aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'f4ce9011d2'
${ noResults }
suricata/src/detect.c

11359 lines
378 KiB
C
Raw Blame History

/* Copyright (C) 2007-2011 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Victor Julien <victor@inliniac.net>
*
* Basic detection engine
*/
#include "suricata-common.h"
#include "suricata.h"
#include "debug.h"
#include "detect.h"
#include "flow.h"
#include "flow-private.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-alert.h"
#include "detect-engine-siggroup.h"
#include "detect-engine-address.h"
#include "detect-engine-proto.h"
#include "detect-engine-port.h"
#include "detect-engine-mpm.h"
#include "detect-engine-iponly.h"
#include "detect-engine-threshold.h"
#include "detect-engine-payload.h"
#include "detect-engine-dcepayload.h"
#include "detect-engine-uri.h"
#include "detect-engine-state.h"
#include "detect-engine-analyzer.h"
#include "detect-http-cookie.h"
#include "detect-http-method.h"
#include "detect-http-ua.h"
#include "detect-engine-event.h"
#include "decode.h"
#include "detect-ipopts.h"
#include "detect-flags.h"
#include "detect-fragbits.h"
#include "detect-fragoffset.h"
#include "detect-gid.h"
#include "detect-ack.h"
#include "detect-seq.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#include "detect-pcre.h"
#include "detect-depth.h"
#include "detect-nocase.h"
#include "detect-rawbytes.h"
#include "detect-bytetest.h"
#include "detect-bytejump.h"
#include "detect-sameip.h"
#include "detect-ipproto.h"
#include "detect-within.h"
#include "detect-distance.h"
#include "detect-offset.h"
#include "detect-sid.h"
#include "detect-priority.h"
#include "detect-classtype.h"
#include "detect-reference.h"
#include "detect-tag.h"
#include "detect-threshold.h"
#include "detect-metadata.h"
#include "detect-msg.h"
#include "detect-rev.h"
#include "detect-flow.h"
#include "detect-window.h"
#include "detect-ftpbounce.h"
#include "detect-isdataat.h"
#include "detect-id.h"
#include "detect-rpc.h"
#include "detect-asn1.h"
#include "detect-filename.h"
#include "detect-fileext.h"
#include "detect-filestore.h"
#include "detect-filemagic.h"
#include "detect-filemd5.h"
#include "detect-dsize.h"
#include "detect-flowvar.h"
#include "detect-flowint.h"
#include "detect-pktvar.h"
#include "detect-noalert.h"
#include "detect-flowbits.h"
#include "detect-csum.h"
#include "detect-stream_size.h"
#include "detect-engine-sigorder.h"
#include "detect-ttl.h"
#include "detect-fast-pattern.h"
#include "detect-itype.h"
#include "detect-icode.h"
#include "detect-icmp-id.h"
#include "detect-icmp-seq.h"
#include "detect-dce-iface.h"
#include "detect-dce-opnum.h"
#include "detect-dce-stub-data.h"
#include "detect-urilen.h"
#include "detect-detection-filter.h"
#include "detect-http-client-body.h"
#include "detect-http-server-body.h"
#include "detect-http-header.h"
#include "detect-http-raw-header.h"
#include "detect-http-uri.h"
#include "detect-http-raw-uri.h"
#include "detect-http-stat-msg.h"
#include "detect-engine-hcbd.h"
#include "detect-engine-hsbd.h"
#include "detect-engine-hhd.h"
#include "detect-engine-hrhd.h"
#include "detect-engine-hmd.h"
#include "detect-engine-hcd.h"
#include "detect-engine-hrud.h"
#include "detect-engine-hsmd.h"
#include "detect-engine-hscd.h"
#include "detect-engine-hua.h"
#include "detect-byte-extract.h"
#include "detect-file-data.h"
#include "detect-replace.h"
#include "detect-tos.h"
#include "detect-app-layer-event.h"
#include "util-rule-vars.h"
#include "app-layer.h"
#include "app-layer-protos.h"
#include "app-layer-htp.h"
#include "detect-tls.h"
#include "detect-tls-version.h"
#include "detect-ssh-proto-version.h"
#include "detect-ssh-software-version.h"
#include "detect-http-stat-code.h"
#include "detect-ssl-version.h"
#include "detect-ssl-state.h"
#include "action-globals.h"
#include "tm-threads.h"
#include "pkt-var.h"
#include "flow-alert-sid.h"
#include "conf.h"
#include "conf-yaml-loader.h"
#include "stream-tcp.h"
#include "stream-tcp-inline.h"
#include "util-classification-config.h"
#include "util-print.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-debug.h"
#include "util-hashlist.h"
#include "util-cuda-handlers.h"
#include "util-mpm-b2g-cuda.h"
#include "util-cuda.h"
#include "util-privs.h"
#include "util-profiling.h"
#include "util-validate.h"
#include "util-optimize.h"
#include "util-vector.h"
#include "util-path.h"
extern uint8_t engine_mode;
extern int engine_analysis;
static int fp_engine_analysis_set = 0;
static int rule_engine_analysis_set = 0;
static FILE *fp_engine_analysis_FD = NULL;
SigMatch *SigMatchAlloc(void);
void DetectExitPrintStats(ThreadVars *tv, void *data);
void DbgPrintSigs(DetectEngineCtx *, SigGroupHead *);
void DbgPrintSigs2(DetectEngineCtx *, SigGroupHead *);
static void PacketCreateMask(Packet *p, SignatureMask *mask, uint16_t alproto, void *alstate, StreamMsg *smsg);
/* tm module api functions */
TmEcode Detect(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *);
TmEcode DetectThreadInit(ThreadVars *, void *, void **);
TmEcode DetectThreadDeinit(ThreadVars *, void *);
void TmModuleDetectRegister (void) {
tmm_modules[TMM_DETECT].name = "Detect";
tmm_modules[TMM_DETECT].ThreadInit = DetectThreadInit;
tmm_modules[TMM_DETECT].Func = Detect;
tmm_modules[TMM_DETECT].ThreadExitPrintStats = DetectExitPrintStats;
tmm_modules[TMM_DETECT].ThreadDeinit = DetectThreadDeinit;
tmm_modules[TMM_DETECT].RegisterTests = SigRegisterTests;
tmm_modules[TMM_DETECT].cap_flags = 0;
PacketAlertTagInit();
}
void DetectExitPrintStats(ThreadVars *tv, void *data) {
DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data;
if (det_ctx == NULL)
return;
}
/**
* \brief Create the path if default-rule-path was specified
* \param sig_file The name of the file
* \retval str Pointer to the string path + sig_file
*/
char *DetectLoadCompleteSigPath(char *sig_file)
{
char *defaultpath = NULL;
char *path = NULL;
/* Path not specified */
if (PathIsRelative(sig_file)) {
if (ConfGet("default-rule-path", &defaultpath) == 1) {
SCLogDebug("Default path: %s", defaultpath);
size_t path_len = sizeof(char) * (strlen(defaultpath) +
strlen(sig_file) + 2);
path = SCMalloc(path_len);
if (path == NULL)
return NULL;
strlcpy(path, defaultpath, path_len);
if (path[strlen(path) - 1] != '/')
strlcat(path, "/", path_len);
strlcat(path, sig_file, path_len);
} else {
path = SCStrdup(sig_file);
}
} else {
path = SCStrdup(sig_file);
}
return path;
}
static inline void EngineAnalysisWriteFastPattern(Signature *s, SigMatch *mpm_sm)
{
int fast_pattern_set = 0;
int fast_pattern_only_set = 0;
int fast_pattern_chop_set = 0;
DetectContentData *fp_cd = NULL;
if (mpm_sm != NULL) {
fp_cd = (DetectContentData *)mpm_sm->ctx;
if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN) {
fast_pattern_set = 1;
if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
fast_pattern_only_set = 1;
} else if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
fast_pattern_chop_set = 1;
}
}
}
if (fp_cd == NULL) {
fprintf(fp_engine_analysis_FD, "== Sid: %u ==\n", s->id);
fprintf(fp_engine_analysis_FD, " No content present\n");
return;
}
fprintf(fp_engine_analysis_FD, "== Sid: %u ==\n", s->id);
fprintf(fp_engine_analysis_FD, " Fast pattern matcher: ");
int list_type = SigMatchListSMBelongsTo(s, mpm_sm);
if (list_type == DETECT_SM_LIST_PMATCH)
fprintf(fp_engine_analysis_FD, "content\n");
else if (list_type == DETECT_SM_LIST_UMATCH)
fprintf(fp_engine_analysis_FD, "http uri content\n");
else if (list_type == DETECT_SM_LIST_HRUDMATCH)
fprintf(fp_engine_analysis_FD, "http raw uri content\n");
else if (list_type == DETECT_SM_LIST_HHDMATCH)
fprintf(fp_engine_analysis_FD, "http header content\n");
else if (list_type == DETECT_SM_LIST_HRHDMATCH)
fprintf(fp_engine_analysis_FD, "http raw header content\n");
else if (list_type == DETECT_SM_LIST_HMDMATCH)
fprintf(fp_engine_analysis_FD, "http method content\n");
else if (list_type == DETECT_SM_LIST_HCDMATCH)
fprintf(fp_engine_analysis_FD, "http cookie content\n");
else if (list_type == DETECT_SM_LIST_HCBDMATCH)
fprintf(fp_engine_analysis_FD, "http client body content\n");
else if (list_type == DETECT_SM_LIST_HSBDMATCH)
fprintf(fp_engine_analysis_FD, "http server body content\n");
else if (list_type == DETECT_SM_LIST_HSCDMATCH)
fprintf(fp_engine_analysis_FD, "http stat code content\n");
else if (list_type == DETECT_SM_LIST_HSMDMATCH)
fprintf(fp_engine_analysis_FD, "http stat msg content\n");
fprintf(fp_engine_analysis_FD, " Fast pattern set: %s\n", fast_pattern_set ? "yes" : "no");
fprintf(fp_engine_analysis_FD, " Fast pattern only set: %s\n",
fast_pattern_only_set ? "yes" : "no");
fprintf(fp_engine_analysis_FD, " Fast pattern chop set: %s\n",
fast_pattern_chop_set ? "yes" : "no");
if (fast_pattern_chop_set) {
fprintf(fp_engine_analysis_FD, " Fast pattern offset, length: %u, %u\n",
fp_cd->fp_chop_offset, fp_cd->fp_chop_len);
}
fprintf(fp_engine_analysis_FD, " Content negated: %s\n",
(fp_cd->flags & DETECT_CONTENT_NEGATED) ? "yes" : "no");
uint16_t patlen = fp_cd->content_len;
uint8_t *pat = SCMalloc(fp_cd->content_len + 1);
if (pat == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
exit(EXIT_FAILURE);
}
memcpy(pat, fp_cd->content, fp_cd->content_len);
pat[fp_cd->content_len] = '\0';
fprintf(fp_engine_analysis_FD, " Original content: ");
PrintRawUriFp(fp_engine_analysis_FD, pat, patlen);
fprintf(fp_engine_analysis_FD, "\n");
if (fast_pattern_chop_set) {
SCFree(pat);
patlen = fp_cd->fp_chop_len;
pat = SCMalloc(fp_cd->fp_chop_len + 1);
if (pat == NULL) {
exit(EXIT_FAILURE);
}
memcpy(pat, fp_cd->content + fp_cd->fp_chop_offset, fp_cd->fp_chop_len);
pat[fp_cd->fp_chop_len] = '\0';
fprintf(fp_engine_analysis_FD, " Final content: ");
PrintRawUriFp(fp_engine_analysis_FD, pat, patlen);
fprintf(fp_engine_analysis_FD, "\n");
} else {
fprintf(fp_engine_analysis_FD, " Final content: ");
PrintRawUriFp(fp_engine_analysis_FD, pat, patlen);
fprintf(fp_engine_analysis_FD, "\n");
}
SCFree(pat);
return;
}
/**
* \brief Prints analysis of fast pattern for a signature.
*
* The code here mimics the logic to select fast_pattern from staging.
* If any changes are made to the staging logic, this should follow suit.
*
* \param s Pointer to the signature.
*/
void EngineAnalysisFastPattern(Signature *s)
{
SigMatch *mpm_sm = NULL;
uint32_t fast_pattern = 0;
int list_id = 0;
for (list_id = 0; list_id < DETECT_SM_LIST_MAX; list_id++) {
/* we have no keywords that support fp in this Signature sm list */
if (!FastPatternSupportEnabledForSigMatchList(list_id))
continue;
SigMatch *sm = NULL;
/* get the total no of patterns in this Signature, as well as find out
* if we have a fast_pattern set in this Signature */
for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) {
/* this keyword isn't registered for fp support */
if (sm->type != DETECT_CONTENT)
continue;
DetectContentData *cd = (DetectContentData *)sm->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN) {
fast_pattern = 1;
break;
}
} /* for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) */
/* found a fast pattern for the sig. Let's get outta here */
if (fast_pattern)
break;
} /* for ( ; list_id < DETECT_SM_LIST_MAX; list_id++) */
int max_len = 0;
/* get the longest pattern in the sig */
if (!fast_pattern) {
SigMatch *sm = NULL;
for (list_id = 0; list_id < DETECT_SM_LIST_MAX; list_id++) {
if (!FastPatternSupportEnabledForSigMatchList(list_id))
continue;
for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_CONTENT)
continue;
DetectContentData *cd = (DetectContentData *)sm->ctx;
if (max_len < cd->content_len)
max_len = cd->content_len;
}
}
}
SigMatch *sm = NULL;
for (list_id = 0; list_id < DETECT_SM_LIST_MAX; list_id++) {
if (!FastPatternSupportEnabledForSigMatchList(list_id))
continue;
for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_CONTENT)
continue;
/* skip in case of:
* 1. we expect a fastpattern but this isn't it */
if (fast_pattern) {
/* can be any content based keyword since all of them
* now use a unified structure - DetectContentData */
DetectContentData *cd = (DetectContentData *)sm->ctx;
if (!(cd->flags & DETECT_CONTENT_FAST_PATTERN)) {
SCLogDebug("not a fast pattern %"PRIu32"", cd->id);
continue;
}
SCLogDebug("fast pattern %"PRIu32"", cd->id);
} else {
DetectContentData *cd = (DetectContentData *)sm->ctx;
if (cd->content_len < max_len)
continue;
} /* else - if (fast_pattern[sig] == 1) */
if (mpm_sm == NULL) {
mpm_sm = sm;
if (fast_pattern)
break;
} else {
DetectContentData *data1 = (DetectContentData *)sm->ctx;
DetectContentData *data2 = (DetectContentData *)mpm_sm->ctx;
uint32_t ls = PatternStrength(data1->content, data1->content_len);
uint32_t ss = PatternStrength(data2->content, data2->content_len);
if (ls > ss) {
mpm_sm = sm;
} else if (ls == ss) {
/* if 2 patterns are of equal strength, we pick the longest */
if (data1->content_len > data2->content_len)
mpm_sm = sm;
} else {
SCLogDebug("sticking with mpm_sm");
}
} /* else - if (mpm == NULL) */
} /* for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) */
if (mpm_sm != NULL && fast_pattern)
break;
} /* for ( ; list_id < DETECT_SM_LIST_MAX; list_id++) */
/* output result to file */
EngineAnalysisWriteFastPattern(s, mpm_sm);
return;
}
/**
* \brief Load a file with signatures
* \param de_ctx Pointer to the detection engine context
* \param sig_file Filename to load signatures from
* \param sigs_tot Will store number of signatures processed in the file
* \retval Number of rules loaded successfully, -1 on error
*/
int DetectLoadSigFile(DetectEngineCtx *de_ctx, char *sig_file, int *sigs_tot) {
Signature *sig = NULL;
int good = 0, bad = 0;
char line[8192] = "";
size_t offset = 0;
int lineno = 0, multiline = 0;
if (sig_file == NULL) {
SCLogError(SC_ERR_INVALID_ARGUMENT, "opening rule file null");
return -1;
}
FILE *fp = fopen(sig_file, "r");
if (fp == NULL) {
SCLogError(SC_ERR_OPENING_RULE_FILE, "opening rule file %s:"
" %s.", sig_file, strerror(errno));
return -1;
}
while(fgets(line + offset, (int)sizeof(line) - offset, fp) != NULL) {
lineno++;
size_t len = strlen(line);
/* ignore comments and empty lines */
if (line[0] == '\n' || line [0] == '\r' || line[0] == ' ' || line[0] == '#' || line[0] == '\t')
continue;
/* Check for multiline rules. */
while (isspace(line[--len]));
if (line[len] == '\\') {
multiline++;
offset = len;
if (offset < sizeof(line) - 1) {
/* We have room for more. */
continue;
}
/* No more room in line buffer, continue, rule will fail
* to parse. */
}
/* Check if we have a trailing newline, and remove it */
len = strlen(line);
if (len > 0 && (line[len - 1] == '\n' || line[len - 1] == '\r')) {
line[len - 1] = '\0';
}
/* Reset offset. */
offset = 0;
de_ctx->rule_file = sig_file;
de_ctx->rule_line = lineno - multiline;
sig = DetectEngineAppendSig(de_ctx, line);
(*sigs_tot)++;
if (sig != NULL) {
if (fp_engine_analysis_set) {
EngineAnalysisFastPattern(sig);
}
if (rule_engine_analysis_set) {
EngineAnalysisRules(sig, line);
}
SCLogDebug("signature %"PRIu32" loaded", sig->id);
good++;
} else {
SCLogError(SC_ERR_INVALID_SIGNATURE, "error parsing signature \"%s\" from "
"file %s at line %"PRId32"", line, sig_file, lineno - multiline);
if (de_ctx->failure_fatal == 1) {
exit(EXIT_FAILURE);
}
bad++;
}
multiline = 0;
}
fclose(fp);
return good;
}
/**
* \brief Load signatures
* \param de_ctx Pointer to the detection engine context
* \param sig_file Filename holding signatures
* \param sig_file_exclusive File passed in 'sig_file' should be loaded exclusively.
* \retval -1 on error
*/
int SigLoadSignatures(DetectEngineCtx *de_ctx, char *sig_file, int sig_file_exclusive)
{
SCEnter();
ConfNode *rule_files;
ConfNode *file = NULL;
int ret = 0;
int r = 0;
int cnt = 0;
int cntf = 0;
int sigtotal = 0;
char *sfile = NULL;
/* needed by engine_analysis */
char log_path[256];
if (engine_analysis) {
if ((ConfGetBool("engine-analysis.rules-fast-pattern",
&fp_engine_analysis_set)) == 0) {
SCLogInfo("Conf parameter \"engine-analysis.rules-fast-pattern\" not "
"found. Defaulting to not printing the fast_pattern "
"report.");
fp_engine_analysis_set = 0;
}
if (fp_engine_analysis_set) {
char *log_dir;
if (ConfGet("default-log-dir", &log_dir) != 1)
log_dir = DEFAULT_LOG_DIR;
snprintf(log_path, 256, "%s/%s", log_dir, "rules_fast_pattern.txt");
fp_engine_analysis_FD = fopen(log_path, "w");
if (fp_engine_analysis_FD == NULL) {
SCLogError(SC_ERR_FOPEN, "ERROR: failed to open %s: %s", log_path,
strerror(errno));
return -1;
}
struct timeval tval;
struct tm *tms;
gettimeofday(&tval, NULL);
struct tm local_tm;
tms = (struct tm *)SCLocalTime(tval.tv_sec, &local_tm);
fprintf(fp_engine_analysis_FD, "----------------------------------------------"
"---------------------\n");
fprintf(fp_engine_analysis_FD, "Date: %" PRId32 "/%" PRId32 "/%04d -- "
"%02d:%02d:%02d\n",
tms->tm_mday, tms->tm_mon + 1, tms->tm_year + 1900, tms->tm_hour,
tms->tm_min, tms->tm_sec);
fprintf(fp_engine_analysis_FD, "----------------------------------------------"
"---------------------\n");
}
else {
SCLogInfo("Engine-Analysis for fast_pattern disabled in conf file.");
}
rule_engine_analysis_set = SetupRuleAnalyzer(log_path);
}
/* ok, let's load signature files from the general config */
if (!(sig_file != NULL && sig_file_exclusive == TRUE)) {
rule_files = ConfGetNode("rule-files");
if (rule_files != NULL) {
TAILQ_FOREACH(file, &rule_files->head, next) {
sfile = DetectLoadCompleteSigPath(file->val);
SCLogDebug("Loading rule file: %s", sfile);
r = DetectLoadSigFile(de_ctx, sfile, &sigtotal);
cntf++;
if (r > 0) {
cnt += r;
} else if (r == 0){
SCLogWarning(SC_ERR_NO_RULES, "No rules loaded from %s", sfile);
if (de_ctx->failure_fatal == 1) {
exit(EXIT_FAILURE);
}
} else if (r < 0){
if (de_ctx->failure_fatal == 1) {
exit(EXIT_FAILURE);
}
}
SCFree(sfile);
}
}
}
/* If a Signature file is specified from commandline, parse it too */
if (sig_file != NULL) {
SCLogInfo("Loading rule file: %s", sig_file);
r = DetectLoadSigFile(de_ctx, sig_file, &sigtotal);
cntf++;
if (r > 0) {
cnt += r;
} else if (r == 0) {
SCLogError(SC_ERR_NO_RULES, "No rules loaded from %s", sig_file);
if (de_ctx->failure_fatal == 1) {
exit(EXIT_FAILURE);
}
} else if (r < 0){
if (de_ctx->failure_fatal == 1) {
exit(EXIT_FAILURE);
}
}
}
/* now we should have signatures to work with */
if (cnt <= 0) {
if (cntf > 0) {
SCLogError(SC_ERR_NO_RULES_LOADED, "%d rule files specified, but no rule was loaded at all!", cntf);
if (de_ctx->failure_fatal == 1) {
exit(EXIT_FAILURE);
}
ret = -1;
} else {
SCLogInfo("No signatures supplied.");
goto end;
}
} else {
/* we report the total of files and rules successfully loaded and failed */
SCLogInfo("%" PRId32 " rule files processed. %" PRId32 " rules succesfully loaded, %" PRId32 " rules failed", cntf, cnt, sigtotal-cnt);
}
if (ret < 0 && de_ctx->failure_fatal) {
goto end;
}
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
SCSigSignatureOrderingModuleCleanup(de_ctx);
Signature *s = de_ctx->sig_list;
/* Assign the unique order id of signatures after sorting,
* so the IP Only engine process them in order too */
SigIntId sig_id = 0;
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
/* Setup the signature group lookup structure and pattern matchers */
SigGroupBuild(de_ctx);
ret = 0;
end:
if (engine_analysis) {
if (fp_engine_analysis_set) {
if (fp_engine_analysis_FD != NULL) {
SCLogInfo("Engine-Analyis for fast_pattern printed to file - %s",
log_path);
fclose(fp_engine_analysis_FD);
fp_engine_analysis_FD = NULL;
}
}
if (rule_engine_analysis_set) {
CleanupRuleAnalyzer(log_path);
}
}
DetectParseDupSigHashFree(de_ctx);
SCReturnInt(ret);
}
/**
* \brief See if we can prefilter a signature on inexpensive checks
*
* Order of SignatureHeader access:
* 1. flags
* 2. alproto
* 3. mpm_pattern_id_div8
* 4. mpm_pattern_id_mod8
* 5. num
*
* \retval 0 can't match, don't inspect
* \retval 1 might match, further inspection required
*/
static inline int SigMatchSignaturesBuildMatchArrayAddSignature(DetectEngineThreadCtx *det_ctx,
Packet *p, SignatureHeader *s, uint16_t alproto)
{
/* if the sig has alproto and the session as well they should match */
if (s->flags & SIG_FLAG_APPLAYER && s->alproto != ALPROTO_UNKNOWN && s->alproto != alproto) {
if (s->alproto == ALPROTO_DCERPC) {
if (alproto != ALPROTO_SMB && alproto != ALPROTO_SMB2) {
SCLogDebug("DCERPC sig, alproto not SMB or SMB2");
return 0;
}
} else {
SCLogDebug("alproto mismatch");
return 0;
}
}
/* check for a pattern match of the one pattern in this sig. */
if (s->flags & (SIG_FLAG_MPM_PACKET|SIG_FLAG_MPM_STREAM|SIG_FLAG_MPM_HTTP))
{
/* filter out sigs that want pattern matches, but
* have no matches */
if (!(det_ctx->pmq.pattern_id_bitarray[(s->mpm_pattern_id_div_8)] & s->mpm_pattern_id_mod_8)) {
if (s->flags & SIG_FLAG_MPM_PACKET) {
if (!(s->flags & SIG_FLAG_MPM_PACKET_NEG)) {
return 0;
}
} else if (s->flags & SIG_FLAG_MPM_STREAM) {
/* filter out sigs that want pattern matches, but
* have no matches */
if (!(s->flags & SIG_FLAG_MPM_STREAM_NEG)) {
return 0;
}
} else if (s->flags & SIG_FLAG_MPM_HTTP) {
if (!(s->flags & SIG_FLAG_MPM_HTTP_NEG)) {
return 0;
}
}
}
}
/* de_state check, filter out all signatures that already had a match before
* or just partially match */
if (s->flags & SIG_FLAG_STATE_MATCH) {
/* we run after DeStateDetectContinueDetection, so we might have
* state NEW here. In that case we'd want to continue detection
* for this sig. If we have NOSTATE, stateful detection didn't
* start yet for this sig, so we will inspect it.
*/
if (det_ctx->de_state_sig_array[s->num] != DE_STATE_MATCH_NEW &&
det_ctx->de_state_sig_array[s->num] != DE_STATE_MATCH_NOSTATE) {
SCLogDebug("de state not NEW or NOSTATE, ignoring");
return 0;
}
}
return 1;
}
#if defined(__SSE3__)
/**
* \brief SIMD implementation of mask prefiltering.
*
* Mass mask matching is done creating a bitmap of signatures that need
* futher inspection.
*
* On 32 bit systems we inspect in 32 sig batches, creating a u32 with flags.
* On 64 bit systems we inspect in 64 sig batches, creating a u64 with flags.
* The size of a register is leading here.
*/
static inline void SigMatchSignaturesBuildMatchArraySIMD(DetectEngineThreadCtx *det_ctx,
Packet *p, SignatureMask mask, uint16_t alproto)
{
uint32_t u;
SigIntId x;
int bitno = 0;
#if __WORDSIZE == 32
register uint32_t bm; /* bit mask, 32 bits used */
Vector pm, sm, r1, r2;
/* load the packet mask into each byte of the vector */
pm.v = _mm_set1_epi8(mask);
/* reset previous run */
det_ctx->match_array_cnt = 0;
for (u = 0; u < det_ctx->sgh->sig_cnt; u += 32) {
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&det_ctx->sgh->mask_array[u]);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
/* convert into a bitarray */
bm = ((uint32_t) _mm_movemask_epi8(r2.v));
SCLogDebug("bm1 %08x", bm);
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&det_ctx->sgh->mask_array[u+16]);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
/* convert into a bitarray */
bm |= ((uint32_t) _mm_movemask_epi8(r2.v) << 16);
SCLogDebug("bm2 %08x", bm);
if (bm == 0) {
continue;
}
/* Check each bit in the bit map. Little endian is assumed (SSE is x86),
* so the bits are in memory backwards, 0 is on the right edge,
* 31 on the left edge. This is why above we store the output of the
* _mm_movemask_epi8 in this order as well */
bitno = 0;
for (x = u; x < det_ctx->sgh->sig_cnt && bitno < 32; x++, bitno++) {
if (bm & (1 << bitno)) {
SignatureHeader *s = &det_ctx->sgh->head_array[x];
if (SigMatchSignaturesBuildMatchArrayAddSignature(det_ctx, p, s, alproto) == 1) {
/* okay, store it */
det_ctx->match_array[det_ctx->match_array_cnt] = s->full_sig;
det_ctx->match_array_cnt++;
}
}
}
}
#elif __WORDSIZE == 64
register uint64_t bm; /* bit mask, 64 bits used */
Vector pm, sm, r1, r2;
/* load the packet mask into each byte of the vector */
pm.v = _mm_set1_epi8(mask);
/* reset previous run */
det_ctx->match_array_cnt = 0;
for (u = 0; u < det_ctx->sgh->sig_cnt; u += 64) {
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&det_ctx->sgh->mask_array[u]);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
/* convert into a bitarray */
bm = ((uint64_t) _mm_movemask_epi8(r2.v));
SCLogDebug("bm1 %08"PRIx64, bm);
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&det_ctx->sgh->mask_array[u+16]);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
/* convert into a bitarray */
bm |= ((uint64_t) _mm_movemask_epi8(r2.v)) << 16;
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&det_ctx->sgh->mask_array[u+32]);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
/* convert into a bitarray */
bm |= ((uint64_t) _mm_movemask_epi8(r2.v)) << 32;
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&det_ctx->sgh->mask_array[u+48]);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
/* convert into a bitarray */
bm |= ((uint64_t) _mm_movemask_epi8(r2.v)) << 48;
SCLogDebug("bm2 %08"PRIx64, bm);
if (bm == 0) {
continue;
}
/* Check each bit in the bit map. Little endian is assumed (SSE is x86-64),
* so the bits are in memory backwards, 0 is on the right edge,
* 63 on the left edge. This is why above we store the output of the
* _mm_movemask_epi8 in this order as well */
bitno = 0;
for (x = u; x < det_ctx->sgh->sig_cnt && bitno < 64; x++, bitno++) {
if (bm & ((uint64_t)1 << bitno)) {
SignatureHeader *s = &det_ctx->sgh->head_array[x];
if (SigMatchSignaturesBuildMatchArrayAddSignature(det_ctx, p, s, alproto) == 1) {
/* okay, store it */
det_ctx->match_array[det_ctx->match_array_cnt] = s->full_sig;
det_ctx->match_array_cnt++;
}
}
}
}
#else
#error Wordsize (__WORDSIZE) neither 32 or 64.
#endif
}
#endif /* defined(__SSE3__) */
static inline void SigMatchSignaturesBuildMatchArrayNoSIMD(DetectEngineThreadCtx *det_ctx,
Packet *p, SignatureMask mask, uint16_t alproto)
{
uint32_t u;
/* reset previous run */
det_ctx->match_array_cnt = 0;
for (u = 0; u < det_ctx->sgh->sig_cnt; u++) {
SignatureHeader *s = &det_ctx->sgh->head_array[u];
if ((mask & s->mask) == s->mask) {
if (SigMatchSignaturesBuildMatchArrayAddSignature(det_ctx, p, s, alproto) == 1) {
/* okay, store it */
det_ctx->match_array[det_ctx->match_array_cnt] = s->full_sig;
det_ctx->match_array_cnt++;
}
}
}
}
/**
* \brief build an array of signatures that will be inspected
*
* All signatures that can be filtered out on forehand are not added to it.
*
* \param de_ctx detection engine ctx
* \param det_ctx detection engine thread ctx -- array is stored here
* \param p packet
* \param mask Packets mask
* \param alproto application layer protocol
*/
static void SigMatchSignaturesBuildMatchArray(DetectEngineThreadCtx *det_ctx,
Packet *p, SignatureMask mask, uint16_t alproto)
{
#if defined(__SSE3__)
SigMatchSignaturesBuildMatchArraySIMD(det_ctx, p, mask, alproto);
#else
SigMatchSignaturesBuildMatchArrayNoSIMD(det_ctx, p, mask, alproto);
#endif
}
static int SigMatchSignaturesRunPostMatch(ThreadVars *tv,
DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p,
Signature *s)
{
/* run the packet match functions */
if (s->sm_lists[DETECT_SM_LIST_POSTMATCH] != NULL) {
SigMatch *sm = s->sm_lists[DETECT_SM_LIST_POSTMATCH];
SCLogDebug("running match functions, sm %p", sm);
for ( ; sm != NULL; sm = sm->next) {
(void)sigmatch_table[sm->type].Match(tv, det_ctx, p, s, sm);
}
}
DetectReplaceExecute(p, det_ctx->replist);
det_ctx->replist = NULL;
DetectFilestorePostMatch(tv, det_ctx,p);
return 1;
}
/**
* \brief Get the SigGroupHead for a packet.
*
* \param de_ctx detection engine context
* \param det_ctx thread detection engine content
* \param p packet
*
* \retval sgh the SigGroupHead or NULL if non applies to the packet
*/
SigGroupHead *SigMatchSignaturesGetSgh(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) {
SCEnter();
int f;
SigGroupHead *sgh = NULL;
/* if the packet proto is 0 (not set), we're inspecting it against
* the decoder events sgh we have. */
if (p->proto == 0 && p->events.cnt > 0) {
SCReturnPtr(de_ctx->decoder_event_sgh, "SigGroupHead");
}
/* select the flow_gh */
if (p->flowflags & FLOW_PKT_TOCLIENT)
f = 0;
else
f = 1;
SCLogDebug("f %d", f);
SCLogDebug("IP_GET_IPPROTO(p) %u", IP_GET_IPPROTO(p));
/* find the right mpm instance */
DetectAddress *ag = DetectAddressLookupInHead(de_ctx->flow_gh[f].src_gh[IP_GET_IPPROTO(p)], &p->src);
if (ag != NULL) {
/* source group found, lets try a dst group */
ag = DetectAddressLookupInHead(ag->dst_gh, &p->dst);
if (ag != NULL) {
if (ag->port == NULL) {
SCLogDebug("we don't have ports");
sgh = ag->sh;
} else {
SCLogDebug("we have ports");
DetectPort *sport = DetectPortLookupGroup(ag->port,p->sp);
if (sport != NULL) {
DetectPort *dport = DetectPortLookupGroup(sport->dst_ph,p->dp);
if (dport != NULL) {
sgh = dport->sh;
} else {
SCLogDebug("no dst port group found for the packet with dp %"PRIu16"", p->dp);
}
} else {
SCLogDebug("no src port group found for the packet with sp %"PRIu16"", p->sp);
}
}
} else {
SCLogDebug("no dst address group found for the packet");
}
} else {
SCLogDebug("no src address group found for the packet");
}
SCReturnPtr(sgh, "SigGroupHead");
}
/** \brief Get the smsgs relevant to this packet
*
* \param f LOCKED flow
* \param p packet
* \param flags stream flags
*/
static StreamMsg *SigMatchSignaturesGetSmsg(Flow *f, Packet *p, uint8_t flags) {
SCEnter();
DEBUG_ASSERT_FLOW_LOCKED(f);
StreamMsg *smsg = NULL;
if (p->proto == IPPROTO_TCP && f->protoctx != NULL) {
TcpSession *ssn = (TcpSession *)f->protoctx;
/* at stream eof, or in inline mode, inspect all smsg's */
if (flags & STREAM_EOF || StreamTcpInlineMode()) {
if (p->flowflags & FLOW_PKT_TOSERVER) {
smsg = ssn->toserver_smsg_head;
/* deref from the ssn */
ssn->toserver_smsg_head = NULL;
ssn->toserver_smsg_tail = NULL;
SCLogDebug("to_server smsg %p at stream eof", smsg);
} else {
smsg = ssn->toclient_smsg_head;
/* deref from the ssn */
ssn->toclient_smsg_head = NULL;
ssn->toclient_smsg_tail = NULL;
SCLogDebug("to_client smsg %p at stream eof", smsg);
}
} else {
if (p->flowflags & FLOW_PKT_TOSERVER) {
StreamMsg *head = ssn->toserver_smsg_head;
if (unlikely(head == NULL)) {
SCLogDebug("no smsgs in to_server direction");
goto end;
}
/* if the smsg is bigger than the current packet, we will
* process the smsg in a later run */
if ((head->data.seq + head->data.data_len) > (TCP_GET_SEQ(p) + p->payload_len)) {
SCLogDebug("smsg ends beyond current packet, skipping for now %"PRIu32">%"PRIu32,
(head->data.seq + head->data.data_len), (TCP_GET_SEQ(p) + p->payload_len));
goto end;
}
smsg = head;
/* deref from the ssn */
ssn->toserver_smsg_head = NULL;
ssn->toserver_smsg_tail = NULL;
SCLogDebug("to_server smsg %p", smsg);
} else {
StreamMsg *head = ssn->toclient_smsg_head;
if (unlikely(head == NULL))
goto end;
/* if the smsg is bigger than the current packet, we will
* process the smsg in a later run */
if ((head->data.seq + head->data.data_len) > (TCP_GET_SEQ(p) + p->payload_len)) {
SCLogDebug("smsg ends beyond current packet, skipping for now %"PRIu32">%"PRIu32,
(head->data.seq + head->data.data_len), (TCP_GET_SEQ(p) + p->payload_len));
goto end;
}
smsg = head;
/* deref from the ssn */
ssn->toclient_smsg_head = NULL;
ssn->toclient_smsg_tail = NULL;
SCLogDebug("to_client smsg %p", smsg);
}
}
}
end:
SCReturnPtr(smsg, "StreamMsg");
}
#define SMS_USE_FLOW_SGH 0x01
#define SMS_USED_PM 0x02
#define SMS_USED_STREAM_PM 0x04
/**
* \internal
* \brief Run mpm on packet, stream and other buffers based on
* alproto, sgh state.
*
* \param de_ctx Pointer to the detection engine context.
* \param det_ctx Pointer to the detection engine thread context.
* \param smsg The stream segment to inspect for stream mpm.
* \param p Packet.
* \param flags Flags.
* \param alproto Flow alproto.
* \param alstate Flow alstate.
* \param sms_runflags Used to store state by detection engine.
