43 static void DetectAsn1RegisterTests(
void);
83 const DetectAsn1Data *ad = (
const DetectAsn1Data *)ctx;
87 ret = rs_asn1_checks(asn1, ad);
102 static DetectAsn1Data *DetectAsn1Parse(
const char *asn1str)
104 DetectAsn1Data *ad = rs_detect_asn1_parse(asn1str);
107 SCLogError(
"Malformed asn1 argument: %s", asn1str);
126 DetectAsn1Data *ad = DetectAsn1Parse(asn1str);
134 DetectAsn1Free(
de_ctx, ad);
154 DetectAsn1Data *ad = (DetectAsn1Data *)ptr;
155 rs_detect_asn1_free(ad);
163 static int DetectAsn1TestReal01(
void)
165 uint8_t *buf = (uint8_t *)
"\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01"
166 "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"
167 "\x42\x01\x33\xA1\x0A\x43\x08""19710917"
168 "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"
169 "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"
170 "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111"
171 "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05"
172 "Jones""\xA0\x0A\x43\x08""19590717"
173 "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P"
174 "\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"
175 "\x42\x01\x33\xA1\x0A\x43\x08""19710917"
176 "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"
177 "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"
178 "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F"
179 "\x61\x11\x1A\x05""Pablo""\x1A\x01""B""\x1A\x05""Jones"
180 "\xA0\x0A\x43\x08""19590717";
182 uint16_t buflen = strlen((
char *)buf) - 1;
185 uint8_t *buf2 = (uint8_t *)
"AA\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01"
186 "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"
187 "\x42\x01\x33\xA1\x0A\x43\x08""19710917"
188 "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"
189 "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"
190 "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111"
191 "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05"
192 "Jones""\xA0\x0A\x43\x08""19590717"
193 "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P"
194 "\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"
195 "\x42\x01\x33\xA1\x0A\x43\x08""19710917"
196 "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"
197 "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"
198 "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F"
199 "\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05""Jones"
200 "\xA0\x0A\x43\x08""19590717";
202 uint16_t buflen2 = strlen((
char *)buf2) - 1;
212 sigs[0]=
"alert ip any any -> any any (msg:\"Testing id 1\"; "
213 "content:\"Pablo\"; asn1:absolute_offset 0, "
214 "oversize_length 130; sid:1;)";
215 sigs[1]=
"alert ip any any -> any any (msg:\"Testing id 2\"; "
216 "content:\"AA\"; asn1:relative_offset 0, "
217 "oversize_length 130; sid:2;)";
218 sigs[2]=
"alert ip any any -> any any (msg:\"Testing id 3\"; "
219 "content:\"lalala\"; asn1: oversize_length 2000; sid:3;)";
221 uint32_t sid[3] = {1, 2, 3};
237 static int DetectAsn1TestReal02(
void)
240 uint8_t *buf = (uint8_t *)
"\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01"
241 "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"
242 "\x42\x01\x33\xA1\x0A\x43\x08""19710917"
243 "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"
244 "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"
245 "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111"
246 "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05"
247 "Jones""\xA0\x0A\x43\x08""19590717"
248 "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P"
249 "\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"
250 "\x42\x01\x33\xA1\x0A\x43\x08""19710917"
251 "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"
252 "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"
253 "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F"
254 "\x61\x11\x1A\x05""Pablo""\x1A\x01""B""\x1A\x05""Jones"
255 "\xA0\x0A\x43\x08""19590717";
257 uint16_t buflen = strlen((
char *)buf) - 1;
260 uint8_t *buf2 = (uint8_t *)
"AA\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01"
261 "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"
262 "\x42\x01\x33\xA1\x0A\x43\x08""19710917"
263 "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"
264 "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"
