49 #define MAX_ALPROTO_NAME 50
55 static void DetectAppLayerEventRegisterTests(
void);
60 uint8_t
flags,
void *alstate,
void *tx, uint64_t tx_id);
61 static int g_applayer_events_list_id = 0;
72 DetectAppLayerEventPktMatch;
77 DetectAppLayerEventRegisterTests;
81 DetectEngineAptEventInspect, NULL);
83 DetectEngineAptEventInspect, NULL);
90 uint8_t
flags,
void *alstate,
void *tx, uint64_t tx_id)
96 if (decoder_events == NULL)
104 if (AppLayerDecoderEventsIsEventSet(decoder_events, aled->
event_id)) {
150 "supplied with packet based event - \"%s\" that isn't "
151 "supported yet.", arg);
164 static bool OutdatedEvent(
const char *raw)
166 if (strcmp(raw,
"tls.certificate_missing_element") == 0 ||
167 strcmp(raw,
"tls.certificate_unknown_element") == 0 ||
168 strcmp(raw,
"tls.certificate_invalid_string") == 0) {
179 uint8_t *ipproto_bitarray,
187 if (OutdatedEvent(data->
arg)) {
190 "app-layer-event keyword no longer supports event \"%s\"", data->
arg);
194 "app-layer-event keyword no longer supports event \"%s\"", data->
arg);
199 const char *p_idx = strchr(data->
arg,
'.');
206 if (ipproto_bitarray[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8)) {
207 ipproto = IPPROTO_TCP;
208 }
else if (ipproto_bitarray[IPPROTO_UDP / 8] & 1 << (IPPROTO_UDP % 8)) {
209 ipproto = IPPROTO_UDP;
217 p_idx + 1, &event_id, event_type);
224 "protocol \"%s\" doesn't have event \"%s\" registered",
225 alproto_name, p_idx + 1);
229 "protocol \"%s\" doesn't have event \"%s\" registered",
230 alproto_name, p_idx + 1);
239 static AppProto AppLayerEventGetProtoByName(
char *alproto_name)
253 bool needs_detctx =
false;
255 const char *p_idx = strchr(arg,
'.');
261 strlcpy(alproto_name, arg, p_idx - arg + 1);
263 const AppProto alproto = AppLayerEventGetProtoByName(alproto_name);
265 if (!strcmp(alproto_name,
"file")) {
269 "supplied with unknown protocol \"%s\"",
280 if (aled->
arg == NULL) {
296 "with no arguments. This keyword needs an argument.");
300 while (*arg !=
'\0' && isspace((
unsigned char)*arg))
303 if (strchr(arg,
'.') == NULL) {
304 return DetectAppLayerEventParsePkt(arg, event_type);
306 return DetectAppLayerEventParseAppP1(arg);
360 DetectAppLayerEventFree(
de_ctx, data);
372 if (data->
arg != NULL)
394 int ret = DetectAppLayerEventSetupP2(
de_ctx, s, sm);
418 #define APP_LAYER_EVENT_TEST_MAP_EVENT1 0
419 #define APP_LAYER_EVENT_TEST_MAP_EVENT2 1
420 #define APP_LAYER_EVENT_TEST_MAP_EVENT3 2
421 #define APP_LAYER_EVENT_TEST_MAP_EVENT4 3
422 #define APP_LAYER_EVENT_TEST_MAP_EVENT5 4
423 #define APP_LAYER_EVENT_TEST_MAP_EVENT6 5
434 static int DetectAppLayerEventTestGetEventInfo(
const char *event_name,
439 if (*event_id == -1) {
441 "app-layer-event's test enum map table.", event_name);
452 static int DetectAppLayerEventTest01(
void)
456 DetectAppLayerEventTestGetEventInfo);
460 uint8_t ipproto_bitarray[256 / 8];
461 memset(ipproto_bitarray, 0,
sizeof(ipproto_bitarray));
462 ipproto_bitarray[IPPROTO_TCP / 8] |= 1 << (IPPROTO_TCP % 8);
468 if (DetectAppLayerEventParseAppP2(aled, ipproto_bitarray, &event_type) < 0) {
469 printf(
"failure 1\n");
474 printf(
"test failure. Holding wrong state\n");
483 DetectAppLayerEventFree(NULL, aled);
487 static int DetectAppLayerEventTest02(
void)
492 DetectAppLayerEventTestGetEventInfo);
494 IPPROTO_TCP,
ALPROTO_HTTP1, DetectAppLayerEventTestGetEventInfo);
