mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
2476 lines
74 KiB
C
2476 lines
74 KiB
C
/* Copyright (C) 2007-2013 Open Information Security Foundation
|
|
*
|
|
* You can copy, redistribute or modify this Program under the terms of
|
|
* the GNU General Public License version 2 as published by the Free
|
|
* Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* version 2 along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
* 02110-1301, USA.
|
|
*/
|
|
|
|
/**
|
|
* \ingroup httplayer
|
|
*
|
|
* @{
|
|
*/
|
|
|
|
|
|
/**
|
|
* \file
|
|
*
|
|
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
|
|
*
|
|
* Implements support for the http_raw_host keyword.
|
|
*/
|
|
|
|
#include "suricata-common.h"
|
|
#include "threads.h"
|
|
#include "decode.h"
|
|
|
|
#include "detect.h"
|
|
#include "detect-parse.h"
|
|
#include "detect-engine.h"
|
|
#include "detect-engine-mpm.h"
|
|
#include "detect-engine-state.h"
|
|
#include "detect-content.h"
|
|
#include "detect-pcre.h"
|
|
|
|
#include "flow.h"
|
|
#include "flow-var.h"
|
|
#include "flow-util.h"
|
|
|
|
#include "util-debug.h"
|
|
#include "util-unittest.h"
|
|
#include "util-unittest-helper.h"
|
|
#include "util-spm.h"
|
|
|
|
#include "app-layer.h"
|
|
|
|
#include "app-layer-htp.h"
|
|
#include "stream-tcp.h"
|
|
#include "detect-http-hrh.h"
|
|
|
|
int DetectHttpHRHSetup(DetectEngineCtx *, Signature *, char *);
|
|
void DetectHttpHRHRegisterTests(void);
|
|
void DetectHttpHRHFree(void *);
|
|
|
|
/**
|
|
* \brief Registers the keyword handlers for the "http_raw_host" keyword.
|
|
*/
|
|
void DetectHttpHRHRegister(void)
|
|
{
|
|
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].name = "http_raw_host";
|
|
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].desc = "content modifier to match only on the HTTP host header or the raw hostname from the HTTP uri";
|
|
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].Match = NULL;
|
|
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].AppLayerMatch = NULL;
|
|
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].Setup = DetectHttpHRHSetup;
|
|
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].Free = DetectHttpHRHFree;
|
|
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].RegisterTests = DetectHttpHRHRegisterTests;
|
|
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].alproto = ALPROTO_HTTP;
|
|
|
|
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].flags |= SIGMATCH_PAYLOAD ;
|
|
|
|
return;
|
|
}
|
|
|
|
/**
|
|
* \brief The setup function for the http_raw_host keyword for a signature.
|
|
*
|
|
* \param de_ctx Pointer to the detection engine context.
|
|
* \param s Pointer to the signature for the current Signature being
|
|
* parsed from the rules.
|
|
* \param m Pointer to the head of the SigMatch for the current rule
|
|
* being parsed.
|
|
* \param arg Pointer to the string holding the keyword value.
|
|
*
|
|
* \retval 0 On success
|
|
* \retval -1 On failure
|
|
*/
|
|
int DetectHttpHRHSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
|
|
{
|
|
DetectContentData *cd = NULL;
|
|
SigMatch *sm = NULL;
|
|
|
|
if (arg != NULL && strcmp(arg, "") != 0) {
|
|
SCLogError(SC_ERR_INVALID_ARGUMENT, "http_raw_host not supplied with args");
|
|
goto error;
|
|
}
|
|
|
|
sm = SigMatchGetLastSMFromLists(s, 2,
|
|
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
|
|
/* if we still can't find any previous content keywords, it's an invalid
|
|
* rule */
|
|
if (sm == NULL) {
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "\"http_raw_host\" keyword "
|
|
"found inside the rule without a content context. "
|
|
"Please use a \"content\" keyword before using the "
|
|
"\"http_raw_host\" keyword");
|
|
goto error;
|
|
}
|
|
|
|
cd = (DetectContentData *)sm->ctx;
|
|
|
|
/* http_raw_host should not be used with the rawbytes rule */
|
|
if (cd->flags & DETECT_CONTENT_RAWBYTES) {
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "http_raw_host rule can not "
|
|
"be used with the rawbytes rule keyword");
|
|
goto error;
|
|
}
|
|
|
|
if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_HTTP) {
|
|
SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains a non http "
|
|
"alproto set");
|
|
goto error;
|
|
}
|
|
|
|
if (s->flags & SIG_FLAG_TOCLIENT) {
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "http_raw_host can not be used "
|
|
"with flow:to_client or flow:from_server. ");