*/
static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx, StreamMsg *smsg, Packet *p,
uint8_t flags, uint16_t alproto, void *alstate, uint8_t *sms_runflags)
{
if (p->payload_len > 0 && (!(p->flags & PKT_NOPAYLOAD_INSPECTION))) {
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_PACKET) {
/* run the multi packet matcher against the payload of the packet */
SCLogDebug("search: (%p, maxlen %" PRIu32 ", sgh->sig_cnt %" PRIu32 ")",
det_ctx->sgh, det_ctx->sgh->mpm_content_maxlen, det_ctx->sgh->sig_cnt);
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_PACKET);
PacketPatternSearch(det_ctx, p);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_PACKET);
*sms_runflags |= SMS_USED_PM;
}
if (!(p->flags & PKT_STREAM_ADD) && det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_STREAM) {
*sms_runflags |= SMS_USED_PM;
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_PKT_STREAM);
PacketPatternSearchWithStreamCtx(det_ctx, p);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_PKT_STREAM);
}
}
/* have a look at the reassembled stream (if any) */
if (p->flowflags & FLOW_PKT_ESTABLISHED) {
SCLogDebug("p->flowflags & FLOW_PKT_ESTABLISHED");
if (smsg != NULL && det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_STREAM) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_STREAM);
StreamPatternSearch(det_ctx, p, smsg, flags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_STREAM);
*sms_runflags |= SMS_USED_STREAM_PM;
} else {
SCLogDebug("smsg NULL or no stream mpm for this sgh");
}
/* all http based mpms */
if (alproto == ALPROTO_HTTP && alstate != NULL) {
if (p->flowflags & FLOW_PKT_TOSERVER) {
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_URI) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_URI);
DetectUricontentInspectMpm(det_ctx, p->flow, alstate, flags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_URI);
}
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HRUD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HRUD);
DetectEngineRunHttpRawUriMpm(det_ctx, p->flow, alstate, flags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HRUD);
}
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HCBD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HCBD);
DetectEngineRunHttpClientBodyMpm(de_ctx, det_ctx, p->flow, alstate, flags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HCBD);
}
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HMD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HMD);
DetectEngineRunHttpMethodMpm(det_ctx, p->flow, alstate, flags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HMD);
}
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HUAD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HUAD);
DetectEngineRunHttpUAMpm(det_ctx, p->flow, alstate, flags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HUAD);
}
} else { /* implied FLOW_PKT_TOCLIENT */
if (p->flowflags & FLOW_PKT_TOCLIENT && det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HSBD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HSBD);
DetectEngineRunHttpServerBodyMpm(de_ctx, det_ctx, p->flow, alstate, flags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HSBD);
}
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HSMD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HSMD);
DetectEngineRunHttpStatMsgMpm(det_ctx, p->flow, alstate, flags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HSMD);
}
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HSCD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HSCD);
DetectEngineRunHttpStatCodeMpm(det_ctx, p->flow, alstate, flags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HSCD);
}
}
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HHD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HHD);
DetectEngineRunHttpHeaderMpm(det_ctx, p->flow, alstate, flags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HHD);
}
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HRHD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HRHD);
DetectEngineRunHttpRawHeaderMpm(det_ctx, p->flow, alstate, flags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HRHD);
}
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HCD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HCD);
DetectEngineRunHttpCookieMpm(det_ctx, p->flow, alstate, flags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HCD);
}
}
} else {
SCLogDebug("NOT p->flowflags & FLOW_PKT_ESTABLISHED");
}
}
#ifdef DEBUG
static void DebugInspectIds(Packet *p, Flow *f, StreamMsg *smsg)
{
AppLayerParserStateStore *parser_state_store = f->alparser;
if (parser_state_store != NULL) {
SCLogDebug("pcap_cnt %02"PRIu64", %s, %12s, avail_id %u, inspect_id %u, inspecting %u, smsg %s",
p->pcap_cnt, p->flowflags & FLOW_PKT_TOSERVER ? "toserver" : "toclient",
p->flags & PKT_STREAM_EST ? "established" : "stateless",
parser_state_store->avail_id, parser_state_store->inspect_id,
parser_state_store->inspect_id+1, smsg?"yes":"no");
//if (smsg)
// PrintRawDataFp(stdout,smsg->data.data, smsg->data.data_len);
}
}
#endif
/**
* \brief Signature match function
*
* \retval 1 one or more signatures matched
* \retval 0 no matches were found
*/
int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
{
uint8_t sms_runflags = 0; /* function flags */
uint8_t alert_flags = 0;
uint16_t alproto = ALPROTO_UNKNOWN;
int match = 0;
int fmatch = 0;
uint32_t idx;
uint8_t flags = 0; /* flow/state flags */
void *alstate = NULL;
StreamMsg *smsg = NULL;
Signature *s = NULL;
SigMatch *sm = NULL;
uint16_t alversion = 0;
SCEnter();
SCLogDebug("pcap_cnt %"PRIu64, p->pcap_cnt);
p->alerts.cnt = 0;
det_ctx->filestore_cnt = 0;
/* No need to perform any detection on this packet, if the the given flag is set.*/
if (p->flags & PKT_NOPACKET_INSPECTION) {
SCReturnInt(0);
}
/* grab the protocol state we will detect on */
if (p->flags & PKT_HAS_FLOW) {
if (p->flags & PKT_STREAM_EOF) {
flags |= STREAM_EOF;
SCLogDebug("STREAM_EOF set");
}
FlowIncrUsecnt(p->flow);
FLOWLOCK_WRLOCK(p->flow);
{
/* set the iponly stuff */
if (p->flow->flags & FLOW_TOCLIENT_IPONLY_SET)
p->flowflags |= FLOW_PKT_TOCLIENT_IPONLY_SET;
if (p->flow->flags & FLOW_TOSERVER_IPONLY_SET)
p->flowflags |= FLOW_PKT_TOSERVER_IPONLY_SET;
/* Get the stored sgh from the flow (if any). Make sure we're not using
* the sgh for icmp error packets part of the same stream. */
if (IP_GET_IPPROTO(p) == p->flow->proto) { /* filter out icmp */
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_GETSGH);
if (p->flowflags & FLOW_PKT_TOSERVER && p->flow->flags & FLOW_SGH_TOSERVER) {
det_ctx->sgh = p->flow->sgh_toserver;
sms_runflags |= SMS_USE_FLOW_SGH;
} else if (p->flowflags & FLOW_PKT_TOCLIENT && p->flow->flags & FLOW_SGH_TOCLIENT) {
det_ctx->sgh = p->flow->sgh_toclient;
sms_runflags |= SMS_USE_FLOW_SGH;
}
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_GETSGH);
smsg = SigMatchSignaturesGetSmsg(p->flow, p, flags);
#if 0
StreamMsg *tmpsmsg = smsg;
while (tmpsmsg) {
printf("detect ---start---:\n");
PrintRawDataFp(stdout,tmpsmsg->data.data,tmpsmsg->data.data_len);
printf("detect ---end---:\n");
tmpsmsg = tmpsmsg->next;
}
#endif
}
/* Retrieve the app layer state and protocol and the tcp reassembled
* stream chunks. */
if ((p->proto == IPPROTO_TCP && p->flags & PKT_STREAM_EST) ||
(p->proto == IPPROTO_UDP && p->flowflags & FLOW_PKT_ESTABLISHED) ||
(p->proto == IPPROTO_SCTP && p->flowflags & FLOW_PKT_ESTABLISHED))
{
alstate = AppLayerGetProtoStateFromPacket(p);
alproto = AppLayerGetProtoFromPacket(p);
alversion = AppLayerGetStateVersion(p->flow);
SCLogDebug("alstate %p, alproto %u", alstate, alproto);
} else {
SCLogDebug("packet doesn't have established flag set (proto %d)", p->proto);
}
}
FLOWLOCK_UNLOCK(p->flow);
if (p->flowflags & FLOW_PKT_TOSERVER) {
flags |= STREAM_TOSERVER;
SCLogDebug("flag STREAM_TOSERVER set");
} else if (p->flowflags & FLOW_PKT_TOCLIENT) {
flags |= STREAM_TOCLIENT;
SCLogDebug("flag STREAM_TOCLIENT set");
}
SCLogDebug("p->flowflags 0x%02x", p->flowflags);
/* see if we need to increment the inspect_id and reset the de_state */
if (alstate != NULL && alproto == ALPROTO_HTTP) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_STATEFUL);
SCLogDebug("getting de_state_status");
int de_state_status = DeStateUpdateInspectTransactionId(p->flow,
(flags & STREAM_TOSERVER) ? STREAM_TOSERVER : STREAM_TOCLIENT);
SCLogDebug("de_state_status %d", de_state_status);
if (de_state_status == 2) {
SCMutexLock(&p->flow->de_state_m);
DetectEngineStateReset(p->flow->de_state);
SCMutexUnlock(&p->flow->de_state_m);
}
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_STATEFUL);
}
if ((p->flowflags & FLOW_PKT_TOSERVER && !(p->flowflags & FLOW_PKT_TOSERVER_IPONLY_SET)) ||
(p->flowflags & FLOW_PKT_TOCLIENT && !(p->flowflags & FLOW_PKT_TOCLIENT_IPONLY_SET)))
{
SCLogDebug("testing against \"ip-only\" signatures");
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_IPONLY);
IPOnlyMatchPacket(th_v, de_ctx, det_ctx, &de_ctx->io_ctx, &det_ctx->io_ctx, p);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_IPONLY);
/* save in the flow that we scanned this direction... locking is
* done in the FlowSetIPOnlyFlag function. */
FlowSetIPOnlyFlag(p->flow, p->flowflags & FLOW_PKT_TOSERVER ? 1 : 0);
} else if ((p->flowflags & FLOW_PKT_TOSERVER &&
(p->flow->flags & FLOW_TOSERVER_IPONLY_SET)) ||
(p->flowflags & FLOW_PKT_TOCLIENT &&
(p->flow->flags & FLOW_TOCLIENT_IPONLY_SET)))
{
/* Get the result of the first IPOnlyMatch() */
if (p->flow->flags & FLOW_ACTION_PASS) {
/* if it matched a "pass" rule, we have to let it go */
p->action |= ACTION_PASS;
}
/* If we have a drop from IP only module,
* we will drop the rest of the flow packets
* This will apply only to inline/IPS */
if (p->flow->flags & FLOW_ACTION_DROP)
{
alert_flags = PACKET_ALERT_FLAG_DROP_FLOW;
p->action |= ACTION_DROP;
}
}
if (!(sms_runflags & SMS_USE_FLOW_SGH)) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_GETSGH);
det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_GETSGH);
}
#ifdef DEBUG
if (p->flow) {
SCMutexLock(&p->flow->m);
DebugInspectIds(p, p->flow, smsg);
SCMutexUnlock(&p->flow->m);
}
#endif
} else { /* p->flags & PKT_HAS_FLOW */
/* no flow */
/* Even without flow we should match the packet src/dst */
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_IPONLY);
IPOnlyMatchPacket(th_v, de_ctx, det_ctx, &de_ctx->io_ctx,
&det_ctx->io_ctx, p);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_IPONLY);
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_GETSGH);
det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_GETSGH);
}
/* if we didn't get a sig group head, we
* have nothing to do.... */
if (det_ctx->sgh == NULL) {
SCLogDebug("no sgh for this packet, nothing to match against");
goto end;
}
/* run the mpm for each type */
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM);
DetectMpmPrefilter(de_ctx, det_ctx, smsg, p, flags, alproto,
alstate, &sms_runflags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM);
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_STATEFUL);
/* stateful app layer detection */
if (p->flags & PKT_HAS_FLOW && alstate != NULL) {
/* initialize to 0 (DE_STATE_MATCH_NOSTATE) */
memset(det_ctx->de_state_sig_array, 0x00, det_ctx->de_state_sig_array_len);
/* if applicable, continue stateful detection */
int state = DeStateFlowHasState(p->flow, flags, alversion);
if (state == 1) {
DeStateDetectContinueDetection(th_v, de_ctx, det_ctx, p->flow,
flags, alstate, alproto, alversion);
} else if (state == 2) {
alstate = NULL;
}
}
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_STATEFUL);
/* create our prefilter mask */
SignatureMask mask = 0;
PacketCreateMask(p, &mask, alproto, alstate, smsg);
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PREFILTER);
/* build the match array */
SigMatchSignaturesBuildMatchArray(det_ctx, p, mask, alproto);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PREFILTER);
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_RULES);
/* inspect the sigs against the packet */
for (idx = 0; idx < det_ctx->match_array_cnt; idx++) {
RULE_PROFILING_START;
s = det_ctx->match_array[idx];
SCLogDebug("inspecting signature id %"PRIu32"", s->id);
/* check if this signature has a requirement for flowvars of some type
* and if so, if we actually have any in the flow. If not, the sig
* can't match and we skip it. */
if (p->flags & PKT_HAS_FLOW && s->flags & SIG_FLAG_REQUIRE_FLOWVAR) {
FLOWLOCK_RDLOCK(p->flow);
int m = p->flow->flowvar ? 1 : 0;
FLOWLOCK_UNLOCK(p->flow);
/* no flowvars? skip this sig */
if (m == 0) {
SCLogDebug("skipping sig as the flow has no flowvars and sig "
"has SIG_FLAG_REQUIRE_FLOWVAR flag set.");
goto next;
}
}
if (DetectProtoContainsProto(&s->proto, IP_GET_IPPROTO(p)) == 0) {
SCLogDebug("proto didn't match");
goto next;
}
/* check the source & dst port in the sig */
if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) {
if (!(s->flags & SIG_FLAG_DP_ANY)) {
DetectPort *dport = DetectPortLookupGroup(s->dp,p->dp);
if (dport == NULL) {
SCLogDebug("dport didn't match.");
goto next;
}
}
if (!(s->flags & SIG_FLAG_SP_ANY)) {
DetectPort *sport = DetectPortLookupGroup(s->sp,p->sp);
if (sport == NULL) {
SCLogDebug("sport didn't match.");
goto next;
}
}
}
/* check the destination address */
if (!(s->flags & SIG_FLAG_DST_ANY)) {
if (PKT_IS_IPV4(p)) {
if (DetectAddressMatchIPv4(s->addr_dst_match4, s->addr_dst_match4_cnt, &p->dst) == 0)
goto next;
} else if (PKT_IS_IPV6(p)) {
if (DetectAddressMatchIPv6(s->addr_dst_match6, s->addr_dst_match6_cnt, &p->dst) == 0)
goto next;
}
}
/* check the source address */
if (!(s->flags & SIG_FLAG_SRC_ANY)) {
if (PKT_IS_IPV4(p)) {
if (DetectAddressMatchIPv4(s->addr_src_match4, s->addr_src_match4_cnt, &p->src) == 0)
goto next;
} else if (PKT_IS_IPV6(p)) {
if (DetectAddressMatchIPv6(s->addr_src_match6, s->addr_src_match6_cnt, &p->src) == 0)
goto next;
}
}
/* Check the payload keywords. If we are a MPM sig and we've made
* to here, we've had at least one of the patterns match */
if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
/* if we have stream msgs, inspect against those first,
* but not for a "dsize" signature */
if (s->flags & SIG_FLAG_REQUIRE_STREAM) {
char pmatch = 0;
if (smsg != NULL) {
uint8_t pmq_idx = 0;
StreamMsg *smsg_inspect = smsg;
for ( ; smsg_inspect != NULL; smsg_inspect = smsg_inspect->next, pmq_idx++) {
/* filter out sigs that want pattern matches, but
* have no matches */
if ((s->flags & SIG_FLAG_MPM_STREAM) && !(s->flags & SIG_FLAG_MPM_STREAM_NEG) &&
!(det_ctx->smsg_pmq[pmq_idx].pattern_id_bitarray[(s->mpm_pattern_id_div_8)] & s->mpm_pattern_id_mod_8)) {
SCLogDebug("no match in this smsg");
continue;
}
if (DetectEngineInspectStreamPayload(de_ctx, det_ctx, s, p->flow, smsg_inspect->data.data, smsg_inspect->data.data_len) == 1) {
SCLogDebug("match in smsg %p", smsg);
pmatch = 1;
det_ctx->flags |= DETECT_ENGINE_THREAD_CTX_STREAM_CONTENT_MATCH;
/* Tell the engine that this reassembled stream can drop the
* rest of the pkts with no further inspection */
if (s->action & ACTION_DROP)
alert_flags |= PACKET_ALERT_FLAG_DROP_FLOW;
alert_flags |= PACKET_ALERT_FLAG_STREAM_MATCH;
break;
}
}
} /* if (smsg != NULL) */
/* no match? then inspect packet payload */
if (pmatch == 0) {
SCLogDebug("no match in smsg, fall back to packet payload");
if (!(s->flags & SIG_FLAG_REQUIRE_PACKET)) {
if (p->flags & PKT_STREAM_ADD)
goto next;
}
if (sms_runflags & SMS_USED_PM) {
if (s->flags & SIG_FLAG_MPM_PACKET && !(s->flags & SIG_FLAG_MPM_PACKET_NEG) &&
!(det_ctx->pmq.pattern_id_bitarray[(s->mpm_pattern_id_div_8)] &
s->mpm_pattern_id_mod_8)) {
goto next;
}
if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1) {
goto next;
}
} else {
if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1) {
goto next;
}
}
}
} else {
if (sms_runflags & SMS_USED_PM) {
if (s->flags & SIG_FLAG_MPM_PACKET && !(s->flags & SIG_FLAG_MPM_PACKET_NEG) &&
!(det_ctx->pmq.pattern_id_bitarray[(s->mpm_pattern_id_div_8)] &
s->mpm_pattern_id_mod_8)) {
goto next;
}
if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1) {
goto next;
}
} else {
if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1)
goto next;
}
}
}
/* run the packet match functions */
if (s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) {
sm = s->sm_lists[DETECT_SM_LIST_MATCH];
SCLogDebug("running match functions, sm %p", sm);
for ( ; sm != NULL; sm = sm->next) {
match = sigmatch_table[sm->type].Match(th_v, det_ctx, p, s, sm);
if (match <= 0) {
goto next;
}
}
}
SCLogDebug("s->sm_lists[DETECT_SM_LIST_AMATCH] %p, "
"s->sm_lists[DETECT_SM_LIST_UMATCH] %p, "
"s->sm_lists[DETECT_SM_LIST_DMATCH] %p, "
"s->sm_lists[DETECT_SM_LIST_HCDMATCH] %p",
s->sm_lists[DETECT_SM_LIST_AMATCH],
s->sm_lists[DETECT_SM_LIST_UMATCH],
s->sm_lists[DETECT_SM_LIST_DMATCH],
s->sm_lists[DETECT_SM_LIST_HCDMATCH]);
/* consider stateful sig matches */
if (s->flags & SIG_FLAG_STATE_MATCH) {
if (alstate == NULL) {
SCLogDebug("state matches but no state, we can't match");
goto next;
}
if (det_ctx->de_state_sig_array[s->num] == DE_STATE_MATCH_NOSTATE) {
SCLogDebug("stateful app layer match inspection starting");
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_STATEFUL);
int de_r = DeStateDetectStartDetection(th_v, de_ctx, det_ctx, s,
p->flow, flags, alstate, alproto, alversion);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_STATEFUL);
if (de_r != 1) {
goto next;
}
} else {
SCLogDebug("already having a destate");
SCLogDebug("signature %"PRIu32" (%"PRIuMAX"): %s",
s->id, (uintmax_t)s->num, DeStateMatchResultToString(det_ctx->de_state_sig_array[s->num]));
if (det_ctx->de_state_sig_array[s->num] != DE_STATE_MATCH_NEW) {
goto next;
}
}
/* match */
if (s->action & ACTION_DROP)
alert_flags |= PACKET_ALERT_FLAG_DROP_FLOW;
alert_flags |= PACKET_ALERT_FLAG_STATE_MATCH;
}
/* match! */
fmatch = 1;
SigMatchSignaturesRunPostMatch(th_v, de_ctx, det_ctx, p, s);
if (!(s->flags & SIG_FLAG_NOALERT)) {
PacketAlertAppend(det_ctx, s, p, alert_flags);
}
next:
DetectReplaceFree(det_ctx->replist);
det_ctx->replist = NULL;
RULE_PROFILING_END(s, match);
det_ctx->flags = 0;
continue;
}
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_RULES);
end:
/* see if we need to increment the inspect_id and reset the de_state */
if (alstate != NULL && alproto != ALPROTO_HTTP) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_STATEFUL);
SCLogDebug("getting de_state_status");
int de_state_status = DeStateUpdateInspectTransactionId(p->flow,
(flags & STREAM_TOSERVER) ? STREAM_TOSERVER : STREAM_TOCLIENT);
SCLogDebug("de_state_status %d", de_state_status);
if (de_state_status == 2) {
SCMutexLock(&p->flow->de_state_m);
DetectEngineStateReset(p->flow->de_state);
SCMutexUnlock(&p->flow->de_state_m);
}
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_STATEFUL);
}
/* so now let's iterate the alerts and remove the ones after a pass rule
* matched (if any). This is done inside PacketAlertFinalize() */
/* PR: installed "tag" keywords are handled after the threshold inspection */
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_ALERT);
PacketAlertFinalize(de_ctx, det_ctx, p);
if (p->alerts.cnt > 0) {
SCPerfCounterAddUI64(det_ctx->counter_alerts, det_ctx->tv->sc_perf_pca, (uint64_t)p->alerts.cnt);
}
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_ALERT);
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_CLEANUP);
/* cleanup pkt specific part of the patternmatcher */
PacketPatternCleanup(th_v, det_ctx);
DetectEngineCleanHCBDBuffers(det_ctx);
DetectEngineCleanHSBDBuffers(det_ctx);
DetectEngineCleanHHDBuffers(det_ctx);
/* store the found sgh (or NULL) in the flow to save us from looking it
* up again for the next packet. Also return any stream chunk we processed
* to the pool. */
if (p->flags & PKT_HAS_FLOW) {
if (sms_runflags & SMS_USED_STREAM_PM) {
StreamPatternCleanup(th_v, det_ctx, smsg);
}
FLOWLOCK_WRLOCK(p->flow);
if (!(sms_runflags & SMS_USE_FLOW_SGH)) {
if (p->flowflags & FLOW_PKT_TOSERVER && !(p->flow->flags & FLOW_SGH_TOSERVER)) {
/* first time we see this toserver sgh, store it */
p->flow->sgh_toserver = det_ctx->sgh;
p->flow->flags |= FLOW_SGH_TOSERVER;
/* see if this sgh requires us to consider file storing */
if (p->flow->sgh_toserver == NULL || p->flow->sgh_toserver->filestore_cnt == 0) {
FileDisableStoring(p->flow, STREAM_TOSERVER);
}
/* see if this sgh requires us to consider file magic */
if (!FileForceMagic() && (p->flow->sgh_toserver == NULL ||
!(p->flow->sgh_toserver->flags & SIG_GROUP_HEAD_HAVEFILEMAGIC)))
{
SCLogDebug("disabling magic for flow");
FileDisableMagic(p->flow, STREAM_TOSERVER);
}
} else if (p->flowflags & FLOW_PKT_TOCLIENT && !(p->flow->flags & FLOW_SGH_TOCLIENT)) {
p->flow->sgh_toclient = det_ctx->sgh;
p->flow->flags |= FLOW_SGH_TOCLIENT;
if (p->flow->sgh_toclient == NULL || p->flow->sgh_toclient->filestore_cnt == 0) {
FileDisableStoring(p->flow, STREAM_TOCLIENT);
}
/* check if this flow needs magic, if not disable it */
if (!FileForceMagic() && (p->flow->sgh_toclient == NULL ||
!(p->flow->sgh_toclient->flags & SIG_GROUP_HEAD_HAVEFILEMAGIC)))
{
SCLogDebug("disabling magic for flow");
FileDisableMagic(p->flow, STREAM_TOCLIENT);
}
}
}
/* if we had no alerts that involved the smsgs,
* we can get rid of them now. */
StreamMsgReturnListToPool(smsg);
FLOWLOCK_UNLOCK(p->flow);
FlowDecrUsecnt(p->flow);
}
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_CLEANUP);
SCReturnInt(fmatch);
}
/* tm module api functions */
/** \brief Detection engine thread wrapper.
* \param tv thread vars
* \param p packet to inspect
* \param data thread specific data
* \param pq packet queue
* \retval TM_ECODE_FAILED error
* \retval TM_ECODE_OK ok
*/
TmEcode Detect(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
{
DEBUG_VALIDATE_PACKET(p);
/* No need to perform any detection on this packet, if the the given flag is set.*/
if (p->flags & PKT_NOPACKET_INSPECTION || p->action & ACTION_DROP)
return 0;
DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data;
if (det_ctx == NULL) {
printf("ERROR: Detect has no thread ctx\n");
goto error;
}
DetectEngineCtx *de_ctx = det_ctx->de_ctx;
if (de_ctx == NULL) {
printf("ERROR: Detect has no detection engine ctx\n");
goto error;
}
/* see if the packet matches one or more of the sigs */
int r = SigMatchSignatures(tv,de_ctx,det_ctx,p);
if (r >= 0) {
return TM_ECODE_OK;
}
error:
return TM_ECODE_FAILED;
}
TmEcode DetectThreadInit(ThreadVars *t, void *initdata, void **data)
{
return DetectEngineThreadCtxInit(t,initdata,data);
}
TmEcode DetectThreadDeinit(ThreadVars *t, void *data) {
return DetectEngineThreadCtxDeinit(t,data);
}
void SigCleanSignatures(DetectEngineCtx *de_ctx)
{
Signature *s = NULL, *ns;
if (de_ctx == NULL)
return;
for (s = de_ctx->sig_list; s != NULL;) {
ns = s->next;
SigFree(s);
s = ns;
}
de_ctx->sig_list = NULL;
DetectEngineResetMaxSigId(de_ctx);
de_ctx->sig_list = NULL;
}
/** \brief Find a specific signature by sid and gid
* \param de_ctx detection engine ctx
* \param sid the signature id
* \param gid the signature group id
*
* \retval s sig found
* \retval NULL sig not found
*/
Signature *SigFindSignatureBySidGid(DetectEngineCtx *de_ctx, uint32_t sid, uint32_t gid)
{
Signature *s = NULL;
if (de_ctx == NULL)
return NULL;
for (s = de_ctx->sig_list; s != NULL; s = s->next) {
if (s->id == sid && s->gid == gid)
return s;
}
return NULL;
}
int SignatureIsAppLayer(DetectEngineCtx *de_ctx, Signature *s) {
if (s->alproto != 0)
return 1;
return 0;
}
/**
* \brief Check if a signature contains the filestore keyword.
*
* \param s signature
*
* \retval 0 no
* \retval 1 yes
*/
int SignatureIsFilestoring(Signature *s) {
if (s == NULL)
return 0;
if (s->flags & SIG_FLAG_FILESTORE)
return 1;
return 0;
}
/**
* \brief Check if a signature contains the filemagic keyword.
*
* \param s signature
*
* \retval 0 no
* \retval 1 yes
*/
int SignatureIsFilemagicInspecting(Signature *s) {
if (s == NULL)
return 0;
if (s->file_flags & FILE_SIG_NEED_MAGIC)
return 1;
return 0;
}
/** \brief Test is a initialized signature is IP only
* \param de_ctx detection engine ctx
* \param s the signature
* \retval 1 sig is ip only
* \retval 0 sig is not ip only
*/
int SignatureIsIPOnly(DetectEngineCtx *de_ctx, Signature *s) {
if (s->alproto != ALPROTO_UNKNOWN)
return 0;
if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL)
return 0;
if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL)
return 0;
if (s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL)
return 0;
if (s->sm_lists[DETECT_SM_LIST_HSBDMATCH] != NULL)
return 0;
if (s->sm_lists[DETECT_SM_LIST_HHDMATCH] != NULL)
return 0;
if (s->sm_lists[DETECT_SM_LIST_HRHDMATCH] != NULL)
return 0;
if (s->sm_lists[DETECT_SM_LIST_HMDMATCH] != NULL)
return 0;
if (s->sm_lists[DETECT_SM_LIST_HCDMATCH] != NULL)
return 0;
if (s->sm_lists[DETECT_SM_LIST_HRUDMATCH] != NULL)
return 0;
if (s->sm_lists[DETECT_SM_LIST_HSMDMATCH] != NULL)
return 0;
if (s->sm_lists[DETECT_SM_LIST_HSCDMATCH] != NULL)
return 0;
if (s->sm_lists[DETECT_SM_LIST_HUADMATCH] != NULL)
return 0;
if (s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL)
return 0;
SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MATCH];
if (sm == NULL)
goto iponly;
for ( ; sm != NULL; sm = sm->next) {
if ( !(sigmatch_table[sm->type].flags & SIGMATCH_IPONLY_COMPAT))
return 0;
/* we have enabled flowbits to be compatible with ip only sigs, as long
* as the sig only has a "set" flowbits */
if (sm->type == DETECT_FLOWBITS &&
(((DetectFlowbitsData *)sm->ctx)->cmd != DETECT_FLOWBITS_CMD_SET) ) {
return 0;
}
}
iponly:
if (!(de_ctx->flags & DE_QUIET)) {
SCLogDebug("IP-ONLY (%" PRIu32 "): source %s, dest %s", s->id,
s->flags & SIG_FLAG_SRC_ANY ? "ANY" : "SET",
s->flags & SIG_FLAG_DST_ANY ? "ANY" : "SET");
}
return 1;
}
/**
* \internal
* \brief Check if the initialized signature is inspecting the packet payload
* \param de_ctx detection engine ctx
* \param s the signature
* \retval 1 sig is inspecting the payload
* \retval 0 sig is not inspecting the payload
*/
static int SignatureIsInspectingPayload(DetectEngineCtx *de_ctx, Signature *s) {
if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
return 1;
}
#if 0
SigMatch *sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm == NULL)
return 0;
for (; sm != NULL; sm = sm->next) {
if (sigmatch_table[sm->type].flags & SIGMATCH_PAYLOAD) {
if (!(de_ctx->flags & DE_QUIET))
SCLogDebug("Signature (%" PRIu32 "): is inspecting payload.", s->id);
return 1;
}
}
#endif
return 0;
}
/**
* \internal
* \brief check if a signature is decoder event matching only
* \param de_ctx detection engine
* \param s the signature to test
* \retval 0 not a DEOnly sig
* \retval 1 DEOnly sig
*/
static int SignatureIsDEOnly(DetectEngineCtx *de_ctx, Signature *s) {
if (s->alproto != ALPROTO_UNKNOWN) {
SCReturnInt(0);
}
if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL ||
s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL ||
s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL ||
s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL ||
s->sm_lists[DETECT_SM_LIST_HSBDMATCH] != NULL ||
s->sm_lists[DETECT_SM_LIST_HHDMATCH] != NULL ||
s->sm_lists[DETECT_SM_LIST_HRHDMATCH] != NULL ||
s->sm_lists[DETECT_SM_LIST_HMDMATCH] != NULL ||
s->sm_lists[DETECT_SM_LIST_HCDMATCH] != NULL ||
s->sm_lists[DETECT_SM_LIST_HSMDMATCH] != NULL ||
s->sm_lists[DETECT_SM_LIST_HSCDMATCH] != NULL ||
s->sm_lists[DETECT_SM_LIST_HRUDMATCH] != NULL ||
s->sm_lists[DETECT_SM_LIST_HUADMATCH] != NULL)
{
SCReturnInt(0);
}
/* check for conflicting keywords */
SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MATCH];
for ( ;sm != NULL; sm = sm->next) {
if ( !(sigmatch_table[sm->type].flags & SIGMATCH_DEONLY_COMPAT))
SCReturnInt(0);
}
/* need at least one decode event keyword to be considered decode event. */
sm = s->sm_lists[DETECT_SM_LIST_MATCH];
for ( ;sm != NULL; sm = sm->next) {
if (sm->type == DETECT_DECODE_EVENT)
goto deonly;
if (sm->type == DETECT_ENGINE_EVENT)
goto deonly;
if (sm->type == DETECT_STREAM_EVENT)
goto deonly;
}
SCReturnInt(0);
deonly:
if (!(de_ctx->flags & DE_QUIET)) {
SCLogDebug("DE-ONLY (%" PRIu32 "): source %s, dest %s", s->id,
s->flags & SIG_FLAG_SRC_ANY ? "ANY" : "SET",
s->flags & SIG_FLAG_DST_ANY ? "ANY" : "SET");
}
SCReturnInt(1);
}
#define MASK_TCP_INITDEINIT_FLAGS (TH_SYN|TH_RST|TH_FIN)
#define MASK_TCP_UNUSUAL_FLAGS (TH_URG|TH_ECN|TH_CWR)
/* Create mask for this packet + it's flow if it has one
*
* Sets SIG_MASK_REQUIRE_PAYLOAD, SIG_MASK_REQUIRE_FLOW,
* SIG_MASK_REQUIRE_HTTP_STATE, SIG_MASK_REQUIRE_DCE_STATE
*/
static void
PacketCreateMask(Packet *p, SignatureMask *mask, uint16_t alproto, void *alstate, StreamMsg *smsg) {
if (!(p->flags & PKT_NOPAYLOAD_INSPECTION) && (p->payload_len > 0 || smsg != NULL)) {
SCLogDebug("packet has payload");
(*mask) |= SIG_MASK_REQUIRE_PAYLOAD;
} else {
SCLogDebug("packet has no payload");
(*mask) |= SIG_MASK_REQUIRE_NO_PAYLOAD;
}
if (PKT_IS_TCP(p)) {
if ((p->tcph->th_flags & MASK_TCP_INITDEINIT_FLAGS) != 0) {
(*mask) |= SIG_MASK_REQUIRE_FLAGS_INITDEINIT;
}
if ((p->tcph->th_flags & MASK_TCP_UNUSUAL_FLAGS) != 0) {
(*mask) |= SIG_MASK_REQUIRE_FLAGS_UNUSUAL;
}
}
if (p->flags & PKT_HAS_FLOW) {
SCLogDebug("packet has flow");
(*mask) |= SIG_MASK_REQUIRE_FLOW;
if (alstate != NULL) {
switch(alproto) {
case ALPROTO_HTTP:
SCLogDebug("packet/flow has http state");
(*mask) |= SIG_MASK_REQUIRE_HTTP_STATE;
break;
case ALPROTO_SMB:
case ALPROTO_SMB2:
case ALPROTO_DCERPC:
SCLogDebug("packet/flow has dce state");
(*mask) |= SIG_MASK_REQUIRE_DCE_STATE;
break;
default:
SCLogDebug("packet/flow has other state");
break;
}
} else {
SCLogDebug("no alstate");
}
}
}
static int SignatureCreateMask(Signature *s) {
SCEnter();
if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_PAYLOAD;
SCLogDebug("sig requires payload");
}
if (s->sm_lists[DETECT_SM_LIST_DMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_DCE_STATE;
SCLogDebug("sig requires dce state");
}
if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_HTTP_STATE;
SCLogDebug("sig requires http state");
}
if (s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_HTTP_STATE;
SCLogDebug("sig requires http app state");
}
if (s->sm_lists[DETECT_SM_LIST_HSBDMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_HTTP_STATE;
SCLogDebug("sig requires http app state");
}
if (s->sm_lists[DETECT_SM_LIST_HHDMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_HTTP_STATE;
SCLogDebug("sig requires http app state");
}
if (s->sm_lists[DETECT_SM_LIST_HRHDMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_HTTP_STATE;
SCLogDebug("sig requires http app state");
}
if (s->sm_lists[DETECT_SM_LIST_HMDMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_HTTP_STATE;
SCLogDebug("sig requires http app state");
}
if (s->sm_lists[DETECT_SM_LIST_HCDMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_HTTP_STATE;
SCLogDebug("sig requires http app state");
}
if (s->sm_lists[DETECT_SM_LIST_HRUDMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_HTTP_STATE;
SCLogDebug("sig requires http app state");
}
if (s->sm_lists[DETECT_SM_LIST_HSMDMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_HTTP_STATE;
SCLogDebug("sig requires http app state");
}
if (s->sm_lists[DETECT_SM_LIST_HSCDMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_HTTP_STATE;
SCLogDebug("sig requires http app state");
}
if (s->sm_lists[DETECT_SM_LIST_HUADMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_HTTP_STATE;
SCLogDebug("sig requires http app state");
}
SigMatch *sm;
for (sm = s->sm_lists[DETECT_SM_LIST_AMATCH] ; sm != NULL; sm = sm->next) {
switch(sm->type) {
case DETECT_AL_URILEN:
case DETECT_AL_HTTP_URI:
s->mask |= SIG_MASK_REQUIRE_HTTP_STATE;
SCLogDebug("sig requires dce http state");
break;
}
}
for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) {
switch(sm->type) {
case DETECT_FLOWBITS:
{
/* figure out what flowbit action */
DetectFlowbitsData *fb = (DetectFlowbitsData *)sm->ctx;
if (fb->cmd == DETECT_FLOWBITS_CMD_ISSET) {
/* not a mask flag, but still set it here */
s->flags |= SIG_FLAG_REQUIRE_FLOWVAR;
SCLogDebug("SIG_FLAG_REQUIRE_FLOWVAR set as sig has "
"flowbit isset option.");
}
/* flow is required for any flowbit manipulation */
s->mask |= SIG_MASK_REQUIRE_FLOW;
SCLogDebug("sig requires flow to be able to manipulate "
"flowbit(s)");
break;
}
case DETECT_FLAGS:
{
DetectFlagsData *fl = (DetectFlagsData *)sm->ctx;
if (fl->flags & TH_SYN) {
s->mask |= SIG_MASK_REQUIRE_FLAGS_INITDEINIT;
SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_INITDEINIT");
}
if (fl->flags & TH_RST) {
s->mask |= SIG_MASK_REQUIRE_FLAGS_INITDEINIT;
SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_INITDEINIT");
}
if (fl->flags & TH_FIN) {
s->mask |= SIG_MASK_REQUIRE_FLAGS_INITDEINIT;
SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_INITDEINIT");
}
if (fl->flags & TH_URG) {
s->mask |= SIG_MASK_REQUIRE_FLAGS_UNUSUAL;
SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_UNUSUAL");
}
if (fl->flags & TH_ECN) {
s->mask |= SIG_MASK_REQUIRE_FLAGS_UNUSUAL;
SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_UNUSUAL");
}
if (fl->flags & TH_CWR) {
s->mask |= SIG_MASK_REQUIRE_FLAGS_UNUSUAL;
SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_UNUSUAL");
}
break;
}
case DETECT_DSIZE:
{
DetectDsizeData *ds = (DetectDsizeData *)sm->ctx;
switch (ds->mode) {
case DETECTDSIZE_LT:
/* LT will include 0, so no payload.