496 DetectAppLayerEventTestGetEventInfo);
498 DetectAppLayerEventTestGetEventInfo);
501 uint8_t ipproto_bitarray[256 / 8];
502 memset(ipproto_bitarray, 0,
sizeof(ipproto_bitarray));
503 ipproto_bitarray[IPPROTO_TCP / 8] |= 1 << (IPPROTO_TCP % 8);
508 FAIL_IF(DetectAppLayerEventParseAppP2(aled, ipproto_bitarray, &event_type) < 0);
512 aled = DetectAppLayerEventParse(
"smtp.event4",
515 FAIL_IF(DetectAppLayerEventParseAppP2(aled, ipproto_bitarray, &event_type) < 0);
519 aled = DetectAppLayerEventParse(
"http.event2",
522 FAIL_IF(DetectAppLayerEventParseAppP2(aled, ipproto_bitarray, &event_type) < 0);
526 aled = DetectAppLayerEventParse(
"smb.event3",
529 FAIL_IF(DetectAppLayerEventParseAppP2(aled, ipproto_bitarray, &event_type) < 0);
533 aled = DetectAppLayerEventParse(
"ftp.event5",
536 FAIL_IF(DetectAppLayerEventParseAppP2(aled, ipproto_bitarray, &event_type) < 0);
541 DetectAppLayerEventFree(NULL, aled);
545 static int DetectAppLayerEventTest03(
void)
556 uint8_t buf_ts[] =
"GET /index.html HTTP/1.1\r\n"
557 "Host: 127.0.0.1\r\n"
558 "User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.3) Gecko/20100402 Firefox/3.6.3\r\n"
559 "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
560 "Accept-Language: en-us,en;q=0.5\r\n"
561 "Accept-Encoding: gzip,deflate\r\n"
562 "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n"
563 "Keep-Alive: 115\r\n"
564 "Connection: keep-alive\r\n"
566 uint8_t buf_tc[] =
"HTTP/1.1 200 OK\r\n"
567 "Date: Fri, 22 Oct 2010 12:31:08 GMT\r\n"
568 "Server: Apache/2.2.15 (Unix) DAV/2\r\n"
569 "Last-Modified: Sat, 20 Nov 2004 20:16:24 GMT\r\n"
570 "ETag: \"ab8486-2c-3e9564c23b600\"\r\n"
571 "Accept-Ranges: bytes\r\n"
572 "Content-Length: 44\r\n"
573 "Keep-Alive: timeout=5, max=100\r\n"
574 "Connection: Keep-Alive\r\n"
575 "Content-Type: text/html\r\n"
577 "<html><body><h1>It works!</h1></body></html>";
581 memset(&stream_ts, 0,
sizeof(
TcpStream));
582 memset(&stream_tc, 0,
sizeof(
TcpStream));
590 "(app-layer-event: applayer_mismatch_protocol_both_directions; "
596 f =
UTHBuildFlow(AF_INET,
"1.2.3.4",
"1.2.3.5", 200, 220);
600 f->
proto = IPPROTO_TCP;
608 p->
proto = IPPROTO_TCP;
615 sizeof(buf_ts), STREAM_TOSERVER | STREAM_START) < 0);
624 sizeof(buf_tc), STREAM_TOCLIENT | STREAM_START) < 0);
634 static int DetectAppLayerEventTest04(
void)
645 uint8_t buf_ts[] =
"GET /index.html HTTP/1.1\r\n"
646 "Host: 127.0.0.1\r\n"
647 "User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.3) Gecko/20100402 Firefox/3.6.3\r\n"
648 "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
649 "Accept-Language: en-us,en;q=0.5\r\n"
650 "Accept-Encoding: gzip,deflate\r\n"
651 "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n"
652 "Keep-Alive: 115\r\n"
653 "Connection: keep-alive\r\n"
655 uint8_t buf_tc[] =
"XTTP/1.1 200 OK\r\n"
656 "Date: Fri, 22 Oct 2010 12:31:08 GMT\r\n"
657 "Server: Apache/2.2.15 (Unix) DAV/2\r\n"
658 "Last-Modified: Sat, 20 Nov 2004 20:16:24 GMT\r\n"
659 "ETag: \"ab8486-2c-3e9564c23b600\"\r\n"
660 "Accept-Ranges: bytes\r\n"
661 "Content-Length: 44\r\n"
662 "Keep-Alive: timeout=5, max=100\r\n"
663 "Connection: Keep-Alive\r\n"
664 "Content-Type: text/html\r\n"
666 "<html><body><h1>It works!</h1></body></html>";
670 memset(&stream_ts, 0,
sizeof(
TcpStream));
671 memset(&stream_tc, 0,
sizeof(
TcpStream));