|
|
goto error;
|
|
}
|
|
|
|
if ((cd->flags & DETECT_CONTENT_WITHIN) || (cd->flags & DETECT_CONTENT_DISTANCE)) {
|
|
SigMatch *pm = SigMatchGetLastSMFromLists(s, 4,
|
|
DETECT_CONTENT, sm->prev,
|
|
DETECT_PCRE, sm->prev);
|
|
/* pm can be NULL now. To accomodate parsing sigs like -
|
|
* content:one; http_modifier; content:two; distance:0; http_modifier */
|
|
if (pm != NULL) {
|
|
if (pm->type == DETECT_CONTENT) {
|
|
DetectContentData *tmp_cd = (DetectContentData *)pm->ctx;
|
|
tmp_cd->flags &= ~DETECT_CONTENT_RELATIVE_NEXT;
|
|
} else {
|
|
DetectPcreData *tmp_pd = (DetectPcreData *)pm->ctx;
|
|
tmp_pd->flags &= ~ DETECT_PCRE_RELATIVE_NEXT;
|
|
}
|
|
|
|
} /* if (pm != NULL) */
|
|
|
|
/* reassigning pm */
|
|
pm = SigMatchGetLastSMFromLists(s, 4,
|
|
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH],
|
|
DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]);
|
|
if (pm == NULL) {
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "http_raw_host seen with a "
|
|
"distance or within without a previous http_raw_host "
|
|
"content. Invalidating signature.");
|
|
goto error;
|
|
}
|
|
if (pm->type == DETECT_PCRE) {
|
|
DetectPcreData *tmp_pd = (DetectPcreData *)pm->ctx;
|
|
tmp_pd->flags |= DETECT_PCRE_RELATIVE_NEXT;
|
|
} else {
|
|
DetectContentData *tmp_cd = (DetectContentData *)pm->ctx;
|
|
tmp_cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;
|
|
}
|
|
}
|
|
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_SM_LIST_HRHHDMATCH);
|
|
sm->type = DETECT_CONTENT;
|
|
|
|
/* transfer the sm from the pmatch list to hrhhdmatch list */
|
|
SigMatchTransferSigMatchAcrossLists(sm,
|
|
&s->sm_lists[DETECT_SM_LIST_PMATCH],
|
|
&s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
|
|
&s->sm_lists[DETECT_SM_LIST_HRHHDMATCH],
|
|
&s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]);
|
|
|
|
/* flag the signature to indicate that we scan the app layer data */
|
|
s->flags |= SIG_FLAG_APPLAYER;
|
|
s->alproto = ALPROTO_HTTP;
|
|
|
|
return 0;
|
|
|
|
error:
|
|
return -1;
|
|
}
|
|
|
|
/**
|
|
* \brief The function to free the http_raw_host data.
|
|
*
|
|
* \param ptr Pointer to the http_raw_host.
|
|
*/
|
|
void DetectHttpHRHFree(void *ptr)
|
|
{
|
|
DetectContentData *hrhhd = (DetectContentData *)ptr;
|
|
if (hrhhd == NULL)
|
|
return;
|
|
|
|
if (hrhhd->content != NULL)
|
|
SCFree(hrhhd->content);
|
|
|
|
BoyerMooreCtxDeInit(hrhhd->bm_ctx);
|
|
SCFree(hrhhd);
|
|
|
|
return;
|
|
}
|
|
|
|
/************************************Unittests*********************************/
|
|
|
|
#ifdef UNITTESTS
|
|
|
|
#include "stream-tcp-reassemble.h"
|
|
|
|
/**
|
|
* \test Test that a signature containting a http_raw_host is correctly parsed
|
|
* and the keyword is registered.
|
|
*/
|
|
static int DetectHttpHRHTest01(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(msg:\"Testing http_raw_host\"; "
|
|
"content:\"one\"; http_raw_host; sid:1;)");
|
|
if (de_ctx->sig_list != NULL) {
|
|
result = 1;
|
|
} else {
|
|
goto end;
|
|
}
|
|
|
|
end:
|
|
SigGroupCleanup(de_ctx);
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test that a signature containing an valid http_raw_host entry is
|
|
* parsed.
|
|
*/
|
|
static int DetectHttpHRHTest02(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(msg:\"Testing http_raw_host\"; "
|
|
"content:\"one\"; http_raw_host; sid:1;)");
|
|
if (de_ctx->sig_list != NULL)
|
|
result = 1;
|
|
|
|
end:
|
|
SigGroupCleanup(de_ctx);
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test that an invalid signature containing no content but a
|
|
* http_raw_host is invalidated.
|
|
*/
|
|
static int DetectHttpHRHTest03(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(msg:\"Testing http_raw_host\"; "
|
|
"http_raw_host; sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
result = 1;
|
|
|
|
end:
|
|
SigGroupCleanup(de_ctx);
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test that an invalid signature containing a rawbytes along with a
|
|
* http_raw_host is invalidated.
|
|
*/
|
|
static int DetectHttpHRHTest04(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(msg:\"Testing http_raw_host\"; "
|
|
"content:\"one\"; rawbytes; http_raw_host; sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
result = 1;
|
|
|
|
end:
|
|
SigGroupCleanup(de_ctx);
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test that a http_raw_host with nocase is parsed.
