suricata
detect-app-layer-protocol.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
22  */
23 
24 #include "suricata-common.h"
25 #include "detect-engine.h"
26 #include "detect-engine-prefilter.h"
27 #include "detect-engine-prefilter-common.h"
28 #include "detect-parse.h"
29 #include "detect-app-layer-protocol.h"
30 #include "app-layer.h"
31 #include "app-layer-parser.h"
32 #include "util-debug.h"
33 #include "util-unittest.h"
34 #include "util-unittest-helper.h"
35 
36 #ifdef UNITTESTS
37 static void DetectAppLayerProtocolRegisterTests(void);
38 #endif
39 
40 static int DetectAppLayerProtocolPacketMatch(
41  DetectEngineThreadCtx *det_ctx,
42  Packet *p, const Signature *s, const SigMatchCtx *ctx)
43 {
44  SCEnter();
45 
46  bool r = false;
47  const DetectAppLayerProtocolData *data = (const DetectAppLayerProtocolData *)ctx;
48 
49  /* if the sig is PD-only we only match when PD packet flags are set */
50  if ((s->flags & SIG_FLAG_PDONLY) &&
51  (p->flags & (PKT_PROTO_DETECT_TS_DONE|PKT_PROTO_DETECT_TC_DONE)) == 0)
52  {
53  SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt);
54  SCReturnInt(0);
55  }
56 
57  const Flow *f = p->flow;
58  if (f == NULL) {
59  SCLogDebug("packet %"PRIu64": no flow", p->pcap_cnt);
60  SCReturnInt(0);
61  }
62 
63  /* unknown means protocol detection isn't ready yet */
64 
65  if ((f->alproto_ts != ALPROTO_UNKNOWN) && (p->flowflags & FLOW_PKT_TOSERVER))
66  {
67  SCLogDebug("toserver packet %"PRIu64": looking for %u/neg %u, got %u",
68  p->pcap_cnt, data->alproto, data->negated, f->alproto_ts);
69 
70  r = AppProtoEquals(data->alproto, f->alproto_ts);
71 
72  } else if ((f->alproto_tc != ALPROTO_UNKNOWN) && (p->flowflags & FLOW_PKT_TOCLIENT))
73  {
74  SCLogDebug("toclient packet %"PRIu64": looking for %u/neg %u, got %u",
75  p->pcap_cnt, data->alproto, data->negated, f->alproto_tc);
76 
77  r = AppProtoEquals(data->alproto, f->alproto_tc);
78  }
79  else {
80  SCLogDebug("packet %"PRIu64": default case: direction %02x, approtos %u/%u/%u",
81  p->pcap_cnt,
82  p->flowflags & (FLOW_PKT_TOCLIENT|FLOW_PKT_TOSERVER),
83  f->alproto, f->alproto_ts, f->alproto_tc);
84  }
85  r = r ^ data->negated;
86  if (r) {
87  SCReturnInt(1);
88  }
89  SCReturnInt(0);
90 }
91 
92 static DetectAppLayerProtocolData *DetectAppLayerProtocolParse(const char *arg, bool negate)
93 {
94  DetectAppLayerProtocolData *data;
95  AppProto alproto = ALPROTO_UNKNOWN;
96 
97  if (strcmp(arg, "failed") == 0) {
98  alproto = ALPROTO_FAILED;
99  } else {
100  alproto = AppLayerGetProtoByName((char *)arg);
101  if (alproto == ALPROTO_UNKNOWN) {
102  SCLogError(SC_ERR_INVALID_SIGNATURE, "app-layer-protocol "
103  "keyword supplied with unknown protocol \"%s\"", arg);
104  return NULL;
105  }
106  }
107 
108  data = SCMalloc(sizeof(DetectAppLayerProtocolData));
109  if (unlikely(data == NULL))
110  return NULL;
111  data->alproto = alproto;
112  data->negated = negate;
113 
114  return data;
115 }
116 
117 static bool HasConflicts(const DetectAppLayerProtocolData *us,
118  const DetectAppLayerProtocolData *them)
119 {
120  /* mixing negated and non negated is illegal */
121  if (them->negated ^ us->negated)
122  return true;
123  /* multiple non-negated is illegal */
124  if (!us->negated)
125  return true;
126  /* duplicate option */
127  if (us->alproto == them->alproto)
128  return true;
129 
130  /* all good */
131  return false;
132 }
133 
134 static int DetectAppLayerProtocolSetup(DetectEngineCtx *de_ctx,
135  Signature *s, const char *arg)
136 {
137  DetectAppLayerProtocolData *data = NULL;
138  SigMatch *sm = NULL;
139 
140  if (s->alproto != ALPROTO_UNKNOWN) {
141  SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "Either we already "
142  "have the rule match on an app layer protocol set through "
143  "other keywords that match on this protocol, or have "
144  "already seen a non-negated app-layer-protocol.");
145  goto error;
146  }
147 