* if GT is used in the same rule the
* flag will be set anyway. */
break;
case DETECTDSIZE_RA:
case DETECTDSIZE_GT:
s->mask |= SIG_MASK_REQUIRE_PAYLOAD;
SCLogDebug("sig requires payload");
break;
case DETECTDSIZE_EQ:
if (ds->dsize > 0) {
s->mask |= SIG_MASK_REQUIRE_PAYLOAD;
SCLogDebug("sig requires payload");
} else if (ds->dsize == 0) {
s->mask |= SIG_MASK_REQUIRE_NO_PAYLOAD;
SCLogDebug("sig requires no payload");
}
break;
}
break;
}
}
}
if (s->mask & SIG_MASK_REQUIRE_DCE_STATE ||
s->mask & SIG_MASK_REQUIRE_HTTP_STATE)
{
s->mask |= SIG_MASK_REQUIRE_FLOW;
SCLogDebug("sig requires flow");
}
if (s->init_flags & SIG_FLAG_INIT_FLOW) {
s->mask |= SIG_MASK_REQUIRE_FLOW;
SCLogDebug("sig requires flow");
}
if (s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_FLOW;
SCLogDebug("sig requires flow");
}
if (s->flags & SIG_FLAG_APPLAYER) {
s->mask |= SIG_MASK_REQUIRE_FLOW;
SCLogDebug("sig requires flow");
}
SCLogDebug("mask %02X", s->mask);
SCReturnInt(0);
}
static void SigInitStandardMpmFactoryContexts(DetectEngineCtx *de_ctx)
{
de_ctx->sgh_mpm_context_proto_tcp_packet =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "packet_proto_tcp",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_proto_udp_packet =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "packet_proto_udp",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_proto_other_packet =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "packet_proto_other",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_uri =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "uri",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_stream =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "stream",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_hcbd =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "hcbd",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_hhd =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "hhd",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_hrhd =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "hrhd",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_hmd =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "hmd",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_hcd =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "hcd",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_hrud =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "hrud",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_hsmd =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "hsmd",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_hscd =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "hscd",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_huad =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "huad",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_app_proto_detect =
MpmFactoryRegisterMpmCtxProfile(de_ctx, "app_proto_detect", 0);
return;
}
/**
* \brief Add all signatures to their own source address group
*
* \param de_ctx Pointer to the Detection Engine Context
*
* \retval 0 on success
* \retval -1 on failure
*/
int SigAddressPrepareStage1(DetectEngineCtx *de_ctx) {
Signature *tmp_s = NULL;
DetectAddress *gr = NULL;
uint32_t cnt = 0, cnt_iponly = 0;
uint32_t cnt_payload = 0;
uint32_t cnt_applayer = 0;
uint32_t cnt_deonly = 0;
//DetectAddressPrintMemory();
//DetectSigGroupPrintMemory();
//DetectPortPrintMemory();
if (!(de_ctx->flags & DE_QUIET)) {
SCLogDebug("building signature grouping structure, stage 1: "
"adding signatures to signature source addresses...");
}
de_ctx->sig_array_len = DetectEngineGetMaxSigId(de_ctx);
de_ctx->sig_array_size = (de_ctx->sig_array_len * sizeof(Signature *));
de_ctx->sig_array = (Signature **)SCMalloc(de_ctx->sig_array_size);
if (de_ctx->sig_array == NULL)
goto error;
memset(de_ctx->sig_array,0,de_ctx->sig_array_size);
SCLogDebug("signature lookup array: %" PRIu32 " sigs, %" PRIu32 " bytes",
de_ctx->sig_array_len, de_ctx->sig_array_size);
/* now for every rule add the source group */
for (tmp_s = de_ctx->sig_list; tmp_s != NULL; tmp_s = tmp_s->next) {
de_ctx->sig_array[tmp_s->num] = tmp_s;
SCLogDebug("Signature %" PRIu32 ", internal id %" PRIu32 ", ptrs %p %p ", tmp_s->id, tmp_s->num, tmp_s, de_ctx->sig_array[tmp_s->num]);
/* see if the sig is ip only */
if (SignatureIsIPOnly(de_ctx, tmp_s) == 1) {
tmp_s->flags |= SIG_FLAG_IPONLY;
cnt_iponly++;
SCLogDebug("Signature %"PRIu32" is considered \"IP only\"", tmp_s->id);
/* see if any sig is inspecting the packet payload */
} else if (SignatureIsInspectingPayload(de_ctx, tmp_s) == 1) {
tmp_s->init_flags |= SIG_FLAG_INIT_PAYLOAD;
cnt_payload++;
SCLogDebug("Signature %"PRIu32" is considered \"Payload inspecting\"", tmp_s->id);
} else if (SignatureIsDEOnly(de_ctx, tmp_s) == 1) {
tmp_s->init_flags |= SIG_FLAG_INIT_DEONLY;
SCLogDebug("Signature %"PRIu32" is considered \"Decoder Event only\"", tmp_s->id);
cnt_deonly++;
}
if (tmp_s->flags & SIG_FLAG_APPLAYER) {
SCLogDebug("Signature %"PRIu32" is considered \"Applayer inspecting\"", tmp_s->id);
cnt_applayer++;
}
#ifdef DEBUG
if (SCLogDebugEnabled()) {
uint16_t colen = 0;
char copresent = 0;
SigMatch *sm;
DetectContentData *co;
for (sm = tmp_s->sm_lists[DETECT_SM_LIST_MATCH]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_CONTENT)
continue;
copresent = 1;
co = (DetectContentData *)sm->ctx;
if (co->content_len > colen)
colen = co->content_len;
}
if (copresent && colen == 1) {
SCLogDebug("signature %8u content maxlen 1", tmp_s->id);
int proto;
for (proto = 0; proto < 256; proto++) {
if (tmp_s->proto.proto[(proto/8)] & (1<<(proto%8)))
SCLogDebug("=> proto %" PRId32 "", proto);
}
}
}
#endif /* DEBUG */
SignatureCreateMask(tmp_s);
for (gr = tmp_s->src.ipv4_head; gr != NULL; gr = gr->next) {
if (SigGroupHeadAppendSig(de_ctx, &gr->sh, tmp_s) < 0) {
goto error;
}
cnt++;
}
for (gr = tmp_s->src.ipv6_head; gr != NULL; gr = gr->next) {
if (SigGroupHeadAppendSig(de_ctx, &gr->sh, tmp_s) < 0) {
goto error;
}
cnt++;
}
for (gr = tmp_s->src.any_head; gr != NULL; gr = gr->next) {
if (SigGroupHeadAppendSig(de_ctx, &gr->sh, tmp_s) < 0) {
goto error;
}
cnt++;
}
de_ctx->sig_cnt++;
}
//DetectAddressPrintMemory();
//DetectSigGroupPrintMemory();
//DetectPortPrintMemory();
if (!(de_ctx->flags & DE_QUIET)) {
SCLogInfo("%" PRIu32 " signatures processed. %" PRIu32 " are IP-only "
"rules, %" PRIu32 " are inspecting packet payload, %"PRIu32
" inspect application layer, %"PRIu32" are decoder event only",
de_ctx->sig_cnt, cnt_iponly, cnt_payload, cnt_applayer,
cnt_deonly);
SCLogInfo("building signature grouping structure, stage 1: "
"adding signatures to signature source addresses... complete");
}
return 0;
error:
return -1;
}
static int DetectEngineLookupBuildSourceAddressList(DetectEngineCtx *de_ctx, DetectEngineLookupFlow *flow_gh, Signature *s, int family) {
DetectAddress *gr = NULL, *lookup_gr = NULL, *head = NULL;
int proto;
if (family == AF_INET) {
head = s->src.ipv4_head;
} else if (family == AF_INET6) {
head = s->src.ipv6_head;
} else {
head = s->src.any_head;
}
/* for each source address group in the signature... */
for (gr = head; gr != NULL; gr = gr->next) {
BUG_ON(gr->ip.family == 0 && !(gr->flags & ADDRESS_FLAG_ANY));
/* ...and each protocol the signature matches on... */
for (proto = 0; proto < 256; proto++) {
if ((s->proto.proto[(proto/8)] & (1<<(proto%8))) || (s->proto.flags & DETECT_PROTO_ANY)) {
/* ...see if the group is in the tmp list, and if not add it. */
if (family == AF_INET) {
lookup_gr = DetectAddressLookupInList(flow_gh->tmp_gh[proto]->ipv4_head,gr);
} else if (family == AF_INET6) {
lookup_gr = DetectAddressLookupInList(flow_gh->tmp_gh[proto]->ipv6_head,gr);
} else {
lookup_gr = DetectAddressLookupInList(flow_gh->tmp_gh[proto]->any_head,gr);
}
if (lookup_gr == NULL) {
DetectAddress *grtmp = DetectAddressCopy(gr);
if (grtmp == NULL) {
goto error;
}
SigGroupHeadAppendSig(de_ctx, &grtmp->sh, s);
/* add to the lookup list */
if (family == AF_INET) {
DetectAddressAdd(&flow_gh->tmp_gh[proto]->ipv4_head, grtmp);
} else if (family == AF_INET6) {
DetectAddressAdd(&flow_gh->tmp_gh[proto]->ipv6_head, grtmp);
} else {
DetectAddressAdd(&flow_gh->tmp_gh[proto]->any_head, grtmp);
}
} else {
/* our group will only have one sig, this one. So add that. */
SigGroupHeadAppendSig(de_ctx, &lookup_gr->sh, s);
lookup_gr->cnt++;
}
}
}
SCLogDebug("calling SigGroupHeadFree gr %p, gr->sh %p", gr, gr->sh);
SigGroupHeadFree(gr->sh);
gr->sh = NULL;
}
return 0;
error:
return -1;
}
/**
* \brief add signature to the right flow group(s)
*/
static int DetectEngineLookupFlowAddSig(DetectEngineCtx *de_ctx, Signature *s, int family) {
SCLogDebug("s->id %u", s->id);
if (s->flags & SIG_FLAG_TOCLIENT) {
SCLogDebug("s->id %u (toclient)", s->id);
DetectEngineLookupBuildSourceAddressList(de_ctx,
&de_ctx->flow_gh[0], s, family);
}
if (s->flags & SIG_FLAG_TOSERVER) {
SCLogDebug("s->id %u (toserver)", s->id);
DetectEngineLookupBuildSourceAddressList(de_ctx,
&de_ctx->flow_gh[1], s, family);
}
return 0;
}
static DetectAddress *GetHeadPtr(DetectAddressHead *head, int family) {
DetectAddress *grhead;
if (head == NULL)
return NULL;
if (family == AF_INET) {
grhead = head->ipv4_head;
} else if (family == AF_INET6) {
grhead = head->ipv6_head;
} else {
grhead = head->any_head;
}
return grhead;
}
//#define SMALL_MPM(c) 0
#define SMALL_MPM(c) ((c) == 1)
// || (c) == 2)
// || (c) == 3)
int CreateGroupedAddrListCmpCnt(DetectAddress *a, DetectAddress *b) {
if (a->cnt > b->cnt)
return 1;
return 0;
}
int CreateGroupedAddrListCmpMpmMaxlen(DetectAddress *a, DetectAddress *b) {
if (a->sh == NULL || b->sh == NULL)
return 0;
if (SMALL_MPM(a->sh->mpm_content_maxlen))
return 1;
if (a->sh->mpm_content_maxlen < b->sh->mpm_content_maxlen)
return 1;
return 0;
}
/* set unique_groups to 0 for no grouping.
*
* srchead is a ordered "inserted" list w/o internal overlap
*
*/
int CreateGroupedAddrList(DetectEngineCtx *de_ctx, DetectAddress *srchead,
int family, DetectAddressHead *newhead,
uint32_t unique_groups,
int (*CompareFunc)(DetectAddress *, DetectAddress *),
uint32_t max_idx)
{
DetectAddress *tmplist = NULL, *tmplist2 = NULL, *joingr = NULL;
char insert = 0;
DetectAddress *gr, *next_gr;
uint32_t groups = 0;
/* insert the addresses into the tmplist, where it will
* be sorted descending on 'cnt'. */
for (gr = srchead; gr != NULL; gr = gr->next) {
BUG_ON(gr->ip.family == 0 && !(gr->flags & ADDRESS_FLAG_ANY));
if (SMALL_MPM(gr->sh->mpm_content_maxlen) && unique_groups > 0)
unique_groups++;
groups++;
/* alloc a copy */
DetectAddress *newtmp = DetectAddressCopy(gr);
if (newtmp == NULL) {
goto error;
}
SigGroupHeadCopySigs(de_ctx, gr->sh,&newtmp->sh);
DetectPort *port = gr->port;
for ( ; port != NULL; port = port->next) {
DetectPortInsertCopy(de_ctx,&newtmp->port, port);
newtmp->flags |= ADDRESS_HAVEPORT;
}
/* insert it */
DetectAddress *tmpgr = tmplist, *prevtmpgr = NULL;
if (tmplist == NULL) {
/* empty list, set head */
tmplist = newtmp;
} else {
/* look for the place to insert */
for ( ; tmpgr != NULL&&!insert; tmpgr = tmpgr->next) {
if (CompareFunc(gr, tmpgr)) {
if (tmpgr == tmplist) {
newtmp->next = tmplist;
tmplist = newtmp;
} else {
newtmp->next = prevtmpgr->next;
prevtmpgr->next = newtmp;
}
insert = 1;
}
prevtmpgr = tmpgr;
}
if (insert == 0) {
newtmp->next = NULL;
prevtmpgr->next = newtmp;
}
insert = 0;
}
}
uint32_t i = unique_groups;
if (i == 0) i = groups;
for (gr = tmplist; gr != NULL; ) {
BUG_ON(gr->ip.family == 0 && !(gr->flags & ADDRESS_FLAG_ANY));
if (i == 0) {
if (joingr == NULL) {
joingr = DetectAddressCopy(gr);
if (joingr == NULL) {
goto error;
}
SigGroupHeadCopySigs(de_ctx,gr->sh,&joingr->sh);
DetectPort *port = gr->port;
for ( ; port != NULL; port = port->next) {
DetectPortInsertCopy(de_ctx,&joingr->port, port);
joingr->flags |= ADDRESS_HAVEPORT;
}
} else {
DetectAddressJoin(de_ctx, joingr, gr);
}
} else {
DetectAddress *newtmp = DetectAddressCopy(gr);
if (newtmp == NULL) {
goto error;
}
SigGroupHeadCopySigs(de_ctx,gr->sh,&newtmp->sh);
DetectPort *port = gr->port;
for ( ; port != NULL; port = port->next) {
DetectPortInsertCopy(de_ctx,&newtmp->port, port);
newtmp->flags |= ADDRESS_HAVEPORT;
}
if (tmplist2 == NULL) {
tmplist2 = newtmp;
} else {
newtmp->next = tmplist2;
tmplist2 = newtmp;
}
}
if (i)i--;
next_gr = gr->next;
DetectAddressFree(gr);
gr = next_gr;
}
/* we now have a tmplist2 containing the 'unique' groups and
* possibly a joingr that covers the rest. Now build the newhead
* that we will pass back to the caller.
*
* Start with inserting the unique groups */
for (gr = tmplist2; gr != NULL; ) {
BUG_ON(gr->ip.family == 0 && !(gr->flags & ADDRESS_FLAG_ANY));
DetectAddress *newtmp = DetectAddressCopy(gr);
if (newtmp == NULL) {
goto error;
}
SigGroupHeadCopySigs(de_ctx, gr->sh,&newtmp->sh);
DetectPort *port = gr->port;
for ( ; port != NULL; port = port->next) {
DetectPortInsertCopy(de_ctx, &newtmp->port, port);
newtmp->flags |= ADDRESS_HAVEPORT;
}
DetectAddressInsert(de_ctx, newhead, newtmp);
next_gr = gr->next;
DetectAddressFree(gr);
gr = next_gr;
}
/* if present, insert the joingr that covers the rest */
if (joingr != NULL) {
DetectAddressInsert(de_ctx, newhead, joingr);
}
return 0;
error:
return -1;
}
int CreateGroupedPortListCmpCnt(DetectPort *a, DetectPort *b) {
if (a->cnt > b->cnt)
return 1;
return 0;
}
int CreateGroupedPortListCmpMpmMaxlen(DetectPort *a, DetectPort *b) {
if (a->sh == NULL || b->sh == NULL)
return 0;
if (SMALL_MPM(a->sh->mpm_content_maxlen))
return 1;
if (a->sh->mpm_content_maxlen < b->sh->mpm_content_maxlen)
return 1;
return 0;
}
static uint32_t g_groupportlist_maxgroups = 0;
static uint32_t g_groupportlist_groupscnt = 0;
static uint32_t g_groupportlist_totgroups = 0;
int CreateGroupedPortList(DetectEngineCtx *de_ctx,HashListTable *port_hash, DetectPort **newhead, uint32_t unique_groups, int (*CompareFunc)(DetectPort *, DetectPort *), uint32_t max_idx) {
DetectPort *tmplist = NULL, *tmplist2 = NULL, *joingr = NULL;
char insert = 0;
DetectPort *gr, *next_gr;
uint32_t groups = 0;
HashListTableBucket *htb = HashListTableGetListHead(port_hash);
/* insert the addresses into the tmplist, where it will
* be sorted descending on 'cnt'. */
for ( ; htb != NULL; htb = HashListTableGetListNext(htb)) {
gr = (DetectPort *)HashListTableGetListData(htb);
SCLogDebug("hash list gr %p", gr);
DetectPortPrint(gr);
if (SMALL_MPM(gr->sh->mpm_content_maxlen) && unique_groups > 0)
unique_groups++;
groups++;
/* alloc a copy */
DetectPort *newtmp = DetectPortCopySingle(de_ctx, gr);
if (newtmp == NULL) {
goto error;
}
/* insert it */
DetectPort *tmpgr = tmplist, *prevtmpgr = NULL;
if (tmplist == NULL) {
/* empty list, set head */
tmplist = newtmp;
} else {
/* look for the place to insert */
for ( ; tmpgr != NULL&&!insert; tmpgr = tmpgr->next) {
if (CompareFunc(gr, tmpgr)) {
if (tmpgr == tmplist) {
newtmp->next = tmplist;
tmplist = newtmp;
} else {
newtmp->next = prevtmpgr->next;
prevtmpgr->next = newtmp;
}
insert = 1;
}
prevtmpgr = tmpgr;
}
if (insert == 0) {
newtmp->next = NULL;
prevtmpgr->next = newtmp;
}
insert = 0;
}
}
uint32_t i = unique_groups;
if (i == 0) i = groups;
if (unique_groups > g_groupportlist_maxgroups)
g_groupportlist_maxgroups = unique_groups;
g_groupportlist_groupscnt++;
g_groupportlist_totgroups += unique_groups;
for (gr = tmplist; gr != NULL; ) {
SCLogDebug("temp list gr %p", gr);
DetectPortPrint(gr);
if (i == 0) {
if (joingr == NULL) {
joingr = DetectPortCopySingle(de_ctx,gr);
if (joingr == NULL) {
goto error;
}
} else {
DetectPortJoin(de_ctx,joingr, gr);
}
} else {
DetectPort *newtmp = DetectPortCopySingle(de_ctx,gr);
if (newtmp == NULL) {
goto error;
}
if (tmplist2 == NULL) {
tmplist2 = newtmp;
} else {
newtmp->next = tmplist2;
tmplist2 = newtmp;
}
}
if (i)i--;
next_gr = gr->next;
gr->next = NULL;
DetectPortFree(gr);
gr = next_gr;
}
/* we now have a tmplist2 containing the 'unique' groups and
* possibly a joingr that covers the rest. Now build the newhead
* that we will pass back to the caller.
*
* Start with inserting the unique groups */
for (gr = tmplist2; gr != NULL; ) {
SCLogDebug("temp list2 gr %p", gr);
DetectPortPrint(gr);
DetectPort *newtmp = DetectPortCopySingle(de_ctx,gr);
if (newtmp == NULL) {
goto error;
}
int r = DetectPortInsert(de_ctx,newhead,newtmp);
BUG_ON(r == -1);
next_gr = gr->next;
gr->next = NULL;
DetectPortFree(gr);
gr = next_gr;
}
DetectPortPrintList(*newhead);
/* if present, insert the joingr that covers the rest */
if (joingr != NULL) {
SCLogDebug("inserting joingr %p", joingr);
DetectPortInsert(de_ctx,newhead,joingr);
} else {
SCLogDebug("no joingr");
}
return 0;
error:
return -1;
}
/**
* \internal
* \brief add a decoder event signature to the detection engine ctx
*/
static void DetectEngineAddDecoderEventSig(DetectEngineCtx *de_ctx, Signature *s) {
SCLogDebug("adding signature %"PRIu32" to the decoder event sgh", s->id);
SigGroupHeadAppendSig(de_ctx, &de_ctx->decoder_event_sgh, s);
}
/**
* \brief Fill the global src group head, with the sigs included
*
* \param de_ctx Pointer to the Detection Engine Context whose Signatures have
* to be processed
*
* \retval 0 On success
* \retval -1 On failure
*/
int SigAddressPrepareStage2(DetectEngineCtx *de_ctx) {
Signature *tmp_s = NULL;
uint32_t sigs = 0;
if (!(de_ctx->flags & DE_QUIET)) {
SCLogDebug("building signature grouping structure, stage 2: "
"building source address lists...");
}
IPOnlyInit(de_ctx, &de_ctx->io_ctx);
int f, proto;
for (f = 0; f < FLOW_STATES; f++) {
for (proto = 0; proto < 256; proto++) {
de_ctx->flow_gh[f].src_gh[proto] = DetectAddressHeadInit();
if (de_ctx->flow_gh[f].src_gh[proto] == NULL) {
goto error;
}
de_ctx->flow_gh[f].tmp_gh[proto] = DetectAddressHeadInit();
if (de_ctx->flow_gh[f].tmp_gh[proto] == NULL) {
goto error;
}
}
}
/* now for every rule add the source group to our temp lists */
for (tmp_s = de_ctx->sig_list; tmp_s != NULL; tmp_s = tmp_s->next) {
SCLogDebug("tmp_s->id %"PRIu32, tmp_s->id);
if (tmp_s->flags & SIG_FLAG_IPONLY) {
IPOnlyAddSignature(de_ctx, &de_ctx->io_ctx, tmp_s);
} else if (tmp_s->init_flags & SIG_FLAG_INIT_DEONLY) {
DetectEngineAddDecoderEventSig(de_ctx, tmp_s);
} else {
DetectEngineLookupFlowAddSig(de_ctx, tmp_s, AF_INET);
DetectEngineLookupFlowAddSig(de_ctx, tmp_s, AF_INET6);
DetectEngineLookupFlowAddSig(de_ctx, tmp_s, AF_UNSPEC);
}
sigs++;
}
/* create the final src addr list based on the tmplist. */
for (f = 0; f < FLOW_STATES; f++) {
for (proto = 0; proto < 256; proto++) {
int groups = (f ? de_ctx->max_uniq_toserver_src_groups : de_ctx->max_uniq_toclient_src_groups);
CreateGroupedAddrList(de_ctx,
de_ctx->flow_gh[f].tmp_gh[proto]->ipv4_head, AF_INET,
de_ctx->flow_gh[f].src_gh[proto], groups,
CreateGroupedAddrListCmpMpmMaxlen, DetectEngineGetMaxSigId(de_ctx));
CreateGroupedAddrList(de_ctx,
de_ctx->flow_gh[f].tmp_gh[proto]->ipv6_head, AF_INET6,
de_ctx->flow_gh[f].src_gh[proto], groups,
CreateGroupedAddrListCmpMpmMaxlen, DetectEngineGetMaxSigId(de_ctx));
CreateGroupedAddrList(de_ctx,
de_ctx->flow_gh[f].tmp_gh[proto]->any_head, AF_UNSPEC,
de_ctx->flow_gh[f].src_gh[proto], groups,
CreateGroupedAddrListCmpMpmMaxlen, DetectEngineGetMaxSigId(de_ctx));
DetectAddressHeadFree(de_ctx->flow_gh[f].tmp_gh[proto]);
de_ctx->flow_gh[f].tmp_gh[proto] = NULL;
}
}
//DetectAddressPrintMemory();
//DetectSigGroupPrintMemory();
//printf("g_src_gh strt\n");
//DetectAddressPrintList(g_src_gh->ipv4_head);
//printf("g_src_gh end\n");
IPOnlyPrepare(de_ctx);
IPOnlyPrint(de_ctx, &de_ctx->io_ctx);
#ifdef DEBUG
DetectAddress *gr = NULL;
if (!(de_ctx->flags & DE_QUIET)) {
SCLogDebug("%" PRIu32 " total signatures:", sigs);
}
/* TCP */
uint32_t cnt_any = 0, cnt_ipv4 = 0, cnt_ipv6 = 0;
for (f = 0; f < FLOW_STATES; f++) {
for (gr = de_ctx->flow_gh[f].src_gh[IPPROTO_TCP]->any_head; gr != NULL; gr = gr->next) {
cnt_any++;
}
}
for (f = 0; f < FLOW_STATES; f++) {
for (gr = de_ctx->flow_gh[f].src_gh[IPPROTO_TCP]->ipv4_head; gr != NULL; gr = gr->next) {
cnt_ipv4++;
}
}
for (f = 0; f < FLOW_STATES; f++) {
for (gr = de_ctx->flow_gh[f].src_gh[IPPROTO_TCP]->ipv6_head; gr != NULL; gr = gr->next) {
cnt_ipv6++;
}
}
if (!(de_ctx->flags & DE_QUIET)) {
SCLogDebug("TCP Source address blocks: any: %4u, ipv4: %4u, ipv6: %4u.", cnt_any, cnt_ipv4, cnt_ipv6);
}
cnt_any = 0, cnt_ipv4 = 0, cnt_ipv6 = 0;
/* UDP */
for (f = 0; f < FLOW_STATES; f++) {
for (gr = de_ctx->flow_gh[f].src_gh[IPPROTO_UDP]->any_head; gr != NULL; gr = gr->next) {
cnt_any++;
}
}
for (f = 0; f < FLOW_STATES; f++) {
for (gr = de_ctx->flow_gh[f].src_gh[IPPROTO_UDP]->ipv4_head; gr != NULL; gr = gr->next) {
cnt_ipv4++;
}
}
for (f = 0; f < FLOW_STATES; f++) {
for (gr = de_ctx->flow_gh[f].src_gh[IPPROTO_UDP]->ipv6_head; gr != NULL; gr = gr->next) {
cnt_ipv6++;
}
}
if (!(de_ctx->flags & DE_QUIET)) {
SCLogDebug("UDP Source address blocks: any: %4u, ipv4: %4u, ipv6: %4u.", cnt_any, cnt_ipv4, cnt_ipv6);
}
cnt_any = 0, cnt_ipv4 = 0, cnt_ipv6 = 0;
/* SCTP */
for (f = 0; f < FLOW_STATES; f++) {
for (gr = de_ctx->flow_gh[f].src_gh[IPPROTO_SCTP]->any_head; gr != NULL; gr = gr->next) {
cnt_any++;
}
}
for (f = 0; f < FLOW_STATES; f++) {
for (gr = de_ctx->flow_gh[f].src_gh[IPPROTO_SCTP]->ipv4_head; gr != NULL; gr = gr->next) {
cnt_ipv4++;
}
}
for (f = 0; f < FLOW_STATES; f++) {
for (gr = de_ctx->flow_gh[f].src_gh[IPPROTO_SCTP]->ipv6_head; gr != NULL; gr = gr->next) {
cnt_ipv6++;
}
}
if (!(de_ctx->flags & DE_QUIET)) {
SCLogDebug("SCTP Source address blocks: any: %4u, ipv4: %4u, ipv6: %4u.", cnt_any, cnt_ipv4, cnt_ipv6);
}
/* ICMP */
cnt_any = 0, cnt_ipv4 = 0, cnt_ipv6 = 0;
for (f = 0; f < FLOW_STATES; f++) {
for (gr = de_ctx->flow_gh[f].src_gh[1]->any_head; gr != NULL; gr = gr->next) {
cnt_any++;
}
}
for (f = 0; f < FLOW_STATES; f++) {
for (gr = de_ctx->flow_gh[f].src_gh[1]->ipv4_head; gr != NULL; gr = gr->next) {
cnt_ipv4++;
}
}
for (f = 0; f < FLOW_STATES; f++) {
for (gr = de_ctx->flow_gh[f].src_gh[1]->ipv6_head; gr != NULL; gr = gr->next) {
cnt_ipv6++;
}
}
if (!(de_ctx->flags & DE_QUIET)) {
SCLogDebug("ICMP Source address blocks: any: %4u, ipv4: %4u, ipv6: %4u.", cnt_any, cnt_ipv4, cnt_ipv6);
}
#endif /* DEBUG */
if (!(de_ctx->flags & DE_QUIET)) {
SCLogInfo("building signature grouping structure, stage 2: building source address list... complete");
}
return 0;
error:
printf("SigAddressPrepareStage2 error\n");
return -1;
}
/**
* \brief Build the destination address portion of the match tree
*/
int BuildDestinationAddressHeads(DetectEngineCtx *de_ctx, DetectAddressHead *head, int family, int flow) {
Signature *tmp_s = NULL;
DetectAddress *gr = NULL, *sgr = NULL, *lookup_gr = NULL;
uint32_t max_idx = 0;
DetectAddress *grhead = NULL, *grdsthead = NULL, *grsighead = NULL;
/* based on the family, select the list we are using in the head */
grhead = GetHeadPtr(head, family);
/* loop through the global source address list */
for (gr = grhead; gr != NULL; gr = gr->next) {
//printf(" * Source group (BuildDestinationAddressHeads): "); DetectAddressPrint(gr); printf(" (%p)\n", gr);
/* initialize the destination group head */
gr->dst_gh = DetectAddressHeadInit();
if (gr->dst_gh == NULL) {
goto error;
}
/* use a tmp list for speeding up insertions */
DetectAddress *tmp_gr_list = NULL;
/* loop through all signatures in this source address group
* and build the temporary destination address list for it */
uint32_t sig;
for (sig = 0; sig < de_ctx->sig_array_len; sig++) {
if (!(gr->sh->init->sig_array[(sig/8)] & (1<<(sig%8))))
continue;
tmp_s = de_ctx->sig_array[sig];
if (tmp_s == NULL)
continue;
//printf(" * (tmp) Signature %u (num %u)\n", tmp_s->id, tmp_s->num);
max_idx = sig;
/* build the temp list */
grsighead = GetHeadPtr(&tmp_s->dst, family);
for (sgr = grsighead; sgr != NULL; sgr = sgr->next) {
//printf(" * (tmp) dst group: "); DetectAddressPrint(sgr); printf(" (%p)\n", sgr);
if ((lookup_gr = DetectAddressLookupInList(tmp_gr_list, sgr)) == NULL) {
DetectAddress *grtmp = DetectAddressCopy(sgr);
if (grtmp == NULL) {
goto error;
}
SigGroupHeadAppendSig(de_ctx,&grtmp->sh,tmp_s);
DetectAddressAdd(&tmp_gr_list,grtmp);
} else {
/* our group will only have one sig, this one. So add that. */
SigGroupHeadAppendSig(de_ctx, &lookup_gr->sh, tmp_s);
lookup_gr->cnt++;
}
}
}
/* Create the destination address list, keeping in
* mind the limits we use. */
int groups = (flow ? de_ctx->max_uniq_toserver_dst_groups : de_ctx->max_uniq_toclient_dst_groups);
CreateGroupedAddrList(de_ctx, tmp_gr_list, family, gr->dst_gh, groups, CreateGroupedAddrListCmpMpmMaxlen, max_idx);
/* see if the sig group head of each address group is the
* same as an earlier one. If it is, free our head and use
* a pointer to the earlier one. This saves _a lot_ of memory.