|
|
*/
|
|
static int DetectHttpHRHTest05(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(msg:\"Testing http_raw_host\"; "
|
|
"content:\"one\"; http_raw_host; sid:1;)");
|
|
if (de_ctx->sig_list != NULL)
|
|
result = 1;
|
|
|
|
end:
|
|
SigGroupCleanup(de_ctx);
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
*\test Test that the http_raw_host content matches against a http request
|
|
* which holds the content.
|
|
*/
|
|
static int DetectHttpHRHTest06(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: This is dummy message body\r\n"
|
|
"Content-Type: text/html\r\n"
|
|
"\r\n";
|
|
uint32_t http_len = sizeof(http_buf) - 1;
|
|
int result = 0;
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p->flow = &f;
|
|
p->flowflags |= FLOW_PKT_TOSERVER;
|
|
p->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:\"message\"; http_raw_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: \n");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
if (!(PacketAlertCheck(p, 1))) {
|
|
printf("sid 1 didn't match but should have\n");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
*\test Test that the http_raw_host content matches against a http request
|
|
* which holds the content.
|
|
*/
|
|
static int DetectHttpHRHTest07(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p1 = NULL;
|
|
Packet *p2 = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http1_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: This is dummy message";
|
|
uint8_t http2_buf[] =
|
|
"body1\r\n\r\n";
|
|
uint32_t http1_len = sizeof(http1_buf) - 1;
|
|
uint32_t http2_len = sizeof(http2_buf) - 1;
|
|
int result = 0;
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p1->flow = &f;
|
|
p1->flowflags |= FLOW_PKT_TOSERVER;
|
|
p1->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
p2->flow = &f;
|
|
p2->flowflags |= FLOW_PKT_TOSERVER;
|
|
p2->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:\"message\"; http_raw_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: ");
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
|
|
|
|
if (PacketAlertCheck(p1, 1)) {
|
|
printf("sid 1 matched on p1 but shouldn't have: ");
|
|
goto end;
|
|
}
|
|
|
|
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
|
|
if (!(PacketAlertCheck(p2, 1))) {
|
|
printf("sid 1 didn't match on p2 but should have: ");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p1, 1);
|
|
UTHFreePackets(&p2, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
*\test Test that the http_raw_host content matches against a http request
|
|
* which holds the content.
|
|
*/
|
|
static int DetectHttpHRHTest08(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p1 = NULL;
|
|
Packet *p2 = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http1_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"host: This is dummy mess";
|
|
uint8_t http2_buf[] =
|
|
"age body\r\n\r\n";
|
|
uint32_t http1_len = sizeof(http1_buf) - 1;
|
|
uint32_t http2_len = sizeof(http2_buf) - 1;
|
|
int result = 0;
|
|
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p1->flow = &f;
|
|
p1->flowflags |= FLOW_PKT_TOSERVER;
|
|
p1->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
p2->flow = &f;
|
|
p2->flowflags |= FLOW_PKT_TOSERVER;
|
|
p2->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:\"message\"; http_raw_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: ");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
|
|
|
|
if ((PacketAlertCheck(p1, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
|
|
|
|
if (!(PacketAlertCheck(p2, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p1, 1);
|
|
UTHFreePackets(&p2, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
*\test Test that the http_raw_host content matches against a http request
|
|
* which holds the content, against a cross boundary present pattern.
|
|
*/
|
|
static int DetectHttpHRHTest09(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p1 = NULL;
|
|
Packet *p2 = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http1_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: This is dummy body1";
|
|
uint8_t http2_buf[] =
|
|
"This is dummy message body2\r\n"
|
|
"Content-Type: text/html\r\n"
|
|
"Content-Length: 46\r\n"
|
|
"\r\n"
|
|
"This is dummy body1";
|
|
uint32_t http1_len = sizeof(http1_buf) - 1;
|
|
uint32_t http2_len = sizeof(http2_buf) - 1;
|
|
int result = 0;
|
|
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p1->flow = &f;
|
|
p1->flowflags |= FLOW_PKT_TOSERVER;
|
|
p1->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
p2->flow = &f;
|
|
p2->flowflags |= FLOW_PKT_TOSERVER;
|
|
p2->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:\"body1This\"; http_raw_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: ");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
|
|
|
|
if ((PacketAlertCheck(p1, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
|
|
|
|
if (!(PacketAlertCheck(p2, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p1, 1);
|
|
UTHFreePackets(&p2, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
*\test Test that the http_raw_host content matches against a http request
|
|
* against a case insensitive pattern.
|
|
*/
|
|
static int DetectHttpHRHTest10(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p1 = NULL;
|
|
Packet *p2 = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http1_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: This is dummy bodY1";
|
|
uint8_t http2_buf[] =
|
|
"This is dummy message body2\r\n"
|
|
"Content-Type: text/html\r\n"
|
|
"Content-Length: 46\r\n"
|
|
"\r\n"
|
|
"This is dummy bodY1";
|
|
uint32_t http1_len = sizeof(http1_buf) - 1;
|
|
uint32_t http2_len = sizeof(http2_buf) - 1;
|
|
int result = 0;
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p1->flow = &f;
|
|
p1->flowflags |= FLOW_PKT_TOSERVER;
|
|
p1->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
p2->flow = &f;
|
|
p2->flowflags |= FLOW_PKT_TOSERVER;
|
|
p2->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:\"bodY1This\"; http_raw_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: \n");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
|
|
|
|
if ((PacketAlertCheck(p1, 1))) {
|
|
printf("sid 1 didn't match but should have\n");
|
|
goto end;
|
|
}
|
|
|
|
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
|
|
|
|
if (!(PacketAlertCheck(p2, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p1, 1);
|
|
UTHFreePackets(&p2, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
*\test Test that the negated http_raw_host content matches against a
|
|
* http request which doesn't hold the content.