679 "(app-layer-event: applayer_detect_protocol_only_one_direction; "
685 f =
UTHBuildFlow(AF_INET,
"1.2.3.4",
"1.2.3.5", 200, 220);
689 f->
proto = IPPROTO_TCP;
697 p->
proto = IPPROTO_TCP;
704 sizeof(buf_ts), STREAM_TOSERVER | STREAM_START) < 0);
711 sizeof(buf_tc), STREAM_TOCLIENT | STREAM_START) < 0);
719 static int DetectAppLayerEventTest05(
void)
730 uint8_t buf_ts[] =
"GET /index.html HTTP/1.1\r\n"
731 "Host: 127.0.0.1\r\n"
732 "User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.3) Gecko/20100402 Firefox/3.6.3\r\n"
733 "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
734 "Accept-Language: en-us,en;q=0.5\r\n"
735 "Accept-Encoding: gzip,deflate\r\n"
736 "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n"
737 "Keep-Alive: 115\r\n"
738 "Connection: keep-alive\r\n"
742 0x16, 0x03, 0x01, 0x00, 0x86, 0x10, 0x00, 0x00,
743 0x82, 0x00, 0x80, 0xd3, 0x6f, 0x1f, 0x63, 0x82,
744 0x8d, 0x75, 0x77, 0x8c, 0x91, 0xbc, 0xa1, 0x3d,
745 0xbb, 0xe1, 0xb5, 0xd3, 0x31, 0x92, 0x59, 0x2b,
746 0x2c, 0x43, 0x96, 0xa3, 0xaa, 0x23, 0x92, 0xd0,
747 0x91, 0x2a, 0x5e, 0x10, 0x5b, 0xc8, 0xc1, 0xe2,
748 0xd3, 0x5c, 0x8b, 0x8c, 0x91, 0x9e, 0xc2, 0xf2,
749 0x9c, 0x3c, 0x4f, 0x37, 0x1e, 0x20, 0x5e, 0x33,
750 0xd5, 0xf0, 0xd6, 0xaf, 0x89, 0xf5, 0xcc, 0xb2,
751 0xcf, 0xc1, 0x60, 0x3a, 0x46, 0xd5, 0x4e, 0x2a,
752 0xb6, 0x6a, 0xb9, 0xfc, 0x32, 0x8b, 0xe0, 0x6e,
753 0xa0, 0xed, 0x25, 0xa0, 0xa4, 0x82, 0x81, 0x73,
754 0x90, 0xbf, 0xb5, 0xde, 0xeb, 0x51, 0x8d, 0xde,
755 0x5b, 0x6f, 0x94, 0xee, 0xba, 0xe5, 0x69, 0xfa,
756 0x1a, 0x80, 0x30, 0x54, 0xeb, 0x12, 0x01, 0xb9,
757 0xfe, 0xbf, 0x82, 0x95, 0x01, 0x7b, 0xb0, 0x97,
758 0x14, 0xc2, 0x06, 0x3c, 0x69, 0xfb, 0x1c, 0x66,
759 0x47, 0x17, 0xd9, 0x14, 0x03, 0x01, 0x00, 0x01,
760 0x01, 0x16, 0x03, 0x01, 0x00, 0x30, 0xf6, 0xbc,
761 0x0d, 0x6f, 0xe8, 0xbb, 0xaa, 0xbf, 0x14, 0xeb,
762 0x7b, 0xcc, 0x6c, 0x28, 0xb0, 0xfc, 0xa6, 0x01,
763 0x2a, 0x97, 0x96, 0x17, 0x5e, 0xe8, 0xb4, 0x4e,
764 0x78, 0xc9, 0x04, 0x65, 0x53, 0xb6, 0x93, 0x3d,
765 0xeb, 0x44, 0xee, 0x86, 0xf9, 0x80, 0x49, 0x45,
766 0x21, 0x34, 0xd1, 0xee, 0xc8, 0x9c,
771 memset(&stream_ts, 0,
sizeof(
TcpStream));
772 memset(&stream_tc, 0,
sizeof(
TcpStream));
780 "(app-layer-event: applayer_mismatch_protocol_both_directions; "
786 f =
UTHBuildFlow(AF_INET,
"1.2.3.4",
"1.2.3.5", 200, 220);
790 f->
proto = IPPROTO_TCP;
798 p->
proto = IPPROTO_TCP;
805 sizeof(buf_ts), STREAM_TOSERVER | STREAM_START) < 0);
812 sizeof(buf_tc), STREAM_TOCLIENT | STREAM_START) < 0);
820 static int DetectAppLayerEventTest06(
void)
823 uint8_t ipproto_bitarray[256 / 8];
824 memset(ipproto_bitarray, 0,
sizeof(ipproto_bitarray));
825 ipproto_bitarray[IPPROTO_TCP / 8] |= 1 << (IPPROTO_TCP % 8);
832 FAIL_IF(DetectAppLayerEventParseAppP2(aled, ipproto_bitarray, &event_type) < 0);
837 DetectAppLayerEventFree(NULL, aled);
844 static void DetectAppLayerEventRegisterTests(
void)
846 UtRegisterTest(
"DetectAppLayerEventTest01", DetectAppLayerEventTest01);
847 UtRegisterTest(
"DetectAppLayerEventTest02", DetectAppLayerEventTest02);
848 UtRegisterTest(
"DetectAppLayerEventTest03", DetectAppLayerEventTest03);
849 UtRegisterTest(
"DetectAppLayerEventTest04", DetectAppLayerEventTest04);
850 UtRegisterTest(
"DetectAppLayerEventTest05", DetectAppLayerEventTest05);
851 UtRegisterTest(
"DetectAppLayerEventTest06", DetectAppLayerEventTest06);