148  data = DetectAppLayerProtocolParse(arg, s->init_data->negated);
149  if (data == NULL)
150  goto error;
151 
152  SigMatch *tsm = s->init_data->smlists[DETECT_SM_LIST_MATCH];
153  for ( ; tsm != NULL; tsm = tsm->next) {
154  if (tsm->type == DETECT_AL_APP_LAYER_PROTOCOL) {
155  const DetectAppLayerProtocolData *them = (const DetectAppLayerProtocolData *)tsm->ctx;
156 
157  if (HasConflicts(data, them)) {
158  SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "can't mix "
159  "positive app-layer-protocol match with negated "
160  "match or match for 'failed'.");
161  goto error;
162  }
163  }
164  }
165 
166  sm = SigMatchAlloc();
167  if (sm == NULL)
168  goto error;
169 
170  sm->type = DETECT_AL_APP_LAYER_PROTOCOL;
171  sm->ctx = (void *)data;
172 
173  SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH);
174  return 0;
175 
176 error:
177  if (data != NULL)
178  SCFree(data);
179  return -1;
180 }
181 
182 static void DetectAppLayerProtocolFree(DetectEngineCtx *de_ctx, void *ptr)
183 {
184  SCFree(ptr);
185  return;
186 }
187 
188 /** \internal
189  * \brief prefilter function for protocol detect matching
190  */
191 static void
192 PrefilterPacketAppProtoMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
193 {
194  const PrefilterPacketHeaderCtx *ctx = pectx;
195 
196  if (!PrefilterPacketHeaderExtraMatch(ctx, p)) {
197  SCLogDebug("packet %"PRIu64": extra match failed", p->pcap_cnt);
198  SCReturn;
199  }
200 
201  if (p->flow == NULL) {
202  SCLogDebug("packet %"PRIu64": no flow, no alproto", p->pcap_cnt);
203  SCReturn;
204  }
205 
206  if ((p->flags & (PKT_PROTO_DETECT_TS_DONE|PKT_PROTO_DETECT_TC_DONE)) == 0) {
207  SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt);
208  SCReturn;
209  }
210 
211  if ((p->flags & PKT_PROTO_DETECT_TS_DONE) && (p->flowflags & FLOW_PKT_TOSERVER))
212  {
213  int r = (ctx->v1.u16[0] == p->flow->alproto_ts) ^ ctx->v1.u8[2];
214  if (r) {
215  PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
216  }
217  } else if ((p->flags & PKT_PROTO_DETECT_TC_DONE) && (p->flowflags & FLOW_PKT_TOCLIENT))
218  {
219  int r = (ctx->v1.u16[0] == p->flow->alproto_tc) ^ ctx->v1.u8[2];
220  if (r) {
221  PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
222  }
223  }
224 }
225 
226 static void
227 PrefilterPacketAppProtoSet(PrefilterPacketHeaderValue *v, void *smctx)
228 {
229  const DetectAppLayerProtocolData *a = smctx;
230  v->u16[0] = a->alproto;
231  v->u8[2] = (uint8_t)a->negated;
232 }
233 
234 static bool
235 PrefilterPacketAppProtoCompare(PrefilterPacketHeaderValue v, void *smctx)
236 {
237  const DetectAppLayerProtocolData *a = smctx;
238  if (v.u16[0] == a->alproto &&
239  v.u8[2] == (uint8_t)a->negated)
240  return true;
241  return false;
242 }
243 
244 static int PrefilterSetupAppProto(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
245 {
246  return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_AL_APP_LAYER_PROTOCOL,
247  PrefilterPacketAppProtoSet,
248  PrefilterPacketAppProtoCompare,
249  PrefilterPacketAppProtoMatch);
250 }
251 
252 static bool PrefilterAppProtoIsPrefilterable(const Signature *s)
253 {
254  if (s->flags & SIG_FLAG_PDONLY) {
255  SCLogDebug("prefilter on PD %u", s->id);
256  return true;
257  }
258  return false;
259 }
260 
261 void DetectAppLayerProtocolRegister(void)
262 {
263  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].name = "app-layer-protocol";
264  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].desc = "match on the detected app-layer protocol";
265  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].url = "/rules/app-layer.html#app-layer-protocol";
266  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].Match =
267  DetectAppLayerProtocolPacketMatch;
268  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].Setup =
269  DetectAppLayerProtocolSetup;
270  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].Free =
271  DetectAppLayerProtocolFree;