|
|
*/
|
|
static int DetectHttpHRHTest11(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: This is dummy message body\r\n"
|
|
"Content-Type: text/html\r\n"
|
|
"\r\n";
|
|
uint32_t http_len = sizeof(http_buf) - 1;
|
|
int result = 0;
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p->flow = &f;
|
|
p->flowflags |= FLOW_PKT_TOSERVER;
|
|
p->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:!\"message\"; http_raw_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: ");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
if (PacketAlertCheck(p, 1)) {
|
|
printf("sid 1 matched but shouldn't have");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
*\test Negative test that the negated http_raw_host content matches against a
|
|
* http request which holds hold the content.
|
|
*/
|
|
static int DetectHttpHRHTest12(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: This is dummy body\r\n"
|
|
"\r\n";
|
|
uint32_t http_len = sizeof(http_buf) - 1;
|
|
int result = 0;
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p->flow = &f;
|
|
p->flowflags |= FLOW_PKT_TOSERVER;
|
|
p->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:!\"message\"; http_raw_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: ");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
if (!(PacketAlertCheck(p, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test Test that the http_raw_host content matches against a http request
|
|
* which holds the content.
|
|
*/
|
|
static int DetectHttpHRHTest13(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: longbufferabcdefghijklmnopqrstuvwxyz0123456789bufferend\r\n"
|
|
"Content-Type: text/html\r\n"
|
|
"\r\n";
|
|
uint32_t http_len = sizeof(http_buf) - 1;
|
|
int result = 0;
|
|
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p->flow = &f;
|
|
p->flowflags |= FLOW_PKT_TOSERVER;
|
|
p->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:\"abcdefghijklmnopqrstuvwxyz0123456789\"; http_raw_host; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: ");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
if (!(PacketAlertCheck(p, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p, 1);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* \test multiple http transactions and body chunks of request handling
|
|
*/
|
|
static int DetectHttpHRHTest14(void)
|
|
{
|
|
int result = 0;
|
|
Signature *s = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
ThreadVars th_v;
|
|
Flow f;
|
|
TcpSession ssn;
|
|
Packet *p = NULL;
|
|
uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n";
|
|
uint8_t httpbuf2[] = "Cookie: dummy1\r\n";
|
|
uint8_t httpbuf3[] = "Host: Body one!!\r\n\r\n";
|
|
uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
|
|
uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
|
|
uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */
|
|
uint8_t httpbuf4[] = "GET /?var=val HTTP/1.1\r\n";
|
|
uint8_t httpbuf5[] = "Cookie: dummy2\r\n";
|
|
uint8_t httpbuf6[] = "Host: Body two\r\n\r\n";
|
|
uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */
|
|
uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */
|
|
uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.proto = IPPROTO_TCP;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p->flow = &f;
|
|
p->flowflags |= FLOW_PKT_TOSERVER;
|
|
p->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL) {
|
|
goto end;
|
|
}
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"POST\"; http_method; content:\"dummy1\"; http_cookie; content:\"Body one\"; http_raw_host; sid:1; rev:1;)");
|
|
if (s == NULL) {
|
|
printf("sig parse failed: ");
|
|
goto end;
|
|
}
|
|
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"dummy2\"; http_cookie; content:\"Body two\"; http_raw_host; sid:2; rev:1;)");
|
|
if (s == NULL) {
|
|
printf("sig2 parse failed: ");
|
|
goto end;
|
|
}
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
if (PacketAlertCheck(p, 1)) {
|
|
printf("sig 1 alerted: ");
|
|
goto end;
|
|
}
|
|
p->alerts.cnt = 0;
|
|
|
|
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2);
|
|
if (r != 0) {
|
|
printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
if (PacketAlertCheck(p, 1)) {
|
|
printf("sig 1 alerted (2): ");
|
|
goto end;
|
|
}
|
|
p->alerts.cnt = 0;
|
|
|
|
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3);
|
|
if (r != 0) {
|
|
printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
if (!(PacketAlertCheck(p, 1))) {
|
|
printf("sig 1 didn't alert: ");
|
|
goto end;
|
|
}
|
|
p->alerts.cnt = 0;
|
|
|
|
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf4, httplen4);
|
|
if (r != 0) {
|
|
printf("toserver chunk 5 returned %" PRId32 ", expected 0: ", r);
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
if (PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2)) {
|
|
printf("sig 1 alerted (4): ");
|
|
goto end;
|
|
}
|
|
p->alerts.cnt = 0;
|
|
|
|
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf5, httplen5);
|
|
if (r != 0) {
|
|
printf("toserver chunk 6 returned %" PRId32 ", expected 0: ", r);
