mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
2180 lines
65 KiB
C
2180 lines
65 KiB
C
/* Copyright (C) 2007-2013 Open Information Security Foundation
|
|
*
|
|
* You can copy, redistribute or modify this Program under the terms of
|
|
* the GNU General Public License version 2 as published by the Free
|
|
* Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* version 2 along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
* 02110-1301, USA.
|
|
*/
|
|
|
|
/**
|
|
* \ingroup httplayer
|
|
*
|
|
* @{
|
|
*/
|
|
|
|
|
|
/**
|
|
* \file
|
|
*
|
|
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
|
|
*
|
|
* Implements support for the http_host keyword.
|
|
*/
|
|
|
|
#include "suricata-common.h"
|
|
#include "threads.h"
|
|
#include "decode.h"
|
|
|
|
#include "detect.h"
|
|
#include "detect-parse.h"
|
|
#include "detect-engine.h"
|
|
#include "detect-engine-mpm.h"
|
|
#include "detect-engine-state.h"
|
|
#include "detect-content.h"
|
|
#include "detect-pcre.h"
|
|
|
|
#include "flow.h"
|
|
#include "flow-var.h"
|
|
#include "flow-util.h"
|
|
|
|
#include "util-debug.h"
|
|
#include "util-unittest.h"
|
|
#include "util-unittest-helper.h"
|
|
#include "util-spm.h"
|
|
|
|
#include "app-layer.h"
|
|
#include "app-layer-parser.h"
|
|
|
|
#include "app-layer-htp.h"
|
|
#include "stream-tcp.h"
|
|
#include "detect-http-hh.h"
|
|
#include "detect-engine-hhhd.h"
|
|
|
|
static int DetectHttpHHSetup(DetectEngineCtx *, Signature *, const char *);
|
|
static void DetectHttpHHRegisterTests(void);
|
|
static void DetectHttpHHFree(void *);
|
|
static _Bool DetectHttpHostValidateCallback(const Signature *s, const char **sigerror);
|
|
static int g_http_host_buffer_id = 0;
|
|
|
|
/**
|
|
* \brief Registers the keyword handlers for the "http_host" keyword.
|
|
*/
|
|
void DetectHttpHHRegister(void)
|
|
{
|
|
sigmatch_table[DETECT_AL_HTTP_HOST].name = "http_host";
|
|
sigmatch_table[DETECT_AL_HTTP_HOST].desc = "content modifier to match only on the HTTP hostname";
|
|
sigmatch_table[DETECT_AL_HTTP_HOST].Match = NULL;
|
|
sigmatch_table[DETECT_AL_HTTP_HOST].Setup = DetectHttpHHSetup;
|
|
sigmatch_table[DETECT_AL_HTTP_HOST].Free = DetectHttpHHFree;
|
|
sigmatch_table[DETECT_AL_HTTP_HOST].RegisterTests = DetectHttpHHRegisterTests;
|
|
|
|
sigmatch_table[DETECT_AL_HTTP_HOST].flags |= SIGMATCH_NOOPT ;
|
|
|
|
DetectAppLayerMpmRegister("http_host", SIG_FLAG_TOSERVER, 2,
|
|
PrefilterTxHostnameRegister);
|
|
|
|
DetectAppLayerInspectEngineRegister("http_host",
|
|
ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
|
|
DetectEngineInspectHttpHH);
|
|
|
|
DetectBufferTypeSetDescriptionByName("http_host",
|
|
"http host header");
|
|
|
|
DetectBufferTypeRegisterValidateCallback("http_host",
|
|
DetectHttpHostValidateCallback);
|
|
|
|
g_http_host_buffer_id = DetectBufferTypeGetByName("http_host");
|
|
}
|
|
|
|
/**
|
|
* \brief The setup function for the http_host keyword for a signature.
|
|
*
|
|
* \param de_ctx Pointer to the detection engine context.
|
|
* \param s Pointer to the signature for the current Signature being
|
|
* parsed from the rules.
|
|
* \param m Pointer to the head of the SigMatch for the current rule
|
|
* being parsed.
|
|
* \param arg Pointer to the string holding the keyword value.