*/
grdsthead = GetHeadPtr(gr->dst_gh, family);
for (sgr = grdsthead; sgr != NULL; sgr = sgr->next) {
//printf(" * Destination group: "); DetectAddressPrint(sgr); printf("\n");
/* Because a pattern matcher context uses quite some
* memory, we first check if we can reuse it from
* another group head. */
SigGroupHead *sgh = SigGroupHeadHashLookup(de_ctx, sgr->sh);
if (sgh == NULL) {
/* put the contents in our sig group head */
SigGroupHeadSetSigCnt(sgr->sh, max_idx);
SigGroupHeadBuildMatchArray(de_ctx, sgr->sh, max_idx);
/* init the pattern matcher, this will respect the copy
* setting */
if (PatternMatchPrepareGroup(de_ctx, sgr->sh) < 0) {
printf("PatternMatchPrepareGroup failed\n");
goto error;
}
if (sgr->sh->mpm_proto_tcp_ctx_ts != NULL) {
if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_tcp_ctx_ts->pattern_cnt)
de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_tcp_ctx_ts->pattern_cnt;
de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_tcp_ctx_ts->pattern_cnt;
}
if (sgr->sh->mpm_proto_tcp_ctx_tc != NULL) {
if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_tcp_ctx_tc->pattern_cnt)
de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_tcp_ctx_tc->pattern_cnt;
de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_tcp_ctx_tc->pattern_cnt;
}
if (sgr->sh->mpm_proto_udp_ctx_ts != NULL) {
if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_udp_ctx_ts->pattern_cnt)
de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_udp_ctx_ts->pattern_cnt;
de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_udp_ctx_ts->pattern_cnt;
}
if (sgr->sh->mpm_proto_udp_ctx_tc != NULL) {
if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_udp_ctx_tc->pattern_cnt)
de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_udp_ctx_tc->pattern_cnt;
de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_udp_ctx_tc->pattern_cnt;
}
if (sgr->sh->mpm_proto_other_ctx != NULL) {
if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_other_ctx->pattern_cnt)
de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_other_ctx->pattern_cnt;
de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_other_ctx->pattern_cnt;
}
if (sgr->sh->mpm_uri_ctx_ts != NULL) {
if (de_ctx->mpm_uri_max_patcnt < sgr->sh->mpm_uri_ctx_ts->pattern_cnt)
de_ctx->mpm_uri_max_patcnt = sgr->sh->mpm_uri_ctx_ts->pattern_cnt;
de_ctx->mpm_uri_tot_patcnt += sgr->sh->mpm_uri_ctx_ts->pattern_cnt;
}
if (sgr->sh->mpm_uri_ctx_tc != NULL) {
if (de_ctx->mpm_uri_max_patcnt < sgr->sh->mpm_uri_ctx_tc->pattern_cnt)
de_ctx->mpm_uri_max_patcnt = sgr->sh->mpm_uri_ctx_tc->pattern_cnt;
de_ctx->mpm_uri_tot_patcnt += sgr->sh->mpm_uri_ctx_tc->pattern_cnt;
}
/* dbg */
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_tcp_ctx_ts) {
de_ctx->mpm_memory_size += sgr->sh->mpm_proto_tcp_ctx_ts->memory_size;
}
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_tcp_ctx_tc) {
de_ctx->mpm_memory_size += sgr->sh->mpm_proto_tcp_ctx_tc->memory_size;
}
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_udp_ctx_ts) {
de_ctx->mpm_memory_size += sgr->sh->mpm_proto_udp_ctx_ts->memory_size;
}
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_udp_ctx_tc) {
de_ctx->mpm_memory_size += sgr->sh->mpm_proto_udp_ctx_tc->memory_size;
}
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_other_ctx) {
de_ctx->mpm_memory_size += sgr->sh->mpm_proto_other_ctx->memory_size;
}
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && sgr->sh->mpm_uri_ctx_ts) {
de_ctx->mpm_memory_size += sgr->sh->mpm_uri_ctx_ts->memory_size;
}
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && sgr->sh->mpm_uri_ctx_tc) {
de_ctx->mpm_memory_size += sgr->sh->mpm_uri_ctx_tc->memory_size;
}
SigGroupHeadHashAdd(de_ctx, sgr->sh);
SigGroupHeadStore(de_ctx, sgr->sh);
de_ctx->gh_unique++;
} else {
SCLogDebug("calling SigGroupHeadFree sgr %p, sgr->sh %p", sgr, sgr->sh);
SigGroupHeadFree(sgr->sh);
sgr->sh = sgh;
de_ctx->gh_reuse++;
sgr->flags |= ADDRESS_SIGGROUPHEAD_COPY;
sgr->sh->flags |= SIG_GROUP_HEAD_REFERENCED;
}
}
/* free the temp list */
DetectAddressCleanupList(tmp_gr_list);
/* clear now unneeded sig group head */
SCLogDebug("calling SigGroupHeadFree gr %p, gr->sh %p", gr, gr->sh);
SigGroupHeadFree(gr->sh);
gr->sh = NULL;
}
return 0;
error:
return -1;
}
//static
int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, DetectAddressHead *head, int family, int flow) {
Signature *tmp_s = NULL;
DetectAddress *src_gr = NULL, *dst_gr = NULL, *sig_gr = NULL, *lookup_gr = NULL;
DetectAddress *src_gr_head = NULL, *dst_gr_head = NULL, *sig_gr_head = NULL;
uint32_t max_idx = 0;
/* loop through the global source address list */
src_gr_head = GetHeadPtr(head,family);
for (src_gr = src_gr_head; src_gr != NULL; src_gr = src_gr->next) {
//printf(" * Source group: "); DetectAddressPrint(src_gr); printf("\n");
/* initialize the destination group head */
src_gr->dst_gh = DetectAddressHeadInit();
if (src_gr->dst_gh == NULL) {
goto error;
}
/* use a tmp list for speeding up insertions */
DetectAddress *tmp_gr_list = NULL;
/* loop through all signatures in this source address group
* and build the temporary destination address list for it */
uint32_t sig;
for (sig = 0; sig < de_ctx->sig_array_len; sig++) {
if (!(src_gr->sh->init->sig_array[(sig/8)] & (1<<(sig%8))))
continue;
tmp_s = de_ctx->sig_array[sig];
if (tmp_s == NULL)
continue;
//printf(" * Source group: "); DetectAddressPrint(src_gr); printf("\n");
max_idx = sig;
/* build the temp list */
sig_gr_head = GetHeadPtr(&tmp_s->dst,family);
for (sig_gr = sig_gr_head; sig_gr != NULL; sig_gr = sig_gr->next) {
//printf(" * Sig dst addr: "); DetectAddressPrint(sig_gr); printf("\n");
if ((lookup_gr = DetectAddressLookupInList(tmp_gr_list, sig_gr)) == NULL) {
DetectAddress *grtmp = DetectAddressCopy(sig_gr);
if (grtmp == NULL) {
goto error;
}
SigGroupHeadAppendSig(de_ctx, &grtmp->sh, tmp_s);
DetectAddressAdd(&tmp_gr_list,grtmp);
} else {
/* our group will only have one sig, this one. So add that. */
SigGroupHeadAppendSig(de_ctx, &lookup_gr->sh, tmp_s);
lookup_gr->cnt++;
}
SCLogDebug("calling SigGroupHeadFree sig_gr %p, sig_gr->sh %p", sig_gr, sig_gr->sh);
SigGroupHeadFree(sig_gr->sh);
sig_gr->sh = NULL;
}
}
/* Create the destination address list, keeping in
* mind the limits we use. */
int groups = (flow ? de_ctx->max_uniq_toserver_dst_groups : de_ctx->max_uniq_toclient_dst_groups);
CreateGroupedAddrList(de_ctx, tmp_gr_list, family, src_gr->dst_gh, groups, CreateGroupedAddrListCmpMpmMaxlen, max_idx);
/* add the ports to the dst address groups and the sigs
* to the ports */
dst_gr_head = GetHeadPtr(src_gr->dst_gh,family);
for (dst_gr = dst_gr_head; dst_gr != NULL; dst_gr = dst_gr->next) {
//printf(" * Destination group: "); DetectAddressPrint(dst_gr); printf("\n");
dst_gr->flags |= ADDRESS_HAVEPORT;
if (dst_gr->sh == NULL)
continue;
/* we will reuse address sig group heads at this points,
* because if the sigs are the same, the ports will be
* the same. Saves memory and a lot of init time. */
SigGroupHead *lookup_sgh = SigGroupHeadHashLookup(de_ctx, dst_gr->sh);
if (lookup_sgh == NULL) {
DetectPortSpHashReset(de_ctx);
uint32_t sig2;
for (sig2 = 0; sig2 < max_idx+1; sig2++) {
if (!(dst_gr->sh->init->sig_array[(sig2/8)] & (1<<(sig2%8))))
continue;
Signature *s = de_ctx->sig_array[sig2];
if (s == NULL)
continue;
//printf(" + Destination group (grouped): "); DetectAddressPrint(dst_gr); printf("\n");
DetectPort *sdp = s->sp;
for ( ; sdp != NULL; sdp = sdp->next) {
DetectPort *lookup_port = DetectPortSpHashLookup(de_ctx, sdp);
if (lookup_port == NULL) {
DetectPort *port = DetectPortCopySingle(de_ctx,sdp);
if (port == NULL)
goto error;
SigGroupHeadAppendSig(de_ctx, &port->sh, s);
DetectPortSpHashAdd(de_ctx, port);
port->cnt = 1;
} else {
SigGroupHeadAppendSig(de_ctx, &lookup_port->sh, s);
lookup_port->cnt++;
}
}
}
int spgroups = (flow ? de_ctx->max_uniq_toserver_sp_groups : de_ctx->max_uniq_toclient_sp_groups);
CreateGroupedPortList(de_ctx, de_ctx->sport_hash_table, &dst_gr->port, spgroups, CreateGroupedPortListCmpMpmMaxlen, max_idx);
SCLogDebug("adding sgh %p to the hash", dst_gr->sh);
SigGroupHeadHashAdd(de_ctx, dst_gr->sh);
dst_gr->sh->init->port = dst_gr->port;
/* mark this head for deletion once we no longer need
* the hash. We're only using the port ptr, so no problem
* when we remove this after initialization is done */
dst_gr->sh->flags |= SIG_GROUP_HEAD_FREE;
/* for each destination port we setup the siggrouphead here */
DetectPort *sp = dst_gr->port;
for ( ; sp != NULL; sp = sp->next) {
//printf(" * Src Port(range): "); DetectPortPrint(sp); printf("\n");
if (sp->sh == NULL)
continue;
/* we will reuse address sig group heads at this points,
* because if the sigs are the same, the ports will be
* the same. Saves memory and a lot of init time. */
SigGroupHead *lookup_sp_sgh = SigGroupHeadSPortHashLookup(de_ctx, sp->sh);
if (lookup_sp_sgh == NULL) {
DetectPortDpHashReset(de_ctx);
uint32_t sig2;
for (sig2 = 0; sig2 < max_idx+1; sig2++) {
if (!(sp->sh->init->sig_array[(sig2/8)] & (1<<(sig2%8))))
continue;
Signature *s = de_ctx->sig_array[sig2];
if (s == NULL)
continue;
DetectPort *sdp = s->dp;
for ( ; sdp != NULL; sdp = sdp->next) {
DetectPort *lookup_port = DetectPortDpHashLookup(de_ctx,sdp);
if (lookup_port == NULL) {
DetectPort *port = DetectPortCopySingle(de_ctx,sdp);
if (port == NULL)
goto error;
SigGroupHeadAppendSig(de_ctx, &port->sh, s);
DetectPortDpHashAdd(de_ctx,port);
port->cnt = 1;
} else {
SigGroupHeadAppendSig(de_ctx, &lookup_port->sh, s);
lookup_port->cnt++;
}
}
}
int dpgroups = (flow ? de_ctx->max_uniq_toserver_dp_groups : de_ctx->max_uniq_toclient_dp_groups);
CreateGroupedPortList(de_ctx, de_ctx->dport_hash_table,
&sp->dst_ph, dpgroups,
CreateGroupedPortListCmpMpmMaxlen, max_idx);
SigGroupHeadSPortHashAdd(de_ctx, sp->sh);
sp->sh->init->port = sp->dst_ph;
/* mark this head for deletion once we no longer need
* the hash. We're only using the port ptr, so no problem
* when we remove this after initialization is done */
sp->sh->flags |= SIG_GROUP_HEAD_FREE;
/* for each destination port we setup the siggrouphead here */
DetectPort *dp = sp->dst_ph;
for ( ; dp != NULL; dp = dp->next) {
if (dp->sh == NULL)
continue;
/* Because a pattern matcher context uses quite some
* memory, we first check if we can reuse it from
* another group head. */
SigGroupHead *lookup_dp_sgh = SigGroupHeadDPortHashLookup(de_ctx, dp->sh);
if (lookup_dp_sgh == NULL) {
SCLogDebug("dp %p dp->sh %p is the original (sp %p, dst_gr %p, src_gr %p)", dp, dp->sh, sp, dst_gr, src_gr);
SigGroupHeadSetSigCnt(dp->sh, max_idx);
SigGroupHeadBuildMatchArray(de_ctx,dp->sh, max_idx);
/* init the pattern matcher, this will respect the copy
* setting */
if (PatternMatchPrepareGroup(de_ctx, dp->sh) < 0) {
printf("PatternMatchPrepareGroup failed\n");
goto error;
}
if (dp->sh->mpm_proto_tcp_ctx_ts != NULL) {
if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_tcp_ctx_ts->pattern_cnt)
de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_tcp_ctx_ts->pattern_cnt;
de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_tcp_ctx_ts->pattern_cnt;
}
if (dp->sh->mpm_proto_tcp_ctx_tc != NULL) {
if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_tcp_ctx_tc->pattern_cnt)
de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_tcp_ctx_tc->pattern_cnt;
de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_tcp_ctx_tc->pattern_cnt;
}
if (dp->sh->mpm_proto_udp_ctx_ts != NULL) {
if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_udp_ctx_ts->pattern_cnt)
de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_udp_ctx_ts->pattern_cnt;
de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_udp_ctx_ts->pattern_cnt;
}
if (dp->sh->mpm_proto_udp_ctx_tc != NULL) {
if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_udp_ctx_tc->pattern_cnt)
de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_udp_ctx_tc->pattern_cnt;
de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_udp_ctx_tc->pattern_cnt;
}
if (dp->sh->mpm_proto_other_ctx != NULL) {
if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_other_ctx->pattern_cnt)
de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_other_ctx->pattern_cnt;
de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_other_ctx->pattern_cnt;
}
if (dp->sh->mpm_uri_ctx_ts != NULL) {
if (de_ctx->mpm_uri_max_patcnt < dp->sh->mpm_uri_ctx_ts->pattern_cnt)
de_ctx->mpm_uri_max_patcnt = dp->sh->mpm_uri_ctx_ts->pattern_cnt;
de_ctx->mpm_uri_tot_patcnt += dp->sh->mpm_uri_ctx_ts->pattern_cnt;
}
if (dp->sh->mpm_uri_ctx_tc != NULL) {
if (de_ctx->mpm_uri_max_patcnt < dp->sh->mpm_uri_ctx_tc->pattern_cnt)
de_ctx->mpm_uri_max_patcnt = dp->sh->mpm_uri_ctx_tc->pattern_cnt;
de_ctx->mpm_uri_tot_patcnt += dp->sh->mpm_uri_ctx_tc->pattern_cnt;
}
/* dbg */
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_tcp_ctx_ts) {
de_ctx->mpm_memory_size += dp->sh->mpm_proto_tcp_ctx_ts->memory_size;
}
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_tcp_ctx_tc) {
de_ctx->mpm_memory_size += dp->sh->mpm_proto_tcp_ctx_tc->memory_size;
}
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_udp_ctx_ts) {
de_ctx->mpm_memory_size += dp->sh->mpm_proto_udp_ctx_ts->memory_size;
}
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_udp_ctx_tc) {
de_ctx->mpm_memory_size += dp->sh->mpm_proto_udp_ctx_tc->memory_size;
}
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_other_ctx) {
de_ctx->mpm_memory_size += dp->sh->mpm_proto_other_ctx->memory_size;
}
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && dp->sh->mpm_uri_ctx_ts) {
de_ctx->mpm_memory_size += dp->sh->mpm_uri_ctx_ts->memory_size;
}
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && dp->sh->mpm_uri_ctx_tc) {
de_ctx->mpm_memory_size += dp->sh->mpm_uri_ctx_tc->memory_size;
}
SigGroupHeadDPortHashAdd(de_ctx, dp->sh);
SigGroupHeadStore(de_ctx, dp->sh);
de_ctx->gh_unique++;
} else {
SCLogDebug("dp %p dp->sh %p is a copy", dp, dp->sh);
SigGroupHeadFree(dp->sh);
dp->sh = lookup_dp_sgh;
dp->flags |= PORT_SIGGROUPHEAD_COPY;
dp->sh->flags |= SIG_GROUP_HEAD_REFERENCED;
de_ctx->gh_reuse++;
}
}
/* sig group head found in hash, free it and use the hashed one */
} else {
SigGroupHeadFree(sp->sh);
sp->sh = lookup_sp_sgh;
sp->flags |= PORT_SIGGROUPHEAD_COPY;
sp->sh->flags |= SIG_GROUP_HEAD_REFERENCED;
SCLogDebug("replacing sp->dst_ph %p with lookup_sp_sgh->init->port %p", sp->dst_ph, lookup_sp_sgh->init->port);
DetectPortCleanupList(sp->dst_ph);
sp->dst_ph = lookup_sp_sgh->init->port;
sp->flags |= PORT_GROUP_PORTS_COPY;
de_ctx->gh_reuse++;
}
}
} else {
SigGroupHeadFree(dst_gr->sh);
dst_gr->sh = lookup_sgh;
dst_gr->flags |= ADDRESS_SIGGROUPHEAD_COPY;
dst_gr->sh->flags |= SIG_GROUP_HEAD_REFERENCED;
SCLogDebug("replacing dst_gr->port %p with lookup_sgh->init->port %p", dst_gr->port, lookup_sgh->init->port);
DetectPortCleanupList(dst_gr->port);
dst_gr->port = lookup_sgh->init->port;
dst_gr->flags |= ADDRESS_PORTS_COPY;
de_ctx->gh_reuse++;
}
}
/* free the temp list */
DetectAddressCleanupList(tmp_gr_list);
/* clear now unneeded sig group head */
SigGroupHeadFree(src_gr->sh);
src_gr->sh = NULL;
/* free dst addr sgh's */
dst_gr_head = GetHeadPtr(src_gr->dst_gh,family);
for (dst_gr = dst_gr_head; dst_gr != NULL; dst_gr = dst_gr->next) {
if (!(dst_gr->flags & ADDRESS_SIGGROUPHEAD_COPY)) {
if (!(dst_gr->sh->flags & SIG_GROUP_HEAD_REFERENCED)) {
SCLogDebug("removing sgh %p from hash", dst_gr->sh);
int r = SigGroupHeadHashRemove(de_ctx,dst_gr->sh);
BUG_ON(r == -1);
if (r == 0) {
SCLogDebug("removed sgh %p from hash", dst_gr->sh);
SigGroupHeadFree(dst_gr->sh);
dst_gr->sh = NULL;
}
}
}
}
}
return 0;
error:
return -1;
}
static void DetectEngineBuildDecoderEventSgh(DetectEngineCtx *de_ctx) {
if (de_ctx->decoder_event_sgh == NULL)
return;
uint32_t max_idx = DetectEngineGetMaxSigId(de_ctx);
SigGroupHeadSetSigCnt(de_ctx->decoder_event_sgh, max_idx);
SigGroupHeadBuildMatchArray(de_ctx, de_ctx->decoder_event_sgh, max_idx);
}
int SigAddressPrepareStage3(DetectEngineCtx *de_ctx) {
int r;
if (!(de_ctx->flags & DE_QUIET)) {
SCLogDebug("building signature grouping structure, stage 3: "
"building destination address lists...");
}
//DetectAddressPrintMemory();
//DetectSigGroupPrintMemory();
//DetectPortPrintMemory();
int f = 0;
int proto;
for (f = 0; f < FLOW_STATES; f++) {
r = BuildDestinationAddressHeadsWithBothPorts(de_ctx, de_ctx->flow_gh[f].src_gh[IPPROTO_TCP],AF_INET,f);
if (r < 0) {
printf ("BuildDestinationAddressHeads(src_gh[6],AF_INET) failed\n");
goto error;
}
r = BuildDestinationAddressHeadsWithBothPorts(de_ctx, de_ctx->flow_gh[f].src_gh[IPPROTO_UDP],AF_INET,f);
if (r < 0) {
printf ("BuildDestinationAddressHeads(src_gh[17],AF_INET) failed\n");
goto error;
}
r = BuildDestinationAddressHeadsWithBothPorts(de_ctx, de_ctx->flow_gh[f].src_gh[IPPROTO_SCTP],AF_INET,f);
if (r < 0) {
printf ("BuildDestinationAddressHeads(src_gh[IPPROTO_SCTP],AF_INET) failed\n");
goto error;
}
r = BuildDestinationAddressHeadsWithBothPorts(de_ctx, de_ctx->flow_gh[f].src_gh[IPPROTO_TCP],AF_INET6,f);
if (r < 0) {
printf ("BuildDestinationAddressHeads(src_gh[6],AF_INET) failed\n");
goto error;
}
r = BuildDestinationAddressHeadsWithBothPorts(de_ctx, de_ctx->flow_gh[f].src_gh[IPPROTO_UDP],AF_INET6,f);
if (r < 0) {
printf ("BuildDestinationAddressHeads(src_gh[17],AF_INET) failed\n");
goto error;
}
r = BuildDestinationAddressHeadsWithBothPorts(de_ctx, de_ctx->flow_gh[f].src_gh[IPPROTO_SCTP],AF_INET6,f);
if (r < 0) {
printf ("BuildDestinationAddressHeads(src_gh[IPPROTO_SCTP],AF_INET) failed\n");
goto error;
}
r = BuildDestinationAddressHeadsWithBothPorts(de_ctx, de_ctx->flow_gh[f].src_gh[IPPROTO_TCP],AF_UNSPEC,f);
if (r < 0) {
printf ("BuildDestinationAddressHeads(src_gh[6],AF_INET) failed\n");
goto error;
}
r = BuildDestinationAddressHeadsWithBothPorts(de_ctx, de_ctx->flow_gh[f].src_gh[IPPROTO_UDP],AF_UNSPEC,f);
if (r < 0) {
printf ("BuildDestinationAddressHeads(src_gh[17],AF_INET) failed\n");
goto error;
}
r = BuildDestinationAddressHeadsWithBothPorts(de_ctx, de_ctx->flow_gh[f].src_gh[IPPROTO_SCTP],AF_UNSPEC,f);
if (r < 0) {
printf ("BuildDestinationAddressHeads(src_gh[IPPROTO_SCTP],AF_INET) failed\n");
goto error;
}
for (proto = 0; proto < 256; proto++) {
if (proto == IPPROTO_TCP || proto == IPPROTO_UDP || proto == IPPROTO_SCTP)
continue;
r = BuildDestinationAddressHeads(de_ctx, de_ctx->flow_gh[f].src_gh[proto],AF_INET,f);
if (r < 0) {
printf ("BuildDestinationAddressHeads(src_gh[%" PRId32 "],AF_INET) failed\n", proto);
goto error;
}
r = BuildDestinationAddressHeads(de_ctx, de_ctx->flow_gh[f].src_gh[proto],AF_INET6,f);
if (r < 0) {
printf ("BuildDestinationAddressHeads(src_gh[%" PRId32 "],AF_INET6) failed\n", proto);
goto error;
}
r = BuildDestinationAddressHeads(de_ctx, de_ctx->flow_gh[f].src_gh[proto],AF_UNSPEC,f); /* for any */
if (r < 0) {
printf ("BuildDestinationAddressHeads(src_gh[%" PRId32 "],AF_UNSPEC) failed\n", proto);
goto error;
}
}
}
/* prepare the decoder event sgh */
DetectEngineBuildDecoderEventSgh(de_ctx);
/* cleanup group head (uri)content_array's */
SigGroupHeadFreeMpmArrays(de_ctx);
/* cleanup group head sig arrays */
SigGroupHeadFreeSigArrays(de_ctx);
/* cleanup the hashes now since we won't need them
* after the initialization phase. */
SigGroupHeadHashFree(de_ctx);
SigGroupHeadDPortHashFree(de_ctx);
SigGroupHeadSPortHashFree(de_ctx);
SigGroupHeadMpmHashFree(de_ctx);
SigGroupHeadMpmUriHashFree(de_ctx);
DetectPortDpHashFree(de_ctx);
DetectPortSpHashFree(de_ctx);
if (!(de_ctx->flags & DE_QUIET)) {
SCLogDebug("MPM memory %" PRIuMAX " (dynamic %" PRIu32 ", ctxs %" PRIuMAX ", avg per ctx %" PRIu32 ")",
de_ctx->mpm_memory_size + ((de_ctx->mpm_unique + de_ctx->mpm_uri_unique) * (uintmax_t)sizeof(MpmCtx)),
de_ctx->mpm_memory_size, ((de_ctx->mpm_unique + de_ctx->mpm_uri_unique) * (uintmax_t)sizeof(MpmCtx)),
de_ctx->mpm_unique ? de_ctx->mpm_memory_size / de_ctx->mpm_unique: 0);
SCLogDebug("max sig id %" PRIu32 ", array size %" PRIu32 "", DetectEngineGetMaxSigId(de_ctx), DetectEngineGetMaxSigId(de_ctx) / 8 + 1);
SCLogDebug("signature group heads: unique %" PRIu32 ", copies %" PRIu32 ".", de_ctx->gh_unique, de_ctx->gh_reuse);
SCLogDebug("MPM instances: %" PRIu32 " unique, copies %" PRIu32 " (none %" PRIu32 ").",
de_ctx->mpm_unique, de_ctx->mpm_reuse, de_ctx->mpm_none);
SCLogDebug("MPM (URI) instances: %" PRIu32 " unique, copies %" PRIu32 " (none %" PRIu32 ").",
de_ctx->mpm_uri_unique, de_ctx->mpm_uri_reuse, de_ctx->mpm_uri_none);
SCLogDebug("MPM max patcnt %" PRIu32 ", avg %" PRIu32 "", de_ctx->mpm_max_patcnt, de_ctx->mpm_unique?de_ctx->mpm_tot_patcnt/de_ctx->mpm_unique:0);
if (de_ctx->mpm_uri_tot_patcnt && de_ctx->mpm_uri_unique)
SCLogDebug("MPM (URI) max patcnt %" PRIu32 ", avg %" PRIu32 " (%" PRIu32 "/%" PRIu32 ")", de_ctx->mpm_uri_max_patcnt, de_ctx->mpm_uri_tot_patcnt/de_ctx->mpm_uri_unique, de_ctx->mpm_uri_tot_patcnt, de_ctx->mpm_uri_unique);
SCLogDebug("port maxgroups: %" PRIu32 ", avg %" PRIu32 ", tot %" PRIu32 "", g_groupportlist_maxgroups, g_groupportlist_groupscnt ? g_groupportlist_totgroups/g_groupportlist_groupscnt : 0, g_groupportlist_totgroups);
SCLogInfo("building signature grouping structure, stage 3: building destination address lists... complete");
}
return 0;
error:
printf("SigAddressPrepareStage3 error\n");
return -1;
}
int SigAddressCleanupStage1(DetectEngineCtx *de_ctx) {
BUG_ON(de_ctx == NULL);
if (!(de_ctx->flags & DE_QUIET)) {
SCLogDebug("cleaning up signature grouping structure...");
}
int f, proto;
for (f = 0; f < FLOW_STATES; f++) {
for (proto = 0; proto < 256; proto++) {
/* XXX fix this */
DetectAddressHeadFree(de_ctx->flow_gh[f].src_gh[proto]);
de_ctx->flow_gh[f].src_gh[proto] = NULL;
}
}
IPOnlyDeinit(de_ctx, &de_ctx->io_ctx);
if (!(de_ctx->flags & DE_QUIET)) {
SCLogInfo("cleaning up signature grouping structure... complete");
}
return 0;
}
void DbgPrintSigs(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
if (sgh == NULL) {
printf("\n");
return;
}
uint32_t sig;
for (sig = 0; sig < sgh->sig_cnt; sig++) {
printf("%" PRIu32 " ", sgh->match_array[sig]->id);
}
printf("\n");
}
void DbgPrintSigs2(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
if (sgh == NULL || sgh->init == NULL) {
printf("\n");
return;
}
uint32_t sig;
for (sig = 0; sig < DetectEngineGetMaxSigId(de_ctx); sig++) {
if (sgh->init->sig_array[(sig/8)] & (1<<(sig%8))) {
printf("%" PRIu32 " ", de_ctx->sig_array[sig]->id);
}
}
printf("\n");
}
void DbgSghContainsSig(DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t sid) {
if (sgh == NULL || sgh->init == NULL) {
printf("\n");
return;
}
uint32_t sig;
for (sig = 0; sig < DetectEngineGetMaxSigId(de_ctx); sig++) {
if (!(sgh->init->sig_array[(sig/8)] & (1<<(sig%8))))
continue;
Signature *s = de_ctx->sig_array[sig];
if (s == NULL)
continue;
if (sid == s->id) {
printf("%" PRIu32 " ", de_ctx->sig_array[sig]->id);
}
}
printf("\n");
}
/** \brief finalize preparing sgh's */
int SigAddressPrepareStage4(DetectEngineCtx *de_ctx) {
SCEnter();
//SCLogInfo("sgh's %"PRIu32, de_ctx->sgh_array_cnt);
uint32_t idx = 0;
for (idx = 0; idx < de_ctx->sgh_array_cnt; idx++) {
SigGroupHead *sgh = de_ctx->sgh_array[idx];
if (sgh == NULL)
continue;
SigGroupHeadBuildHeadArray(de_ctx, sgh);
SigGroupHeadSetFilemagicFlag(de_ctx, sgh);
SigGroupHeadSetFilestoreCount(de_ctx, sgh);
SCLogDebug("filestore count %u", sgh->filestore_cnt);
}
if (de_ctx->decoder_event_sgh != NULL) {
SigGroupHeadBuildHeadArray(de_ctx, de_ctx->decoder_event_sgh);
/* no need to set filestore count here as that would make a
* signature not decode event only. */
}
SCFree(de_ctx->sgh_array);
de_ctx->sgh_array_cnt = 0;
de_ctx->sgh_array_size = 0;
SCReturnInt(0);
}
/* shortcut for debugging. If enabled Stage5 will
* print sigid's for all groups */
#define PRINTSIGS
/* just printing */
int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
DetectAddressHead *global_dst_gh = NULL;
DetectAddress *global_src_gr = NULL, *global_dst_gr = NULL;
uint32_t u;
printf("* Building signature grouping structure, stage 5: print...\n");
int f, proto;
printf("\n");
for (f = 0; f < FLOW_STATES; f++) {
printf("\n");
for (proto = 0; proto < 256; proto++) {
if (proto != IPPROTO_TCP)
continue;
for (global_src_gr = de_ctx->flow_gh[f].src_gh[proto]->ipv4_head; global_src_gr != NULL;
global_src_gr = global_src_gr->next)
{
printf("1 Src Addr: "); DetectAddressPrint(global_src_gr);
printf(" (sh %p)\n", global_src_gr->sh);
//printf("\n");
#ifdef PRINTSIGS
SigGroupHeadPrintSigs(de_ctx, global_src_gr->sh);
if (global_src_gr->sh != NULL) {
printf(" - ");
for (u = 0; u < global_src_gr->sh->sig_cnt; u++) {
Signature *s = global_src_gr->sh->match_array[u];
printf("%" PRIu32 " ", s->id);
}
printf("\n");
}
#endif
global_dst_gh = global_src_gr->dst_gh;
if (global_dst_gh == NULL)
continue;
for (global_dst_gr = global_dst_gh->ipv4_head;
global_dst_gr != NULL;
global_dst_gr = global_dst_gr->next)
{
printf(" 2 Dst Addr: "); DetectAddressPrint(global_dst_gr);
//printf(" (sh %p) ", global_dst_gr->sh);
if (global_dst_gr->sh) {
if (global_dst_gr->sh->flags & ADDRESS_SIGGROUPHEAD_COPY) {
printf(" (COPY): ");
} else {
printf(" (ORIGINAL): ");
}
} else {
printf(" ");
}
#ifdef PRINTSIGS
if (global_dst_gr->sh != NULL) {
printf(" - ");
for (u = 0; u < global_dst_gr->sh->sig_cnt; u++) {
Signature *s = global_dst_gr->sh->match_array[u];
printf("%" PRIu32 " ", s->id);
}
printf("\n");
}
#endif
DetectPort *sp = global_dst_gr->port;
for ( ; sp != NULL; sp = sp->next) {
printf(" 3 Src port(range): "); DetectPortPrint(sp);
//printf(" (sh %p)", sp->sh);
printf("\n");
DetectPort *dp = sp->dst_ph;
for ( ; dp != NULL; dp = dp->next) {
printf(" 4 Dst port(range): "); DetectPortPrint(dp);
printf(" (sigs %" PRIu32 ", sgh %p, maxlen %" PRIu32 ")", dp->sh->sig_cnt, dp->sh, dp->sh->mpm_content_maxlen);
#ifdef PRINTSIGS
printf(" - ");
for (u = 0; u < dp->sh->sig_cnt; u++) {
Signature *s = dp->sh->match_array[u];
printf("%" PRIu32 " ", s->id);
}
#endif
printf("\n");
}
}
}
for (global_dst_gr = global_dst_gh->any_head;
global_dst_gr != NULL;
global_dst_gr = global_dst_gr->next)
{
printf(" - "); DetectAddressPrint(global_dst_gr);
//printf(" (sh %p) ", global_dst_gr->sh);
if (global_dst_gr->sh) {
if (global_dst_gr->sh->flags & ADDRESS_SIGGROUPHEAD_COPY) {
printf("(COPY)\n");
} else {
printf("\n");
}
}
DetectPort *sp = global_dst_gr->port;
for ( ; sp != NULL; sp = sp->next) {
printf(" * Src port(range): "); DetectPortPrint(sp); printf("\n");
DetectPort *dp = sp->dst_ph;
for ( ; dp != NULL; dp = dp->next) {
printf(" * Dst port(range): "); DetectPortPrint(dp);
printf(" (sigs %" PRIu32 ")", dp->sh->sig_cnt);
#ifdef PRINTSIGS
printf(" - ");
for (u = 0; u < dp->sh->sig_cnt; u++) {
Signature *s = dp->sh->match_array[u];
printf("%" PRIu32 " ", s->id);
}
#endif
printf("\n");
}
}
}
}
#if 0
for (global_src_gr = de_ctx->flow_gh[f].src_gh[proto]->ipv6_head; global_src_gr != NULL;
global_src_gr = global_src_gr->next)
{
printf("- "); DetectAddressPrint(global_src_gr);
//printf(" (sh %p)\n", global_src_gr->sh);
global_dst_gh = global_src_gr->dst_gh;
if (global_dst_gh == NULL)
continue;
for (global_dst_gr = global_dst_gh->ipv6_head;
global_dst_gr != NULL;
global_dst_gr = global_dst_gr->next)
{
printf(" - "); DetectAddressPrint(global_dst_gr);
//printf(" (sh %p) ", global_dst_gr->sh);
if (global_dst_gr->sh) {
if (global_dst_gr->sh->flags & ADDRESS_SIGGROUPHEAD_COPY) {
printf("(COPY)\n");
} else {
printf("\n");
}
}
DetectPort *sp = global_dst_gr->port;
for ( ; sp != NULL; sp = sp->next) {
printf(" * Src port(range): "); DetectPortPrint(sp); printf("\n");
DetectPort *dp = sp->dst_ph;
for ( ; dp != NULL; dp = dp->next) {
printf(" * Dst port(range): "); DetectPortPrint(dp);
printf(" (sigs %" PRIu32 ")", dp->sh->sig_cnt);
#ifdef PRINTSIGS
printf(" - ");
for (u = 0; u < dp->sh->sig_cnt; u++) {
Signature *s = de_ctx->sig_array[dp->sh->match_array[u]];
printf("%" PRIu32 " ", s->id);
}
#endif
printf("\n");
}
}
}
for (global_dst_gr = global_dst_gh->any_head;
global_dst_gr != NULL;
global_dst_gr = global_dst_gr->next)
{
printf(" - "); DetectAddressPrint(global_dst_gr);
//printf(" (sh %p) ", global_dst_gr->sh);
if (global_dst_gr->sh) {
if (global_dst_gr->sh->flags & ADDRESS_SIGGROUPHEAD_COPY) {
printf("(COPY)\n");
} else {
printf("\n");
}
}
DetectPort *sp = global_dst_gr->port;
for ( ; sp != NULL; sp = sp->next) {
printf(" * Src port(range): "); DetectPortPrint(sp); printf("\n");
DetectPort *dp = sp->dst_ph;
for ( ; dp != NULL; dp = dp->next) {
printf(" * Dst port(range): "); DetectPortPrint(dp);
printf(" (sigs %" PRIu32 ")", dp->sh->sig_cnt);
#ifdef PRINTSIGS
printf(" - ");
for (u = 0; u < dp->sh->sig_cnt; u++) {
Signature *s = de_ctx->sig_array[dp->sh->match_array[u]];
printf("%" PRIu32 " ", s->id);
}
#endif
printf("\n");
}
}
}
}
for (global_src_gr = de_ctx->flow_gh[f].src_gh[proto]->any_head; global_src_gr != NULL;
global_src_gr = global_src_gr->next)
{
printf("- "); DetectAddressPrint(global_src_gr);
//printf(" (sh %p)\n", global_src_gr->sh);
global_dst_gh = global_src_gr->dst_gh;
if (global_dst_gh == NULL)
continue;
for (global_dst_gr = global_dst_gh->any_head;
global_dst_gr != NULL;
global_dst_gr = global_dst_gr->next)
{
printf(" - "); DetectAddressPrint(global_dst_gr);
//printf(" (sh %p) ", global_dst_gr->sh);
if (global_dst_gr->sh) {
if (global_dst_gr->sh->flags & ADDRESS_SIGGROUPHEAD_COPY) {
printf("(COPY)\n");
} else {
printf("\n");
}
}
DetectPort *sp = global_dst_gr->port;
for ( ; sp != NULL; sp = sp->next) {
printf(" * Src port(range): "); DetectPortPrint(sp); printf("\n");
DetectPort *dp = sp->dst_ph;
for ( ; dp != NULL; dp = dp->next) {
printf(" * Dst port(range): "); DetectPortPrint(dp);
printf(" (sigs %" PRIu32 ")", dp->sh->sig_cnt);
#ifdef PRINTSIGS
printf(" - ");
for (u = 0; u < dp->sh->sig_cnt; u++) {
Signature *s = de_ctx->sig_array[dp->sh->match_array[u]];
printf("%" PRIu32 " ", s->id);
}
#endif
printf("\n");
}
}
}
for (global_dst_gr = global_dst_gh->ipv4_head;
global_dst_gr != NULL;
global_dst_gr = global_dst_gr->next)
{
printf(" - "); DetectAddressPrint(global_dst_gr);
//printf(" (sh %p) ", global_dst_gr->sh);
if (global_dst_gr->sh) {
if (global_dst_gr->sh->flags & ADDRESS_SIGGROUPHEAD_COPY) {
printf("(COPY)\n");
} else {
printf("\n");
}
}
DetectPort *sp = global_dst_gr->port;
for ( ; sp != NULL; sp = sp->next) {
printf(" * Src port(range): "); DetectPortPrint(sp); printf("\n");
DetectPort *dp = sp->dst_ph;
for ( ; dp != NULL; dp = dp->next) {
printf(" * Dst port(range): "); DetectPortPrint(dp);
printf(" (sigs %" PRIu32 ")", dp->sh->sig_cnt);
#ifdef PRINTSIGS
printf(" - ");
for (u = 0; u < dp->sh->sig_cnt; u++) {
Signature *s = de_ctx->sig_array[dp->sh->match_array[u]];
printf("%" PRIu32 " ", s->id);
}
#endif
printf("\n");
}
}
}
for (global_dst_gr = global_dst_gh->ipv6_head;
global_dst_gr != NULL;
global_dst_gr = global_dst_gr->next)
{
printf(" - "); DetectAddressPrint(global_dst_gr);
//printf(" (sh %p) ", global_dst_gr->sh);
if (global_dst_gr->sh) {
if (global_dst_gr->sh->flags & ADDRESS_SIGGROUPHEAD_COPY) {
printf("(COPY)\n");
} else {
printf("\n");
}
}
DetectPort *sp = global_dst_gr->port;
for ( ; sp != NULL; sp = sp->next) {
printf(" * Src port(range): "); DetectPortPrint(sp); printf("\n");
DetectPort *dp = sp->dst_ph;
for ( ; dp != NULL; dp = dp->next) {
printf(" * Dst port(range): "); DetectPortPrint(dp);
printf(" (sigs %" PRIu32 ")", dp->sh->sig_cnt);
#ifdef PRINTSIGS
printf(" - ");
for (u = 0; u < dp->sh->sig_cnt; u++) {
Signature *s = de_ctx->sig_array[dp->sh->match_array[u]];
printf("%" PRIu32 " ", s->id);
}
#endif
printf("\n");
}
}
}
}
#endif
}
}
printf("* Building signature grouping structure, stage 5: print... done\n");
return 0;
}
/**
* \brief Convert the signature list into the runtime match structure.
*
* \param de_ctx Pointer to the Detection Engine Context whose Signatures have
* to be processed
*
* \retval 0 Always
*/
int SigGroupBuild (DetectEngineCtx *de_ctx) {
/* if we are using single sgh_mpm_context then let us init the standard mpm
* contexts using the mpm_ctx factory */
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) {
SigInitStandardMpmFactoryContexts(de_ctx);
}
if (SigAddressPrepareStage1(de_ctx) != 0) {
SCLogError(SC_ERR_DETECT_PREPARE, "initializing the detection engine failed");
exit(EXIT_FAILURE);
}
if (SigAddressPrepareStage2(de_ctx) != 0) {
SCLogError(SC_ERR_DETECT_PREPARE, "initializing the detection engine failed");
exit(EXIT_FAILURE);
}
#ifdef __SC_CUDA_SUPPORT__
unsigned int cuda_total = 0;
unsigned int cuda_free_before_alloc = 0;
/* we register a module that would require cuda handler service. This
* module would hold the context for all the patterns in the rules */
de_ctx->cuda_rc_mod_handle = SCCudaHlRegisterModule("SC_RULES_CONTENT_B2G_CUDA");
if (de_ctx->mpm_matcher == MPM_B2G_CUDA) {
CUcontext dummy_context;
if (SCCudaHlGetCudaContext(&dummy_context, "mpm",
de_ctx->cuda_rc_mod_handle) == -1) {
SCLogError(SC_ERR_B2G_CUDA_ERROR, "Error getting a cuda context for the "
"module SC_RULES_CONTENT_B2G_CUDA");
}
SCCudaCtxPushCurrent(dummy_context);
if (SCCudaMemGetInfo(&cuda_free_before_alloc, &cuda_total) == 0) {
SCLogInfo("Total Memory available in the CUDA context used for mpm "
"with b2g: %.2f MB", cuda_total/(1024.0 * 1024.0));
SCLogInfo("Free Memory available in the CUDA context used for b2g "
"mpm before any allocation is made on the GPU for the "
"context: %.2f MB", cuda_free_before_alloc/(1024.0 * 1024.0));
}
}
#endif
if (SigAddressPrepareStage3(de_ctx) != 0) {
SCLogError(SC_ERR_DETECT_PREPARE, "initializing the detection engine failed");
exit(EXIT_FAILURE);
}
if (SigAddressPrepareStage4(de_ctx) != 0) {
SCLogError(SC_ERR_DETECT_PREPARE, "initializing the detection engine failed");
exit(EXIT_FAILURE);
}
#ifdef __SC_CUDA_SUPPORT__
unsigned int cuda_free_after_alloc = 0;
/* if a user has selected some other mpm algo other than b2g_cuda, inspite of
* enabling cuda support, then no cuda contexts or cuda vars would be created.