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
if ((PacketAlertCheck(p, 1)) || (PacketAlertCheck(p, 2))) {
|
|
printf("sig 1 alerted (request 2, chunk 6): ");
|
|
goto end;
|
|
}
|
|
p->alerts.cnt = 0;
|
|
|
|
SCLogDebug("sending data chunk 7");
|
|
|
|
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf6, httplen6);
|
|
if (r != 0) {
|
|
printf("toserver chunk 7 returned %" PRId32 ", expected 0: ", r);
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
if (PacketAlertCheck(p, 1) || !(PacketAlertCheck(p, 2))) {
|
|
printf("signature 2 didn't match or sig 1 matched, but shouldn't have: ");
|
|
goto end;
|
|
}
|
|
p->alerts.cnt = 0;
|
|
|
|
HtpState *htp_state = f.alstate;
|
|
if (htp_state == NULL) {
|
|
printf("no http state: ");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
if (list_size(htp_state->connp->conn->transactions) != 2) {
|
|
printf("The http app layer doesn't have 2 transactions, but it should: ");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (det_ctx != NULL) {
|
|
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
|
|
}
|
|
if (de_ctx != NULL) {
|
|
SigGroupCleanup(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
}
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePacket(p);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest16(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; content:\"one\"; http_raw_host; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hrhhd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (cd->id == hrhhd->id)
|
|
goto end;
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest17(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_raw_host; content:\"one\"; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hrhhd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (cd->id == hrhhd->id)
|
|
goto end;
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest18(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; content:\"one\"; content:\"one\"; http_raw_host; content:\"one\"; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hrhhd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (cd->id != 0 || hrhhd->id != 1)
|
|
goto end;
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest19(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_raw_host; content:\"one\"; content:\"one\"; content:\"one\"; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hrhhd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (cd->id != 1 || hrhhd->id != 0)
|
|
goto end;
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest20(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_raw_host; "
|
|
"content:\"one\"; content:\"one\"; http_raw_host; content:\"one\"; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hrhhd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
DetectContentData *hrhhd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
|
|
if (cd->id != 1 || hrhhd1->id != 0 || hrhhd2->id != 0)
|
|
goto end;
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest21(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_raw_host; "
|
|
"content:\"one\"; content:\"one\"; http_raw_host; content:\"two\"; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hrhhd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
DetectContentData *hrhhd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
|
|
if (cd->id != 2 || hrhhd1->id != 0 || hrhhd2->id != 0)
|
|
goto end;
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
int DetectHttpHRHTest22(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; content:\"two\"; http_raw_host; "
|
|
"content:\"three\"; distance:10; http_raw_host; content:\"four\"; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
|
|
DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hrhhd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
|
|
DetectContentData *hrhhd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (cd1->flags != 0 || memcmp(cd1->content, "one", cd1->content_len) != 0 ||
|
|
cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 ||
|
|
hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) ||
|
|
memcmp(hrhhd1->content, "two", hrhhd1->content_len) != 0 ||
|
|
hrhhd2->flags != (DETECT_CONTENT_DISTANCE) ||
|
|
memcmp(hrhhd2->content, "three", hrhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
if (!DETECT_CONTENT_IS_SINGLE(cd1) ||
|
|
!DETECT_CONTENT_IS_SINGLE(cd2) ||
|
|
DETECT_CONTENT_IS_SINGLE(hrhhd1) ||
|
|
DETECT_CONTENT_IS_SINGLE(hrhhd2)) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest23(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_raw_host; pcre:/two/; "
|
|
"content:\"three\"; distance:10; http_raw_host; content:\"four\"; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectPcreData *pd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
|
|
DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hrhhd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
|
|
DetectContentData *hrhhd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (pd1->flags != 0 ||
|
|
cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 ||