|
|
*
|
|
* \retval 0 On success
|
|
* \retval -1 On failure
|
|
*/
|
|
static int DetectHttpHHSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
|
|
{
|
|
return DetectEngineContentModifierBufferSetup(de_ctx, s, arg,
|
|
DETECT_AL_HTTP_HOST,
|
|
g_http_host_buffer_id,
|
|
ALPROTO_HTTP);
|
|
}
|
|
|
|
static _Bool DetectHttpHostValidateCallback(const Signature *s, const char **sigerror)
|
|
{
|
|
const SigMatch *sm = s->init_data->smlists[g_http_host_buffer_id];
|
|
for ( ; sm != NULL; sm = sm->next) {
|
|
if (sm->type == DETECT_CONTENT) {
|
|
DetectContentData *cd = (DetectContentData *)sm->ctx;
|
|
if (cd->flags & DETECT_CONTENT_NOCASE) {
|
|
*sigerror = "http_host keyword "
|
|
"specified along with \"nocase\". "
|
|
"Since the hostname buffer we match against "
|
|
"is actually lowercase. So having a "
|
|
"nocase is redundant.";
|
|
SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror);
|
|
return FALSE;
|
|
} else {
|
|
uint32_t u;
|
|
for (u = 0; u < cd->content_len; u++) {
|
|
if (isupper(cd->content[u]))
|
|
break;
|
|
}
|
|
if (u != cd->content_len) {
|
|
*sigerror = "A pattern with "
|
|
"uppercase chars detected for http_host. "
|
|
"Since the hostname buffer we match against "
|
|
"is lowercase only, please specify a "
|
|
"lowercase pattern.";
|
|
SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror);
|
|
return FALSE;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
/**
|
|
* \brief The function to free the http_host data.
|
|
*
|
|
* \param ptr Pointer to the http_host.
|
|
*/
|
|
void DetectHttpHHFree(void *ptr)
|
|
{
|
|
DetectContentData *hhhd = (DetectContentData *)ptr;
|
|
if (hhhd == NULL)
|
|
return;
|
|
|
|
if (hhhd->content != NULL)
|
|
SCFree(hhhd->content);
|
|
|
|
SpmDestroyCtx(hhhd->spm_ctx);
|
|
SCFree(hhhd);
|
|
|
|
return;
|
|
}
|
|
|
|
/************************************Unittests*********************************/
|
|
|
|
#ifdef UNITTESTS
|
|
|
|
#include "stream-tcp-reassemble.h"
|
|
|
|
/**
|
|
* \test Test that a signature containting a http_host is correctly parsed
|
|
* and the keyword is registered.
|
|
*/
|
|
static int DetectHttpHHTest01(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(msg:\"Testing http_host\"; "
|
|
"content:\"one\"; http_host; sid:1;)");
|
|
if (de_ctx->sig_list != NULL) {
|
|
result = 1;
|
|
} else {
|
|
goto end;
|
|
}
|
|
|
|
end:
|
|
SigGroupCleanup(de_ctx);
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test that a signature containing an valid http_host entry is
|
|
* parsed.
|
|
*/
|
|
static int DetectHttpHHTest02(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(msg:\"Testing http_host\"; "
|
|
"content:\"one\"; http_host; sid:1;)");
|
|
if (de_ctx->sig_list != NULL)
|
|
result = 1;
|
|
|
|
end:
|
|
SigGroupCleanup(de_ctx);
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test that an invalid signature containing no content but a
|
|
* http_host is invalidated.
|
|
*/
|
|
static int DetectHttpHHTest03(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(msg:\"Testing http_host\"; "
|
|
"http_host; sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
result = 1;
|
|
|
|
end:
|
|
SigGroupCleanup(de_ctx);
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test that an invalid signature containing a rawbytes along with a
|
|
* http_host is invalidated.
|
|
*/
|
|
static int DetectHttpHHTest04(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(msg:\"Testing http_host\"; "
|
|
"content:\"one\"; rawbytes; http_host; sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
result = 1;
|
|
|
|
end:
|
|
SigGroupCleanup(de_ctx);
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test that a http_host with nocase is parsed.