* Pop the cuda context, only on confirming that the MPM algo selected is the
* CUDA mpm algo */
if (de_ctx->mpm_matcher == MPM_B2G_CUDA) {
if (SCCudaMemGetInfo(&cuda_free_after_alloc, &cuda_total) == 0) {
SCLogInfo("Free Memory available in the CUDA context used for b2g mpm "
"after allocation is made on the GPU for the context: %.2f MB",
cuda_free_after_alloc/(1024.0 * 1024.0));
SCLogInfo("Total memory consumed by the CUDA context for the b2g mpm: "
"%.2f MB", (cuda_free_before_alloc/(1024.0 * 1024.0)) -
(cuda_free_after_alloc/(1024.0 * 1024.0)));
}
/* the AddressPrepareStage3 actually handles the creation of device
* pointers on the gpu. The cuda context that stage3 used would still be
* attached to this host thread. We need to pop this cuda context so that
* the dispatcher thread that we are going to create for the above module
* we registered can attach to this cuda context */
CUcontext context;
if (SCCudaCtxPopCurrent(&context) == -1)
exit(EXIT_FAILURE);
}
#endif
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) {
MpmCtx *mpm_ctx = NULL;
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_tcp_packet, 0);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_tcp_packet, 1);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("packet- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_udp_packet, 0);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_udp_packet, 1);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("packet- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_other_packet, 0);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("packet- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_uri, 0);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_uri, 1);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("uri- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcbd, 0);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcbd, 1);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("hcbd- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hhd, 0);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hhd, 1);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("hhd- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrhd, 0);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrhd, 1);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("hrhd- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hmd, 0);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hmd, 1);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("hmd- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcd, 0);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcd, 1);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("hcd- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrud, 0);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrud, 1);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("hrud- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_stream, 0);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_stream, 1);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("stream- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hsmd, 0);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("hsmd- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hsmd, 1);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("hsmd- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hscd, 0);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("hscd- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hscd, 1);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("hscd- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_huad, 0);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("huad- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_huad, 1);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("huad- %d\n", mpm_ctx->pattern_cnt);
}
// SigAddressPrepareStage5(de_ctx);
// DetectAddressPrintMemory();
// DetectSigGroupPrintMemory();
// DetectPortPrintMemory();
return 0;
}
int SigGroupCleanup (DetectEngineCtx *de_ctx) {
SigAddressCleanupStage1(de_ctx);
return 0;
}
void SigTableList(void)
{
size_t size = sizeof(sigmatch_table) / sizeof(SigTableElmt);
size_t i;
printf("=====Supported keywords=====\n");
for (i = 0; i < size; i++) {
if (sigmatch_table[i].name != NULL)
printf("- %s\n", sigmatch_table[i].name);
}
return;
}
void SigTableSetup(void) {
memset(sigmatch_table, 0, sizeof(sigmatch_table));
DetectSidRegister();
DetectPriorityRegister();
DetectRevRegister();
DetectClasstypeRegister();
DetectReferenceRegister();
DetectTagRegister();
DetectThresholdRegister();
DetectMetadataRegister();
DetectMsgRegister();
DetectAckRegister();
DetectSeqRegister();
DetectContentRegister();
DetectUricontentRegister();
DetectPcreRegister();
DetectDepthRegister();
DetectNocaseRegister();
DetectRawbytesRegister();
DetectBytetestRegister();
DetectBytejumpRegister();
DetectSameipRegister();
DetectIPProtoRegister();
DetectWithinRegister();
DetectDistanceRegister();
DetectOffsetRegister();
DetectReplaceRegister();
DetectFlowRegister();
DetectWindowRegister();
DetectRpcRegister();
DetectFtpbounceRegister();
DetectIsdataatRegister();
DetectIdRegister();
DetectDsizeRegister();
DetectFlowvarRegister();
DetectFlowintRegister();
DetectPktvarRegister();
DetectNoalertRegister();
DetectFlowbitsRegister();
DetectEngineEventRegister();
DetectIpOptsRegister();
DetectFlagsRegister();
DetectFragBitsRegister();
DetectFragOffsetRegister();
DetectGidRegister();
DetectMarkRegister();
DetectCsumRegister();
DetectStreamSizeRegister();
DetectTtlRegister();
DetectTosRegister();
DetectFastPatternRegister();
DetectITypeRegister();
DetectICodeRegister();
DetectIcmpIdRegister();
DetectIcmpSeqRegister();
DetectDceIfaceRegister();
DetectDceOpnumRegister();
DetectDceStubDataRegister();
DetectHttpCookieRegister();
DetectHttpMethodRegister();
DetectHttpStatMsgRegister();
DetectTlsRegister();
DetectTlsVersionRegister();
DetectUrilenRegister();
DetectDetectionFilterRegister();
DetectHttpHeaderRegister();
DetectHttpRawHeaderRegister();
DetectHttpClientBodyRegister();
DetectHttpServerBodyRegister();
DetectHttpUriRegister();
DetectHttpRawUriRegister();
DetectAsn1Register();
DetectSshVersionRegister();
DetectSslStateRegister();
DetectSshSoftwareVersionRegister();
DetectHttpStatCodeRegister();
DetectSslVersionRegister();
DetectByteExtractRegister();
DetectFiledataRegister();
DetectFilenameRegister();
DetectFileextRegister();
DetectFilestoreRegister();
DetectFilemagicRegister();
DetectFileMd5Register();
DetectAppLayerEventRegister();
DetectHttpUARegister();
uint8_t i = 0;
for (i = 0; i < DETECT_TBLSIZE; i++) {
if (sigmatch_table[i].RegisterTests == NULL) {
SCLogDebug("detection plugin %s has no unittest "
"registration function.", sigmatch_table[i].name);
}
}
}
void SigTableRegisterTests(void) {
/* register the tests */
uint8_t i = 0;
for (i = 0; i < DETECT_TBLSIZE; i++) {
if (sigmatch_table[i].RegisterTests != NULL) {
sigmatch_table[i].RegisterTests();
}
}
}
/*
* TESTS
*/
#ifdef UNITTESTS
#include "flow-util.h"
#include "stream-tcp-reassemble.h"
#include "util-var-name.h"
static const char *dummy_conf_string =
"%YAML 1.1\n"
"---\n"
"\n"
"default-log-dir: /var/log/suricata\n"
"\n"
"logging:\n"
"\n"
" default-log-level: debug\n"
"\n"
" default-format: \"<%t> - <%l>\"\n"
"\n"
" default-startup-message: Your IDS has started.\n"
"\n"
" default-output-filter:\n"
"\n"
" output:\n"
"\n"
" - interface: console\n"
" log-level: info\n"
"\n"
" - interface: file\n"
" filename: /var/log/suricata.log\n"
"\n"
" - interface: syslog\n"
" facility: local5\n"
" format: \"%l\"\n"
"\n"
"pfring:\n"
"\n"
" interface: eth0\n"
"\n"
" clusterid: 99\n"
"\n"
"vars:\n"
"\n"
" address-groups:\n"
"\n"
" HOME_NET: \"[192.168.0.0/16,10.8.0.0/16,127.0.0.1,2001:888:"
"13c5:5AFE::/64,2001:888:13c5:CAFE::/64]\"\n"
"\n"
" EXTERNAL_NET: \"[!192.168.0.0/16,2000::/3]\"\n"
"\n"
" HTTP_SERVERS: \"!192.168.0.0/16\"\n"
"\n"
" SMTP_SERVERS: \"!192.168.0.0/16\"\n"
"\n"
" SQL_SERVERS: \"!192.168.0.0/16\"\n"
"\n"
" DNS_SERVERS: any\n"
"\n"
" TELNET_SERVERS: any\n"
"\n"
" AIM_SERVERS: any\n"
"\n"
" port-groups:\n"
"\n"
" HTTP_PORTS: \"80:81,88\"\n"
"\n"
" SHELLCODE_PORTS: 80\n"
"\n"
" ORACLE_PORTS: 1521\n"
"\n"
" SSH_PORTS: 22\n"
"\n";
static int SigTest01Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.1\r\n"
"Host: one.example.org\r\n"
"\r\n\r\n"
"GET /two/ HTTP/1.1\r\n"
"Host: two.example.org\r\n"
"\r\n\r\n";
uint16_t buflen = strlen((char *)buf);
Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP);
int result = 0;
char sig[] = "alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P<pkt_http_uri>.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:1;)";
if (UTHPacketMatchSigMpm(p, sig, mpm_type) == 0) {
result = 0;
goto end;
}
#if 0
//printf("URI0 \"%s\", len %" PRIu32 "\n", p.http_uri.raw[0], p.http_uri.raw_size[0]);
//printf("URI1 \"%s\", len %" PRIu32 "\n", p.http_uri.raw[1], p.http_uri.raw_size[1]);
if (p->http_uri.raw_size[0] == 5 &&
memcmp(p->http_uri.raw[0], "/one/", 5) == 0 &&
p->http_uri.raw_size[1] == 5 &&
memcmp(p->http_uri.raw[1], "/two/", 5) == 0)
{
result = 1;
}
#endif
result = 1;
end:
if (p != NULL)
UTHFreePacket(p);
return result;
}
static int SigTest01B2g (void) {
return SigTest01Real(MPM_B2G);
}
static int SigTest01B3g (void) {
return SigTest01Real(MPM_B3G);
}
static int SigTest01Wm (void) {
return SigTest01Real(MPM_WUMANBER);
}
static int SigTest02Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.1\r\n"
"Host: one.example.org\r\n"
"\r\n\r\n"
"GET /two/ HTTP/1.1\r\n"
"Host: two.example.org\r\n"
"\r\n\r\n";
uint16_t buflen = strlen((char *)buf);
Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP);
char sig[] = "alert tcp any any -> any any (msg:\"HTTP TEST\"; content:\"Host: one.example.org\"; offset:20; depth:41; sid:1;)";
int ret = UTHPacketMatchSigMpm(p, sig, mpm_type);
UTHFreePacket(p);
return ret;
}
static int SigTest02B2g (void) {
return SigTest02Real(MPM_B2G);
}
static int SigTest02B3g (void) {
return SigTest02Real(MPM_B3G);
}
static int SigTest02Wm (void) {
return SigTest02Real(MPM_WUMANBER);
}
static int SigTest03Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.1\r\n"
"Host: one.example.org\r\n"
"\r\n\r\n"
"GET /two/ HTTP/1.1\r\n"
"Host: two.example.org\r\n"
"\r\n\r\n";
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP TEST\"; content:\"Host: one.example.org\"; offset:20; depth:39; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
//PatternMatchPrepare(mpm_ctx, mpm_type);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1))
result = 1;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
//PatternMatchDestroy(mpm_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
return result;
}
static int SigTest03B2g (void) {
return SigTest03Real(MPM_B2G);
}
static int SigTest03B3g (void) {
return SigTest03Real(MPM_B3G);
}
static int SigTest03Wm (void) {
return SigTest03Real(MPM_WUMANBER);
}
static int SigTest04Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.1\r\n" /* 20*/
"Host: one.example.org\r\n" /* 23, post "Host:" 18 */
"\r\n\r\n" /* 4 */
"GET /two/ HTTP/1.1\r\n" /* 20 */
"Host: two.example.org\r\n" /* 23 */
"\r\n\r\n"; /* 4 */
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP TEST\"; content:\"Host:\"; offset:20; depth:25; content:\"Host:\"; distance:42; within:47; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1))
result = 1;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
return result;
}
static int SigTest04B2g (void) {
return SigTest04Real(MPM_B2G);
}
static int SigTest04B3g (void) {
return SigTest04Real(MPM_B3G);
}
static int SigTest04Wm (void) {
return SigTest04Real(MPM_WUMANBER);
}
static int SigTest05Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.1\r\n" /* 20 */
"Host: one.example.org\r\n" /* 23, 43 */
"\r\n\r\n" /* 4, 47 */
"GET /two/ HTTP/1.1\r\n" /* 20, 67 */
"Host: two.example.org\r\n" /* 23, 90 */
"\r\n\r\n"; /* 4, 94 */
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP TEST\"; content:\"Host:\"; offset:20; depth:25; content:\"Host:\"; distance:48; within:52; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("sig parse failed: ");
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (!PacketAlertCheck(p, 1)) {
result = 1;
} else {
printf("sig matched but shouldn't have: ");
}
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
return result;
}
static int SigTest05B2g (void) {
return SigTest05Real(MPM_B2G);
}
static int SigTest05B3g (void) {
return SigTest05Real(MPM_B3G);
}
static int SigTest05Wm (void) {
return SigTest05Real(MPM_WUMANBER);
}
static int SigTest06Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.1\r\n" /* 20 */
"Host: one.example.org\r\n" /* 23, 43 */
"\r\n\r\n" /* 4, 47 */
"GET /two/ HTTP/1.1\r\n" /* 20, 67 */
"Host: two.example.org\r\n" /* 23, 90 */
"\r\n\r\n"; /* 4, 94 */
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
Flow f;
TcpSession ssn;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.flags |= FLOW_IPV4;
p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_ESTABLISHED;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
f.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P<pkt_http_uri>.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI test\"; uricontent:\"two\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, buf, buflen);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
result = 0;
goto end;
}
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1) && PacketAlertCheck(p, 2))
result = 1;
else
printf("sid:1 %s, sid:2 %s: ",
PacketAlertCheck(p, 1) ? "OK" : "FAIL",
PacketAlertCheck(p, 2) ? "OK" : "FAIL");
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
return result;
}
static int SigTest06B2g (void) {
return SigTest06Real(MPM_B2G);
}
static int SigTest06B3g (void) {
return SigTest06Real(MPM_B3G);
}
static int SigTest06Wm (void) {
return SigTest06Real(MPM_WUMANBER);
}
static int SigTest07Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.1\r\n" /* 20 */
"Host: one.example.org\r\n" /* 23, 43 */
"\r\n\r\n" /* 4, 47 */
"GET /two/ HTTP/1.1\r\n" /* 20, 67 */
"Host: two.example.org\r\n" /* 23, 90 */
"\r\n\r\n"; /* 4, 94 */
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
Flow f;
TcpSession ssn;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.flags |= FLOW_IPV4;
p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_ESTABLISHED;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
f.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P<pkt_http_uri>.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI test\"; uricontent:\"three\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, buf, buflen);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
result = 0;
goto end;
}
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1) && PacketAlertCheck(p, 2))
result = 0;
else
result = 1;
end:
UTHFreePackets(&p, 1);
StreamTcpFreeConfig(TRUE);
AppLayerParserCleanupState(&f);
FLOW_DESTROY(&f);
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
//PatternMatchDestroy(mpm_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
static int SigTest07B2g (void) {
return SigTest07Real(MPM_B2G);
}
static int SigTest07B3g (void) {
return SigTest07Real(MPM_B3G);
}
static int SigTest07Wm (void) {
return SigTest07Real(MPM_WUMANBER);
}
static int SigTest08Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.0\r\n" /* 20 */
"Host: one.example.org\r\n" /* 23, 43 */
"\r\n\r\n" /* 4, 47 */
"GET /two/ HTTP/1.0\r\n" /* 20, 67 */
"Host: two.example.org\r\n" /* 23, 90 */
"\r\n\r\n"; /* 4, 94 */
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
Flow f;
TcpSession ssn;
int result = 0;
memset(&f, 0, sizeof(Flow));
memset(&th_v, 0, sizeof(th_v));
memset(&ssn, 0, sizeof(ssn));
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.flags |= FLOW_IPV4;
p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_ESTABLISHED;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
f.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P<pkt_http_uri>.*) HTTP\\/1\\.0\\r\\n/G\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI test\"; uricontent:\"one\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, buf, buflen);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
result = 0;
goto end;
}
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if ( (PacketAlertCheck(p, 1) || FlowAlertSidIsset(&f, 1)) && PacketAlertCheck(p, 2))
result = 1;
else
printf("sid:1 %s, sid:2 %s: ",
PacketAlertCheck(p, 1) ? "OK" : "FAIL",
PacketAlertCheck(p, 2) ? "OK" : "FAIL");
AppLayerParserCleanupState(&f);
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
return result;
}
static int SigTest08B2g (void) {
return SigTest08Real(MPM_B2G);
}
static int SigTest08B3g (void) {
return SigTest08Real(MPM_B3G);
}
static int SigTest08Wm (void) {
return SigTest08Real(MPM_WUMANBER);
}
static int SigTest09Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.0\r\n" /* 20 */
"Host: one.example.org\r\n" /* 23, 43 */
"\r\n\r\n" /* 4, 47 */
"GET /two/ HTTP/1.0\r\n" /* 20, 67 */
"Host: two.example.org\r\n" /* 23, 90 */
"\r\n\r\n"; /* 4, 94 */
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
Flow f;
TcpSession ssn;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.flags |= FLOW_IPV4;
p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_ESTABLISHED;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
f.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P<pkt_http_uri>.*) HTTP\\/1\\.0\\r\\n/G\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI test\"; uricontent:\"two\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, buf, buflen);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
result = 0;
goto end;
}
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1) && PacketAlertCheck(p, 2))
result = 1;
else
result = 0;
AppLayerParserCleanupState(&f);
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
return result;
}
static int SigTest09B2g (void) {
return SigTest09Real(MPM_B2G);
}
static int SigTest09B3g (void) {
return SigTest09Real(MPM_B3G);
}
static int SigTest09Wm (void) {
return SigTest09Real(MPM_WUMANBER);
}
static int SigTest10Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"ABC";
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
Flow f;
TcpSession ssn;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.flags |= FLOW_IPV4;
p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_ESTABLISHED;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
f.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Long content test (1)\"; content:\"ABCD\"; depth:4; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Long content test (2)\"; content:\"VWXYZ\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, buf, buflen);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
result = 0;
goto end;
}
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1) && PacketAlertCheck(p, 2))
result = 0;
else
result = 1;
AppLayerParserCleanupState(&f);
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
return result;
}
static int SigTest10B2g (void) {
return SigTest10Real(MPM_B2G);
}
static int SigTest10B3g (void) {
return SigTest10Real(MPM_B3G);
}
static int SigTest10Wm (void) {
return SigTest10Real(MPM_WUMANBER);
}
static int SigTest11Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+";
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
Flow f;
TcpSession ssn;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.flags |= FLOW_IPV4;
p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
f.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (content:\"ABCDEFGHIJ\"; content:\"klmnop\"; content:\"1234\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (content:\"VWXYZabcde\"; content:\"5678\"; content:\"89\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1) && PacketAlertCheck(p, 2))
result = 1;
AppLayerParserCleanupState(&f);
SigGroupCleanup(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
return result;
}
static int SigTest11B2g (void) {
return SigTest11Real(MPM_B2G);
}
static int SigTest11B3g (void) {
return SigTest11Real(MPM_B3G);
}
static int SigTest11Wm (void) {
return SigTest11Real(MPM_WUMANBER);
}
static int SigTest12Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+";
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
Flow f;
memset(&f, 0, sizeof(Flow));
FLOW_INITIALIZE(&f);
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
p->flow = &f;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Content order test\"; content:\"ABCDEFGHIJ\"; content:\"klmnop\"; content:\"1234\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1))
result = 1;
else
result = 0;
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
end:
UTHFreePackets(&p, 1);
if (de_ctx != NULL) {
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineCtxFree(de_ctx);
}
FLOW_DESTROY(&f);
return result;
}
static int SigTest12B2g (void) {
return SigTest12Real(MPM_B2G);
}
static int SigTest12B3g (void) {
return SigTest12Real(MPM_B3G);
}
static int SigTest12Wm (void) {
return SigTest12Real(MPM_WUMANBER);
}
static int SigTest13Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+";
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
Flow f;
memset(&f, 0, sizeof(Flow));
FLOW_INITIALIZE(&f);
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
p->flow = &f;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Content order test\"; content:\"ABCDEFGHIJ\"; content:\"1234\"; content:\"klmnop\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1))
result = 1;
else
result = 0;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
FLOW_DESTROY(&f);
return result;
}
static int SigTest13B2g (void) {
return SigTest13Real(MPM_B2G);
}
static int SigTest13B3g (void) {
return SigTest13Real(MPM_B3G);
}
static int SigTest13Wm (void) {
return SigTest13Real(MPM_WUMANBER);
}
static int SigTest14Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+";
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Content order test\"; content:\"ABCDEFGHIJ\"; content:\"1234\"; content:\"klmnop\"; distance:0; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1))
result = 0;
else
result = 1;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
return result;
}
static int SigTest14B2g (void) {
return SigTest14Real(MPM_B2G);
}
static int SigTest14B3g (void) {
return SigTest14Real(MPM_B3G);
}
static int SigTest14Wm (void) {
return SigTest14Real(MPM_WUMANBER);
}
static int SigTest15Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"CONNECT 213.92.8.7:31204 HTTP/1.1";
uint16_t buflen = strlen((char *)buf);
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
p->src.family = AF_INET;
p->dst.family = AF_INET;
p->payload = buf;
p->payload_len = buflen;
p->proto = IPPROTO_TCP;
p->dp = 80;
ConfCreateContextBackup();
ConfInit();
ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any !$HTTP_PORTS (msg:\"ET POLICY Inbound HTTP CONNECT Attempt on Off-Port\"; content:\"CONNECT \"; nocase; depth:8; content:\" HTTP/1.\"; nocase; within:1000; sid:2008284; rev:2;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 2008284))
result = 0;
else
result = 1;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
ConfDeInit();
ConfRestoreContextBackup();
SCFree(p);
return result;
}
static int SigTest15B2g (void) {
return SigTest15Real(MPM_B2G);
}
static int SigTest15B3g (void) {
return SigTest15Real(MPM_B3G);
}
static int SigTest15Wm (void) {
return SigTest15Real(MPM_WUMANBER);
}
static int SigTest16Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"CONNECT 213.92.8.7:31204 HTTP/1.1";
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(&p, 0, sizeof(p));
p = UTHBuildPacketSrcDstPorts((uint8_t *)buf, buflen, IPPROTO_TCP, 12345, 1234);
ConfCreateContextBackup();
ConfInit();
ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any !$HTTP_PORTS (msg:\"ET POLICY Inbound HTTP CONNECT Attempt on Off-Port\"; content:\"CONNECT \"; nocase; depth:8; content:\" HTTP/1.\"; nocase; within:1000; sid:2008284; rev:2;)");
if (de_ctx->sig_list == NULL) {
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 2008284))
result = 1;
else
printf("sid:2008284 %s: ", PacketAlertCheck(p, 2008284) ? "OK" : "FAIL");
SigGroupCleanup(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
ConfDeInit();
ConfRestoreContextBackup();
UTHFreePackets(&p, 1);
return result;
}
static int SigTest16B2g (void) {
return SigTest16Real(MPM_B2G);
}
static int SigTest16B3g (void) {
return SigTest16Real(MPM_B3G);
}
static int SigTest16Wm (void) {
return SigTest16Real(MPM_WUMANBER);
}
static int SigTest17Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.1\r\n" /* 20 */
"Host: one.example.org\r\n" /* 23, 43 */
"\r\n\r\n" /* 4, 47 */
"GET /two/ HTTP/1.1\r\n" /* 20, 67 */
"Host: two.example.org\r\n" /* 23, 90 */
"\r\n\r\n"; /* 4, 94 */
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
p = UTHBuildPacketSrcDstPorts((uint8_t *)buf, buflen, IPPROTO_TCP, 12345, 80);
ConfCreateContextBackup();
ConfInit();
ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any $HTTP_PORTS (msg:\"HTTP host cap\"; content:\"Host:\"; pcre:\"/^Host: (?P<pkt_http_host>.*)\\r\\n/m\"; noalert; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
PktVar *pv_hn = PktVarGet(p, "http_host");
if (pv_hn != NULL) {
if (memcmp(pv_hn->value, "one.example.org", pv_hn->value_len < 15 ? pv_hn->value_len : 15) == 0)
result = 1;
else {
printf("\"");
PrintRawUriFp(stdout, pv_hn->value, pv_hn->value_len);
printf("\" != \"one.example.org\": ");
}
PktVarFree(pv_hn);
} else {
printf("Pkt var http_host not captured: ");
}
end:
if (de_ctx != NULL) {
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
}
ConfDeInit();
ConfRestoreContextBackup();
UTHFreePackets(&p, 1);
return result;
}
static int SigTest17B2g (void) {
return SigTest17Real(MPM_B2G);
}
static int SigTest17B3g (void) {
return SigTest17Real(MPM_B3G);
}
static int SigTest17Wm (void) {
return SigTest17Real(MPM_WUMANBER);
}
static int SigTest18Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"220 (vsFTPd 2.0.5)\r\n";
uint16_t buflen = strlen((char *)buf);
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
p->src.family = AF_INET;
p->dst.family = AF_INET;
p->payload = buf;
p->payload_len = buflen;
p->proto = IPPROTO_TCP;
p->dp = 34260;
p->sp = 21;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any !21:902 -> any any (msg:\"ET MALWARE Suspicious 220 Banner on Local Port\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; sid:2003055; rev:4;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (!PacketAlertCheck(p, 2003055))
result = 1;
else
printf("signature shouldn't match, but did: ");
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
SCFree(p);
return result;
}
static int SigTest18B2g (void) {
return SigTest18Real(MPM_B2G);
}
static int SigTest18B3g (void) {
return SigTest18Real(MPM_B3G);
}
static int SigTest18Wm (void) {
return SigTest18Real(MPM_WUMANBER);
}
int SigTest19Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"220 (vsFTPd 2.0.5)\r\n";
uint16_t buflen = strlen((char *)buf);
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
p->src.family = AF_INET;
p->src.addr_data32[0] = UTHSetIPv4Address("192.168.0.1");
p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4");
p->dst.family = AF_INET;
p->payload = buf;
p->payload_len = buflen;
p->proto = IPPROTO_TCP;
p->dp = 34260;
p->sp = 21;
p->flowflags |= FLOW_PKT_TOSERVER;
ConfCreateContextBackup();
ConfInit();
ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert ip $HOME_NET any -> 1.2.3.4 any (msg:\"IP-ONLY test (1)\"; sid:999; rev:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 999))
result = 1;
else
printf("signature didn't match, but should have: ");
SigGroupCleanup(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
ConfDeInit();
ConfRestoreContextBackup();
SCFree(p);
return result;
}
static int SigTest19B2g (void) {
return SigTest19Real(MPM_B2G);
}
static int SigTest19B3g (void) {
return SigTest19Real(MPM_B3G);
}
static int SigTest19Wm (void) {
return SigTest19Real(MPM_WUMANBER);
}
static int SigTest20Real (int mpm_type) {
uint8_t *buf = (uint8_t *)
"220 (vsFTPd 2.0.5)\r\n";
uint16_t buflen = strlen((char *)buf);
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
p->src.family = AF_INET;
p->src.addr_data32[0] = UTHSetIPv4Address("192.168.0.1");
p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4");
p->dst.family = AF_INET;
p->payload = buf;
p->payload_len = buflen;
p->proto = IPPROTO_TCP;
p->dp = 34260;
p->sp = 21;
p->flowflags |= FLOW_PKT_TOSERVER;
ConfCreateContextBackup();
ConfInit();
ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert ip $HOME_NET any -> [99.99.99.99,1.2.3.0/24,1.1.1.1,3.0.0.0/8] any (msg:\"IP-ONLY test (2)\"; sid:999; rev:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
//PatternMatchPrepare(mpm_ctx, mpm_type);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
//DetectEngineIPOnlyThreadInit(de_ctx,&det_ctx->io_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 999))
result = 1;
else
printf("signature didn't match, but should have: ");
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
//PatternMatchDestroy(mpm_ctx);
DetectEngineCtxFree(de_ctx);
end:
ConfDeInit();
ConfRestoreContextBackup();
SCFree(p);
return result;
}
static int SigTest20B2g (void) {
return SigTest20Real(MPM_B2G);
}
static int SigTest20B3g (void) {
return SigTest20Real(MPM_B3G);
}
static int SigTest20Wm (void) {
return SigTest20Real(MPM_WUMANBER);
}
static int SigTest21Real (int mpm_type) {
ThreadVars th_v;
memset(&th_v, 0, sizeof(th_v));
DetectEngineThreadCtx *det_ctx = NULL;
int result = 0;
Flow f;
memset(&f, 0, sizeof(f));
FLOW_INITIALIZE(&f);
/* packet 1 */
uint8_t *buf1 = (uint8_t *)"GET /one/ HTTP/1.0\r\n"
"\r\n\r\n";
uint16_t buf1len = strlen((char *)buf1);
Packet *p1 = NULL;
/* packet 2 */
uint8_t *buf2 = (uint8_t *)"GET /two/ HTTP/1.0\r\n"
"\r\n\r\n";
uint16_t buf2len = strlen((char *)buf2);
Packet *p2 = NULL;
p1 = UTHBuildPacket((uint8_t *)buf1, buf1len, IPPROTO_TCP);
p1->flow = &f;
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p2 = UTHBuildPacket((uint8_t *)buf2, buf2len, IPPROTO_TCP);
p2->flow = &f;
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"FLOWBIT SET\"; content:\"/one/\"; flowbits:set,TEST.one; flowbits:noalert; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"FLOWBIT TEST\"; content:\"/two/\"; flowbits:isset,TEST.one; sid:2;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1)) {
printf("sid 1 alerted, but shouldn't: ");
goto end;
}
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (!(PacketAlertCheck(p2, 2))) {
printf("sid 2 didn't alert, but should have: ");
goto end;
}
result = 1;
end:
if (de_ctx != NULL) {
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
if (det_ctx != NULL) {
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
}
}
DetectEngineCtxFree(de_ctx);
UTHFreePackets(&p1, 1);
UTHFreePackets(&p2, 1);
FLOW_DESTROY(&f);
return result;
}
static int SigTest21B2g (void) {
return SigTest21Real(MPM_B2G);
}
static int SigTest21B3g (void) {
return SigTest21Real(MPM_B3G);
}
static int SigTest21Wm (void) {
return SigTest21Real(MPM_WUMANBER);
}
static int SigTest22Real (int mpm_type) {
ThreadVars th_v;
memset(&th_v, 0, sizeof(th_v));
DetectEngineThreadCtx *det_ctx;
int result = 0;
Flow f;
memset(&f, 0, sizeof(f));
FLOW_INITIALIZE(&f);
/* packet 1 */
uint8_t *buf1 = (uint8_t *)"GET /one/ HTTP/1.0\r\n"
"\r\n\r\n";
uint16_t buf1len = strlen((char *)buf1);
Packet *p1 = NULL;
p1 = UTHBuildPacket((uint8_t *)buf1, buf1len, IPPROTO_TCP);
p1->flow = &f;
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
/* packet 2 */
uint8_t *buf2 = (uint8_t *)"GET /two/ HTTP/1.0\r\n"
"\r\n\r\n";
uint16_t buf2len = strlen((char *)buf2);
Packet *p2 = NULL;
p2 = UTHBuildPacket((uint8_t *)buf2, buf2len, IPPROTO_TCP);
p2->flow = &f;
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"FLOWBIT SET\"; content:\"/one/\"; flowbits:set,TEST.one; flowbits:noalert; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"FLOWBIT TEST\"; content:\"/two/\"; flowbits:isset,TEST.abc; sid:2;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
//PatternMatchPrepare(mpm_ctx, mpm_type);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1)) {
printf("sid 1 alerted, but shouldn't: ");
goto end;
}
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (!(PacketAlertCheck(p2, 2)))
result = 1;
else
printf("sid 2 alerted, but shouldn't: ");
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
//PatternMatchDestroy(mpm_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p1, 1);
UTHFreePackets(&p2, 1);
FLOW_DESTROY(&f);
return result;
}
static int SigTest22B2g (void) {
return SigTest22Real(MPM_B2G);
}
static int SigTest22B3g (void) {
return SigTest22Real(MPM_B3G);
}
static int SigTest22Wm (void) {
return SigTest22Real(MPM_WUMANBER);
}
static int SigTest23Real (int mpm_type) {
ThreadVars th_v;
memset(&th_v, 0, sizeof(th_v));
DetectEngineThreadCtx *det_ctx;
int result = 0;
Flow f;
memset(&f, 0, sizeof(f));
FLOW_INITIALIZE(&f);
/* packet 1 */
uint8_t *buf1 = (uint8_t *)"GET /one/ HTTP/1.0\r\n"
"\r\n\r\n";
uint16_t buf1len = strlen((char *)buf1);
Packet *p1 = NULL;
p1 = UTHBuildPacket((uint8_t *)buf1, buf1len, IPPROTO_TCP);
p1->flow = &f;
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
/* packet 2 */
uint8_t *buf2 = (uint8_t *)"GET /two/ HTTP/1.0\r\n"
"\r\n\r\n";
uint16_t buf2len = strlen((char *)buf2);
Packet *p2 = NULL;
p2 = UTHBuildPacket((uint8_t *)buf2, buf2len, IPPROTO_TCP);
p2->flow = &f;
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"FLOWBIT SET\"; content:\"/one/\"; flowbits:toggle,TEST.one; flowbits:noalert; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"FLOWBIT TEST\"; content:\"/two/\"; flowbits:isset,TEST.one; sid:2;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1)) {
printf("sid 1 alerted, but shouldn't: ");
goto end;
}
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (PacketAlertCheck(p2, 2))
result = 1;
else
printf("sid 2 didn't alert, but should have: ");
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p1, 1);
UTHFreePackets(&p2, 1);
FLOW_DESTROY(&f);
return result;
}
static int SigTest23B2g (void) {
return SigTest23Real(MPM_B2G);
}
static int SigTest23B3g (void) {
return SigTest23Real(MPM_B3G);
}
static int SigTest23Wm (void) {
return SigTest23Real(MPM_WUMANBER);
}
int SigTest24IPV4Keyword(void)
{
uint8_t valid_raw_ipv4[] = {
0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00,
0x40, 0x01, 0xb7, 0x52, 0xc0, 0xa8, 0x01, 0x03,
0xc0, 0xa8, 0x01, 0x03};
uint8_t invalid_raw_ipv4[] = {
0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00,
0x40, 0x01, 0xb7, 0x52, 0xc0, 0xa8, 0x01, 0x03,
0xc0, 0xa8, 0x01, 0x06};
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
Packet *p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL) {
SCFree(p1);
return 0;
}
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 0;
uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0\r\n"
"\r\n\r\n";
uint16_t buflen = strlen((char *)buf);
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->ip4vars.comp_csum = -1;
p2->ip4vars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)valid_raw_ipv4;
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = buflen;
p1->proto = IPPROTO_TCP;
p2->ip4h = (IPV4Hdr *)invalid_raw_ipv4;
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
p2->payload_len = buflen;
p2->proto = IPPROTO_TCP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert ip any any -> any any "
"(content:\"/one/\"; ipv4-csum:valid; "
"msg:\"ipv4-csum keyword check(1)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("sig 1 parse: ");
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert ip any any -> any any "
"(content:\"/one/\"; ipv4-csum:invalid; "
"msg:\"ipv4-csum keyword check(1)\"; "
"sid:2;)");
if (de_ctx->sig_list->next == NULL) {
printf("sig 2 parse: ");
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (!(PacketAlertCheck(p1, 1))) {
printf("signature 1 didn't match, but should have: ");
goto end;
}
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (!((PacketAlertCheck(p2, 2)))) {
printf("signature 2 didn't match, but should have: ");
goto end;
}
result = 1;
end:
if (det_ctx != NULL) {
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
}
SCFree(p1);
SCFree(p2);
return result;
}
int SigTest25NegativeIPV4Keyword(void)
{
uint8_t valid_raw_ipv4[] = {
0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00,
0x40, 0x01, 0xb7, 0x52, 0xc0, 0xa8, 0x01, 0x03,
0xc0, 0xa8, 0x01, 0x03};
uint8_t invalid_raw_ipv4[] = {
0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00,
0x40, 0x01, 0xb7, 0x52, 0xc0, 0xa8, 0x01, 0x03,
0xc0, 0xa8, 0x01, 0x06};
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
Packet *p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL) {
SCFree(p1);
return 0;
}
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 1;
uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0\r\n"
"\r\n\r\n";
uint16_t buflen = strlen((char *)buf);
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->ip4vars.comp_csum = -1;
p2->ip4vars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)valid_raw_ipv4;
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = buflen;
p1->proto = IPPROTO_TCP;
p2->ip4h = (IPV4Hdr *)invalid_raw_ipv4;
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
p2->payload_len = buflen;
p2->proto = IPPROTO_TCP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert ip any any -> any any "
"(content:\"/one/\"; ipv4-csum:invalid; "
"msg:\"ipv4-csum keyword check(1)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result &= 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert ip any any -> any any "
"(content:\"/one/\"; ipv4-csum:valid; "
"msg:\"ipv4-csum keyword check(1)\"; "
"sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result &= 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1))
result &= 0;
else
result &= 1;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (PacketAlertCheck(p2, 2))
result &= 0;
else
result &= 1;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
SCFree(p1);
SCFree(p2);
return result;
}
int SigTest26TCPV4Keyword(void)
{
uint8_t raw_ipv4[] = {
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x40, 0x8e, 0x7e, 0xb2,
0xc0, 0xa8, 0x01, 0x03};
uint8_t valid_raw_tcp[] = {
0x00, 0x50, 0x8e, 0x16, 0x0d, 0x59, 0xcd, 0x3c,
0xcf, 0x0d, 0x21, 0x80, 0x50, 0x12, 0x16, 0xa0,
0x4A, 0x04, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4,
0x04, 0x02, 0x08, 0x0a, 0x6e, 0x18, 0x78, 0x73,
0x01, 0x71, 0x74, 0xde, 0x01, 0x03, 0x03, 0x02};
uint8_t invalid_raw_tcp[] = {
0x00, 0x50, 0x8e, 0x16, 0x0d, 0x59, 0xcd, 0x3c,
0xcf, 0x0d, 0x21, 0x80, 0x50, 0x12, 0x16, 0xa0,
0xfa, 0x03, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4,
0x04, 0x02, 0x08, 0x0a, 0x6e, 0x18, 0x78, 0x73,
0x01, 0x71, 0x74, 0xde, 0x01, 0x03, 0x03, 0x03};
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
Packet *p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL) {
SCFree(p1);
return 0;
}
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
PacketCopyData(p1, raw_ipv4, sizeof(raw_ipv4));
PacketCopyDataOffset(p1, GET_PKT_LEN(p1), valid_raw_tcp, sizeof(valid_raw_tcp));
PacketCopyData(p2, raw_ipv4, sizeof(raw_ipv4));
PacketCopyDataOffset(p2, GET_PKT_LEN(p2), invalid_raw_tcp, sizeof(invalid_raw_tcp));
p1->tcpvars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)GET_PKT_DATA(p1);
p1->tcph = (TCPHdr *)(GET_PKT_DATA(p1) + sizeof(raw_ipv4));
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = (uint8_t *)GET_PKT_DATA(p1) + sizeof(raw_ipv4) + 20;
p1->payload_len = 20;
p1->proto = IPPROTO_TCP;
p2->tcpvars.comp_csum = -1;
p2->ip4h = (IPV4Hdr *)GET_PKT_DATA(p2);
p2->tcph = (TCPHdr *)(GET_PKT_DATA(p2) + sizeof(raw_ipv4));
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = (uint8_t *)GET_PKT_DATA(p2) + sizeof(raw_ipv4) + 20;
p2->payload_len = 20;
p2->proto = IPPROTO_TCP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert ip any any -> any any "
"(content:\"|DE 01 03|\"; tcpv4-csum:valid; dsize:20; "
"msg:\"tcpv4-csum keyword check(1)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert ip any any -> any any "
"(content:\"|DE 01 03|\"; tcpv4-csum:invalid; "
"msg:\"tcpv4-csum keyword check(1)\"; "
"sid:2;)");
if (de_ctx->sig_list->next == NULL) {
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (!(PacketAlertCheck(p1, 1))) {
printf("sig 1 didn't match: ");
goto end;
}
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (!(PacketAlertCheck(p2, 2))) {
printf("sig 2 didn't match: ");
goto end;
}
result = 1;
end:
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
SCFree(p1);
SCFree(p2);
return result;
}
static int SigTest27NegativeTCPV4Keyword(void)
{
uint8_t raw_ipv4[] = {
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x40, 0x8e, 0x7e, 0xb2,
0xc0, 0xa8, 0x01, 0x03};
uint8_t valid_raw_tcp[] = {
0x00, 0x50, 0x8e, 0x16, 0x0d, 0x59, 0xcd, 0x3c,
0xcf, 0x0d, 0x21, 0x80, 0x50, 0x12, 0x16, 0xa0,
0xfa, 0x03, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4,
0x04, 0x02, 0x08, 0x0a, 0x6e, 0x18, 0x78, 0x73,
0x01, 0x71, 0x74, 0xde, 0x01, 0x03, 0x03, 0x02};
uint8_t invalid_raw_tcp[] = {
0x00, 0x50, 0x8e, 0x16, 0x0d, 0x59, 0xcd, 0x3c,
0xcf, 0x0d, 0x21, 0x80, 0x50, 0x12, 0x16, 0xa0,
0xfa, 0x03, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4,
0x04, 0x02, 0x08, 0x0a, 0x6e, 0x18, 0x78, 0x73,
0x01, 0x71, 0x74, 0xde, 0x01, 0x03, 0x03, 0x03};
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
Packet *p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL) {
SCFree(p1);
return 0;
}
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
PacketCopyData(p1, raw_ipv4, sizeof(raw_ipv4));
PacketCopyDataOffset(p1, GET_PKT_LEN(p1), valid_raw_tcp, sizeof(valid_raw_tcp));
PacketCopyData(p2, raw_ipv4, sizeof(raw_ipv4));
PacketCopyDataOffset(p2, GET_PKT_LEN(p2), invalid_raw_tcp, sizeof(invalid_raw_tcp));
p1->tcpvars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)GET_PKT_DATA(p1);
p1->tcph = (TCPHdr *)(GET_PKT_DATA(p1) + sizeof(raw_ipv4));
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = (uint8_t *)GET_PKT_DATA(p1) + sizeof(raw_ipv4) + 20;
p1->payload_len = 20;
p1->proto = IPPROTO_TCP;
p2->tcpvars.comp_csum = -1;
p2->ip4h = (IPV4Hdr *)GET_PKT_DATA(p2);
p2->tcph = (TCPHdr *)(GET_PKT_DATA(p2) + sizeof(raw_ipv4));
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = (uint8_t *)GET_PKT_DATA(p2) + sizeof(raw_ipv4) + 20;
p2->payload_len = 20;
p2->proto = IPPROTO_TCP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert tcp any any -> any any "
"(content:\"|DE 01 03|\"; tcpv4-csum:invalid; dsize:20; "
"msg:\"tcpv4-csum keyword check(1)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert tcp any any -> any any "
"(content:\"|DE 01 03|\"; tcpv4-csum:valid; dsize:20; "
"msg:\"tcpv4-csum keyword check(2)\"; "
"sid:2;)");
if (de_ctx->sig_list->next == NULL) {
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (!PacketAlertCheck(p1, 1)) {
printf("sig 1 didn't match on p1: ");
goto end;
}
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (PacketAlertCheck(p2, 2)) {
printf("sig 2 matched on p2: ");
goto end;
}
result = 1;
end:
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
SCFree(p1);
SCFree(p2);
return result;
}
int SigTest28TCPV6Keyword(void)
{
static uint8_t valid_raw_ipv6[] = {
0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00,
0x86, 0x05, 0x80, 0xda, 0x86, 0xdd,
0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x40,
0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01,
0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda,
0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00,
0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e,
0x03, 0xfe, 0x00, 0x16, 0xd6, 0x76, 0xf5, 0x2d,
0x0c, 0x7a, 0x08, 0x77, 0x50, 0x10, 0x21, 0x5c,
0xf2, 0xf1, 0x00, 0x00,
0x01, 0x01, 0x08, 0x0a, 0x00, 0x08, 0xca, 0x5a,
