);
|
|
FlowShutdown();
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \brief Wrapper for PortTestMatchReal
|
|
*/
|
|
static int PortTestMatchRealWrp(const char *sig, uint32_t sid)
|
|
{
|
|
/* Real HTTP packeth doing a GET method
|
|
* tcp.sport=47370 tcp.dport=80
|
|
* ip.src=192.168.28.131 ip.dst=192.168.1.1
|
|
*/
|
|
uint8_t raw_eth_pkt[] = {
|
|
0x00,0x50,0x56,0xea,0x00,0xbd,0x00,0x0c,
|
|
0x29,0x40,0xc8,0xb5,0x08,0x00,0x45,0x00,
|
|
0x01,0xa8,0xb9,0xbb,0x40,0x00,0x40,0x06,
|
|
0xe0,0xbf,0xc0,0xa8,0x1c,0x83,0xc0,0xa8,
|
|
0x01,0x01,0xb9,0x0a,0x00,0x50,0x6f,0xa2,
|
|
0x92,0xed,0x7b,0xc1,0xd3,0x4d,0x50,0x18,
|
|
0x16,0xd0,0xa0,0x6f,0x00,0x00,0x47,0x45,
|
|
0x54,0x20,0x2f,0x20,0x48,0x54,0x54,0x50,
|
|
0x2f,0x31,0x2e,0x31,0x0d,0x0a,0x48,0x6f,
|
|
0x73,0x74,0x3a,0x20,0x31,0x39,0x32,0x2e,
|
|
0x31,0x36,0x38,0x2e,0x31,0x2e,0x31,0x0d,
|
|
0x0a,0x55,0x73,0x65,0x72,0x2d,0x41,0x67,
|
|
0x65,0x6e,0x74,0x3a,0x20,0x4d,0x6f,0x7a,
|
|
0x69,0x6c,0x6c,0x61,0x2f,0x35,0x2e,0x30,
|
|
0x20,0x28,0x58,0x31,0x31,0x3b,0x20,0x55,
|
|
0x3b,0x20,0x4c,0x69,0x6e,0x75,0x78,0x20,
|
|
0x78,0x38,0x36,0x5f,0x36,0x34,0x3b,0x20,
|
|
0x65,0x6e,0x2d,0x55,0x53,0x3b,0x20,0x72,
|
|
0x76,0x3a,0x31,0x2e,0x39,0x2e,0x30,0x2e,
|
|
0x31,0x34,0x29,0x20,0x47,0x65,0x63,0x6b,
|
|
0x6f,0x2f,0x32,0x30,0x30,0x39,0x30,0x39,
|
|
0x30,0x32,0x31,0x37,0x20,0x55,0x62,0x75,
|
|
0x6e,0x74,0x75,0x2f,0x39,0x2e,0x30,0x34,
|
|
0x20,0x28,0x6a,0x61,0x75,0x6e,0x74,0x79,
|
|
0x29,0x20,0x46,0x69,0x72,0x65,0x66,0x6f,
|
|
0x78,0x2f,0x33,0x2e,0x30,0x2e,0x31,0x34,
|
|
0x0d,0x0a,0x41,0x63,0x63,0x65,0x70,0x74,
|
|
0x3a,0x20,0x74,0x65,0x78,0x74,0x2f,0x68,
|
|
0x74,0x6d,0x6c,0x2c,0x61,0x70,0x70,0x6c,
|
|
0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x2f,
|
|
0x78,0x68,0x74,0x6d,0x6c,0x2b,0x78,0x6d,
|
|
0x6c,0x2c,0x61,0x70,0x70,0x6c,0x69,0x63,
|
|
0x61,0x74,0x69,0x6f,0x6e,0x2f,0x78,0x6d,
|
|
0x6c,0x3b,0x71,0x3d,0x30,0x2e,0x39,0x2c,
|
|
0x2a,0x2f,0x2a,0x3b,0x71,0x3d,0x30,0x2e,
|
|
0x38,0x0d,0x0a,0x41,0x63,0x63,0x65,0x70,
|
|
0x74,0x2d,0x4c,0x61,0x6e,0x67,0x75,0x61,
|
|
0x67,0x65,0x3a,0x20,0x65,0x6e,0x2d,0x75,
|
|
0x73,0x2c,0x65,0x6e,0x3b,0x71,0x3d,0x30,
|
|
0x2e,0x35,0x0d,0x0a,0x41,0x63,0x63,0x65,
|
|
0x70,0x74,0x2d,0x45,0x6e,0x63,0x6f,0x64,
|
|
0x69,0x6e,0x67,0x3a,0x20,0x67,0x7a,0x69,
|
|
0x70,0x2c,0x64,0x65,0x66,0x6c,0x61,0x74,
|
|
0x65,0x0d,0x0a,0x41,0x63,0x63,0x65,0x70,
|
|
0x74,0x2d,0x43,0x68,0x61,0x72,0x73,0x65,
|
|
0x74,0x3a,0x20,0x49,0x53,0x4f,0x2d,0x38,
|
|
0x38,0x35,0x39,0x2d,0x31,0x2c,0x75,0x74,
|
|
0x66,0x2d,0x38,0x3b,0x71,0x3d,0x30,0x2e,
|
|
0x37,0x2c,0x2a,0x3b,0x71,0x3d,0x30,0x2e,
|
|
0x37,0x0d,0x0a,0x4b,0x65,0x65,0x70,0x2d,
|
|
0x41,0x6c,0x69,0x76,0x65,0x3a,0x20,0x33,
|
|
0x30,0x30,0x0d,0x0a,0x43,0x6f,0x6e,0x6e,
|
|
0x65,0x63,0x74,0x69,0x6f,0x6e,0x3a,0x20,
|
|