|
|
*/
|
|
static int DetectHttpHHTest05(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(msg:\"Testing http_host\"; "
|
|
"content:\"one\"; http_host; sid:1;)");
|
|
if (de_ctx->sig_list != NULL)
|
|
result = 1;
|
|
|
|
end:
|
|
SigGroupCleanup(de_ctx);
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
return result;
|
|
}
|
|
|
|
/** \test invalid sig: uppercase content */
|
|
static int DetectHttpHHTest05a(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
FAIL_IF_NULL(de_ctx);
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
Signature *s = DetectEngineAppendSig(de_ctx,
|
|
"alert tcp any any -> any any "
|
|
"(content:\"ABC\"; http_host; sid:1;)");
|
|
FAIL_IF_NOT_NULL(s);
|
|
|
|
DetectEngineCtxFree(de_ctx);
|
|
PASS;
|
|
}
|
|
|
|
/**
|
|
*\test Test that the http_host content matches against a http request
|
|
* which holds the content.
|
|
*/
|
|
static int DetectHttpHHTest06(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: This is dummy message body\r\n"
|
|
"Content-Type: text/html\r\n"
|
|
"\r\n";
|
|
uint32_t http_len = sizeof(http_buf) - 1;
|
|
int result = 0;
|
|
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.proto = IPPROTO_TCP;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p->flow = &f;
|
|
p->flowflags |= FLOW_PKT_TOSERVER;
|
|
p->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:\"message\"; http_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, http_buf, http_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: \n");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
if (!(PacketAlertCheck(p, 1))) {
|
|
printf("sid 1 didn't match but should have\n");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (alp_tctx != NULL)
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
*\test Test that the http_host content matches against a http request
|
|
* which holds the content.
|
|
*/
|
|
static int DetectHttpHHTest07(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p1 = NULL;
|
|
Packet *p2 = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http1_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: This is dummy message";
|
|
uint8_t http2_buf[] =
|
|
"body1\r\n\r\n";
|
|
uint32_t http1_len = sizeof(http1_buf) - 1;
|
|
uint32_t http2_len = sizeof(http2_buf) - 1;
|
|
int result = 0;
|
|
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.proto = IPPROTO_TCP;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p1->flow = &f;
|
|
p1->flowflags |= FLOW_PKT_TOSERVER;
|
|
p1->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
p2->flow = &f;
|
|
p2->flowflags |= FLOW_PKT_TOSERVER;
|
|
p2->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:\"message\"; http_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, http1_buf, http1_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: ");
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
|
|
|
|
if (PacketAlertCheck(p1, 1)) {
|
|
printf("sid 1 matched on p1 but shouldn't have: ");
|
|
goto end;
|
|
}
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, http2_buf, http2_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
|
|
if (!(PacketAlertCheck(p2, 1))) {
|
|
printf("sid 1 didn't match on p2 but should have: ");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (alp_tctx != NULL)
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p1, 1);
|
|
UTHFreePackets(&p2, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
*\test Test that the http_host content matches against a http request
|
|
* which holds the content.
|
|
*/
|
|
static int DetectHttpHHTest08(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p1 = NULL;
|
|
Packet *p2 = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http1_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"host: This is dummy mess";
|
|
uint8_t http2_buf[] =
|
|
"age body\r\n\r\n";
|
|
uint32_t http1_len = sizeof(http1_buf) - 1;
|
|
uint32_t http2_len = sizeof(http2_buf) - 1;
|
|
int result = 0;
|
|
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.proto = IPPROTO_TCP;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p1->flow = &f;
|
|
p1->flowflags |= FLOW_PKT_TOSERVER;
|
|
p1->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
p2->flow = &f;
|
|
p2->flowflags |= FLOW_PKT_TOSERVER;
|
|
p2->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:\"message\"; http_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, http1_buf, http1_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: ");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
|
|
|
|
if ((PacketAlertCheck(p1, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, http2_buf, http2_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
|
|
|
|
if (!(PacketAlertCheck(p2, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (alp_tctx != NULL)
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p1, 1);
|
|
UTHFreePackets(&p2, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
*\test Test that the http_host content matches against a http request
|
|
* which holds the content, against a cross boundary present pattern.