0x00, 0x01, 0x69, 0x27};
static uint8_t invalid_raw_ipv6[] = {
0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00,
0x86, 0x05, 0x80, 0xda, 0x86, 0xdd,
0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x40,
0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01,
0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda,
0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00,
0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e,
0x03, 0xfe, 0x00, 0x16, 0xd6, 0x76, 0xf5, 0x2d,
0x0c, 0x7a, 0x08, 0x77, 0x50, 0x10, 0x21, 0x5c,
0xc2, 0xf1, 0x00, 0x00,
0x01, 0x01, 0x08, 0x0a, 0x00, 0x08, 0xca, 0x5a,
0x00, 0x01, 0x69, 0x28};
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
Packet *p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL) {
SCFree(p1);
return 0;
}
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->tcpvars.comp_csum = -1;
p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1->tcph = (TCPHdr *) (valid_raw_ipv6 + 54);
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = valid_raw_ipv6 + 54 + 20;
p1->payload_len = 12;
p1->proto = IPPROTO_TCP;
if (TCP_GET_HLEN(p1) != 20) {
BUG_ON(1);
}
p2->tcpvars.comp_csum = -1;
p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2->tcph = (TCPHdr *) (invalid_raw_ipv6 + 54);
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = invalid_raw_ipv6 + 54 + 20;;
p2->payload_len = 12;
p2->proto = IPPROTO_TCP;
if (TCP_GET_HLEN(p2) != 20) {
BUG_ON(1);
}
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert tcp any any -> any any "
"(content:\"|00 01 69|\"; tcpv6-csum:valid; dsize:12; "
"msg:\"tcpv6-csum keyword check(1)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert tcp any any -> any any "
"(content:\"|00 01 69|\"; tcpv6-csum:invalid; dsize:12; "
"msg:\"tcpv6-csum keyword check(1)\"; "
"sid:2;)");
if (de_ctx->sig_list->next == NULL) {
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (!(PacketAlertCheck(p1, 1))) {
printf("sid 1 didn't match on p1: ");
goto end;
}
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (!(PacketAlertCheck(p2, 2))) {
printf("sid 2 didn't match on p2: ");
goto end;
}
result = 1;
end:
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
SCFree(p1);
SCFree(p2);
return result;
}
int SigTest29NegativeTCPV6Keyword(void)
{
static uint8_t valid_raw_ipv6[] = {
0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00,
0x86, 0x05, 0x80, 0xda, 0x86, 0xdd,
0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x40,
0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01,
0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda,
0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00,
0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e,
0x03, 0xfe, 0x00, 0x16, 0xd6, 0x76, 0xf5, 0x2d,
0x0c, 0x7a, 0x08, 0x77, 0x50, 0x10, 0x21, 0x5c,
0xf2, 0xf1, 0x00, 0x00,
0x01, 0x01, 0x08, 0x0a, 0x00, 0x08, 0xca, 0x5a,
0x00, 0x01, 0x69, 0x27};
static uint8_t invalid_raw_ipv6[] = {
0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00,
0x86, 0x05, 0x80, 0xda, 0x86, 0xdd,
0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x40,
0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01,
0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda,
0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00,
0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e,
0x03, 0xfe, 0x00, 0x16, 0xd6, 0x76, 0xf5, 0x2d,
0x0c, 0x7a, 0x08, 0x77, 0x50, 0x10, 0x21, 0x5c,
0xc2, 0xf1, 0x00, 0x00,
0x01, 0x01, 0x08, 0x0a, 0x00, 0x08, 0xca, 0x5a,
0x00, 0x01, 0x69, 0x28};
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
Packet *p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL) {
SCFree(p1);
return 0;
}
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 0;
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->tcpvars.comp_csum = -1;
p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1->tcph = (TCPHdr *) (valid_raw_ipv6 + 54);
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = valid_raw_ipv6 + 54 + 20;
p1->payload_len = 12;
p1->proto = IPPROTO_TCP;
if (TCP_GET_HLEN(p1) != 20) {
BUG_ON(1);
}
p2->tcpvars.comp_csum = -1;
p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2->tcph = (TCPHdr *) (invalid_raw_ipv6 + 54);
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = invalid_raw_ipv6 + 54 + 20;;
p2->payload_len = 12;
p2->proto = IPPROTO_TCP;
if (TCP_GET_HLEN(p2) != 20) {
BUG_ON(1);
}
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert tcp any any -> any any "
"(content:\"|00 01 69|\"; tcpv6-csum:invalid; dsize:12; "
"msg:\"tcpv6-csum keyword check(1)\"; "
"sid:1;)");
if (de_ctx->sig_list == NULL) {
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert tcp any any -> any any "
"(content:\"|00 01 69|\"; tcpv6-csum:valid; dsize:12; "
"msg:\"tcpv6-csum keyword check(1)\"; "
"sid:2;)");
if (de_ctx->sig_list->next == NULL) {
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1))
goto end;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (PacketAlertCheck(p2, 2))
goto end;
result = 1;
end:
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
SCFree(p1);
SCFree(p2);
return result;
}
int SigTest30UDPV4Keyword(void)
{
uint8_t raw_ipv4[] = {
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x11, 0x00, 0x00, 0xd0, 0x43, 0xdc, 0xdc,
0xc0, 0xa8, 0x01, 0x03};
uint8_t valid_raw_udp[] = {
0x00, 0x35, 0xcf, 0x34, 0x00, 0x55, 0x6c, 0xe0,
0x83, 0xfc, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x07, 0x70, 0x61, 0x67,
0x65, 0x61, 0x64, 0x32, 0x11, 0x67, 0x6f, 0x6f,
0x67, 0x6c, 0x65, 0x73, 0x79, 0x6e, 0x64, 0x69,
0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x03, 0x63,
0x6f, 0x6d, 0x00, 0x00, 0x1c, 0x00, 0x01, 0xc0,
0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x01, 0x4b,
0x50, 0x00, 0x12, 0x06, 0x70, 0x61, 0x67, 0x65,
0x61, 0x64, 0x01, 0x6c, 0x06, 0x67, 0x6f, 0x6f,
0x67, 0x6c, 0x65, 0xc0, 0x26};
uint8_t invalid_raw_udp[] = {
0x00, 0x35, 0xcf, 0x34, 0x00, 0x55, 0x6c, 0xe0,
0x83, 0xfc, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x07, 0x70, 0x61, 0x67,
0x65, 0x61, 0x64, 0x32, 0x11, 0x67, 0x6f, 0x6f,
0x67, 0x6c, 0x65, 0x73, 0x79, 0x6e, 0x64, 0x69,
0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x03, 0x63,
0x6f, 0x6d, 0x00, 0x00, 0x1c, 0x00, 0x01, 0xc0,
0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x01, 0x4b,
0x50, 0x00, 0x12, 0x06, 0x70, 0x61, 0x67, 0x65,
0x61, 0x64, 0x01, 0x6c, 0x06, 0x67, 0x6f, 0x6f,
0x67, 0x6c, 0x65, 0xc0, 0x27};
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
Packet *p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL) {
SCFree(p1);
return 0;
}
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 1;
uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0yyyyyyyyyyyyyyyy\r\n"
"\r\n\r\nyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy";
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->udpvars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)raw_ipv4;
p1->udph = (UDPHdr *)valid_raw_udp;
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = sizeof(valid_raw_udp) - UDP_HEADER_LEN;
p1->proto = IPPROTO_UDP;
p2->udpvars.comp_csum = -1;
p2->ip4h = (IPV4Hdr *)raw_ipv4;
p2->udph = (UDPHdr *)invalid_raw_udp;
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
p2->payload_len = sizeof(invalid_raw_udp) - UDP_HEADER_LEN;
p2->proto = IPPROTO_UDP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert udp any any -> any any "
"(content:\"/one/\"; udpv4-csum:valid; "
"msg:\"udpv4-csum keyword check(1)\"; "
"sid:1;)");
if (de_ctx->sig_list == NULL) {
result &= 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert udp any any -> any any "
"(content:\"/one/\"; udpv4-csum:invalid; "
"msg:\"udpv4-csum keyword check(1)\"; "
"sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result &= 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1))
result &= 1;
else
result &= 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (PacketAlertCheck(p2, 2))
result &= 1;
else
result &= 0;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
SCFree(p1);
SCFree(p2);
return result;
}
int SigTest31NegativeUDPV4Keyword(void)
{
uint8_t raw_ipv4[] = {
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xd0, 0x43, 0xdc, 0xdc,
0xc0, 0xa8, 0x01, 0x03};
uint8_t valid_raw_udp[] = {
0x00, 0x35, 0xcf, 0x34, 0x00, 0x55, 0x6c, 0xe0,
0x83, 0xfc, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x07, 0x70, 0x61, 0x67,
0x65, 0x61, 0x64, 0x32, 0x11, 0x67, 0x6f, 0x6f,
0x67, 0x6c, 0x65, 0x73, 0x79, 0x6e, 0x64, 0x69,
0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x03, 0x63,
0x6f, 0x6d, 0x00, 0x00, 0x1c, 0x00, 0x01, 0xc0,
0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x01, 0x4b,
0x50, 0x00, 0x12, 0x06, 0x70, 0x61, 0x67, 0x65,
0x61, 0x64, 0x01, 0x6c, 0x06, 0x67, 0x6f, 0x6f,
0x67, 0x6c, 0x65, 0xc0, 0x26};
uint8_t invalid_raw_udp[] = {
0x00, 0x35, 0xcf, 0x34, 0x00, 0x55, 0x6c, 0xe0,
0x83, 0xfc, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x07, 0x70, 0x61, 0x67,
0x65, 0x61, 0x64, 0x32, 0x11, 0x67, 0x6f, 0x6f,
0x67, 0x6c, 0x65, 0x73, 0x79, 0x6e, 0x64, 0x69,
0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x03, 0x63,
0x6f, 0x6d, 0x00, 0x00, 0x1c, 0x00, 0x01, 0xc0,
0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x01, 0x4b,
0x50, 0x00, 0x12, 0x06, 0x70, 0x61, 0x67, 0x65,
0x61, 0x64, 0x01, 0x6c, 0x06, 0x67, 0x6f, 0x6f,
0x67, 0x6c, 0x65, 0xc0, 0x27};
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
Packet *p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL) {
SCFree(p1);
return 0;
}
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 1;
uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0yyyyyyyyyyyyyyyy\r\n"
"\r\n\r\nyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy";
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->udpvars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)raw_ipv4;
p1->udph = (UDPHdr *)valid_raw_udp;
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = sizeof(valid_raw_udp) - UDP_HEADER_LEN;
p1->proto = IPPROTO_UDP;
p2->udpvars.comp_csum = -1;
p2->ip4h = (IPV4Hdr *)raw_ipv4;
p2->udph = (UDPHdr *)invalid_raw_udp;
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
p2->payload_len = sizeof(invalid_raw_udp) - UDP_HEADER_LEN;
p2->proto = IPPROTO_UDP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert udp any any -> any any "
"(content:\"/one/\"; udpv4-csum:invalid; "
"msg:\"udpv4-csum keyword check(1)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result &= 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert udp any any -> any any "
"(content:\"/one/\"; udpv4-csum:valid; "
"msg:\"udpv4-csum keyword check(1)\"; "
"sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result &= 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1))
result &= 0;
else
result &= 1;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (PacketAlertCheck(p2, 2)) {
result &= 0;
}
else
result &= 1;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
SCFree(p1);
SCFree(p2);
return result;
}
int SigTest32UDPV6Keyword(void)
{
static uint8_t valid_raw_ipv6[] = {
0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00,
0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00,
0x00, 0x00, 0x00, 0x14, 0x11, 0x02, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00,
0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe,
0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0,
0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75,
0x82, 0xa0, 0x00, 0x14, 0x1a, 0xc3, 0x06, 0x02,
0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0x57, 0xb0,
0x09, 0x00};
static uint8_t invalid_raw_ipv6[] = {
0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00,
0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00,
0x00, 0x00, 0x00, 0x14, 0x11, 0x02, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00,
0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe,
0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0,
0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75,
0x82, 0xa0, 0x00, 0x14, 0x1a, 0xc3, 0x06, 0x02,
0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0x57, 0xb0,
0x09, 0x01};
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
Packet *p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL) {
SCFree(p1);
return 0;
}
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 1;
uint8_t *buf = (uint8_t *)"GET /one/ HTTP\r\n"
"\r\n\r\n";
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->udpvars.comp_csum = -1;
p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1->udph = (UDPHdr *) (valid_raw_ipv6 + 54);
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = IPV6_GET_PLEN((p1)) - UDP_HEADER_LEN;
p1->proto = IPPROTO_UDP;
p2->udpvars.comp_csum = -1;
p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2->udph = (UDPHdr *) (invalid_raw_ipv6 + 54);
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
p2->payload_len = IPV6_GET_PLEN((p2)) - UDP_HEADER_LEN;
p2->proto = IPPROTO_UDP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert udp any any -> any any "
"(content:\"/one/\"; udpv6-csum:valid; "
"msg:\"udpv6-csum keyword check(1)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result &= 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert udp any any -> any any "
"(content:\"/one/\"; udpv6-csum:invalid; "
"msg:\"udpv6-csum keyword check(1)\"; "
"sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result &= 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1))
result &= 1;
else
result &= 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (PacketAlertCheck(p2, 2))
result &= 1;
else
result &= 0;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
SCFree(p1);
SCFree(p2);
return result;
}
int SigTest33NegativeUDPV6Keyword(void)
{
static uint8_t valid_raw_ipv6[] = {
0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00,
0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00,
0x00, 0x00, 0x00, 0x14, 0x11, 0x02, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00,
0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe,
0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0,
0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75,
0x82, 0xa0, 0x00, 0x14, 0x1a, 0xc3, 0x06, 0x02,
0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0x57, 0xb0,
0x09, 0x00};
static uint8_t invalid_raw_ipv6[] = {
0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00,
0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00,
0x00, 0x00, 0x00, 0x14, 0x11, 0x02, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00,
0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe,
0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0,
0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75,
0x82, 0xa0, 0x00, 0x14, 0x1a, 0xc3, 0x06, 0x02,
0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0x57, 0xb0,
0x09, 0x01};
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
Packet *p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL) {
SCFree(p1);
return 0;
}
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 1;
uint8_t *buf = (uint8_t *)"GET /one/ HTTP\r\n"
"\r\n\r\n";
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->udpvars.comp_csum = -1;
p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1->udph = (UDPHdr *) (valid_raw_ipv6 + 54);
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = IPV6_GET_PLEN((p1)) - UDP_HEADER_LEN;
p1->proto = IPPROTO_UDP;
p2->udpvars.comp_csum = -1;
p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2->udph = (UDPHdr *) (invalid_raw_ipv6 + 54);
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
p2->payload_len = IPV6_GET_PLEN((p2)) - UDP_HEADER_LEN;
p2->proto = IPPROTO_UDP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert udp any any -> any any "
"(content:\"/one/\"; udpv6-csum:invalid; "
"msg:\"udpv6-csum keyword check(1)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result &= 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert udp any any -> any any "
"(content:\"/one/\"; udpv6-csum:valid; "
"msg:\"udpv6-csum keyword check(1)\"; "
"sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result &= 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1))
result &= 0;
else
result &= 1;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (PacketAlertCheck(p2, 2))
result &= 0;
else
result &= 1;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
SCFree(p1);
SCFree(p2);
return result;
}
int SigTest34ICMPV4Keyword(void)
{
uint8_t valid_raw_ipv4[] = {
0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00,
0x40, 0x01, 0x3c, 0xa7, 0x7f, 0x00, 0x00, 0x01,
0x7f, 0x00, 0x00, 0x01, 0x08, 0x00, 0xc3, 0x01,
0x2b, 0x36, 0x00, 0x01, 0x3f, 0x16, 0x9a, 0x4a,
0x41, 0x63, 0x04, 0x00, 0x08, 0x09, 0x0a, 0x0b,
0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13,
0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b,
0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b,
0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33,
0x34, 0x35, 0x36, 0x37};
uint8_t invalid_raw_ipv4[] = {
0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00,
0x40, 0x01, 0x3c, 0xa7, 0x7f, 0x00, 0x00, 0x01,
0x7f, 0x00, 0x00, 0x01, 0x08, 0x00, 0xc3, 0x01,
0x2b, 0x36, 0x00, 0x01, 0x3f, 0x16, 0x9a, 0x4a,
0x41, 0x63, 0x04, 0x00, 0x08, 0x09, 0x0a, 0x0b,
0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13,
0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b,
0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b,
0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33,
0x34, 0x35, 0x36, 0x38};
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
Packet *p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL) {
SCFree(p1);
return 0;
}
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 1;
uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0\r\n"
"\r\n\r\n";
uint16_t buflen = strlen((char *)buf);
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->icmpv4vars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)(valid_raw_ipv4);
p1->ip4h->ip_verhl = 69;
p1->icmpv4h = (ICMPV4Hdr *) (valid_raw_ipv4 + IPV4_GET_RAW_HLEN(p1->ip4h) * 4);
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = buflen;
p1->proto = IPPROTO_ICMP;
p2->icmpv4vars.comp_csum = -1;
p2->ip4h = (IPV4Hdr *)(invalid_raw_ipv4);
p2->ip4h->ip_verhl = 69;
p2->icmpv4h = (ICMPV4Hdr *) (invalid_raw_ipv4 + IPV4_GET_RAW_HLEN(p2->ip4h) * 4);
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
p2->payload_len = buflen;
p2->proto = IPPROTO_ICMP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert icmp any any -> any any "
"(content:\"/one/\"; icmpv4-csum:valid; "
"msg:\"icmpv4-csum keyword check(1)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result &= 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert icmp any any -> any any "
"(content:\"/one/\"; icmpv4-csum:invalid; "
"msg:\"icmpv4-csum keyword check(1)\"; "
"sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1))
result &= 1;
else
result &= 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (PacketAlertCheck(p2, 2))
result &= 1;
else
result &= 0;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
SCFree(p1);
SCFree(p2);
return result;
}
int SigTest35NegativeICMPV4Keyword(void)
{
uint8_t valid_raw_ipv4[] = {
0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00,
0x40, 0x01, 0x3c, 0xa7, 0x7f, 0x00, 0x00, 0x01,
0x7f, 0x00, 0x00, 0x01, 0x08, 0x00, 0xc3, 0x01,
0x2b, 0x36, 0x00, 0x01, 0x3f, 0x16, 0x9a, 0x4a,
0x41, 0x63, 0x04, 0x00, 0x08, 0x09, 0x0a, 0x0b,
0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13,
0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b,
0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b,
0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33,
0x34, 0x35, 0x36, 0x37};
uint8_t invalid_raw_ipv4[] = {
0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00,
0x40, 0x01, 0x3c, 0xa7, 0x7f, 0x00, 0x00, 0x01,
0x7f, 0x00, 0x00, 0x01, 0x08, 0x00, 0xc3, 0x01,
0x2b, 0x36, 0x00, 0x01, 0x3f, 0x16, 0x9a, 0x4a,
0x41, 0x63, 0x04, 0x00, 0x08, 0x09, 0x0a, 0x0b,
0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13,
0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b,
0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b,
0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33,
0x34, 0x35, 0x36, 0x38};
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
Packet *p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL) {
SCFree(p1);
return 0;
}
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 1;
uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0\r\n"
"\r\n\r\n";
uint16_t buflen = strlen((char *)buf);
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->icmpv4vars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)(valid_raw_ipv4);
p1->ip4h->ip_verhl = 69;
p1->icmpv4h = (ICMPV4Hdr *) (valid_raw_ipv4 + IPV4_GET_RAW_HLEN(p1->ip4h) * 4);
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = buflen;
p1->proto = IPPROTO_ICMP;
p2->icmpv4vars.comp_csum = -1;
p2->ip4h = (IPV4Hdr *)(invalid_raw_ipv4);
p2->ip4h->ip_verhl = 69;
p2->icmpv4h = (ICMPV4Hdr *) (invalid_raw_ipv4 + IPV4_GET_RAW_HLEN(p2->ip4h) * 4);
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
p2->payload_len = buflen;
p2->proto = IPPROTO_ICMP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert icmp any any -> any any "
"(content:\"/one/\"; icmpv4-csum:invalid; "
"msg:\"icmpv4-csum keyword check(1)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result &= 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert icmp any any -> any any "
"(content:\"/one/\"; icmpv4-csum:valid; "
"msg:\"icmpv4-csum keyword check(1)\"; "
"sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result &= 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1))
result &= 0;
else
result &= 1;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (PacketAlertCheck(p2, 2))
result &= 0;
else {
result &= 1;
}
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
SCFree(p1);
SCFree(p2);
return result;
}
int SigTest36ICMPV6Keyword(void)
{
uint8_t valid_raw_ipv6[] = {
0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x00, 0x60,
0x97, 0x07, 0x69, 0xea, 0x86, 0xdd, 0x60, 0x00,
0x00, 0x00, 0x00, 0x44, 0x3a, 0x40, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x60,
0x97, 0xff, 0xfe, 0x07, 0x69, 0xea, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00,
0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x03, 0x00,
0xf7, 0x52, 0x00, 0x00, 0x00, 0x00, 0x60, 0x00,
0x00, 0x00, 0x00, 0x14, 0x11, 0x01, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00,
0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe,
0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0,
0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75,
0x82, 0x9b, 0x00, 0x14, 0x82, 0x8b, 0x01, 0x01,
0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0xf5, 0xed,
0x08, 0x00};
uint8_t invalid_raw_ipv6[] = {
0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x00, 0x60,
0x97, 0x07, 0x69, 0xea, 0x86, 0xdd, 0x60, 0x00,
0x00, 0x00, 0x00, 0x44, 0x3a, 0x40, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x60,
0x97, 0xff, 0xfe, 0x07, 0x69, 0xea, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00,
0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x03, 0x00,
0xf7, 0x52, 0x00, 0x00, 0x00, 0x00, 0x60, 0x00,
0x00, 0x00, 0x00, 0x14, 0x11, 0x01, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00,
0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe,
0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0,
0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75,
0x82, 0x9b, 0x00, 0x14, 0x82, 0x8b, 0x01, 0x01,
0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0xf5, 0xed,
0x08, 0x01};
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
Packet *p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL) {
SCFree(p1);
return 0;
}
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 1;
uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0\r\n"
"\r\n\r\n";
uint16_t buflen = strlen((char *)buf);
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->icmpv6vars.comp_csum = -1;
p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1->icmpv6h = (ICMPV6Hdr *) (valid_raw_ipv6 + 54);
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = buflen;
p1->proto = IPPROTO_ICMPV6;
p2->icmpv6vars.comp_csum = -1;
p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2->icmpv6h = (ICMPV6Hdr *) (invalid_raw_ipv6 + 54);
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
p2->payload_len = buflen;
p2->proto = IPPROTO_ICMPV6;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert icmpv6 any any -> any any "
"(content:\"/one/\"; icmpv6-csum:valid; "
"msg:\"icmpv6-csum keyword check(1)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result &= 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert icmpv6 any any -> any any "
"(content:\"/one/\"; icmpv6-csum:invalid; "
"msg:\"icmpv6-csum keyword check(1)\"; "
"sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result &= 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1))
result &= 1;
else
result &= 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (PacketAlertCheck(p2, 2))
result &= 1;
else
result &= 0;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
SCFree(p1);
SCFree(p2);
return result;
}
int SigTest37NegativeICMPV6Keyword(void)
{
uint8_t valid_raw_ipv6[] = {
0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x00, 0x60,
0x97, 0x07, 0x69, 0xea, 0x86, 0xdd, 0x60, 0x00,
0x00, 0x00, 0x00, 0x44, 0x3a, 0x40, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x60,
0x97, 0xff, 0xfe, 0x07, 0x69, 0xea, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00,
0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x03, 0x00,
0xf7, 0x52, 0x00, 0x00, 0x00, 0x00, 0x60, 0x00,
0x00, 0x00, 0x00, 0x14, 0x11, 0x01, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00,
0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe,
0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0,
0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75,
0x82, 0x9b, 0x00, 0x14, 0x82, 0x8b, 0x01, 0x01,
0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0xf5, 0xed,
0x08, 0x00};
uint8_t invalid_raw_ipv6[] = {
0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x00, 0x60,
0x97, 0x07, 0x69, 0xea, 0x86, 0xdd, 0x60, 0x00,
0x00, 0x00, 0x00, 0x44, 0x3a, 0x40, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x60,
0x97, 0xff, 0xfe, 0x07, 0x69, 0xea, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00,
0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x03, 0x00,
0xf7, 0x52, 0x00, 0x00, 0x00, 0x00, 0x60, 0x00,
0x00, 0x00, 0x00, 0x14, 0x11, 0x01, 0x3f, 0xfe,
0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00,
0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe,
0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0,
0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75,
0x82, 0x9b, 0x00, 0x14, 0x82, 0x8b, 0x01, 0x01,
0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0xf5, 0xed,
0x08, 0x01};
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
Packet *p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL) {
SCFree(p1);
return 0;
}
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 1;
uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0\r\n"
"\r\n\r\n";
uint16_t buflen = strlen((char *)buf);
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->icmpv6vars.comp_csum = -1;
p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1->icmpv6h = (ICMPV6Hdr *) (valid_raw_ipv6 + 54);
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = buflen;
p1->proto = IPPROTO_ICMPV6;
p2->icmpv6vars.comp_csum = -1;
p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2->icmpv6h = (ICMPV6Hdr *) (invalid_raw_ipv6 + 54);
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
p2->payload_len = buflen;
p2->proto = IPPROTO_ICMPV6;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert icmpv6 any any -> any any "
"(content:\"/one/\"; icmpv6-csum:invalid; "
"msg:\"icmpv6-csum keyword check(1)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result &= 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert icmpv6 any any -> any any "
"(content:\"/one/\"; icmpv6-csum:valid; "
"msg:\"icmpv6-csum keyword check(1)\"; "
"sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result &= 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1))
result &= 0;
else
result &= 1;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (PacketAlertCheck(p2, 2))
result &= 0;
else
result &= 1;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
SCFree(p1);
SCFree(p2);
return result;
}
int SigTest38Real(int mpm_type)
{
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 1;
uint8_t raw_eth[] = {
0x00, 0x00, 0x03, 0x04, 0x00, 0x06, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x08, 0x00
};
uint8_t raw_ipv4[] = {
0x45, 0x00, 0x00, 0x7d, 0xd8, 0xf3, 0x40, 0x00,
0x40, 0x06, 0x63, 0x85, 0x7f, 0x00, 0x00, 0x01,
0x7f, 0x00, 0x00, 0x01
};
uint8_t raw_tcp[] = {
0xad, 0x22, 0x04, 0x00, 0x16, 0x39, 0x72,
0xe2, 0x16, 0x1f, 0x79, 0x84, 0x80, 0x18,
0x01, 0x01, 0xfe, 0x71, 0x00, 0x00, 0x01,
0x01, 0x08, 0x0a, 0x00, 0x22, 0xaa, 0x10,
0x00, 0x22, 0xaa, 0x10
};
uint8_t buf[] = {
0x00, 0x00, 0x00, 0x08, 0x62, 0x6f, 0x6f, 0x65,
0x65, 0x6b, 0x0d, 0x0a, 0x4c, 0x45, 0x4e, 0x31,
0x20, 0x38, 0x0d, 0x0a, 0x66, 0x6f, 0x30, 0x30, /* LEN1|20| ends at 17 */
0x30, 0x38, 0x0d, 0x0a, 0x4c, 0x45, 0x4e, 0x32, /* "0008" at offset 5 */
0x20, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39,
0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39,
0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39,
0x39, 0x39, 0x39, 0x0d, 0x0a, 0x41, 0x41, 0x41,
0x41, 0x41, 0x41, 0x0d, 0x0a, 0x0d, 0x0a, 0x0d,
0x0a
};
uint16_t ethlen = sizeof(raw_eth);
uint16_t ipv4len = sizeof(raw_ipv4);
uint16_t tcplen = sizeof(raw_tcp);
uint16_t buflen = sizeof(buf);
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
/* Copy raw data into packet */
if (PacketCopyData(p1, raw_eth, ethlen) == -1) {
SCFree(p1);
return 1;
}
if (PacketCopyDataOffset(p1, ethlen, raw_ipv4, ipv4len) == -1) {
SCFree(p1);
return 1;
}
if (PacketCopyDataOffset(p1, ethlen + ipv4len, raw_tcp, tcplen) == -1) {
SCFree(p1);
return 1;
}
if (PacketCopyDataOffset(p1, ethlen + ipv4len + tcplen, buf, buflen) == -1) {
SCFree(p1);
return 1;
}
SET_PKT_LEN(p1, ethlen + ipv4len + tcplen + buflen);
p1->tcpvars.comp_csum = -1;
p1->ethh = (EthernetHdr *)raw_eth;
p1->ip4h = (IPV4Hdr *)raw_ipv4;
p1->tcph = (TCPHdr *)raw_tcp;
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = GET_PKT_DATA(p1) + ethlen + ipv4len + tcplen;
p1->payload_len = buflen;
p1->proto = IPPROTO_TCP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert tcp any any -> any any "
"(content:\"LEN1|20|\"; "
"byte_test:4,=,8,0; "
"msg:\"byte_test keyword check(1)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result &= 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,
"alert tcp any any -> any any "
"(content:\"LEN1|20|\"; "
"byte_test:4,=,8,5,relative,string,dec; "
"msg:\"byte_test keyword check(2)\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result &= 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1)) {
result = 1;
} else {
result = 0;
printf("sid 1 didn't alert, but should have: ");
goto cleanup;
}
if (PacketAlertCheck(p1, 2)) {
result = 1;
} else {
result = 0;
printf("sid 2 didn't alert, but should have: ");
goto cleanup;
}
cleanup:
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
SCFree(p1);
return result;
}
static int SigTest38B2g (void) {
return SigTest38Real(MPM_B2G);
}
static int SigTest38B3g (void) {
return SigTest38Real(MPM_B3G);
}
static int SigTest38Wm (void) {
return SigTest38Real(MPM_WUMANBER);
}
int SigTest39Real(int mpm_type)
{
Packet *p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 1;
uint8_t raw_eth[] = {
0x00, 0x00, 0x03, 0x04, 0x00, 0x06, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x08, 0x00
};
uint8_t raw_ipv4[] = {
0x45, 0x00, 0x00, 0x7d, 0xd8, 0xf3, 0x40, 0x00,
0x40, 0x06, 0x63, 0x85, 0x7f, 0x00, 0x00, 0x01,
0x7f, 0x00, 0x00, 0x01
};
uint8_t raw_tcp[] = {
0xad, 0x22, 0x04, 0x00, 0x16, 0x39, 0x72,
0xe2, 0x16, 0x1f, 0x79, 0x84, 0x80, 0x18,
0x01, 0x01, 0xfe, 0x71, 0x00, 0x00, 0x01,
0x01, 0x08, 0x0a, 0x00, 0x22, 0xaa, 0x10,
0x00, 0x22, 0xaa, 0x10
};
uint8_t buf[] = {
0x00, 0x00, 0x00, 0x08, 0x62, 0x6f, 0x6f, 0x65,
0x65, 0x6b, 0x0d, 0x0a, 0x4c, 0x45, 0x4e, 0x31,
0x20, 0x38, 0x0d, 0x0a, 0x66, 0x30, 0x30, 0x30,
0x38, 0x72, 0x0d, 0x0a, 0x4c, 0x45, 0x4e, 0x32,
0x20, 0x39, 0x39, 0x4c, 0x45, 0x4e, 0x32, 0x39,
0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39,
0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39,
0x39, 0x39, 0x39, 0x0d, 0x0a, 0x41, 0x41, 0x41,
0x41, 0x41, 0x41, 0x0d, 0x0a, 0x0d, 0x0a, 0x0d,
0x0a
};
uint16_t ethlen = sizeof(raw_eth);
uint16_t ipv4len = sizeof(raw_ipv4);
uint16_t tcplen = sizeof(raw_tcp);
uint16_t buflen = sizeof(buf);
memset(&th_v, 0, sizeof(ThreadVars));
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
/* Copy raw data into packet */
if (PacketCopyData(p1, raw_eth, ethlen) == -1) {
SCFree(p1);
return 1;
}
if (PacketCopyDataOffset(p1, ethlen, raw_ipv4, ipv4len) == -1) {
SCFree(p1);
return 1;
}
if (PacketCopyDataOffset(p1, ethlen + ipv4len, raw_tcp, tcplen) == -1) {
SCFree(p1);
return 1;
}
if (PacketCopyDataOffset(p1, ethlen + ipv4len + tcplen, buf, buflen) == -1) {
SCFree(p1);
return 1;
}
SET_PKT_LEN(p1, ethlen + ipv4len + tcplen + buflen);
p1->tcpvars.comp_csum = -1;
p1->ethh = (EthernetHdr *)raw_eth;
p1->ip4h = (IPV4Hdr *)raw_ipv4;
p1->tcph = (TCPHdr *)raw_tcp;
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = GET_PKT_DATA(p1) + ethlen + ipv4len + tcplen;
p1->payload_len = buflen;
p1->proto = IPPROTO_TCP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,
"alert tcp any any -> any any "
"(content:\"LEN1|20|\"; "
"byte_test:4,=,8,0; "
"byte_jump:4,0; "
"byte_test:6,=,0x4c454e312038,0,relative; "
"msg:\"byte_jump keyword check(1)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result &= 0;
goto end;
}
// XXX TODO
de_ctx->sig_list->next = SigInit(de_ctx,
"alert tcp any any -> any any "
"(content:\"LEN1|20|\"; "
"byte_test:4,=,8,4,relative,string,dec; "
"byte_jump:4,4,relative,string,dec,post_offset 2; "
"byte_test:4,=,0x4c454e32,0,relative; "
"msg:\"byte_jump keyword check(2)\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result &= 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (PacketAlertCheck(p1, 1)) {
result = 1;
} else {
result = 0;
printf("sid 1 didn't alert, but should have: ");
goto cleanup;
}
if (PacketAlertCheck(p1, 2)) {
result = 1;
} else {
result = 0;
printf("sid 2 didn't alert, but should have: ");
goto cleanup;
}
cleanup:
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
SCFree(p1);
return result;
}
static int SigTest39B2g (void) {
return SigTest39Real(MPM_B2G);
}
static int SigTest39B3g (void) {
return SigTest39Real(MPM_B3G);
}
static int SigTest39Wm (void) {
return SigTest39Real(MPM_WUMANBER);
}
/**
* \test SigTest36ContentAndIsdataatKeywords01 is a test to check window with constructed packets,
* \brief expecting to match a size
*/
int SigTest36ContentAndIsdataatKeywords01Real (int mpm_type) {
int result = 0;
// Buid and decode the packet
uint8_t raw_eth [] = {
0x00,0x25,0x00,0x9e,0xfa,0xfe,0x00,0x02,0xcf,0x74,0xfe,0xe1,0x08,0x00,0x45,0x00
,0x01,0xcc,0xcb,0x91,0x00,0x00,0x34,0x06,0xdf,0xa8,0xd1,0x55,0xe3,0x67,0xc0,0xa8
,0x64,0x8c,0x00,0x50,0xc0,0xb7,0xd1,0x11,0xed,0x63,0x81,0xa9,0x9a,0x05,0x80,0x18
,0x00,0x75,0x0a,0xdd,0x00,0x00,0x01,0x01,0x08,0x0a,0x09,0x8a,0x06,0xd0,0x12,0x21
,0x2a,0x3b,0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x31,0x20,0x33,0x30,0x32,0x20,0x46
,0x6f,0x75,0x6e,0x64,0x0d,0x0a,0x4c,0x6f,0x63,0x61,0x74,0x69,0x6f,0x6e,0x3a,0x20
,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x67,0x6f,0x6f,0x67,0x6c
,0x65,0x2e,0x65,0x73,0x2f,0x0d,0x0a,0x43,0x61,0x63,0x68,0x65,0x2d,0x43,0x6f,0x6e
,0x74,0x72,0x6f,0x6c,0x3a,0x20,0x70,0x72,0x69,0x76,0x61,0x74,0x65,0x0d,0x0a,0x43
,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x54,0x79,0x70,0x65,0x3a,0x20,0x74,0x65,0x78
,0x74,0x2f,0x68,0x74,0x6d,0x6c,0x3b,0x20,0x63,0x68,0x61,0x72,0x73,0x65,0x74,0x3d
,0x55,0x54,0x46,0x2d,0x38,0x0d,0x0a,0x44,0x61,0x74,0x65,0x3a,0x20,0x4d,0x6f,0x6e
,0x2c,0x20,0x31,0x34,0x20,0x53,0x65,0x70,0x20,0x32,0x30,0x30,0x39,0x20,0x30,0x38
,0x3a,0x34,0x38,0x3a,0x33,0x31,0x20,0x47,0x4d,0x54,0x0d,0x0a,0x53,0x65,0x72,0x76
,0x65,0x72,0x3a,0x20,0x67,0x77,0x73,0x0d,0x0a,0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74
,0x2d,0x4c,0x65,0x6e,0x67,0x74,0x68,0x3a,0x20,0x32,0x31,0x38,0x0d,0x0a,0x0d,0x0a
,0x3c,0x48,0x54,0x4d,0x4c,0x3e,0x3c,0x48,0x45,0x41,0x44,0x3e,0x3c,0x6d,0x65,0x74
,0x61,0x20,0x68,0x74,0x74,0x70,0x2d,0x65,0x71,0x75,0x69,0x76,0x3d,0x22,0x63,0x6f
,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x74,0x79,0x70,0x65,0x22,0x20,0x63,0x6f,0x6e,0x74
,0x65,0x6e,0x74,0x3d,0x22,0x74,0x65,0x78,0x74,0x2f,0x68,0x74,0x6d,0x6c,0x3b,0x63
,0x68,0x61,0x72,0x73,0x65,0x74,0x3d,0x75,0x74,0x66,0x2d,0x38,0x22,0x3e,0x0a,0x3c
,0x54,0x49,0x54,0x4c,0x45,0x3e,0x33,0x30,0x32,0x20,0x4d,0x6f,0x76,0x65,0x64,0x3c
,0x2f,0x54,0x49,0x54,0x4c,0x45,0x3e,0x3c,0x2f,0x48,0x45,0x41,0x44,0x3e,0x3c,0x42
,0x4f,0x44,0x59,0x3e,0x0a,0x3c,0x48,0x31,0x3e,0x33,0x30,0x32,0x20,0x4d,0x6f,0x76
,0x65,0x64,0x3c,0x2f,0x48,0x31,0x3e,0x0a,0x54,0x68,0x65,0x20,0x64,0x6f,0x63,0x75
,0x6d,0x65,0x6e,0x74,0x20,0x68,0x61,0x73,0x20,0x6d,0x6f,0x76,0x65,0x64,0x0a,0x3c
,0x41,0x20,0x48,0x52,0x45,0x46,0x3d,0x22,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x77
,0x77,0x77,0x2e,0x67,0x6f,0x6f,0x67,0x6c,0x65,0x2e,0x65,0x73,0x2f,0x22,0x3e,0x68
,0x65,0x72,0x65,0x3c,0x2f,0x41,0x3e,0x2e,0x0d,0x0a,0x3c,0x2f,0x42,0x4f,0x44,0x59
,0x3e,0x3c,0x2f,0x48,0x54,0x4d,0x4c,0x3e,0x0d,0x0a };
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
DecodeThreadVars dtv;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&th_v, 0, sizeof(th_v));
FlowInitConfig(FLOW_QUIET);
DecodeEthernet(&th_v, &dtv, p, raw_eth, sizeof(raw_eth), NULL);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"SigTest36ContentAndIsdataatKeywords01 \"; content:\"HTTP\"; isdataat:404, relative; sid:101;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
//PatternMatchPrepare(mpm_ctx, mpm_type);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 101) == 0) {
result = 0;
goto end;
} else {
result=1;
}
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
//PatternMatchDestroy(mpm_ctx);
DetectEngineCtxFree(de_ctx);
FlowShutdown();
SCFree(p);
return result;
end:
if(de_ctx)
{
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
}
if(det_ctx)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
//PatternMatchDestroy(mpm_ctx);
if(de_ctx)
DetectEngineCtxFree(de_ctx);
FlowShutdown();
SCFree(p);
return result;
}
/**
* \test SigTest37ContentAndIsdataatKeywords02 is a test to check window with constructed packets,
* \brief not expecting to match a size
*/
int SigTest37ContentAndIsdataatKeywords02Real (int mpm_type) {
int result = 0;
// Buid and decode the packet
uint8_t raw_eth [] = {
0x00,0x25,0x00,0x9e,0xfa,0xfe,0x00,0x02,0xcf,0x74,0xfe,0xe1,0x08,0x00,0x45,0x00
,0x01,0xcc,0xcb,0x91,0x00,0x00,0x34,0x06,0xdf,0xa8,0xd1,0x55,0xe3,0x67,0xc0,0xa8
,0x64,0x8c,0x00,0x50,0xc0,0xb7,0xd1,0x11,0xed,0x63,0x81,0xa9,0x9a,0x05,0x80,0x18
,0x00,0x75,0x0a,0xdd,0x00,0x00,0x01,0x01,0x08,0x0a,0x09,0x8a,0x06,0xd0,0x12,0x21
,0x2a,0x3b,0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x31,0x20,0x33,0x30,0x32,0x20,0x46
,0x6f,0x75,0x6e,0x64,0x0d,0x0a,0x4c,0x6f,0x63,0x61,0x74,0x69,0x6f,0x6e,0x3a,0x20
,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x67,0x6f,0x6f,0x67,0x6c
,0x65,0x2e,0x65,0x73,0x2f,0x0d,0x0a,0x43,0x61,0x63,0x68,0x65,0x2d,0x43,0x6f,0x6e
,0x74,0x72,0x6f,0x6c,0x3a,0x20,0x70,0x72,0x69,0x76,0x61,0x74,0x65,0x0d,0x0a,0x43
,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x54,0x79,0x70,0x65,0x3a,0x20,0x74,0x65,0x78
,0x74,0x2f,0x68,0x74,0x6d,0x6c,0x3b,0x20,0x63,0x68,0x61,0x72,0x73,0x65,0x74,0x3d
,0x55,0x54,0x46,0x2d,0x38,0x0d,0x0a,0x44,0x61,0x74,0x65,0x3a,0x20,0x4d,0x6f,0x6e
,0x2c,0x20,0x31,0x34,0x20,0x53,0x65,0x70,0x20,0x32,0x30,0x30,0x39,0x20,0x30,0x38
,0x3a,0x34,0x38,0x3a,0x33,0x31,0x20,0x47,0x4d,0x54,0x0d,0x0a,0x53,0x65,0x72,0x76
,0x65,0x72,0x3a,0x20,0x67,0x77,0x73,0x0d,0x0a,0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74
,0x2d,0x4c,0x65,0x6e,0x67,0x74,0x68,0x3a,0x20,0x32,0x31,0x38,0x0d,0x0a,0x0d,0x0a
,0x3c,0x48,0x54,0x4d,0x4c,0x3e,0x3c,0x48,0x45,0x41,0x44,0x3e,0x3c,0x6d,0x65,0x74
,0x61,0x20,0x68,0x74,0x74,0x70,0x2d,0x65,0x71,0x75,0x69,0x76,0x3d,0x22,0x63,0x6f
,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x74,0x79,0x70,0x65,0x22,0x20,0x63,0x6f,0x6e,0x74
,0x65,0x6e,0x74,0x3d,0x22,0x74,0x65,0x78,0x74,0x2f,0x68,0x74,0x6d,0x6c,0x3b,0x63
,0x68,0x61,0x72,0x73,0x65,0x74,0x3d,0x75,0x74,0x66,0x2d,0x38,0x22,0x3e,0x0a,0x3c
,0x54,0x49,0x54,0x4c,0x45,0x3e,0x33,0x30,0x32,0x20,0x4d,0x6f,0x76,0x65,0x64,0x3c
,0x2f,0x54,0x49,0x54,0x4c,0x45,0x3e,0x3c,0x2f,0x48,0x45,0x41,0x44,0x3e,0x3c,0x42
,0x4f,0x44,0x59,0x3e,0x0a,0x3c,0x48,0x31,0x3e,0x33,0x30,0x32,0x20,0x4d,0x6f,0x76
,0x65,0x64,0x3c,0x2f,0x48,0x31,0x3e,0x0a,0x54,0x68,0x65,0x20,0x64,0x6f,0x63,0x75
,0x6d,0x65,0x6e,0x74,0x20,0x68,0x61,0x73,0x20,0x6d,0x6f,0x76,0x65,0x64,0x0a,0x3c
,0x41,0x20,0x48,0x52,0x45,0x46,0x3d,0x22,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x77
,0x77,0x77,0x2e,0x67,0x6f,0x6f,0x67,0x6c,0x65,0x2e,0x65,0x73,0x2f,0x22,0x3e,0x68
,0x65,0x72,0x65,0x3c,0x2f,0x41,0x3e,0x2e,0x0d,0x0a,0x3c,0x2f,0x42,0x4f,0x44,0x59
,0x3e,0x3c,0x2f,0x48,0x54,0x4d,0x4c,0x3e,0x0d,0x0a };
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
DecodeThreadVars dtv;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&th_v, 0, sizeof(th_v));
FlowInitConfig(FLOW_QUIET);
DecodeEthernet(&th_v, &dtv, p, raw_eth, sizeof(raw_eth), NULL);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
Signature *s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"SigTest37ContentAndIsdataatKeywords01 \"; content:\"HTTP\"; isdataat:500, relative; sid:101;)");
if (de_ctx->sig_list == NULL) {
printf("sig parse failed: ");
result = 0;
goto end;
}
if (s->sm_lists[DETECT_SM_LIST_PMATCH]->type != DETECT_CONTENT) {
printf("type not content: ");
goto end;
}
/*
if (s->sm_lists[DETECT_SM_LIST_PMATCH]->next == NULL) {
printf("s->sm_lists[DETECT_SM_LIST_PMATCH]->next == NULL: ");
goto end;
}
if (s->sm_lists[DETECT_SM_LIST_PMATCH]->next->type != DETECT_ISDATAAT) {
printf("type not isdataat: ");
goto end;
}
*/
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 101) == 0) {
result = 1;
goto end;
} else {
printf("sig matched, but should not have: ");
result=0;
}
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
FlowShutdown();
SCFree(p);
return result;
end:
if(de_ctx)
{
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
}
if(det_ctx)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
if(de_ctx)
DetectEngineCtxFree(de_ctx);
FlowShutdown();
SCFree(p);
return result;
}
// Wrapper functions to pass the mpm_type
static int SigTest36ContentAndIsdataatKeywords01B2g (void) {
return SigTest36ContentAndIsdataatKeywords01Real(MPM_B2G);
}
static int SigTest36ContentAndIsdataatKeywords01B3g (void) {
return SigTest36ContentAndIsdataatKeywords01Real(MPM_B3G);
}
static int SigTest36ContentAndIsdataatKeywords01Wm (void) {
return SigTest36ContentAndIsdataatKeywords01Real(MPM_WUMANBER);
}
static int SigTest37ContentAndIsdataatKeywords02B2g (void) {
return SigTest37ContentAndIsdataatKeywords02Real(MPM_B2G);
}
static int SigTest37ContentAndIsdataatKeywords02B3g (void) {
return SigTest37ContentAndIsdataatKeywords02Real(MPM_B3G);
}
static int SigTest37ContentAndIsdataatKeywords02Wm (void) {
return SigTest37ContentAndIsdataatKeywords02Real(MPM_WUMANBER);
}
/**
* \test SigTest41NoPacketInspection is a test to check that when PKT_NOPACKET_INSPECTION
* flag is set, we don't need to inspect the packet protocol header or its contents.