0x6b,0x65,0x65,0x70,0x2d,0x61,0x6c,0x69,
|
|
0x76,0x65,0x0d,0x0a,0x0d,0x0a };
|
|
/* end raw_eth_pkt */
|
|
|
|
return PortTestMatchReal(raw_eth_pkt, (uint16_t)sizeof(raw_eth_pkt),
|
|
sig, sid);
|
|
}
|
|
|
|
/**
|
|
* \test Check if we match a dest port
|
|
*/
|
|
static int PortTestMatchReal01(void)
|
|
{
|
|
/* tcp.sport=47370 tcp.dport=80 */
|
|
const char *sig = "alert tcp any any -> any 80 (msg:\"Nothing..\"; content:\"GET\"; sid:1;)";
|
|
return PortTestMatchRealWrp(sig, 1);
|
|
}
|
|
|
|
/**
|
|
* \test Check if we match a source port
|
|
*/
|
|
static int PortTestMatchReal02(void)
|
|
{
|
|
const char *sig = "alert tcp any 47370 -> any any (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return PortTestMatchRealWrp(sig, 1);
|
|
}
|
|
|
|
/**
|
|
* \test Check if we match both of them
|
|
*/
|
|
static int PortTestMatchReal03(void)
|
|
{
|
|
const char *sig = "alert tcp any 47370 -> any 80 (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return PortTestMatchRealWrp(sig, 1);
|
|
}
|
|
|
|
/**
|
|
* \test Check if we negate dest ports correctly
|
|
*/
|
|
static int PortTestMatchReal04(void)
|
|
{
|
|
const char *sig = "alert tcp any any -> any !80 (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0;
|
|
}
|
|
|
|
/**
|
|
* \test Check if we negate source ports correctly
|
|
*/
|
|
static int PortTestMatchReal05(void)
|
|
{
|
|
const char *sig = "alert tcp any !47370 -> any any (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0;
|
|
}
|
|
|
|
/**
|
|
* \test Check if we negate both ports correctly
|
|
*/
|
|
static int PortTestMatchReal06(void)
|
|
{
|
|
const char *sig = "alert tcp any !47370 -> any !80 (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0;
|
|
}
|
|
|
|
/**
|
|
* \test Check if we match a dest port range
|
|
*/
|
|
static int PortTestMatchReal07(void)
|
|
{
|
|
const char *sig = "alert tcp any any -> any 70:100 (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return PortTestMatchRealWrp(sig, 1);
|
|
}
|
|
|
|
/**
|
|
* \test Check if we match a source port range
|
|
*/
|
|
static int PortTestMatchReal08(void)
|
|
{
|
|
const char *sig = "alert tcp any 47000:50000 -> any any (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return PortTestMatchRealWrp(sig, 1);
|
|
}
|
|
|
|
/**
|
|
* \test Check if we match both port ranges
|
|
*/
|
|
static int PortTestMatchReal09(void)
|
|
{
|
|
const char *sig = "alert tcp any 47000:50000 -> any 70:100 (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return PortTestMatchRealWrp(sig, 1);
|
|
}
|
|
|
|
/**
|
|
* \test Check if we negate a dest port range
|
|
*/
|
|
static int PortTestMatchReal10(void)
|
|
{
|
|
const char *sig = "alert tcp any any -> any !70:100 (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0;
|
|
}
|