|
|
*/
|
|
static int DetectHttpHHTest09(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p1 = NULL;
|
|
Packet *p2 = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http1_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: This is dummy body1";
|
|
uint8_t http2_buf[] =
|
|
"This is dummy message body2\r\n"
|
|
"Content-Type: text/html\r\n"
|
|
"Content-Length: 46\r\n"
|
|
"\r\n"
|
|
"This is dummy body1";
|
|
uint32_t http1_len = sizeof(http1_buf) - 1;
|
|
uint32_t http2_len = sizeof(http2_buf) - 1;
|
|
int result = 0;
|
|
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.proto = IPPROTO_TCP;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p1->flow = &f;
|
|
p1->flowflags |= FLOW_PKT_TOSERVER;
|
|
p1->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
p2->flow = &f;
|
|
p2->flowflags |= FLOW_PKT_TOSERVER;
|
|
p2->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:\"body1this\"; http_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, http1_buf, http1_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: ");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
|
|
|
|
if ((PacketAlertCheck(p1, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, http2_buf, http2_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
|
|
|
|
if (!(PacketAlertCheck(p2, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (alp_tctx != NULL)
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p1, 1);
|
|
UTHFreePackets(&p2, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
*\test Test that the http_host content matches against a http request
|
|
* against a case insensitive pattern.
|
|
*/
|
|
static int DetectHttpHHTest10(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p1 = NULL;
|
|
Packet *p2 = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http1_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: This is dummy bodY1";
|
|
uint8_t http2_buf[] =
|
|
"This is dummy message body2\r\n"
|
|
"Content-Type: text/html\r\n"
|
|
"Content-Length: 46\r\n"
|
|
"\r\n"
|
|
"This is dummy bodY1";
|
|
uint32_t http1_len = sizeof(http1_buf) - 1;
|
|
uint32_t http2_len = sizeof(http2_buf) - 1;
|
|
int result = 0;
|
|
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.proto = IPPROTO_TCP;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p1->flow = &f;
|
|
p1->flowflags |= FLOW_PKT_TOSERVER;
|
|
p1->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
p2->flow = &f;
|
|
p2->flowflags |= FLOW_PKT_TOSERVER;
|
|
p2->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:\"body1this\"; http_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, http1_buf, http1_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: \n");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
|
|
|
|
if ((PacketAlertCheck(p1, 1))) {
|
|
printf("sid 1 didn't match but should have\n");
|
|
goto end;
|
|
}
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, http2_buf, http2_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
|
|
result = 0;
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
|
|
|
|
if (!(PacketAlertCheck(p2, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (alp_tctx != NULL)
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p1, 1);
|
|
UTHFreePackets(&p2, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
*\test Test that the negated http_host content matches against a
|
|
* http request which doesn't hold the content.
|
|
*/
|
|
static int DetectHttpHHTest11(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: This is dummy message body\r\n"
|
|
"Content-Type: text/html\r\n"
|
|
"\r\n";
|
|
uint32_t http_len = sizeof(http_buf) - 1;
|
|
int result = 0;
|
|
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.proto = IPPROTO_TCP;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p->flow = &f;
|
|
p->flowflags |= FLOW_PKT_TOSERVER;
|
|
p->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:!\"message\"; http_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, http_buf, http_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: ");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
if (PacketAlertCheck(p, 1)) {
|
|
printf("sid 1 matched but shouldn't have");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (alp_tctx != NULL)
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
*\test Negative test that the negated http_host content matches against a
|
|
* http request which holds hold the content.
|
|
*/
|
|
static int DetectHttpHHTest12(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: This is dummy body\r\n"
|
|
"\r\n";
|
|
uint32_t http_len = sizeof(http_buf) - 1;
|
|
int result = 0;
|
|
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.proto = IPPROTO_TCP;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p->flow = &f;
|
|
p->flowflags |= FLOW_PKT_TOSERVER;
|
|
p->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:!\"message\"; http_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, http_buf, http_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: ");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
if (!(PacketAlertCheck(p, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (alp_tctx != NULL)
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test that the http_host content matches against a http request
|
|
* which holds the content.