272 #ifdef UNITTESTS
273  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].RegisterTests =
274  DetectAppLayerProtocolRegisterTests;
275 #endif
276  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].flags =
277  (SIGMATCH_QUOTES_OPTIONAL|SIGMATCH_HANDLE_NEGATION);
278 
279  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].SetupPrefilter =
280  PrefilterSetupAppProto;
281  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].SupportsPrefilter =
282  PrefilterAppProtoIsPrefilterable;
283  return;
284 }
285 
286 /**********************************Unittests***********************************/
287 
288 #ifdef UNITTESTS
289 
290 static int DetectAppLayerProtocolTest01(void)
291 {
292  DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("http", false);
293  FAIL_IF_NULL(data);
294  FAIL_IF(data->alproto != ALPROTO_HTTP);
295  FAIL_IF(data->negated != 0);
296  DetectAppLayerProtocolFree(NULL, data);
297  PASS;
298 }
299 
300 static int DetectAppLayerProtocolTest02(void)
301 {
302  DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("http", true);
303  FAIL_IF_NULL(data);
304  FAIL_IF(data->alproto != ALPROTO_HTTP);
305  FAIL_IF(data->negated == 0);
306  DetectAppLayerProtocolFree(NULL, data);
307  PASS;
308 }
309 
310 static int DetectAppLayerProtocolTest03(void)
311 {
312  Signature *s = NULL;
313  DetectAppLayerProtocolData *data = NULL;
314  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
315  FAIL_IF_NULL(de_ctx);
316  de_ctx->flags |= DE_QUIET;
317 
318  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
319  "(app-layer-protocol:http; sid:1;)");
320  FAIL_IF_NULL(s);
321 
322  FAIL_IF(s->alproto != ALPROTO_UNKNOWN);
323 
324  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]);
325  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
326 
327  data = (DetectAppLayerProtocolData *)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
328  FAIL_IF(data->alproto != ALPROTO_HTTP);
329  FAIL_IF(data->negated);
330  DetectEngineCtxFree(de_ctx);
331  PASS;
332 }
333 
334 static int DetectAppLayerProtocolTest04(void)
335 {
336  Signature *s = NULL;
337  DetectAppLayerProtocolData *data = NULL;
338  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
339  FAIL_IF_NULL(de_ctx);
340  de_ctx->flags |= DE_QUIET;
341 
342  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
343  "(app-layer-protocol:!http; sid:1;)");
344  FAIL_IF_NULL(s);
345  FAIL_IF(s->alproto != ALPROTO_UNKNOWN);
346  FAIL_IF(s->flags & SIG_FLAG_APPLAYER);
347 
348  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]);
349  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
350 
351  data = (DetectAppLayerProtocolData*)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
352  FAIL_IF_NULL(data);
353  FAIL_IF(data->alproto != ALPROTO_HTTP);
354  FAIL_IF(data->negated == 0);
355 
356  DetectEngineCtxFree(de_ctx);
357  PASS;
358 }
359 
360 static int DetectAppLayerProtocolTest05(void)
361 {
362  Signature *s = NULL;
363  DetectAppLayerProtocolData *data = NULL;
364  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
365  FAIL_IF_NULL(de_ctx);
366  de_ctx->flags |= DE_QUIET;
367 
368  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
369  "(app-layer-protocol:!http; app-layer-protocol:!smtp; sid:1;)");
370  FAIL_IF_NULL(s);
371  FAIL_IF(s->alproto != ALPROTO_UNKNOWN);
372  FAIL_IF(s->flags & SIG_FLAG_APPLAYER);
373 
374  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]);
375  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
376 
377  data = (DetectAppLayerProtocolData*)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
378  FAIL_IF_NULL(data);
379  FAIL_IF(data->alproto != ALPROTO_HTTP);
380  FAIL_IF(data->negated == 0);
381 
382  data = (DetectAppLayerProtocolData*)s->sm_lists[DETECT_SM_LIST_MATCH]->next->ctx;
383  FAIL_IF_NULL(data);
384  FAIL_IF(data->alproto != ALPROTO_SMTP);
385  FAIL_IF(data->negated == 0);
386 
387  DetectEngineCtxFree(de_ctx);
388  PASS;