|
|
hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) ||
|
|
memcmp(hrhhd1->content, "one", hrhhd1->content_len) != 0 ||
|
|
hrhhd2->flags != (DETECT_CONTENT_DISTANCE) ||
|
|
memcmp(hrhhd2->content, "three", hrhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
if (!DETECT_CONTENT_IS_SINGLE(cd2) ||
|
|
DETECT_CONTENT_IS_SINGLE(hrhhd1) ||
|
|
DETECT_CONTENT_IS_SINGLE(hrhhd2)) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest24(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_raw_host; pcre:/two/; "
|
|
"content:\"three\"; distance:10; within:15; http_raw_host; content:\"four\"; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectPcreData *pd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
|
|
DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hrhhd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
|
|
DetectContentData *hrhhd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (pd1->flags != 0 ||
|
|
cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 ||
|
|
hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) ||
|
|
memcmp(hrhhd1->content, "one", hrhhd1->content_len) != 0 ||
|
|
hrhhd2->flags != (DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) ||
|
|
memcmp(hrhhd2->content, "three", hrhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
if (!DETECT_CONTENT_IS_SINGLE(cd2) ||
|
|
DETECT_CONTENT_IS_SINGLE(hrhhd1) ||
|
|
DETECT_CONTENT_IS_SINGLE(hrhhd2)) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest25(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_raw_host; pcre:/two/; "
|
|
"content:\"three\"; distance:10; http_raw_host; "
|
|
"content:\"four\"; distance:10; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectPcreData *pd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
|
|
DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hrhhd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
|
|
DetectContentData *hrhhd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (pd1->flags != DETECT_PCRE_RELATIVE_NEXT ||
|
|
cd2->flags != DETECT_CONTENT_DISTANCE ||
|
|
memcmp(cd2->content, "four", cd2->content_len) != 0 ||
|
|
hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) ||
|
|
memcmp(hrhhd1->content, "one", hrhhd1->content_len) != 0 ||
|
|
hrhhd2->flags != (DETECT_CONTENT_DISTANCE) ||
|
|
memcmp(hrhhd2->content, "three", hrhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
if (DETECT_CONTENT_IS_SINGLE(cd2) ||
|
|
DETECT_CONTENT_IS_SINGLE(hrhhd1) ||
|
|
DETECT_CONTENT_IS_SINGLE(hrhhd2)) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest26(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; offset:10; http_raw_host; pcre:/two/; "
|
|
"content:\"three\"; distance:10; http_raw_host; within:10; "
|
|
"content:\"four\"; distance:10; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectPcreData *pd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
|
|
DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hrhhd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
|
|
DetectContentData *hrhhd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) ||
|
|
cd2->flags != DETECT_CONTENT_DISTANCE ||
|
|
memcmp(cd2->content, "four", cd2->content_len) != 0 ||
|
|
hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT | DETECT_CONTENT_OFFSET) ||
|
|
memcmp(hrhhd1->content, "one", hrhhd1->content_len) != 0 ||
|
|
hrhhd2->flags != (DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) ||
|
|
memcmp(hrhhd2->content, "three", hrhhd1->content_len) != 0) {
|
|
printf ("failed: http_raw_host incorrect flags");
|
|
goto end;
|
|
}
|
|
|
|
if (DETECT_CONTENT_IS_SINGLE(cd2) ||
|
|
DETECT_CONTENT_IS_SINGLE(hrhhd1) ||
|
|
DETECT_CONTENT_IS_SINGLE(hrhhd2)) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest27(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; offset:10; http_raw_host; pcre:/two/; "
|
|
"content:\"three\"; distance:10; http_raw_host; within:10; "
|
|
"content:\"four\"; distance:10; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest28(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_raw_host; nocase; pcre:/two/; "
|
|
"content:\"three\"; http_raw_host; depth:10; "
|
|
"content:\"four\"; distance:10; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectPcreData *pd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
|
|
DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
|
|
DetectContentData *hrhhd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
|
|
DetectContentData *hrhhd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) ||
|
|
cd2->flags != DETECT_CONTENT_DISTANCE ||
|
|
memcmp(cd2->content, "four", cd2->content_len) != 0 ||
|
|
hrhhd1->flags != (DETECT_CONTENT_NOCASE) ||
|
|
memcmp(hrhhd1->content, "one", hrhhd1->content_len) != 0 ||
|
|
hrhhd2->flags != (DETECT_CONTENT_DEPTH) ||
|
|
memcmp(hrhhd2->content, "three", hrhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
if (DETECT_CONTENT_IS_SINGLE(cd2) ||
|
|
!DETECT_CONTENT_IS_SINGLE(hrhhd1) ||
|
|
DETECT_CONTENT_IS_SINGLE(hrhhd2)) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest29(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_raw_host; "