|
|
|
/**
|
|
* \test Check if we negate a source port range
|
|
*/
|
|
static int PortTestMatchReal11(void)
|
|
{
|
|
const char *sig = "alert tcp any !47000:50000 -> any any (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0;
|
|
}
|
|
|
|
/**
|
|
* \test Check if we negate both port ranges
|
|
*/
|
|
static int PortTestMatchReal12(void)
|
|
{
|
|
const char *sig = "alert tcp any !47000:50000 -> any !70:100 (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0;
|
|
}
|
|
|
|
/**
|
|
* \test Check if we autocomplete ranges correctly
|
|
*/
|
|
static int PortTestMatchReal13(void)
|
|
{
|
|
const char *sig = "alert tcp any 47000:50000 -> any !81: (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return PortTestMatchRealWrp(sig, 1);
|
|
}
|
|
|
|
/**
|
|
* \test Check if we autocomplete ranges correctly
|
|
*/
|
|
static int PortTestMatchReal14(void)
|
|
{
|
|
const char *sig = "alert tcp any !48000:50000 -> any :100 (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return PortTestMatchRealWrp(sig, 1);
|
|
}
|
|
|
|
/**
|
|
* \test Check if we autocomplete ranges correctly
|
|
*/
|
|
static int PortTestMatchReal15(void)
|
|
{
|
|
const char *sig = "alert tcp any :50000 -> any 81:100 (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0;
|
|
}
|
|
|
|
/**
|
|
* \test Check if we separate ranges correctly
|
|
*/
|
|
static int PortTestMatchReal16(void)
|
|
{
|
|
const char *sig = "alert tcp any 100: -> any ![0:79,81:65535] (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return PortTestMatchRealWrp(sig, 1);
|
|
}
|
|
|
|
/**
|
|
* \test Check if we separate ranges correctly
|
|
*/
|
|
static int PortTestMatchReal17(void)
|
|
{
|
|
const char *sig = "alert tcp any ![0:39999,48000:50000] -> any ![0:80,82:65535] "
|
|
"(msg:\"Nothing..\"; content:\"GET\"; sid:1;)";
|
|
return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0;
|
|
}
|
|
|
|
/**
|
|
* \test Check if we separate ranges correctly
|
|
*/
|
|
static int PortTestMatchReal18(void)
|
|
{
|
|
const char *sig = "alert tcp any ![0:39999,48000:50000] -> any 80 (msg:\"Nothing"
|
|
" at all\"; content:\"GET\"; sid:1;)";
|
|
return PortTestMatchRealWrp(sig, 1);
|
|
}
|
|
|
|
/**
|
|
* \test Check if we separate ranges correctly
|
|
*/
|
|
static int PortTestMatchReal19(void)
|
|
{
|
|
const char *sig = "alert tcp any any -> any 80 (msg:\"Nothing..\";"
|
|
" content:\"GET\"; sid:1;)";
|
|
return PortTestMatchRealWrp(sig, 1);
|
|
}
|
|
|
|
static int PortTestMatchDoubleNegation(void)
|
|
{
|
|
int result = 0;
|
|
DetectPort *head = NULL, *nhead = NULL;
|
|
|
|
if (DetectPortParseDo(NULL, &head, &nhead, "![!80]", 0, NULL) == -1)
|
|
return result;
|
|
|
|
result = (head != NULL);
|
|
result = (nhead == NULL);
|
|
|
|
return result;
|
|
}
|
|
|
|