389 }
390 
391 static int DetectAppLayerProtocolTest06(void)
392 {
393  Signature *s = NULL;
394  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
395  FAIL_IF_NULL(de_ctx);
396  de_ctx->flags |= DE_QUIET;
397 
398  s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
399  "(app-layer-protocol:smtp; sid:1;)");
400  FAIL_IF_NOT_NULL(s);
401  DetectEngineCtxFree(de_ctx);
402  PASS;
403 }
404 
405 static int DetectAppLayerProtocolTest07(void)
406 {
407  Signature *s = NULL;
408  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
409  FAIL_IF_NULL(de_ctx);
410  de_ctx->flags |= DE_QUIET;
411 
412  s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
413  "(app-layer-protocol:!smtp; sid:1;)");
414  FAIL_IF_NOT_NULL(s);
415  DetectEngineCtxFree(de_ctx);
416  PASS;
417 }
418 
419 static int DetectAppLayerProtocolTest08(void)
420 {
421  Signature *s = NULL;
422  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
423  FAIL_IF_NULL(de_ctx);
424  de_ctx->flags |= DE_QUIET;
425 
426  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
427  "(app-layer-protocol:!smtp; app-layer-protocol:http; sid:1;)");
428  FAIL_IF_NOT_NULL(s);
429  DetectEngineCtxFree(de_ctx);
430  PASS;
431 }
432 
433 static int DetectAppLayerProtocolTest09(void)
434 {
435  Signature *s = NULL;
436  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
437  FAIL_IF_NULL(de_ctx);
438  de_ctx->flags |= DE_QUIET;
439 
440  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
441  "(app-layer-protocol:http; app-layer-protocol:!smtp; sid:1;)");
442  FAIL_IF_NOT_NULL(s);
443  DetectEngineCtxFree(de_ctx);
444  PASS;
445 }
446 
447 static int DetectAppLayerProtocolTest10(void)
448 {
449  Signature *s = NULL;
450  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
451  FAIL_IF_NULL(de_ctx);
452  de_ctx->flags |= DE_QUIET;
453 
454  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
455  "(app-layer-protocol:smtp; app-layer-protocol:!http; sid:1;)");
456  FAIL_IF_NOT_NULL(s);
457  DetectEngineCtxFree(de_ctx);
458  PASS;
459 }
460 
461 static int DetectAppLayerProtocolTest11(void)
462 {
463  DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("failed", false);
464  FAIL_IF_NULL(data);
465  FAIL_IF(data->alproto != ALPROTO_FAILED);
466  FAIL_IF(data->negated != 0);
467  DetectAppLayerProtocolFree(NULL, data);
468  PASS;
469 }
470 
471 static int DetectAppLayerProtocolTest12(void)
472 {
473  DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("failed", true);
474  FAIL_IF_NULL(data);
475  FAIL_IF(data->alproto != ALPROTO_FAILED);
476  FAIL_IF(data->negated == 0);
477  DetectAppLayerProtocolFree(NULL, data);
478  PASS;
479 }
480 
481 static int DetectAppLayerProtocolTest13(void)
482 {
483  Signature *s = NULL;
484  DetectAppLayerProtocolData *data = NULL;
485  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
486  FAIL_IF_NULL(de_ctx);
487  de_ctx->flags |= DE_QUIET;
488 
489  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
490  "(app-layer-protocol:failed; sid:1;)");
491  FAIL_IF_NULL(s);
492 
493  FAIL_IF(s->alproto != ALPROTO_UNKNOWN);
494 
495  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]);
496  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
497 
498  data = (DetectAppLayerProtocolData *)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
499  FAIL_IF(data->alproto != ALPROTO_FAILED);
500  FAIL_IF(data->negated);
501  DetectEngineCtxFree(de_ctx);
502  PASS;
503 }
504 
505 static int DetectAppLayerProtocolTest14(void)
506 {
507  DetectAppLayerProtocolData *data = NULL;
508  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
509  FAIL_IF_NULL(de_ctx);
510  de_ctx->flags |= DE_QUIET;
511 
512  Signature *s1 = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
513  "(app-layer-protocol:http; flowbits:set,blah; sid:1;)");
514  FAIL_IF_NULL(s1);
515  FAIL_IF(s1->alproto != ALPROTO_UNKNOWN);
516  FAIL_IF_NULL(s1->sm_lists[DETECT_SM_LIST_MATCH]);