*/
int SigTest40NoPacketInspection01(void) {
uint8_t *buf = (uint8_t *)
"220 (vsFTPd 2.0.5)\r\n";
uint16_t buflen = strlen((char *)buf);
Packet *p = SCMalloc(SIZE_OF_PACKET);
TCPHdr tcphdr;
if (p == NULL)
return 0;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
PacketQueue pq;
Flow f;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
memset(&pq, 0, sizeof(pq));
memset(&f, 0, sizeof(f));
memset(&tcphdr, 0, sizeof(tcphdr));
p->src.family = AF_INET;
p->src.addr_data32[0] = UTHSetIPv4Address("192.168.0.1");
p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4");
p->dst.family = AF_INET;
p->payload = buf;
p->payload_len = buflen;
p->proto = IPPROTO_TCP;
p->dp = 34260;
p->sp = 21;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flags |= PKT_NOPACKET_INSPECTION;
p->tcph = &tcphdr;
p->flow = &f;
FLOW_INITIALIZE(&f);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> 1.2.3.4 any (msg:\"No Packet Inspection Test\"; flow:to_server; sid:2; rev:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx);
det_ctx->de_ctx = de_ctx;
Detect(&th_v, p, det_ctx, &pq, NULL);
if (PacketAlertCheck(p, 2))
result = 0;
else
result = 1;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
//PatternMatchDestroy(mpm_ctx);
DetectEngineCtxFree(de_ctx);
end:
SCFree(p);
return result;
}
/**
* \test SigTest42NoPayloadInspection is a test to check that when PKT_NOPAYLOAD_INSPECTION
* flasg is set, we don't need to inspect the packet contents.
*/
int SigTest40NoPayloadInspection02(void) {
uint8_t *buf = (uint8_t *)
"220 (vsFTPd 2.0.5)\r\n";
uint16_t buflen = strlen((char *)buf);
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 1;
memset(&th_v, 0, sizeof(th_v));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
p->src.family = AF_INET;
p->dst.family = AF_INET;
p->payload = buf;
p->payload_len = buflen;
p->proto = IPPROTO_TCP;
p->flags |= PKT_NOPAYLOAD_INSPECTION;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
result = 0;
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"No Payload TEST\"; content:\"220 (vsFTPd 2.0.5)\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
if (!(de_ctx->sig_list->init_flags & SIG_FLAG_INIT_PAYLOAD))
result = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1))
result &= 0;
else
result &= 1;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
SCFree(p);
return result;
}
static int SigTestMemory01 (void) {
uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.1\r\n"
"Host: one.example.org\r\n"
"\r\n\r\n"
"GET /two/ HTTP/1.1\r\n"
"Host: two.example.org\r\n"
"\r\n\r\n";
uint16_t buflen = strlen((char *)buf);
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
p->src.family = AF_INET;
p->dst.family = AF_INET;
p->payload = buf;
p->payload_len = buflen;
p->proto = IPPROTO_TCP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P<pkt_http_uri>.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
printf("@pre cleanup\n\n");
DetectSigGroupPrintMemory();
DetectAddressPrintMemory();
DetectPortPrintMemory();
SigGroupCleanup(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
printf("@exit\n\n");
DetectSigGroupPrintMemory();
DetectAddressPrintMemory();
DetectPortPrintMemory();
result = 1;
end:
SCFree(p);
return result;
}
static int SigTestMemory02 (void) {
ThreadVars th_v;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 456 (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P<pkt_http_uri>.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any 1:1000 (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P<pkt_http_uri>.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
printf("@cleanup\n\n");
SigGroupCleanup(de_ctx);
DetectEngineCtxFree(de_ctx);
printf("@exit\n\n");
DetectSigGroupPrintMemory();
DetectAddressPrintMemory();
DetectPortPrintMemory();
printf("@exit\n\n");
DetectSigGroupPrintMemory();
DetectAddressPrintMemory();
DetectPortPrintMemory();
result = 1;
end:
return result;
}
static int SigTestMemory03 (void) {
ThreadVars th_v;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> 1.2.3.4 456 (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P<pkt_http_uri>.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> 1.2.3.3-1.2.3.6 1:1000 (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P<pkt_http_uri>.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
de_ctx->sig_list->next->next = SigInit(de_ctx,"alert tcp any any -> !1.2.3.5 1:990 (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P<pkt_http_uri>.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:3;)");
if (de_ctx->sig_list->next->next == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
printf("@cleanup\n\n");
SigGroupCleanup(de_ctx);
DetectEngineCtxFree(de_ctx);
printf("@exit\n\n");
DetectSigGroupPrintMemory();
DetectAddressPrintMemory();
DetectPortPrintMemory();
result = 1;
end:
return result;
}
static int SigTestSgh01 (void) {
ThreadVars th_v;
int result = 0;
DetectEngineThreadCtx *det_ctx;
memset(&th_v, 0, sizeof(th_v));
Packet *p = NULL;
p = UTHBuildPacketSrcDstPorts((uint8_t *)"a", 1, IPPROTO_TCP, 12345, 80);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"1\"; content:\"one\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->num != 0) {
printf("internal id != 0: ");
goto end;
}
if (de_ctx->sig_list->mpm_content_maxlen != 3) {
printf("de_ctx->sig_list->mpm_content_maxlen %u, expected 3: ", de_ctx->sig_list->mpm_content_maxlen);
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any 81 (msg:\"2\"; content:\"two\"; content:\"abcd\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->num != 1) {
printf("internal id != 1: ");
goto end;
}
if (de_ctx->sig_list->next->mpm_content_maxlen != 4) {
printf("de_ctx->sig_list->mpm_content_maxlen %u, expected 4: ", de_ctx->sig_list->next->mpm_content_maxlen);
goto end;
}
de_ctx->sig_list->next->next = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"3\"; content:\"three\"; sid:3;)");
if (de_ctx->sig_list->next->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->next->num != 2) {
printf("internal id != 2: ");
goto end;
}
if (de_ctx->sig_list->next->next->mpm_content_maxlen != 5) {
printf("de_ctx->sig_list->next->next->mpm_content_maxlen %u, expected 5: ", de_ctx->sig_list->next->next->mpm_content_maxlen);
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigGroupHead *sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
#if 0
printf("-\n");
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
#endif
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->match_array == NULL) {
printf("sgh->match_array == NULL: ");
goto end;
}
if (sgh->match_array[0] != de_ctx->sig_list) {
printf("sgh doesn't contain sid 1, should have (sgh->match_array[0] %p, expected %p): ", sgh->match_array[0], de_ctx->sig_list);
goto end;
}
if (sgh->match_array[1] != de_ctx->sig_list->next->next) {
printf("sgh doesn't contain sid 3, should have: ");
goto end;
}
p->dp = 81;
SigGroupHead *sgh2 = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
if (sgh2 == NULL) {
printf("no sgh2: ");
goto end;
}
#if 0
if (!(SigGroupHeadContainsSigId(de_ctx, sgh2, 1))) {
printf("sgh2 doesn't have sid 1: ");
goto end;
}
#endif
if (sgh2->sig_cnt != 1) {
printf("expected one sig, got %u in sgh2: ", sgh2->sig_cnt);
goto end;
}
if (sgh2->match_array[0] != de_ctx->sig_list->next) {
printf("sgh doesn't contain sid 2, should have (sgh2->match_array[0] %p, expected %p): ",
sgh2->match_array[0], de_ctx->sig_list->next);
goto end;
}
#if 0
printf("-\n");
printf("sgh2->mpm_content_maxlen %u\n", sgh2->mpm_content_maxlen);
printf("sgh2->mpm_uricontent_maxlen %u\n", sgh2->mpm_uricontent_maxlen);
printf("sgh2->sig_cnt %u\n", sgh2->sig_cnt);
printf("sgh2->sig_size %u\n", sgh2->sig_size);
#endif
if (sgh2->mpm_content_maxlen != 4) {
printf("sgh2->mpm_content_maxlen %u, expected 4: ", sgh2->mpm_content_maxlen);
goto end;
}
if (sgh2->match_array[0] != de_ctx->sig_list->next) {
printf("sgh2 doesn't contain sid 2, should have: ");
goto end;
}
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
SigGroupCleanup(de_ctx);
DetectEngineCtxFree(de_ctx);
result = 1;
end:
return result;
}
static int SigTestSgh02 (void) {
ThreadVars th_v;
int result = 0;
DetectEngineThreadCtx *det_ctx;
Packet *p = NULL;
p = UTHBuildPacketSrcDstPorts((uint8_t *)"a", 1, IPPROTO_TCP, 12345, 80);
memset(&th_v, 0, sizeof(th_v));
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 80:82 (msg:\"1\"; content:\"one\"; content:\"1\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->num != 0) {
printf("internal id != 0: ");
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any 81 (msg:\"2\"; content:\"two2\"; content:\"abcdef\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->num != 1) {
printf("internal id != 1: ");
goto end;
}
de_ctx->sig_list->next->next = SigInit(de_ctx,"alert tcp any any -> any 80:81 (msg:\"3\"; content:\"three\"; content:\"abcdefgh\"; sid:3;)");
if (de_ctx->sig_list->next->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->next->num != 2) {
printf("internal id != 2: ");
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigGroupHead *sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->match_array == NULL) {
printf("sgh->match_array == NULL: ");
goto end;
}
if (sgh->sig_cnt != 2) {
printf("sgh sig cnt %u, expected 2: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != de_ctx->sig_list) {
printf("sgh doesn't contain sid 1, should have (sgh->match_array[0] %p, expected %p): ", sgh->match_array[0], de_ctx->sig_list);
goto end;
}
if (sgh->match_array[1] != de_ctx->sig_list->next->next) {
printf("sgh doesn't contain sid 3, should have: ");
goto end;
}
#if 0
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
p->dp = 81;
sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->sig_cnt != 3) {
printf("sgh sig cnt %u, expected 3: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != de_ctx->sig_list) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
if (sgh->match_array[1] != de_ctx->sig_list->next) {
printf("sgh doesn't contain sid 2, should have: ");
goto end;
}
if (sgh->match_array[2] != de_ctx->sig_list->next->next) {
printf("sgh doesn't contain sid 3, should have: ");
goto end;
}
#if 0
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
p->dp = 82;
sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->sig_cnt != 1) {
printf("sgh sig cnt %u, expected 1: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != de_ctx->sig_list) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
#if 0
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
p->src.family = AF_INET6;
p->dst.family = AF_INET6;
sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->sig_cnt != 1) {
printf("sgh sig cnt %u, expected 1: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != de_ctx->sig_list) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
#if 0
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
SigGroupCleanup(de_ctx);
DetectEngineCtxFree(de_ctx);
result = 1;
end:
return result;
}
static int SigTestSgh03 (void) {
ThreadVars th_v;
int result = 0;
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
DetectEngineThreadCtx *det_ctx;
memset(&th_v, 0, sizeof(th_v));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
p->src.family = AF_INET;
p->dst.family = AF_INET;
p->payload_len = 1;
p->proto = IPPROTO_TCP;
p->dp = 80;
p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4");
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> 1.2.3.4-1.2.3.6 any (msg:\"1\"; content:\"one\"; content:\"1\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->num != 0) {
printf("internal id != 0: ");
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert ip any any -> 1.2.3.5 any (msg:\"2\"; content:\"two2\"; content:\"abcdef\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->num != 1) {
printf("internal id != 1: ");
goto end;
}
de_ctx->sig_list->next->next = SigInit(de_ctx,"alert ip any any -> 1.2.3.4-1.2.3.5 any (msg:\"3\"; content:\"three\"; content:\"abcdefgh\"; sid:3;)");
if (de_ctx->sig_list->next->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->next->num != 2) {
printf("internal id != 2: ");
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigGroupHead *sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
#if 0
printf("-\n");
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->match_array == NULL) {
printf("sgh->match_array == NULL: ");
goto end;
}
if (sgh->sig_cnt != 2) {
printf("sgh sig cnt %u, expected 2: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != de_ctx->sig_list) {
printf("sgh doesn't contain sid 1, should have (sgh->match_array[0] %p, expected %p): ", sgh->match_array[0], de_ctx->sig_list);
goto end;
}
if (sgh->match_array[1] != de_ctx->sig_list->next->next) {
printf("sgh doesn't contain sid 3, should have: ");
goto end;
}
p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.5");
sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
#if 0
printf("-\n");
printf("sgh %p\n", sgh);
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
if (sgh->sig_cnt != 3) {
printf("sgh sig cnt %u, expected 3: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != de_ctx->sig_list) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
if (sgh->match_array[1] != de_ctx->sig_list->next) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
if (sgh->match_array[2] != de_ctx->sig_list->next->next) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3 (%x): ", sgh->mpm_content_maxlen, p->dst.addr_data32[0]);
goto end;
}
p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.6");
sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
#if 0
printf("-\n");
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->sig_cnt != 1) {
printf("sgh sig cnt %u, expected 1: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != de_ctx->sig_list) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
SigGroupCleanup(de_ctx);
DetectEngineCtxFree(de_ctx);
result = 1;
end:
SCFree(p);
return result;
}
static int SigTestSgh04 (void) {
ThreadVars th_v;
int result = 0;
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
DetectEngineThreadCtx *det_ctx;
memset(&th_v, 0, sizeof(th_v));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
p->src.family = AF_INET;
p->dst.family = AF_INET;
p->payload_len = 1;
p->proto = IPPROTO_TCP;
p->dp = 80;
p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4");
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> 1.2.3.4-1.2.3.6 any (msg:\"1\"; content:\"one\"; content:\"1\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->num != 0) {
printf("internal id != 0: ");
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert ip any any -> 1.2.3.5 any (msg:\"2\"; content:\"two2\"; content:\"abcdef\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->num != 1) {
printf("internal id != 1: ");
goto end;
}
de_ctx->sig_list->next->next = SigInit(de_ctx,"alert ip any any -> 1.2.3.4-1.2.3.5 any (msg:\"3\"; content:\"three\"; content:\"abcdefgh\"; sid:3;)");
if (de_ctx->sig_list->next->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->next->num != 2) {
printf("internal id != 2: ");
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigGroupHead *sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->match_array == NULL) {
printf("sgh->match_array == NULL: ");
goto end;
}
if (sgh->sig_cnt != 2) {
printf("sgh sig cnt %u, expected 2: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != de_ctx->sig_list) {
printf("sgh doesn't contain sid 1, should have (sgh->match_array[0] %p, expected %p): ", sgh->match_array[0], de_ctx->sig_list);
goto end;
}
if (sgh->match_array[1] != de_ctx->sig_list->next->next) {
printf("sgh doesn't contain sid 3, should have: ");
goto end;
}
#if 0
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.5");
sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->sig_cnt != 3) {
printf("sgh sig cnt %u, expected 3: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != de_ctx->sig_list) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
if (sgh->match_array[1] != de_ctx->sig_list->next) {
printf("sgh doesn't contain sid 2, should have: ");
goto end;
}
if (sgh->match_array[2] != de_ctx->sig_list->next->next) {
printf("sgh doesn't contain sid 3, should have: ");
goto end;
}
#if 0
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.6");
sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->sig_cnt != 1) {
printf("sgh sig cnt %u, expected 1: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != de_ctx->sig_list) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
#if 0
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
p->proto = IPPROTO_GRE;
sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
#if 0
printf("-\n");
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->match_array[0] != de_ctx->sig_list) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
SigGroupCleanup(de_ctx);
DetectEngineCtxFree(de_ctx);
result = 1;
end:
SCFree(p);
return result;
}
/** \test setting of mpm type */
static int SigTestSgh05 (void) {
ThreadVars th_v;
int result = 0;
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
DetectEngineThreadCtx *det_ctx;
memset(&th_v, 0, sizeof(th_v));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
p->src.family = AF_INET;
p->dst.family = AF_INET;
p->payload_len = 1;
p->proto = IPPROTO_TCP;
p->dp = 80;
p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4");
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->mpm_matcher = MPM_WUMANBER;
de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> 1.2.3.4-1.2.3.6 any (msg:\"1\"; content:\"one\"; content:\"1\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigGroupHead *sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_proto_tcp_ctx_ts != NULL || sgh->mpm_proto_tcp_ctx_tc != NULL ||
sgh->mpm_proto_udp_ctx_ts != NULL || sgh->mpm_proto_udp_ctx_tc != NULL ||
sgh->mpm_proto_other_ctx != NULL) {
printf("sgh->mpm_proto_tcp_ctx_ts != NULL || sgh->mpm_proto_tcp_ctx_tc != NULL"
"sgh->mpm_proto_udp_ctx_ts != NULL || sgh->mpm_proto_udp_ctx_tc != NULL"
"sgh->mpm_proto_other_ctx != NULL: ");
goto end;
}
if (sgh->mpm_stream_ctx_ts == NULL || sgh->mpm_stream_ctx_tc == NULL) {
printf("sgh->mpm_stream_ctx == NULL || sgh->mpm_stream_ctx_tc == NULL: ");
goto end;
}
if (sgh->mpm_stream_ctx_ts->mpm_type != MPM_WUMANBER) {
printf("sgh->mpm_type != MPM_WUMANBER, expected %d, got %d: ", MPM_WUMANBER, sgh->mpm_stream_ctx_ts->mpm_type);
goto end;
}
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
SigGroupCleanup(de_ctx);
DetectEngineCtxFree(de_ctx);
result = 1;
end:
SCFree(p);
return result;
}
static int SigTestContent01Real (int mpm_type) {
uint8_t *buf = (uint8_t *)"01234567890123456789012345678901";
uint16_t buflen = strlen((char *)buf);
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
Packet *p = NULL;
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1))
result = 1;
else
printf("sig 1 didn't match: ");
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
return result;
}
static int SigTestContent01B2g (void) {
return SigTestContent01Real(MPM_B2G);
}
static int SigTestContent01B3g (void) {
return SigTestContent01Real(MPM_B3G);
}
static int SigTestContent01Wm (void) {
return SigTestContent01Real(MPM_WUMANBER);
}
static int SigTestContent02Real (int mpm_type) {
uint8_t *buf = (uint8_t *)"01234567890123456789012345678901";
uint16_t buflen = strlen((char *)buf);
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
Packet *p = NULL;
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 31\"; content:\"0123456789012345678901234567890\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) {
if (PacketAlertCheck(p, 2)) {
result = 1;
} else
printf("sig 2 didn't match: ");
}
else
printf("sig 1 didn't match: ");
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
return result;
}
static int SigTestContent02B2g (void) {
return SigTestContent02Real(MPM_B2G);
}
static int SigTestContent02B3g (void) {
return SigTestContent02Real(MPM_B3G);
}
static int SigTestContent02Wm (void) {
return SigTestContent02Real(MPM_WUMANBER);
}
static int SigTestContent03Real (int mpm_type) {
uint8_t *buf = (uint8_t *)"01234567890123456789012345678901abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
uint16_t buflen = strlen((char *)buf);
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
Packet *p = NULL;
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:0; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1))
result = 1;
else
printf("sig 1 didn't match: ");
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
return result;
}
static int SigTestContent03B2g (void) {
return SigTestContent03Real(MPM_B2G);
}
static int SigTestContent03B3g (void) {
return SigTestContent03Real(MPM_B3G);
}
static int SigTestContent03Wm (void) {
return SigTestContent03Real(MPM_WUMANBER);
}
static int SigTestContent04Real (int mpm_type) {
uint8_t *buf = (uint8_t *)"01234567890123456789012345678901abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
uint16_t buflen = strlen((char *)buf);
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
Packet *p = NULL;
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:0; within:32; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1))
result = 1;
else
printf("sig 1 didn't match: ");
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
return result;
}
static int SigTestContent04B2g (void) {
return SigTestContent04Real(MPM_B2G);
}
static int SigTestContent04B3g (void) {
return SigTestContent04Real(MPM_B3G);
}
static int SigTestContent04Wm (void) {
return SigTestContent04Real(MPM_WUMANBER);
}
/** \test sigs with patterns at the limit of the pm's size limit */
static int SigTestContent05Real (int mpm_type) {
uint8_t *buf = (uint8_t *)"01234567890123456789012345678901PADabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
uint16_t buflen = strlen((char *)buf);
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
Packet *p = NULL;
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
printf("de_ctx == NULL: ");
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:0; within:32; sid:1;)");
if (de_ctx->sig_list == NULL) {
printf("sig1 parse failed: ");
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:1; within:32; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
printf("sig2 parse failed: ");
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) {
printf("sig 1 matched but shouldn't: ");
goto end;
}
if (PacketAlertCheck(p, 2)) {
printf("sig 2 matched but shouldn't: ");
goto end;
}
result = 1;
end:
UTHFreePackets(&p, 1);
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
if (det_ctx != NULL) {
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
}
if (de_ctx != NULL) {
DetectEngineCtxFree(de_ctx);
}
return result;
}
static int SigTestContent05B2g (void) {
return SigTestContent05Real(MPM_B2G);
}
static int SigTestContent05B3g (void) {
return SigTestContent05Real(MPM_B3G);
}
static int SigTestContent05Wm (void) {
return SigTestContent05Real(MPM_WUMANBER);
}
static int SigTestContent06Real (int mpm_type) {
uint8_t *buf = (uint8_t *)"01234567890123456789012345678901abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
uint16_t buflen = strlen((char *)buf);
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
Packet *p = NULL;
p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Test 32 sig1\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:0; within:32; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Test 32 sig2\"; content:\"01234567890123456789012345678901\"; content:\"abcdefg\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)){
//printf("sig 1 matched :");
}else{
printf("sig 1 didn't match: ");
goto end;
}
if (PacketAlertCheck(p, 2)){
result = 1;
}else{
printf("sig 2 didn't match: ");
goto end;
}
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
return result;
}
static int SigTestContent06B2g (void) {
return SigTestContent06Real(MPM_B2G);
}
static int SigTestContent06B3g (void) {
return SigTestContent06Real(MPM_B3G);
}
static int SigTestContent06Wm (void) {
return SigTestContent06Real(MPM_WUMANBER);
}
static int SigTestWithinReal01 (int mpm_type) {
DecodeThreadVars dtv;
ThreadVars th_v;
int result = 0;
Packet *p1 = NULL;
Packet *p2 = NULL;
Packet *p3 = NULL;
Packet *p4 = NULL;
uint8_t rawpkt1[] = {
0x00,0x04,0x76,0xd3,0xd8,0x6a,0x00,0x24,
0xe8,0x29,0xfa,0x4f,0x08,0x00,0x45,0x00,
0x00,0x8c,0x95,0x50,0x00,0x00,0x40,0x06,
0x2d,0x45,0xc0,0xa8,0x02,0x03,0xd0,0x45,
0x24,0xe6,0x06,0xcc,0x03,0x09,0x18,0x72,
0xd0,0xe3,0x1a,0xab,0x7c,0x98,0x50,0x00,
0x02,0x00,0x46,0xa0,0x00,0x00,0x48,0x69,
0x2c,0x20,0x74,0x68,0x69,0x73,0x20,0x69,
0x73,0x20,0x61,0x20,0x62,0x69,0x67,0x20,
0x74,0x65,0x73,0x74,0x20,0x74,0x6f,0x20,
0x63,0x68,0x65,0x63,0x6b,0x20,0x63,0x6f,
0x6e,0x74,0x65,0x6e,0x74,0x20,0x6d,0x61,
0x74,0x63,0x68,0x65,0x73,0x0a,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00 }; /* end rawpkt1 */
uint8_t rawpkt2[] = {
0x00,0x04,0x76,0xd3,0xd8,0x6a,0x00,0x24,
0xe8,0x29,0xfa,0x4f,0x08,0x00,0x45,0x00,
0x00,0x8c,0x30,0x87,0x00,0x00,0x40,0x06,
0x92,0x0e,0xc0,0xa8,0x02,0x03,0xd0,0x45,
0x24,0xe6,0x06,0xcd,0x03,0x09,0x73,0xec,
0xd5,0x35,0x14,0x7d,0x7c,0x12,0x50,0x00,
0x02,0x00,0xed,0x86,0x00,0x00,0x48,0x69,
0x2c,0x20,0x74,0x68,0x69,0x73,0x20,0x69,
0x73,0x20,0x61,0x20,0x62,0x69,0x67,0x20,
0x74,0x65,0x73,0x74,0x20,0x74,0x6f,0x20,
0x63,0x68,0x65,0x63,0x6b,0x20,0x63,0x6f,
0x6e,0x74,0x65,0x6e,0x74,0x20,0x6d,0x61,
0x74,0x63,0x68,0x65,0x73,0x0a,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00 }; /* end rawpkt2 */
uint8_t rawpkt3[] = {
0x00,0x04,0x76,0xd3,0xd8,0x6a,0x00,0x24,
0xe8,0x29,0xfa,0x4f,0x08,0x00,0x45,0x00,
0x00,0x8c,0x57,0xd8,0x00,0x00,0x40,0x06,
0x6a,0xbd,0xc0,0xa8,0x02,0x03,0xd0,0x45,
0x24,0xe6,0x06,0xce,0x03,0x09,0x06,0x3d,
0x02,0x22,0x2f,0x9b,0x6f,0x8f,0x50,0x00,
0x02,0x00,0x1f,0xae,0x00,0x00,0x48,0x69,
0x2c,0x20,0x74,0x68,0x69,0x73,0x20,0x69,
0x73,0x20,0x61,0x20,0x62,0x69,0x67,0x20,
0x74,0x65,0x73,0x74,0x20,0x74,0x6f,0x20,
0x63,0x68,0x65,0x63,0x6b,0x20,0x63,0x6f,
0x6e,0x74,0x65,0x6e,0x74,0x20,0x6d,0x61,
0x74,0x63,0x68,0x65,0x73,0x0a,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00 }; /* end rawpkt3 */
uint8_t rawpkt4[] = {
0x00,0x04,0x76,0xd3,0xd8,0x6a,0x00,0x24,
0xe8,0x29,0xfa,0x4f,0x08,0x00,0x45,0x00,
0x00,0x8c,0xa7,0x2e,0x00,0x00,0x40,0x06,
0x1b,0x67,0xc0,0xa8,0x02,0x03,0xd0,0x45,
0x24,0xe6,0x06,0xcf,0x03,0x09,0x00,0x0e,
0xdf,0x72,0x3d,0xc2,0x21,0xce,0x50,0x00,
0x02,0x00,0x88,0x25,0x00,0x00,0x48,0x69,
0x2c,0x20,0x74,0x68,0x69,0x73,0x20,0x69,
0x73,0x20,0x61,0x20,0x62,0x69,0x67,0x20,
0x74,0x65,0x73,0x74,0x20,0x74,0x6f,0x20,
0x63,0x68,0x65,0x63,0x6b,0x20,0x63,0x6f,
0x6e,0x74,0x65,0x6e,0x74,0x20,0x6d,0x61,
0x74,0x63,0x68,0x65,0x73,0x0a,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00 }; /* end rawpkt4 */
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&th_v, 0, sizeof(th_v));
DetectEngineThreadCtx *det_ctx = NULL;
FlowInitConfig(FLOW_QUIET);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"within test\"; content:\"Hi, this is a big test to check \"; content:\"content matches\"; distance:0; within:15; sid:556;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
/* packet 1 */
p1 = SCMalloc(SIZE_OF_PACKET);
if (p1 == NULL)
return 0;
memset(p1, 0, SIZE_OF_PACKET);
p1->pkt = (uint8_t *)(p1 + 1);
DecodeEthernet(&th_v, &dtv, p1, rawpkt1, sizeof(rawpkt1), NULL);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
if (!(PacketAlertCheck(p1, 556))) {
printf("failed to match on packet 1: ");
goto end;
}
/* packet 2 */
p2 = SCMalloc(SIZE_OF_PACKET);
if (p2 == NULL)
return 0;
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
DecodeEthernet(&th_v, &dtv, p2, rawpkt2, sizeof(rawpkt2), NULL);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
if (!(PacketAlertCheck(p2, 556))) {
printf("failed to match on packet 2: ");
goto end;
}
/* packet 3 */
p3 = SCMalloc(SIZE_OF_PACKET);
if (p3 == NULL)
return 0;
memset(p3, 0, SIZE_OF_PACKET);
p3->pkt = (uint8_t *)(p3 + 1);
DecodeEthernet(&th_v, &dtv, p3, rawpkt3, sizeof(rawpkt3), NULL);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p3);
if (!(PacketAlertCheck(p3, 556))) {
printf("failed to match on packet 3: ");
goto end;
}
/* packet 4 */
p4 = SCMalloc(SIZE_OF_PACKET);
if (p4 == NULL)
return 0;
memset(p4, 0, SIZE_OF_PACKET);
p4->pkt = (uint8_t *)(p4 + 1);
DecodeEthernet(&th_v, &dtv, p4, rawpkt4, sizeof(rawpkt4), NULL);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p4);
if (!(PacketAlertCheck(p4, 556))) {
printf("failed to match on packet 4: ");
goto end;
}
/* packet 5 */
uint8_t *p5buf = (uint8_t *)"Hi, this is a big test to check content matches";
uint16_t p5buflen = strlen((char *)p5buf);
Packet *p5 = UTHBuildPacket(p5buf, p5buflen, IPPROTO_TCP);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p5);
if (!(PacketAlertCheck(p5, 556))) {
printf("failed to match on packet 5: ");
goto end;
}
UTHFreePackets(&p5, 1);
result = 1;
end:
if (de_ctx != NULL) {
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
}
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
if (de_ctx != NULL)
DetectEngineCtxFree(de_ctx);
FlowShutdown();
if (p1 != NULL)
SCFree(p1);
if (p2 != NULL)
SCFree(p2);
if (p3 != NULL)
SCFree(p3);
if (p4 != NULL)
SCFree(p4);
return result;
}
static int SigTestWithinReal01B2g (void) {
return SigTestWithinReal01(MPM_B2G);
}
static int SigTestWithinReal01B3g (void) {
return SigTestWithinReal01(MPM_B3G);
}
static int SigTestWithinReal01Wm (void) {
return SigTestWithinReal01(MPM_WUMANBER);
}
static int SigTestDepthOffset01Real (int mpm_type) {
uint8_t *buf = (uint8_t *)"01234567890123456789012345678901abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
uint16_t buflen = strlen((char *)buf);
Packet *p = NULL;
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
p = UTHBuildPacket(buf, buflen, IPPROTO_TCP);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = mpm_type;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"depth offset\"; content:\"456\"; offset:4; depth:3; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1))
result = 1;
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