#endif /* UNITTESTS */
|
|
|
|
void DetectPortTests(void)
|
|
{
|
|
#ifdef UNITTESTS
|
|
UtRegisterTest("PortTestParse01", PortTestParse01);
|
|
UtRegisterTest("PortTestParse02", PortTestParse02);
|
|
UtRegisterTest("PortTestParse03", PortTestParse03);
|
|
UtRegisterTest("PortTestParse04", PortTestParse04);
|
|
UtRegisterTest("PortTestParse05", PortTestParse05);
|
|
UtRegisterTest("PortTestParse06", PortTestParse06);
|
|
UtRegisterTest("PortTestParse07", PortTestParse07);
|
|
UtRegisterTest("PortTestParse08", PortTestParse08);
|
|
UtRegisterTest("PortTestParse09", PortTestParse09);
|
|
UtRegisterTest("PortTestParse10", PortTestParse10);
|
|
UtRegisterTest("PortTestParse11", PortTestParse11);
|
|
UtRegisterTest("PortTestParse12", PortTestParse12);
|
|
UtRegisterTest("PortTestParse13", PortTestParse13);
|
|
UtRegisterTest("PortTestParse14", PortTestParse14);
|
|
UtRegisterTest("PortTestParse15", PortTestParse15);
|
|
UtRegisterTest("PortTestParse16", PortTestParse16);
|
|
UtRegisterTest("PortTestFunctions01", PortTestFunctions01);
|
|
UtRegisterTest("PortTestFunctions02", PortTestFunctions02);
|
|
UtRegisterTest("PortTestFunctions03", PortTestFunctions03);
|
|
UtRegisterTest("PortTestFunctions04", PortTestFunctions04);
|
|
UtRegisterTest("PortTestFunctions05", PortTestFunctions05);
|
|
UtRegisterTest("PortTestFunctions06", PortTestFunctions06);
|
|
UtRegisterTest("PortTestFunctions07", PortTestFunctions07);
|
|
UtRegisterTest("PortTestMatchReal01", PortTestMatchReal01);
|
|
UtRegisterTest("PortTestMatchReal02", PortTestMatchReal02);
|
|
UtRegisterTest("PortTestMatchReal03", PortTestMatchReal03);
|
|
UtRegisterTest("PortTestMatchReal04", PortTestMatchReal04);
|
|
UtRegisterTest("PortTestMatchReal05", PortTestMatchReal05);
|
|
UtRegisterTest("PortTestMatchReal06", PortTestMatchReal06);
|
|
UtRegisterTest("PortTestMatchReal07", PortTestMatchReal07);
|
|
UtRegisterTest("PortTestMatchReal08", PortTestMatchReal08);
|
|
UtRegisterTest("PortTestMatchReal09", PortTestMatchReal09);
|
|
UtRegisterTest("PortTestMatchReal10", PortTestMatchReal10);
|
|
UtRegisterTest("PortTestMatchReal11", PortTestMatchReal11);
|
|
UtRegisterTest("PortTestMatchReal12", PortTestMatchReal12);
|
|
UtRegisterTest("PortTestMatchReal13", PortTestMatchReal13);
|
|
UtRegisterTest("PortTestMatchReal14", PortTestMatchReal14);
|
|
UtRegisterTest("PortTestMatchReal15", PortTestMatchReal15);
|
|
UtRegisterTest("PortTestMatchReal16", PortTestMatchReal16);
|
|
UtRegisterTest("PortTestMatchReal17", PortTestMatchReal17);
|
|
UtRegisterTest("PortTestMatchReal18", PortTestMatchReal18);
|
|
UtRegisterTest("PortTestMatchReal19", PortTestMatchReal19);
|
|
UtRegisterTest("PortTestMatchDoubleNegation", PortTestMatchDoubleNegation);
|
|
|
|
|
|
#endif /* UNITTESTS */
|
|
}
|
|
|