517  FAIL_IF_NULL(s1->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
518  data = (DetectAppLayerProtocolData *)s1->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
519  FAIL_IF(data->alproto != ALPROTO_HTTP);
520  FAIL_IF(data->negated);
521 
522  Signature *s2 = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
523  "(app-layer-protocol:http; flow:to_client; sid:2;)");
524  FAIL_IF_NULL(s2);
525  FAIL_IF(s2->alproto != ALPROTO_UNKNOWN);
526  FAIL_IF_NULL(s2->sm_lists[DETECT_SM_LIST_MATCH]);
527  FAIL_IF_NULL(s2->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
528  data = (DetectAppLayerProtocolData *)s2->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
529  FAIL_IF(data->alproto != ALPROTO_HTTP);
530  FAIL_IF(data->negated);
531 
532  /* flow:established and other options not supported for PD-only */
533  Signature *s3 = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
534  "(app-layer-protocol:http; flow:to_client,established; sid:3;)");
535  FAIL_IF_NULL(s3);
536  FAIL_IF(s3->alproto != ALPROTO_UNKNOWN);
537  FAIL_IF_NULL(s3->sm_lists[DETECT_SM_LIST_MATCH]);
538  FAIL_IF_NULL(s3->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
539  data = (DetectAppLayerProtocolData *)s3->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
540  FAIL_IF(data->alproto != ALPROTO_HTTP);
541  FAIL_IF(data->negated);
542 
543  SigGroupBuild(de_ctx);
544  FAIL_IF_NOT(s1->flags & SIG_FLAG_PDONLY);
545  FAIL_IF_NOT(s2->flags & SIG_FLAG_PDONLY);
546  FAIL_IF(s3->flags & SIG_FLAG_PDONLY); // failure now
547 
548  DetectEngineCtxFree(de_ctx);
549  PASS;
550 }
551 
552 
553 static void DetectAppLayerProtocolRegisterTests(void)
554 {
555  UtRegisterTest("DetectAppLayerProtocolTest01",
556  DetectAppLayerProtocolTest01);
557  UtRegisterTest("DetectAppLayerProtocolTest02",
558  DetectAppLayerProtocolTest02);
559  UtRegisterTest("DetectAppLayerProtocolTest03",
560  DetectAppLayerProtocolTest03);
561  UtRegisterTest("DetectAppLayerProtocolTest04",
562  DetectAppLayerProtocolTest04);
563  UtRegisterTest("DetectAppLayerProtocolTest05",
564  DetectAppLayerProtocolTest05);
565  UtRegisterTest("DetectAppLayerProtocolTest06",
566  DetectAppLayerProtocolTest06);
567  UtRegisterTest("DetectAppLayerProtocolTest07",
568  DetectAppLayerProtocolTest07);
569  UtRegisterTest("DetectAppLayerProtocolTest08",
570  DetectAppLayerProtocolTest08);
571  UtRegisterTest("DetectAppLayerProtocolTest09",
572  DetectAppLayerProtocolTest09);
573  UtRegisterTest("DetectAppLayerProtocolTest10",
574  DetectAppLayerProtocolTest10);
575  UtRegisterTest("DetectAppLayerProtocolTest11",
576  DetectAppLayerProtocolTest11);
577  UtRegisterTest("DetectAppLayerProtocolTest12",
578  DetectAppLayerProtocolTest12);
579  UtRegisterTest("DetectAppLayerProtocolTest13",
580  DetectAppLayerProtocolTest13);
581  UtRegisterTest("DetectAppLayerProtocolTest14",
582  DetectAppLayerProtocolTest14);
583 }
584 #endif /* UNITTESTS */
SigTableElmt_::url
const char * url
Definition: detect.h:1270
detect-engine.h
detect-app-layer-protocol.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SigTableElmt_::desc
const char * desc
Definition: detect.h:1269
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1257
SIG_FLAG_PDONLY
#define SIG_FLAG_PDONLY
Definition: detect.h:247
SigTableElmt_::name
const char * name
Definition: detect.h:1267
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1425
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
Signature_::alproto
AppProto alproto
Definition: detect.h:552
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:588
SIGMATCH_QUOTES_OPTIONAL
#define SIGMATCH_QUOTES_OPTIONAL
Definition: detect.h:1465
DetectAppLayerProtocolData_
Definition: detect-app-layer-protocol.h:27
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
Packet_::flags
uint32_t flags
Definition: decode.h:462
DetectAppLayerProtocolData_::negated
uint8_t negated
Definition: detect-app-layer-protocol.h:29
Flow_
Flow data structure.