|
|
*/
|
|
static int DetectHttpHHTest13(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: longbufferabcdefghijklmnopqrstuvwxyz0123456789bufferend\r\n"
|
|
"Content-Type: text/html\r\n"
|
|
"\r\n";
|
|
uint32_t http_len = sizeof(http_buf) - 1;
|
|
int result = 0;
|
|
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.proto = IPPROTO_TCP;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p->flow = &f;
|
|
p->flowflags |= FLOW_PKT_TOSERVER;
|
|
p->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:\"abcdefghijklmnopqrstuvwxyz0123456789\"; http_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, http_buf, http_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: ");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
if (!(PacketAlertCheck(p, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (alp_tctx != NULL)
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test multiple http transactions and body chunks of request handling
|
|
*/
|
|
static int DetectHttpHHTest14(void)
|
|
{
|
|
int result = 0;
|
|
Signature *s = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
ThreadVars th_v;
|
|
Flow f;
|
|
TcpSession ssn;
|
|
Packet *p = NULL;
|
|
uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n";
|
|
uint8_t httpbuf2[] = "Cookie: dummy1\r\n";
|
|
uint8_t httpbuf3[] = "Host: Body one!!\r\n\r\n";
|
|
uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
|
|
uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
|
|
uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */
|
|
uint8_t httpbuf4[] = "GET /?var=val HTTP/1.1\r\n";
|
|
uint8_t httpbuf5[] = "Cookie: dummy2\r\n";
|
|
uint8_t httpbuf6[] = "Host: Body two\r\n\r\n";
|
|
uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */
|
|
uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */
|
|
uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */
|
|
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.proto = IPPROTO_TCP;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p->flow = &f;
|
|
p->flowflags |= FLOW_PKT_TOSERVER;
|
|
p->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL) {
|
|
goto end;
|
|
}
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"POST\"; http_method; content:\"dummy1\"; http_cookie; content:\"body one\"; http_host; sid:1; rev:1;)");
|
|
if (s == NULL) {
|
|
printf("sig parse failed: ");
|
|
goto end;
|
|
}
|
|
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"dummy2\"; http_cookie; content:\"body two\"; http_host; sid:2; rev:1;)");
|
|
if (s == NULL) {
|
|
printf("sig2 parse failed: ");
|
|
goto end;
|
|
}
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, httpbuf1, httplen1);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
if (PacketAlertCheck(p, 1)) {
|
|
printf("sig 1 alerted: ");
|
|
goto end;
|
|
}
|
|
p->alerts.cnt = 0;
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, httpbuf2, httplen2);
|
|
if (r != 0) {
|
|
printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
if (PacketAlertCheck(p, 1)) {
|
|
printf("sig 1 alerted (2): ");
|
|
goto end;
|
|
}
|
|
p->alerts.cnt = 0;
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, httpbuf3, httplen3);
|
|
if (r != 0) {
|
|
printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
if (!(PacketAlertCheck(p, 1))) {
|
|
printf("sig 1 didn't alert: ");
|
|
goto end;
|
|
}
|
|
p->alerts.cnt = 0;
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, httpbuf4, httplen4);
|
|
if (r != 0) {
|
|
printf("toserver chunk 5 returned %" PRId32 ", expected 0: ", r);
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
if (PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2)) {
|
|
printf("sig 1 alerted (4): ");
|
|
goto end;
|
|
}
|
|
p->alerts.cnt = 0;
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, httpbuf5, httplen5);
|
|
if (r != 0) {
|
|
printf("toserver chunk 6 returned %" PRId32 ", expected 0: ", r);
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
if ((PacketAlertCheck(p, 1)) || (PacketAlertCheck(p, 2))) {
|
|
printf("sig 1 alerted (request 2, chunk 6): ");
|
|
goto end;
|
|
}
|
|
p->alerts.cnt = 0;
|
|
|
|
SCLogDebug("sending data chunk 7");
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
|
|
STREAM_TOSERVER, httpbuf6, httplen6);
|
|
if (r != 0) {
|
|
printf("toserver chunk 7 returned %" PRId32 ", expected 0: ", r);