|
|
"content:\"two\"; distance:0; http_raw_host; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectContentData *hrhhd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
|
|
DetectContentData *hrhhd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) ||
|
|
memcmp(hrhhd1->content, "one", hrhhd1->content_len) != 0 ||
|
|
hrhhd2->flags != (DETECT_CONTENT_DISTANCE) ||
|
|
memcmp(hrhhd2->content, "two", hrhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest30(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_raw_host; "
|
|
"content:\"two\"; within:5; http_raw_host; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
DetectContentData *hrhhd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
|
|
DetectContentData *hrhhd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) ||
|
|
memcmp(hrhhd1->content, "one", hrhhd1->content_len) != 0 ||
|
|
hrhhd2->flags != (DETECT_CONTENT_WITHIN) ||
|
|
memcmp(hrhhd2->content, "two", hrhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest31(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; within:5; http_raw_host; sid:1;)");
|
|
if (de_ctx->sig_list != NULL) {
|
|
printf("de_ctx->sig_list != NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest32(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; http_raw_host; within:5; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list != NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest33(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"one\"; within:5; sid:1;)");
|
|
if (de_ctx->sig_list != NULL) {
|
|
printf("de_ctx->sig_list != NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest34(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(pcre:/one/Zi; "
|
|
"content:\"two\"; within:5; http_raw_host; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH] == NULL ||
|
|
de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->type != DETECT_CONTENT ||
|
|
de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev == NULL ||
|
|
de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->type != DETECT_PCRE) {
|
|
|
|
goto end;
|
|
}
|
|
|
|
DetectPcreData *pd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
|
|
DetectContentData *hrhhd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT | DETECT_PCRE_HTTP_RAW_HOST | DETECT_PCRE_CASELESS) ||
|
|
hrhhd2->flags != (DETECT_CONTENT_WITHIN) ||
|
|
memcmp(hrhhd2->content, "two", hrhhd2->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest35(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(content:\"two\"; http_raw_host; "
|
|
"pcre:/one/ZRi; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH] == NULL ||
|
|
de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->type != DETECT_PCRE ||
|
|
de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev == NULL ||
|
|
de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->type != DETECT_CONTENT) {
|
|
|
|
goto end;
|
|
}
|
|
|
|
DetectContentData *hrhhd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
|
|
DetectPcreData *pd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (pd2->flags != (DETECT_PCRE_RELATIVE | DETECT_PCRE_HTTP_RAW_HOST | DETECT_PCRE_CASELESS) ||
|
|
hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) ||
|
|
memcmp(hrhhd1->content, "two", hrhhd1->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
int DetectHttpHRHTest36(void)
|
|
{
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
int result = 0;
|
|
|
|
if ( (de_ctx = DetectEngineCtxInit()) == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
|
|
"(pcre:/one/Zi; "
|
|
"content:\"two\"; distance:5; http_raw_host; sid:1;)");
|
|
if (de_ctx->sig_list == NULL) {
|
|
printf("de_ctx->sig_list == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) {
|
|
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n");
|
|
goto end;
|
|
}
|
|
|
|
if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH] == NULL ||
|
|
de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->type != DETECT_CONTENT ||
|
|
de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev == NULL ||
|
|
de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->type != DETECT_PCRE) {
|
|
|
|
goto end;
|
|
}
|
|
|
|
DetectPcreData *pd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx;
|
|
DetectContentData *hrhhd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx;
|
|
if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT | DETECT_PCRE_HTTP_RAW_HOST | DETECT_PCRE_CASELESS) ||
|
|
hrhhd2->flags != (DETECT_CONTENT_DISTANCE) ||
|
|
memcmp(hrhhd2->content, "two", hrhhd2->content_len) != 0) {
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
|
|
end:
|
|
SigCleanSignatures(de_ctx);
|
|
DetectEngineCtxFree(de_ctx);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
*\test Test that the http_raw_host content matches against a http request
|
|
* against a case insensitive pattern.
|
|
*/
|
|
static int DetectHttpHRHTest37(void)
|
|
{
|
|
TcpSession ssn;
|
|
Packet *p1 = NULL;
|
|
Packet *p2 = NULL;
|
|
ThreadVars th_v;
|
|