UTHFreePackets(&p, 1);
return result;
}
static int SigTestDepthOffset01B2g (void) {
return SigTestDepthOffset01Real(MPM_B2G);
}
static int SigTestDepthOffset01B3g (void) {
return SigTestDepthOffset01Real(MPM_B3G);
}
static int SigTestDepthOffset01Wm (void) {
return SigTestDepthOffset01Real(MPM_WUMANBER);
}
static int SigTestDetectAlertCounter(void)
{
Packet *p = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
int result = 0;
memset(&tv, 0, sizeof(tv));
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = MPM_B2G;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"Test counter\"; "
"content:\"boo\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
goto end;
}
SigGroupBuild(de_ctx);
tv.name = "detect_test";
DetectEngineThreadCtxInit(&tv, de_ctx, (void *)&det_ctx);
p = UTHBuildPacket((uint8_t *)"boo", strlen("boo"), IPPROTO_TCP);
Detect(&tv, p, det_ctx, NULL, NULL);
result = (SCPerfGetLocalCounterValue(det_ctx->counter_alerts, tv.sc_perf_pca) == 1);
Detect(&tv, p, det_ctx, NULL, NULL);
result &= (SCPerfGetLocalCounterValue(det_ctx->counter_alerts, tv.sc_perf_pca) == 2);
UTHFreePackets(&p, 1);
p = UTHBuildPacket((uint8_t *)"roo", strlen("roo"), IPPROTO_TCP);
Detect(&tv, p, det_ctx, NULL, NULL);
result &= (SCPerfGetLocalCounterValue(det_ctx->counter_alerts, tv.sc_perf_pca) == 2);
UTHFreePackets(&p, 1);
p = UTHBuildPacket((uint8_t *)"laboosa", strlen("laboosa"), IPPROTO_TCP);
Detect(&tv, p, det_ctx, NULL, NULL);
result &= (SCPerfGetLocalCounterValue(det_ctx->counter_alerts, tv.sc_perf_pca) == 3);
UTHFreePackets(&p, 1);
end:
SigGroupCleanup(de_ctx);
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
return result;
}
/** \test test if the engine set flag to drop pkts of a flow that
* triggered a drop action on IPS mode */
static int SigTestDropFlow01(void)
{
int result = 0;
Flow f;
HtpState *http_state = NULL;
uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n"
"User-Agent: Mozilla/1.0\r\n"
"Cookie: hellocatch\r\n\r\n";
uint32_t http_buf1_len = sizeof(http_buf1) - 1;
TcpSession ssn;
Packet *p = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
memset(&tv, 0, sizeof(ThreadVars));
memset(&f, 0, sizeof(Flow));
memset(&ssn, 0, sizeof(TcpSession));
p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.flags |= FLOW_IPV4;
p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_ESTABLISHED;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
f.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = MPM_B2G;
de_ctx->flags |= DE_QUIET;
s = de_ctx->sig_list = SigInit(de_ctx, "drop http any any -> any any "
"(msg:\"Test proto match\"; "
"sid:1;)");
if (s == NULL) {
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
goto end;
}
http_state = f.alstate;
if (http_state == NULL) {
printf("no http state: ");
goto end;
}
/* do detect */
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
if (!PacketAlertCheck(p, 1)) {
printf("sig 1 didn't alert, but it should: ");
goto end;
}
if ( !(p->flow->flags & FLOW_ACTION_DROP)) {
printf("sig 1 alerted but flow was not flagged correctly: ");
goto end;
}
/* Ok, now we know that the flag is set for proto http */
result = 1;
end:
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&tv, det_ctx);
if (de_ctx != NULL)
SigGroupCleanup(de_ctx);
if (de_ctx != NULL)
DetectEngineCtxFree(de_ctx);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
UTHFreePackets(&p, 1);
return result;
}
/** \test test if the engine set flag to drop pkts of a flow that
* triggered a drop action on IPS mode */
static int SigTestDropFlow02(void)
{
int result = 0;
Flow f;
HtpState *http_state = NULL;
uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n"
"User-Agent: Mozilla/1.0\r\n"
"Cookie: hellocatch\r\n\r\n";
uint32_t http_buf1_len = sizeof(http_buf1) - 1;
TcpSession ssn;
Packet *p = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
memset(&tv, 0, sizeof(ThreadVars));
memset(&f, 0, sizeof(Flow));
memset(&ssn, 0, sizeof(TcpSession));
p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.flags |= FLOW_IPV4;
p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_ESTABLISHED;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
f.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = MPM_B2G;
de_ctx->flags |= DE_QUIET;
s = de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any 80 "
"(msg:\"Test proto match\"; uricontent:\"one\";"
"sid:1;)");
if (s == NULL) {
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
goto end;
}
http_state = f.alstate;
if (http_state == NULL) {
printf("no http state: ");
goto end;
}
/* do detect */
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
if (!PacketAlertCheck(p, 1)) {
printf("sig 1 didn't alert, but it should: ");
goto end;
}
if ( !(p->flow->flags & FLOW_ACTION_DROP)) {
printf("sig 1 alerted but flow was not flagged correctly: ");
goto end;
}
/* Ok, now we know that the flag is set for app layer sigs
* (ex: inspecting uricontent) */
result = 1;
end:
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&tv, det_ctx);
if (de_ctx != NULL)
SigGroupCleanup(de_ctx);
if (de_ctx != NULL)
DetectEngineCtxFree(de_ctx);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
UTHFreePackets(&p, 1);
return result;
}
/** \test test if the engine set flag to drop pkts of a flow that
* triggered a drop action on IPS mode, and it doesn't inspect
* any other packet of the stream */
static int SigTestDropFlow03(void)
{
int result = 0;
Flow f;
HtpState *http_state = NULL;
uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n"
"User-Agent: Mozilla/1.0\r\n"
"Cookie: hellocatch\r\n\r\n";
uint32_t http_buf1_len = sizeof(http_buf1) - 1;
uint8_t http_buf2[] = "POST /two HTTP/1.0\r\n"
"User-Agent: Mozilla/1.0\r\n"
"Cookie: hellocatch\r\n\r\n";
uint32_t http_buf2_len = sizeof(http_buf1) - 1;
/* Set the engine mode to IPS */
SET_ENGINE_MODE_IPS(engine_mode);
TcpSession ssn;
Packet *p1 = NULL;
Packet *p2 = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
memset(&tv, 0, sizeof(ThreadVars));
memset(&f, 0, sizeof(Flow));
memset(&ssn, 0, sizeof(TcpSession));
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.flags |= FLOW_IPV4;
p1->flow = &f;
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p2->flow = &f;
p2->flowflags |= FLOW_PKT_TOSERVER;
p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
f.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = MPM_B2G;
de_ctx->flags |= DE_QUIET;
s = de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any 80 "
"(msg:\"Test proto match\"; uricontent:\"one\";"
"sid:1;)");
if (s == NULL) {
goto end;
}
/* the no inspection flag should be set after the first sig gets triggered,
* so the second packet should not match the next sig (because of no inspection) */
s = de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any 80 "
"(msg:\"Test proto match\"; uricontent:\"two\";"
"sid:2;)");
if (s == NULL) {
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
goto end;
}
http_state = f.alstate;
if (http_state == NULL) {
printf("no http state: ");
goto end;
}
/* do detect */
SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
if (!PacketAlertCheck(p1, 1)) {
printf("sig 1 didn't alert on p1, but it should: ");
goto end;
}
if ( !(p1->flow->flags & FLOW_ACTION_DROP)) {
printf("sig 1 alerted but flow was not flagged correctly: ");
goto end;
}
/* Second part.. Let's feed with another packet */
if (StreamTcpCheckFlowDrops(p2) == 1) {
SCLogDebug("This flow/stream triggered a drop rule");
FlowSetNoPacketInspectionFlag(p2->flow);
DecodeSetNoPacketInspectionFlag(p2);
FlowSetSessionNoApplayerInspectionFlag(p2->flow);
p2->action |= ACTION_DROP;
/* return the segments to the pool */
StreamTcpSessionPktFree(p2);
}
if ( !(p2->flags & PKT_NOPACKET_INSPECTION)) {
printf("The packet was not flagged with no-inspection: ");
goto end;
}
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len);
if (r != 0) {
printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
goto end;
}
/* do detect */
SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
if (PacketAlertCheck(p2, 1)) {
printf("sig 1 alerted, but it should not since the no pkt inspection should be set: ");
goto end;
}
if (PacketAlertCheck(p2, 2)) {
printf("sig 2 alerted, but it should not since the no pkt inspection should be set: ");
goto end;
}
if ( !(p2->action & ACTION_DROP)) {
printf("A \"drop\" action should be set from the flow to the packet: ");
goto end;
}
result = 1;
end:
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&tv, det_ctx);
if (de_ctx != NULL)
SigGroupCleanup(de_ctx);
if (de_ctx != NULL)
DetectEngineCtxFree(de_ctx);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
UTHFreePackets(&p1, 1);
UTHFreePackets(&p2, 1);
/* Restore mode to IDS */
SET_ENGINE_MODE_IDS(engine_mode);
return result;
}
/** \test test if the engine set flag to drop pkts of a flow that
* triggered a drop action on IDS mode, but continue the inspection
* as usual (instead of on IPS mode) */
static int SigTestDropFlow04(void)
{
int result = 0;
Flow f;
HtpState *http_state = NULL;
uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n"
"User-Agent: Mozilla/1.0\r\n"
"Cookie: hellocatch\r\n\r\n";
uint32_t http_buf1_len = sizeof(http_buf1) - 1;
uint8_t http_buf2[] = "POST /two HTTP/1.0\r\n"
"User-Agent: Mozilla/1.0\r\n"
"Cookie: hellocatch\r\n\r\n";
uint32_t http_buf2_len = sizeof(http_buf1) - 1;
TcpSession ssn;
Packet *p1 = NULL;
Packet *p2 = NULL;
Signature *s = NULL;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
memset(&tv, 0, sizeof(ThreadVars));
memset(&f, 0, sizeof(Flow));
memset(&ssn, 0, sizeof(TcpSession));
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.flags |= FLOW_IPV4;
p1->flow = &f;
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p2->flow = &f;
p2->flowflags |= FLOW_PKT_TOSERVER;
p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
f.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->mpm_matcher = MPM_B2G;
de_ctx->flags |= DE_QUIET;
s = de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any 80 "
"(msg:\"Test proto match\"; uricontent:\"one\";"
"sid:1;)");
if (s == NULL) {
goto end;
}
/* the no inspection flag should be set after the first sig gets triggered,
* so the second packet should not match the next sig (because of no inspection) */
s = de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any 80 "
"(msg:\"Test proto match\"; uricontent:\"two\";"
"sid:2;)");
if (s == NULL) {
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
goto end;
}
http_state = f.alstate;
if (http_state == NULL) {
printf("no http state: ");
goto end;
}
/* do detect */
SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
if (!PacketAlertCheck(p1, 1)) {
printf("sig 1 didn't alert on p1, but it should: ");
goto end;
}
if (PacketAlertCheck(p1, 2)) {
printf("sig 2 alerted on p1, but it should not: ");
goto end;
}
if ( !(p1->flow->flags & FLOW_ACTION_DROP)) {
printf("sig 1 alerted but flow was not flagged correctly: ");
goto end;
}
if (!(p1->action & ACTION_DROP)) {
printf("A \"drop\" action was set from the flow to the packet "
"which is right, but setting the flag shouldn't disable "
"inspection on the packet in IDS mode");
goto end;
}
/* Second part.. Let's feed with another packet */
if (StreamTcpCheckFlowDrops(p2) == 1) {
FlowSetNoPacketInspectionFlag(p2->flow);
DecodeSetNoPacketInspectionFlag(p2);
FlowSetSessionNoApplayerInspectionFlag(p2->flow);
p2->action |= ACTION_DROP;
/* return the segments to the pool */
StreamTcpSessionPktFree(p2);
}
if ( (p2->flags & PKT_NOPACKET_INSPECTION)) {
printf("The packet was flagged with no-inspection but we are not on IPS mode: ");
goto end;
}
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len);
if (r != 0) {
printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
goto end;
}
/* do detect */
SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
if (PacketAlertCheck(p2, 1)) {
printf("sig 1 alerted, but it should not: ");
goto end;
}
if (!PacketAlertCheck(p2, 2)) {
printf("sig 2 didn't alert, but it should, since we are not on IPS mode: ");
goto end;
}
if (!(p2->action & ACTION_DROP)) {
printf("A \"drop\" action was set from the flow to the packet "
"which is right, but setting the flag shouldn't disable "
"inspection on the packet in IDS mode");
goto end;
}
result = 1;
end:
if (det_ctx != NULL)
DetectEngineThreadCtxDeinit(&tv, det_ctx);
if (de_ctx != NULL)
SigGroupCleanup(de_ctx);
if (de_ctx != NULL)
DetectEngineCtxFree(de_ctx);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
UTHFreePackets(&p1, 1);
UTHFreePackets(&p2, 1);
return result;
}
/// SCLogInfo("%s %u %u %u %u", #v, (v).dw[0], (v).dw[1], (v).dw[2], (v).dw[3]);
#define VECTOR_SCLogInfo(v) { \
SCLogInfo("%s %08X %08X %08X %08X", #v, (v).dw[0], (v).dw[1], (v).dw[2], (v).dw[3]); \
}
/**
* \test Test 32 bit SIMD code.
*/
int SigTestSIMDMask01(void) {
#if defined (__SSE3__)
Vector pm, sm, r1, r2;
uint32_t bm = 0;
uint8_t *mask = SCMallocAligned(32, 16);
memset(mask, 0xEF, 32);
mask[31] = 0xFF;
printf("\n");
pm.v = _mm_set1_epi8(0xEF);
VECTOR_SCLogInfo(pm);
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&mask[0]);
VECTOR_SCLogInfo(sm);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
VECTOR_SCLogInfo(r1);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
VECTOR_SCLogInfo(r2);
/* convert into a bitarray */
bm = ((uint32_t) _mm_movemask_epi8(r2.v));
SCLogInfo("bm %08x", bm);
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&mask[16]);
VECTOR_SCLogInfo(sm);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
VECTOR_SCLogInfo(r1);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
VECTOR_SCLogInfo(r2);
/* convert into a bitarray */
bm |= ((uint32_t) _mm_movemask_epi8(r2.v)) << 16;
SCLogInfo("bm %08x", bm);
int b = 0;
for ( ; b < 32; b++){
if (bm & (1 << b)) {
SCLogInfo("b %02d, set", b);
} else {
SCLogInfo("b %02d, not set", b);
}
}
if (!(bm & (1 << 31))) {
return 1;
}
return 0;
#else
return 1;
#endif
}
/**
* \test Test 32 bit SIMD code.
*/
int SigTestSIMDMask02(void) {
#if defined (__SSE3__)
Vector pm, sm, r1, r2;
uint32_t bm = 0;
uint8_t *mask = SCMallocAligned(32, 16);
memset(mask, 0x01, 32);
mask[31] = 0;
pm.v = _mm_set1_epi8(0x02);
VECTOR_SCLogInfo(pm);
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&mask[0]);
VECTOR_SCLogInfo(sm);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
VECTOR_SCLogInfo(r1);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
VECTOR_SCLogInfo(r2);
/* convert into a bitarray */
bm = ((uint32_t) _mm_movemask_epi8(r2.v));
SCLogInfo("bm %08x", bm);
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&mask[16]);
VECTOR_SCLogInfo(sm);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
VECTOR_SCLogInfo(r1);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
VECTOR_SCLogInfo(r2);
/* convert into a bitarray */
bm |= ((uint32_t) _mm_movemask_epi8(r2.v)) << 16;
SCLogInfo("bm %08x", bm);
int b = 0;
for ( ; b < 32; b++){
if (bm & (1 << b)) {
SCLogInfo("b %02d, set", b);
} else {
SCLogInfo("b %02d, not set", b);
}
}
if (bm & (1 << 31)) {
return 1;
}
return 0;
#else
return 1;
#endif
}
/**
* \test Test 64 bit SIMD code.
*/
int SigTestSIMDMask03(void) {
#if defined (__SSE3__)
Vector pm, sm, r1, r2;
uint64_t bm = 0;
uint8_t *mask = SCMallocAligned(64, 16);
memset(mask, 0xEF, 64);
mask[31] = 0xFF;
mask[62] = 0xFF;
printf("\n");
pm.v = _mm_set1_epi8(0xEF);
VECTOR_SCLogInfo(pm);
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&mask[0]);
VECTOR_SCLogInfo(sm);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
VECTOR_SCLogInfo(r1);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
VECTOR_SCLogInfo(r2);
/* convert into a bitarray */
bm = ((uint64_t) _mm_movemask_epi8(r2.v));
SCLogInfo("bm1 %"PRIxMAX, (uintmax_t)bm);
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&mask[16]);
VECTOR_SCLogInfo(sm);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
VECTOR_SCLogInfo(r1);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
VECTOR_SCLogInfo(r2);
/* convert into a bitarray */
bm |= ((uint64_t) _mm_movemask_epi8(r2.v)) << 16;
SCLogInfo("bm2 %"PRIxMAX, (uintmax_t)bm);
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&mask[32]);
VECTOR_SCLogInfo(sm);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
VECTOR_SCLogInfo(r1);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
VECTOR_SCLogInfo(r2);
/* convert into a bitarray */
bm |= ((uint64_t) _mm_movemask_epi8(r2.v)) << 32;
SCLogInfo("bm3 %"PRIxMAX, (uintmax_t)bm);
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&mask[48]);
VECTOR_SCLogInfo(sm);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
VECTOR_SCLogInfo(r1);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
VECTOR_SCLogInfo(r2);
/* convert into a bitarray */
bm |= ((uint64_t) _mm_movemask_epi8(r2.v)) << 48;
SCLogInfo("bm4 %"PRIxMAX, (uintmax_t)bm);
int b = 0;
for ( ; b < 64; b++){
if (bm & ((uint64_t)1 << b)) {
SCLogInfo("b %02d, set", b);
} else {
SCLogInfo("b %02d, not set", b);
}
}
if (!(bm & ((uint64_t)1 << 31)) && !(bm & ((uint64_t)1 << 62))) {
return 1;
}
return 0;
#else
return 1;
#endif
}
/**
* \test Test 64 bit SIMD code.
*/
int SigTestSIMDMask04(void) {
#if defined (__SSE3__)
Vector pm, sm, r1, r2;
uint64_t bm = 0;
uint8_t *mask = SCMallocAligned(64, 16);
memset(mask, 0x01, 64);
mask[31] = 0;
mask[62] = 0;
pm.v = _mm_set1_epi8(0x02);
VECTOR_SCLogInfo(pm);
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&mask[0]);
VECTOR_SCLogInfo(sm);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
VECTOR_SCLogInfo(r1);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
VECTOR_SCLogInfo(r2);
/* convert into a bitarray */
bm = ((uint64_t) _mm_movemask_epi8(r2.v));
SCLogInfo("bm1 %"PRIxMAX, (uintmax_t)bm);
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&mask[16]);
VECTOR_SCLogInfo(sm);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
VECTOR_SCLogInfo(r1);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
VECTOR_SCLogInfo(r2);
/* convert into a bitarray */
bm |= ((uint64_t) _mm_movemask_epi8(r2.v)) << 16;
SCLogInfo("bm2 %"PRIxMAX, (uintmax_t)bm);
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&mask[32]);
VECTOR_SCLogInfo(sm);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
VECTOR_SCLogInfo(r1);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
VECTOR_SCLogInfo(r2);
/* convert into a bitarray */
bm |= ((uint64_t) _mm_movemask_epi8(r2.v)) << 32;
SCLogInfo("bm3 %"PRIxMAX, (uintmax_t)bm);
/* load a batch of masks */
sm.v = _mm_load_si128((const __m128i *)&mask[48]);
VECTOR_SCLogInfo(sm);
/* logical AND them with the packet's mask */
r1.v = _mm_and_si128(pm.v, sm.v);
VECTOR_SCLogInfo(r1);
/* compare the result with the original mask */
r2.v = _mm_cmpeq_epi8(sm.v, r1.v);
VECTOR_SCLogInfo(r2);
/* convert into a bitarray */
bm |= (((uint64_t) _mm_movemask_epi8(r2.v)) << 48);
SCLogInfo("bm4-total %"PRIxMAX, (uintmax_t)bm);
int b = 0;
for ( ; b < 64; b++){
if (bm & ((uint64_t)1 << b)) {
SCLogInfo("b %02d, set", b);
} else {
SCLogInfo("b %02d, not set", b);
}
}
if ((bm & ((uint64_t)1 << 31)) && (bm & ((uint64_t)1 << 62))) {
return 1;
}
return 0;
#else
return 1;
#endif
}
#endif /* UNITTESTS */
void SigRegisterTests(void) {
#ifdef UNITTESTS
SigParseRegisterTests();
IPOnlyRegisterTests();
UtRegisterTest("SigTest01B2g -- HTTP URI cap", SigTest01B2g, 1);
UtRegisterTest("SigTest01B3g -- HTTP URI cap", SigTest01B3g, 1);
UtRegisterTest("SigTest01Wm -- HTTP URI cap", SigTest01Wm, 1);
UtRegisterTest("SigTest02B2g -- Offset/Depth match", SigTest02B2g, 1);
UtRegisterTest("SigTest02B3g -- Offset/Depth match", SigTest02B3g, 1);
UtRegisterTest("SigTest02Wm -- Offset/Depth match", SigTest02Wm, 1);
UtRegisterTest("SigTest03B2g -- offset/depth mismatch", SigTest03B2g, 1);
UtRegisterTest("SigTest03B3g -- offset/depth mismatch", SigTest03B3g, 1);
UtRegisterTest("SigTest03Wm -- offset/depth mismatch", SigTest03Wm, 1);
UtRegisterTest("SigTest04B2g -- distance/within match", SigTest04B2g, 1);
UtRegisterTest("SigTest04B3g -- distance/within match", SigTest04B3g, 1);
UtRegisterTest("SigTest04Wm -- distance/within match", SigTest04Wm, 1);
UtRegisterTest("SigTest05B2g -- distance/within mismatch", SigTest05B2g, 1);
UtRegisterTest("SigTest05B3g -- distance/within mismatch", SigTest05B3g, 1);
UtRegisterTest("SigTest05Wm -- distance/within mismatch", SigTest05Wm, 1);
UtRegisterTest("SigTest06B2g -- uricontent HTTP/1.1 match test", SigTest06B2g, 1);
UtRegisterTest("SigTest06B3g -- uricontent HTTP/1.1 match test", SigTest06B3g, 1);
UtRegisterTest("SigTest06wm -- uricontent HTTP/1.1 match test", SigTest06Wm, 1);
UtRegisterTest("SigTest07B2g -- uricontent HTTP/1.1 mismatch test", SigTest07B2g, 1);
UtRegisterTest("SigTest07B3g -- uricontent HTTP/1.1 mismatch test", SigTest07B3g, 1);
UtRegisterTest("SigTest07Wm -- uricontent HTTP/1.1 mismatch test", SigTest07Wm, 1);
UtRegisterTest("SigTest08B2g -- uricontent HTTP/1.0 match test", SigTest08B2g, 1);
UtRegisterTest("SigTest08B3g -- uricontent HTTP/1.0 match test", SigTest08B3g, 1);
UtRegisterTest("SigTest08Wm -- uricontent HTTP/1.0 match test", SigTest08Wm, 1);
UtRegisterTest("SigTest09B2g -- uricontent HTTP/1.0 mismatch test", SigTest09B2g, 1);
UtRegisterTest("SigTest09B3g -- uricontent HTTP/1.0 mismatch test", SigTest09B3g, 1);
UtRegisterTest("SigTest09Wm -- uricontent HTTP/1.0 mismatch test", SigTest09Wm, 1);
UtRegisterTest("SigTest10B2g -- long content match, longer than pkt", SigTest10B2g, 1);
UtRegisterTest("SigTest10B3g -- long content match, longer than pkt", SigTest10B3g, 1);
UtRegisterTest("SigTest10Wm -- long content match, longer than pkt", SigTest10Wm, 1);
UtRegisterTest("SigTest11B2g -- mpm searching", SigTest11B2g, 1);
UtRegisterTest("SigTest11B3g -- mpm searching", SigTest11B3g, 1);
UtRegisterTest("SigTest11Wm -- mpm searching", SigTest11Wm, 1);
UtRegisterTest("SigTest12B2g -- content order matching, normal", SigTest12B2g, 1);
UtRegisterTest("SigTest12B3g -- content order matching, normal", SigTest12B3g, 1);
UtRegisterTest("SigTest12Wm -- content order matching, normal", SigTest12Wm, 1);
UtRegisterTest("SigTest13B2g -- content order matching, diff order", SigTest13B2g, 1);
UtRegisterTest("SigTest13B3g -- content order matching, diff order", SigTest13B3g, 1);
UtRegisterTest("SigTest13Wm -- content order matching, diff order", SigTest13Wm, 1);
UtRegisterTest("SigTest14B2g -- content order matching, distance 0", SigTest14B2g, 1);
UtRegisterTest("SigTest14B3g -- content order matching, distance 0", SigTest14B3g, 1);
UtRegisterTest("SigTest14Wm -- content order matching, distance 0", SigTest14Wm, 1);
UtRegisterTest("SigTest15B2g -- port negation sig (no match)", SigTest15B2g, 1);
UtRegisterTest("SigTest15B3g -- port negation sig (no match)", SigTest15B3g, 1);
UtRegisterTest("SigTest15Wm -- port negation sig (no match)", SigTest15Wm, 1);
UtRegisterTest("SigTest16B2g -- port negation sig (match)", SigTest16B2g, 1);
UtRegisterTest("SigTest16B3g -- port negation sig (match)", SigTest16B3g, 1);
UtRegisterTest("SigTest16Wm -- port negation sig (match)", SigTest16Wm, 1);
UtRegisterTest("SigTest17B2g -- HTTP Host Pkt var capture", SigTest17B2g, 1);
UtRegisterTest("SigTest17B3g -- HTTP Host Pkt var capture", SigTest17B3g, 1);
UtRegisterTest("SigTest17Wm -- HTTP Host Pkt var capture", SigTest17Wm, 1);
UtRegisterTest("SigTest18B2g -- Ftp negation sig test", SigTest18B2g, 1);
UtRegisterTest("SigTest18B3g -- Ftp negation sig test", SigTest18B3g, 1);
UtRegisterTest("SigTest18Wm -- Ftp negation sig test", SigTest18Wm, 1);
UtRegisterTest("SigTest19B2g -- IP-ONLY test (1)", SigTest19B2g, 1);
UtRegisterTest("SigTest19B3g -- IP-ONLY test (1)", SigTest19B3g, 1);
UtRegisterTest("SigTest19Wm -- IP-ONLY test (1)", SigTest19Wm, 1);
UtRegisterTest("SigTest20B2g -- IP-ONLY test (2)", SigTest20B2g, 1);
UtRegisterTest("SigTest20B3g -- IP-ONLY test (2)", SigTest20B3g, 1);
UtRegisterTest("SigTest20Wm -- IP-ONLY test (2)", SigTest20Wm, 1);
UtRegisterTest("SigTest21B2g -- FLOWBIT test (1)", SigTest21B2g, 1);
UtRegisterTest("SigTest21B3g -- FLOWBIT test (1)", SigTest21B3g, 1);
UtRegisterTest("SigTest21Wm -- FLOWBIT test (1)", SigTest21Wm, 1);
UtRegisterTest("SigTest22B2g -- FLOWBIT test (2)", SigTest22B2g, 1);
UtRegisterTest("SigTest22B3g -- FLOWBIT test (2)", SigTest22B3g, 1);
UtRegisterTest("SigTest22Wm -- FLOWBIT test (2)", SigTest22Wm, 1);
UtRegisterTest("SigTest23B2g -- FLOWBIT test (3)", SigTest23B2g, 1);
UtRegisterTest("SigTest23B3g -- FLOWBIT test (3)", SigTest23B3g, 1);
UtRegisterTest("SigTest23Wm -- FLOWBIT test (3)", SigTest23Wm, 1);
UtRegisterTest("SigTest24IPV4Keyword", SigTest24IPV4Keyword, 1);
UtRegisterTest("SigTest25NegativeIPV4Keyword",
SigTest25NegativeIPV4Keyword, 1);
UtRegisterTest("SigTest26TCPV4Keyword", SigTest26TCPV4Keyword, 1);
UtRegisterTest("SigTest27NegativeTCPV4Keyword",
SigTest27NegativeTCPV4Keyword, 1);
UtRegisterTest("SigTest28TCPV6Keyword", SigTest28TCPV6Keyword, 1);
UtRegisterTest("SigTest29NegativeTCPV6Keyword",
SigTest29NegativeTCPV6Keyword, 1);
UtRegisterTest("SigTest30UDPV4Keyword", SigTest30UDPV4Keyword, 1);
UtRegisterTest("SigTest31NegativeUDPV4Keyword",
SigTest31NegativeUDPV4Keyword, 1);
UtRegisterTest("SigTest32UDPV6Keyword", SigTest32UDPV6Keyword, 1);
UtRegisterTest("SigTest33NegativeUDPV6Keyword",
SigTest33NegativeUDPV6Keyword, 1);
UtRegisterTest("SigTest34ICMPV4Keyword", SigTest34ICMPV4Keyword, 1);
UtRegisterTest("SigTest35NegativeICMPV4Keyword",
SigTest35NegativeICMPV4Keyword, 1);
/* The following tests check content options with isdataat options
relative to that content match
*/
UtRegisterTest("SigTest36ContentAndIsdataatKeywords01B2g",
SigTest36ContentAndIsdataatKeywords01B2g, 1);
UtRegisterTest("SigTest36ContentAndIsdataatKeywords01B3g",
SigTest36ContentAndIsdataatKeywords01B3g, 1);
UtRegisterTest("SigTest36ContentAndIsdataatKeywords01Wm" ,
SigTest36ContentAndIsdataatKeywords01Wm, 1);
UtRegisterTest("SigTest37ContentAndIsdataatKeywords02B2g",
SigTest37ContentAndIsdataatKeywords02B2g, 1);
UtRegisterTest("SigTest37ContentAndIsdataatKeywords02B3g",
SigTest37ContentAndIsdataatKeywords02B3g, 1);
UtRegisterTest("SigTest37ContentAndIsdataatKeywords02Wm" ,
SigTest37ContentAndIsdataatKeywords02Wm, 1);
/* We need to enable these tests, as soon as we add the ICMPv6 protocol
support in our rules engine */
//UtRegisterTest("SigTest36ICMPV6Keyword", SigTest36ICMPV6Keyword, 1);
//UtRegisterTest("SigTest37NegativeICMPV6Keyword",
// SigTest37NegativeICMPV6Keyword, 1);
UtRegisterTest("SigTest38B2g -- byte_test test (1)", SigTest38B2g, 1);
UtRegisterTest("SigTest38B3g -- byte_test test (1)", SigTest38B3g, 1);
UtRegisterTest("SigTest38Wm -- byte_test test (1)", SigTest38Wm, 1);
UtRegisterTest("SigTest39B2g -- byte_jump test (2)", SigTest39B2g, 1);
UtRegisterTest("SigTest39B3g -- byte_jump test (2)", SigTest39B3g, 1);
UtRegisterTest("SigTest39Wm -- byte_jump test (2)", SigTest39Wm, 1);
UtRegisterTest("SigTest40NoPacketInspection01", SigTest40NoPacketInspection01, 1);
UtRegisterTest("SigTest40NoPayloadInspection02", SigTest40NoPayloadInspection02, 1);
UtRegisterTest("SigTestMemory01", SigTestMemory01, 1);
UtRegisterTest("SigTestMemory02", SigTestMemory02, 1);
UtRegisterTest("SigTestMemory03", SigTestMemory03, 1);
UtRegisterTest("SigTestSgh01", SigTestSgh01, 1);
UtRegisterTest("SigTestSgh02", SigTestSgh02, 1);
UtRegisterTest("SigTestSgh03", SigTestSgh03, 1);
UtRegisterTest("SigTestSgh04", SigTestSgh04, 1);
UtRegisterTest("SigTestSgh05", SigTestSgh05, 1);
UtRegisterTest("SigTestContent01B2g -- 32 byte pattern", SigTestContent01B2g, 1);
UtRegisterTest("SigTestContent01B3g -- 32 byte pattern", SigTestContent01B3g, 1);
UtRegisterTest("SigTestContent01Wm -- 32 byte pattern", SigTestContent01Wm, 1);
UtRegisterTest("SigTestContent02B2g -- 32+31 byte pattern", SigTestContent02B2g, 1);
UtRegisterTest("SigTestContent02B3g -- 32+31 byte pattern", SigTestContent02B3g, 1);
UtRegisterTest("SigTestContent02Wm -- 32+31 byte pattern", SigTestContent02Wm, 1);
UtRegisterTest("SigTestContent03B2g -- 32 byte pattern, x2 + distance", SigTestContent03B2g, 1);
UtRegisterTest("SigTestContent03B3g -- 32 byte pattern, x2 + distance", SigTestContent03B3g, 1);
UtRegisterTest("SigTestContent03Wm -- 32 byte pattern, x2 + distance", SigTestContent03Wm, 1);
UtRegisterTest("SigTestContent04B2g -- 32 byte pattern, x2 + distance/within", SigTestContent04B2g, 1);
UtRegisterTest("SigTestContent04B3g -- 32 byte pattern, x2 + distance/within", SigTestContent04B3g, 1);
UtRegisterTest("SigTestContent04Wm -- 32 byte pattern, x2 + distance/within", SigTestContent04Wm, 1);
UtRegisterTest("SigTestContent05B2g -- distance/within", SigTestContent05B2g, 1);
UtRegisterTest("SigTestContent05B3g -- distance/within", SigTestContent05B3g, 1);
UtRegisterTest("SigTestContent05Wm -- distance/within", SigTestContent05Wm, 1);
UtRegisterTest("SigTestContent06B2g -- distance/within ip only", SigTestContent06B2g, 1);
UtRegisterTest("SigTestContent06B3g -- distance/within ip only", SigTestContent06B3g, 1);
UtRegisterTest("SigTestContent06Wm -- distance/within ip only", SigTestContent06Wm, 1);
UtRegisterTest("SigTestWithinReal01B2g", SigTestWithinReal01B2g, 1);
UtRegisterTest("SigTestWithinReal01B3g", SigTestWithinReal01B3g, 1);
UtRegisterTest("SigTestWithinReal01Wm", SigTestWithinReal01Wm, 1);
UtRegisterTest("SigTestDepthOffset01B2g", SigTestDepthOffset01B2g, 1);
UtRegisterTest("SigTestDepthOffset01B3g", SigTestDepthOffset01B3g, 1);
UtRegisterTest("SigTestDepthOffset01Wm", SigTestDepthOffset01Wm, 1);
UtRegisterTest("SigTestDetectAlertCounter", SigTestDetectAlertCounter, 1);
UtRegisterTest("SigTestDropFlow01", SigTestDropFlow01, 1);
UtRegisterTest("SigTestDropFlow02", SigTestDropFlow02, 1);
UtRegisterTest("SigTestDropFlow03", SigTestDropFlow03, 1);
UtRegisterTest("SigTestDropFlow04", SigTestDropFlow04, 1);
UtRegisterTest("SigTestSIMDMask01", SigTestSIMDMask01, 1);
UtRegisterTest("SigTestSIMDMask02", SigTestSIMDMask02, 1);
UtRegisterTest("SigTestSIMDMask03", SigTestSIMDMask03, 1);
UtRegisterTest("SigTestSIMDMask04", SigTestSIMDMask04, 1);
#endif /* UNITTESTS */
}
Reference in New Issue View Git Blame Copy Permalink