|
|
FLOWLOCK_UNLOCK(&f);
|
|
goto end;
|
|
}
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
if (PacketAlertCheck(p, 1) || !(PacketAlertCheck(p, 2))) {
|
|
printf("signature 2 didn't match or sig 1 matched, but shouldn't have: ");
|
|
goto end;
|
|
}
|
|
p->alerts.cnt = 0;
|
|
|
|
HtpState *htp_state = f.alstate;
|
|
if (htp_state == NULL) {
|
|
printf("no http state: ");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
if (AppLayerParserGetTxCnt(&f, htp_state) != 2) {
|
|
printf("The http app layer doesn't have 2 transactions, but it should: ");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (alp_tctx != NULL)
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
if (det_ctx != NULL) {
|
|
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
|
|
}
|
|
if (de_ctx != NULL) {
|
|
SigGroupCleanup(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
}
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePacket(p);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest22(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; content:\"two\"; http_host; "
|
|
"content:\"three\"; distance:10; http_host; content:\"four\"; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectContentData *cd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
|
|
DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
|
|
DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
|
|
if (cd1->flags != 0 || memcmp(cd1->content, "one", cd1->content_len) != 0 ||
|
|
cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 ||
|
|
hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) ||
|
|
memcmp(hhhd1->content, "two", hhhd1->content_len) != 0 ||
|
|
hhhd2->flags != (DETECT_CONTENT_DISTANCE) ||
|
|
memcmp(hhhd2->content, "three", hhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
if (!DETECT_CONTENT_IS_SINGLE(cd1) ||
|
|
!DETECT_CONTENT_IS_SINGLE(cd2) ||
|
|
DETECT_CONTENT_IS_SINGLE(hhhd1) ||
|
|
DETECT_CONTENT_IS_SINGLE(hhhd2)) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest23(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_host; pcre:/two/; "
|
|
"content:\"three\"; distance:10; http_host; content:\"four\"; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
|
|
DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
|
|
DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
|
|
if (pd1->flags != 0 ||
|
|
cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 ||
|
|
hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) ||
|
|
memcmp(hhhd1->content, "one", hhhd1->content_len) != 0 ||
|
|
hhhd2->flags != (DETECT_CONTENT_DISTANCE) ||
|
|
memcmp(hhhd2->content, "three", hhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
if (!DETECT_CONTENT_IS_SINGLE(cd2) ||
|
|
DETECT_CONTENT_IS_SINGLE(hhhd1) ||
|
|
DETECT_CONTENT_IS_SINGLE(hhhd2)) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest24(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_host; pcre:/two/; "
|
|
"content:\"three\"; distance:10; within:15; http_host; content:\"four\"; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
|
|
DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
|
|
DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
|
|
if (pd1->flags != 0 ||
|
|
cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 ||
|
|
hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) ||
|
|
memcmp(hhhd1->content, "one", hhhd1->content_len) != 0 ||
|
|
hhhd2->flags != (DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) ||
|
|
memcmp(hhhd2->content, "three", hhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
if (!DETECT_CONTENT_IS_SINGLE(cd2) ||
|
|
DETECT_CONTENT_IS_SINGLE(hhhd1) ||
|
|
DETECT_CONTENT_IS_SINGLE(hhhd2)) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest25(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_host; pcre:/two/; "
|
|
"content:\"three\"; distance:10; http_host; "
|
|
"content:\"four\"; distance:10; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
|
|
DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
|
|
DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
|
|
if (pd1->flags != DETECT_PCRE_RELATIVE_NEXT ||
|
|
cd2->flags != DETECT_CONTENT_DISTANCE ||
|
|
memcmp(cd2->content, "four", cd2->content_len) != 0 ||
|
|
hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) ||