DetectEngineCtx *de_ctx = NULL;
|
|
DetectEngineThreadCtx *det_ctx = NULL;
|
|
HtpState *http_state = NULL;
|
|
Flow f;
|
|
uint8_t http1_buf[] =
|
|
"GET /index.html HTTP/1.0\r\n"
|
|
"User-Agent: www.openinfosecfoundation.org\r\n"
|
|
"Host: This is dummy bodY1";
|
|
uint8_t http2_buf[] =
|
|
"This is dummy message body2\r\n"
|
|
"Content-Type: text/html\r\n"
|
|
"Content-Length: 46\r\n"
|
|
"\r\n"
|
|
"This is dummy bodY1";
|
|
uint32_t http1_len = sizeof(http1_buf) - 1;
|
|
uint32_t http2_len = sizeof(http2_buf) - 1;
|
|
int result = 0;
|
|
|
|
memset(&th_v, 0, sizeof(th_v));
|
|
memset(&f, 0, sizeof(f));
|
|
memset(&ssn, 0, sizeof(ssn));
|
|
|
|
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
|
|
|
|
FLOW_INITIALIZE(&f);
|
|
f.protoctx = (void *)&ssn;
|
|
f.flags |= FLOW_IPV4;
|
|
|
|
p1->flow = &f;
|
|
p1->flowflags |= FLOW_PKT_TOSERVER;
|
|
p1->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
p2->flow = &f;
|
|
p2->flowflags |= FLOW_PKT_TOSERVER;
|
|
p2->flowflags |= FLOW_PKT_ESTABLISHED;
|
|
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
|
|
f.alproto = ALPROTO_HTTP;
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
de_ctx = DetectEngineCtxInit();
|
|
if (de_ctx == NULL)
|
|
goto end;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
|
|
"(msg:\"http host test\"; "
|
|
"content:\"body1this\"; http_raw_host; nocase; "
|
|
"sid:1;)");
|
|
if (de_ctx->sig_list == NULL)
|
|
goto end;
|
|
|
|
SigGroupBuild(de_ctx);
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
http_state = f.alstate;
|
|
if (http_state == NULL) {
|
|
printf("no http state: \n");
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
|
|
|
|
if ((PacketAlertCheck(p1, 1))) {
|
|
printf("sid 1 didn't match but should have\n");
|
|
goto end;
|
|
}
|
|
|
|
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len);
|
|
if (r != 0) {
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
|
|
result = 0;
|
|
goto end;
|
|
}
|
|
|
|
/* do detect */
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
|
|
|
|
if (!(PacketAlertCheck(p2, 1))) {
|
|
printf("sid 1 didn't match but should have");
|
|
goto end;
|
|
}
|
|
|
|
result = 1;
|
|
end:
|
|
if (de_ctx != NULL)
|
|
SigGroupCleanup(de_ctx);
|
|
if (de_ctx != NULL)
|
|
SigCleanSignatures(de_ctx);
|
|
if (de_ctx != NULL)
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
FLOW_DESTROY(&f);
|
|
UTHFreePackets(&p1, 1);
|
|
UTHFreePackets(&p2, 1);
|
|
return result;
|
|
}
|
|
|
|
#endif /* UNITTESTS */
|
|
|
|
void DetectHttpHRHRegisterTests(void)
|
|
{
|
|
#ifdef UNITTESTS
|
|
UtRegisterTest("DetectHttpHRHTest01", DetectHttpHRHTest01, 1);
|
|
UtRegisterTest("DetectHttpHRHTest02", DetectHttpHRHTest02, 1);
|
|
UtRegisterTest("DetectHttpHRHTest03", DetectHttpHRHTest03, 1);
|
|
UtRegisterTest("DetectHttpHRHTest04", DetectHttpHRHTest04, 1);
|
|
UtRegisterTest("DetectHttpHRHTest05", DetectHttpHRHTest05, 1);
|
|
UtRegisterTest("DetectHttpHRHTest06", DetectHttpHRHTest06, 1);
|
|
UtRegisterTest("DetectHttpHRHTest07", DetectHttpHRHTest07, 1);
|
|
UtRegisterTest("DetectHttpHRHTest08", DetectHttpHRHTest08, 1);
|
|
UtRegisterTest("DetectHttpHRHTest09", DetectHttpHRHTest09, 1);
|
|
UtRegisterTest("DetectHttpHRHTest10", DetectHttpHRHTest10, 1);
|
|
UtRegisterTest("DetectHttpHRHTest11", DetectHttpHRHTest11, 1);
|
|
UtRegisterTest("DetectHttpHRHTest12", DetectHttpHRHTest12, 1);
|
|
UtRegisterTest("DetectHttpHRHTest13", DetectHttpHRHTest13, 1);
|
|
UtRegisterTest("DetectHttpHRHTest14", DetectHttpHRHTest14, 1);
|
|
|
|
UtRegisterTest("DetectHttpHRHTest16", DetectHttpHRHTest16, 1);
|
|
UtRegisterTest("DetectHttpHRHTest17", DetectHttpHRHTest17, 1);
|
|
UtRegisterTest("DetectHttpHRHTest18", DetectHttpHRHTest18, 1);
|
|
UtRegisterTest("DetectHttpHRHTest19", DetectHttpHRHTest19, 1);
|
|
UtRegisterTest("DetectHttpHRHTest20", DetectHttpHRHTest20, 1);
|
|
UtRegisterTest("DetectHttpHRHTest21", DetectHttpHRHTest21, 1);
|
|
|
|
UtRegisterTest("DetectHttpHRHTest22", DetectHttpHRHTest22, 1);
|
|
UtRegisterTest("DetectHttpHRHTest23", DetectHttpHRHTest23, 1);
|
|
UtRegisterTest("DetectHttpHRHTest24", DetectHttpHRHTest24, 1);
|
|
UtRegisterTest("DetectHttpHRHTest25", DetectHttpHRHTest25, 1);
|
|
UtRegisterTest("DetectHttpHRHTest26", DetectHttpHRHTest26, 1);
|
|
UtRegisterTest("DetectHttpHRHTest27", DetectHttpHRHTest27, 1);
|
|
UtRegisterTest("DetectHttpHRHTest28", DetectHttpHRHTest28, 1);
|
|
UtRegisterTest("DetectHttpHRHTest29", DetectHttpHRHTest29, 1);
|
|
UtRegisterTest("DetectHttpHRHTest30", DetectHttpHRHTest30, 1);
|
|
UtRegisterTest("DetectHttpHRHTest31", DetectHttpHRHTest31, 1);
|
|
UtRegisterTest("DetectHttpHRHTest32", DetectHttpHRHTest32, 1);
|
|
UtRegisterTest("DetectHttpHRHTest33", DetectHttpHRHTest33, 1);
|
|
UtRegisterTest("DetectHttpHRHTest34", DetectHttpHRHTest34, 1);
|
|
UtRegisterTest("DetectHttpHRHTest35", DetectHttpHRHTest35, 1);
|
|
UtRegisterTest("DetectHttpHRHTest36", DetectHttpHRHTest36, 1);
|
|
UtRegisterTest("DetectHttpHRHTest37", DetectHttpHRHTest37, 1);
|
|
#endif /* UNITTESTS */
|
|
|
|
return;
|
|
}
|
|
/**
|
|
* @}
|
|
*/
|