Definition: flow.h:353
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1167
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1261
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:811
SC_ERR_INVALID_SIGNATURE
@ SC_ERR_INVALID_SIGNATURE
Definition: util-error.h:69
PrefilterPacketHeaderCtx_::sigs_array
SigIntId * sigs_array
Definition: detect-engine-prefilter-common.h:41
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2433
PrefilterPacketHeaderValue::u8
uint8_t u8[16]
Definition: detect-engine-prefilter-common.h:22
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:225
DE_QUIET
#define DE_QUIET
Definition: detect.h:295
PrefilterPacketHeaderCtx_::sigs_cnt
uint32_t sigs_cnt
Definition: detect-engine-prefilter-common.h:40
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:458
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1252
PrefilterPacketHeaderValue::u16
uint16_t u16[8]
Definition: detect-engine-prefilter-common.h:23
detect-engine-prefilter.h
util-unittest.h
AppLayerGetProtoByName
AppProto AppLayerGetProtoByName(char *alproto_name)
Given a protocol string, returns the corresponding internal protocol id.
Definition: app-layer.c:862
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
PKT_PROTO_DETECT_TS_DONE
#define PKT_PROTO_DETECT_TS_DONE
Definition: decode.h:1208
SIG_FLAG_APPLAYER
#define SIG_FLAG_APPLAYER
Definition: detect.h:218
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1255
Signature_::next
struct Signature_ * next
Definition: detect.h:622
PrefilterPacketHeaderCtx_
Definition: detect-engine-prefilter-common.h:33
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1060
ALPROTO_SMTP
@ ALPROTO_SMTP
Definition: app-layer-protos.h:32
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:325
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:89
app-layer-parser.h
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:324
SCReturn
#define SCReturn
Definition: util-debug.h:302
Signature_::flags
uint32_t flags
Definition: detect.h:549
Packet_
Definition: decode.h:427
DETECT_AL_APP_LAYER_PROTOCOL
@ DETECT_AL_APP_LAYER_PROTOCOL
Definition: detect-engine-register.h:35
SIGMATCH_HANDLE_NEGATION
#define SIGMATCH_HANDLE_NEGATION
Definition: detect.h:1473
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:619
DetectAppLayerProtocolData_::alproto
AppProto alproto
Definition: detect-app-layer-protocol.h:28
SignatureInitData_::negated
bool negated
Definition: detect.h:503
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1235
SignatureInitData_::smlists
struct SigMatch_ ** smlists
Definition: detect.h:542
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:226
SigMatchAlloc
SigMatch * SigMatchAlloc(void)
Definition: detect-parse.c:235
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:1948
PrefilterPacketHeaderCtx_::v1
PrefilterPacketHeaderValue v1
Definition: detect-engine-prefilter-common.h:34
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:316
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2420
Packet_::flow
struct Flow_ * flow
Definition: decode.h:464
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:322
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
PKT_PROTO_DETECT_TC_DONE
#define PKT_PROTO_DETECT_TC_DONE
Definition: decode.h:1209
PrefilterSetupPacketHeader
int PrefilterSetupPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:417
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:461
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1254
Signature_::id
uint32_t id
Definition: detect.h:582
detect-parse.h
Signature_
Signature container.
Definition: detect.h:548
SigMatch_
a single match condition for a signature
Definition: detect.h:321
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition: app-layer-protos.h:66
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:70
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2394
DetectAppLayerProtocolRegister
void DetectAppLayerProtocolRegister(void)
Definition: detect-app-layer-protocol.c:261
PrefilterPacketHeaderValue
Definition: detect-engine-prefilter-common.h:21
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:812
detect-engine-prefilter-common.h
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:462
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:460
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
SigMatchAppendSMToList
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:349
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1259
app-layer.h
SC_ERR_CONFLICTING_RULE_KEYWORDS
@ SC_ERR_CONFLICTING_RULE_KEYWORDS
Definition: util-error.h:171