|
|
memcmp(hhhd1->content, "one", hhhd1->content_len) != 0 ||
|
|
hhhd2->flags != (DETECT_CONTENT_DISTANCE) ||
|
|
memcmp(hhhd2->content, "three", hhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
if (DETECT_CONTENT_IS_SINGLE(cd2) ||
|
|
DETECT_CONTENT_IS_SINGLE(hhhd1) ||
|
|
DETECT_CONTENT_IS_SINGLE(hhhd2)) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest26(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; offset:10; http_host; pcre:/two/; "
|
|
"content:\"three\"; distance:10; http_host; within:10; "
|
|
"content:\"four\"; distance:10; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
|
|
DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
|
|
DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
|
|
if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) ||
|
|
cd2->flags != DETECT_CONTENT_DISTANCE ||
|
|
memcmp(cd2->content, "four", cd2->content_len) != 0 ||
|
|
hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT | DETECT_CONTENT_OFFSET) ||
|
|
memcmp(hhhd1->content, "one", hhhd1->content_len) != 0 ||
|
|
hhhd2->flags != (DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) ||
|
|
memcmp(hhhd2->content, "three", hhhd1->content_len) != 0) {
|
|
printf ("failed: http_host incorrect flags");
|
|
goto end;
|
|
}
|
|
|
|
if (DETECT_CONTENT_IS_SINGLE(cd2) ||
|
|
DETECT_CONTENT_IS_SINGLE(hhhd1) ||
|
|
DETECT_CONTENT_IS_SINGLE(hhhd2)) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest27(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; offset:10; http_host; pcre:/two/; "
|
|
"content:\"three\"; distance:10; http_host; within:10; "
|
|
"content:\"four\"; distance:10; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest28(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_host; pcre:/two/; "
|
|
"content:\"three\"; http_host; depth:10; "
|
|
"content:\"four\"; distance:10; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
|
|
DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
|
|
DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
|
|
if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) ||
|
|
cd2->flags != DETECT_CONTENT_DISTANCE ||
|
|
memcmp(cd2->content, "four", cd2->content_len) != 0 ||
|
|
hhhd1->flags != (0) ||
|
|
memcmp(hhhd1->content, "one", hhhd1->content_len) != 0 ||
|
|
hhhd2->flags != (DETECT_CONTENT_DEPTH) ||
|
|
memcmp(hhhd2->content, "three", hhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
if (DETECT_CONTENT_IS_SINGLE(cd2) ||
|
|
!DETECT_CONTENT_IS_SINGLE(hhhd1) ||
|
|
DETECT_CONTENT_IS_SINGLE(hhhd2)) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest29(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_host; "
|
|
"content:\"two\"; distance:0; http_host; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
|
|
DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
|
|
if (hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) ||
|
|
memcmp(hhhd1->content, "one", hhhd1->content_len) != 0 ||
|
|
hhhd2->flags != (DETECT_CONTENT_DISTANCE) ||
|
|
memcmp(hhhd2->content, "two", hhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest30(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_host; "
|
|
"content:\"two\"; within:5; http_host; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
|
|
DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
|
|
if (hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) ||
|
|
memcmp(hhhd1->content, "one", hhhd1->content_len) != 0 ||
|
|
hhhd2->flags != (DETECT_CONTENT_WITHIN) ||
|
|
memcmp(hhhd2->content, "two", hhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest31(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; within:5; http_host; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest32(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_host; within:5; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list != NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest33(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; within:5; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest34(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(pcre:/one/W; "
|
|
"content:\"two\"; within:5; http_host; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id] == NULL ||
|
|
de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->type != DETECT_CONTENT ||
|
|
de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev == NULL ||
|
|
de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->type != DETECT_PCRE) {
|
|
|
|
goto end;
|
|
}
|
|
|
|
DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
|
|
DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
|
|
if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) ||
|
|
hhhd2->flags != (DETECT_CONTENT_WITHIN) ||
|
|
memcmp(hhhd2->content, "two", hhhd2->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest35(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"two\"; http_host; "
|
|
"pcre:/one/WR; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id] == NULL ||
|
|
de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->type != DETECT_PCRE ||
|
|
de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev == NULL ||
|
|
de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->type != DETECT_CONTENT) {
|
|
|
|
goto end;
|
|
}
|
|
|
|
DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
|
|
DetectPcreData *pd2 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
|
|
if (pd2->flags != (DETECT_PCRE_RELATIVE) ||
|
|
hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) ||
|
|
memcmp(hhhd1->content, "two", hhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
static int DetectHttpHHTest36(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(pcre:/one/W; "
|
|
"content:\"two\"; distance:5; http_host; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[g_http_host_buffer_id] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id] == NULL ||
|
|
de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->type != DETECT_CONTENT ||
|
|
de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev == NULL ||
|
|
de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->type != DETECT_PCRE) {
|
|
|
|
goto end;
|
|
}
|
|
|
|
DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->prev->ctx;
|
|
DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_host_buffer_id]->ctx;
|
|
if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) ||
|
|
hhhd2->flags != (DETECT_CONTENT_DISTANCE) ||
|
|
memcmp(hhhd2->content, "two", hhhd2->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
#endif /* UNITTESTS */
|
|
|
|
void DetectHttpHHRegisterTests(void)
|
|
{
|
|
#ifdef UNITTESTS
|
|
UtRegisterTest("DetectHttpHHTest01", DetectHttpHHTest01);
|
|
UtRegisterTest("DetectHttpHHTest02", DetectHttpHHTest02);
|
|
UtRegisterTest("DetectHttpHHTest03", DetectHttpHHTest03);
|
|
UtRegisterTest("DetectHttpHHTest04", DetectHttpHHTest04);
|
|
UtRegisterTest("DetectHttpHHTest05", DetectHttpHHTest05);
|
|
UtRegisterTest("DetectHttpHHTest05a", DetectHttpHHTest05a);
|
|
UtRegisterTest("DetectHttpHHTest06", DetectHttpHHTest06);
|
|
UtRegisterTest("DetectHttpHHTest07", DetectHttpHHTest07);
|
|
UtRegisterTest("DetectHttpHHTest08", DetectHttpHHTest08);
|
|
UtRegisterTest("DetectHttpHHTest09", DetectHttpHHTest09);
|
|
UtRegisterTest("DetectHttpHHTest10", DetectHttpHHTest10);
|
|
UtRegisterTest("DetectHttpHHTest11", DetectHttpHHTest11);
|
|
UtRegisterTest("DetectHttpHHTest12", DetectHttpHHTest12);
|
|
UtRegisterTest("DetectHttpHHTest13", DetectHttpHHTest13);
|
|
UtRegisterTest("DetectHttpHHTest14", DetectHttpHHTest14);
|
|
|
|
UtRegisterTest("DetectHttpHHTest22", DetectHttpHHTest22);
|
|
UtRegisterTest("DetectHttpHHTest23", DetectHttpHHTest23);
|
|
UtRegisterTest("DetectHttpHHTest24", DetectHttpHHTest24);
|
|
UtRegisterTest("DetectHttpHHTest25", DetectHttpHHTest25);
|
|
UtRegisterTest("DetectHttpHHTest26", DetectHttpHHTest26);
|
|
UtRegisterTest("DetectHttpHHTest27", DetectHttpHHTest27);
|
|
UtRegisterTest("DetectHttpHHTest28", DetectHttpHHTest28);
|
|
UtRegisterTest("DetectHttpHHTest29", DetectHttpHHTest29);
|
|
UtRegisterTest("DetectHttpHHTest30", DetectHttpHHTest30);
|
|
UtRegisterTest("DetectHttpHHTest31", DetectHttpHHTest31);
|
|
UtRegisterTest("DetectHttpHHTest32", DetectHttpHHTest32);
|
|
UtRegisterTest("DetectHttpHHTest33", DetectHttpHHTest33);
|
|
UtRegisterTest("DetectHttpHHTest34", DetectHttpHHTest34);
|
|
UtRegisterTest("DetectHttpHHTest35", DetectHttpHHTest35);
|
|
UtRegisterTest("DetectHttpHHTest36", DetectHttpHHTest36);
|
|
#endif /* UNITTESTS */
|
|
|
|
return;
|
|
}
|
|
/**
|
|
* @}
|
|
*/
|