265 "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111"
266 "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05"
267 "Jones""\xA0\x0A\x43\x08""19590717"
268 "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P"
269 "\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"
270 "\x42\x01\x33\xA1\x0A\x43\x08""19710917"
271 "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"
272 "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"
273 "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F"
274 "\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05""Jones"
275 "\xA0\x0A\x43\x08""19590717";
277 uint16_t buflen2 = strlen((
char *)buf2) - 1;
284 if (p[0] == NULL || p[1] == NULL)
288 sigs[0]=
"alert ip any any -> any any (msg:\"Testing id 1\"; "
289 "content:\"Pablo\"; asn1:absolute_offset 0, "
290 "oversize_length 140; sid:1;)";
291 sigs[1]=
"alert ip any any -> any any (msg:\"Testing id 2\"; "
292 "content:\"AA\"; asn1:relative_offset 0, "
293 "oversize_length 140; sid:2;)";
294 sigs[2]=
"alert ip any any -> any any (msg:\"Testing id 3\"; "
295 "content:\"lalala\"; asn1: oversize_length 2000; sid:3;)";
297 uint32_t sid[3] = {1, 2, 3};
314 static int DetectAsn1TestReal03(
void)
317 uint8_t buf[261] =
"";
331 uint16_t buflen = 261;
334 uint8_t *buf2 = (uint8_t *)
"AA\x03\x01\xFF";
336 uint16_t buflen2 = 5;
338 Packet *p[2] = { NULL, NULL };
343 if (p[0] == NULL || p[1] == NULL)
348 sigs[0]=
"alert ip any any -> any any (msg:\"Testing id 1\"; "
349 "asn1:absolute_offset 0, double_overflow; sid:1;)";
351 sigs[1]=
"alert ip any any -> any any (msg:\"Testing id 2\"; "
352 "asn1:relative_offset 2, bitstring_overflow,"
353 "oversize_length 140; sid:2;)";
355 sigs[2]=
"alert ip any any -> any any (msg:\"Testing id 3\"; "
356 "asn1: oversize_length 2000; sid:3;)";
358 uint32_t sid[3] = {1, 2, 3};
360 uint32_t
results[2][3] = {{1, 0, 0},
375 static int DetectAsn1TestReal04(
void)
378 uint8_t *buf = (uint8_t *)
"\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01"
379 "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"
380 "\x42\x01\x33\xA1\x0A\x43\x08""19710917"
381 "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"
382 "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"
383 "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111"
384 "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05"
385 "Jones""\xA0\x0A\x43\x08""19590717"
386 "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P"
387 "\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"
388 "\x42\x01\x33\xA1\x0A\x43\x08""19710917"
389 "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"
390 "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"
391 "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F"
392 "\x61\x11\x1A\x05""Pablo""\x1A\x01""B""\x1A\x05""Jones"
393 "\xA0\x0A\x43\x08""19590717";
395 uint16_t buflen = strlen((
char *)buf) - 1;
398 uint8_t *buf2 = (uint8_t *)
"AA\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01"
399 "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"
400 "\x42\x01\x33\xA1\x0A\x43\x08""19710917"
401 "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"
402 "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"
403 "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111"
404 "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05"
405 "Jones""\xA0\x0A\x43\x08""19590717"
406 "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P"
407 "\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"
408 "\x42\x01\x33\xA1\x0A\x43\x08""19710917"
409 "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"
410 "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"
411 "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F"
412 "\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05""Jones"
413 "\xA0\x0A\x43\x08""19590717";
415 uint16_t buflen2 = strlen((
char *)buf2) - 1;
422 if (p[0] == NULL || p[1] == NULL)
426 sigs[0]=
"alert ip any any -> any any (msg:\"Testing id 1\"; "
427 "content:\"Pablo\"; asn1:absolute_offset 0, "
428 "oversize_length 140; sid:1;)";
429 sigs[1]=
"alert ip any any -> any any (msg:\"Testing id 2\"; "
430 "content:\"John\"; asn1:relative_offset -11, "
431 "oversize_length 140; sid:2;)";
432 sigs[2]=
"alert ip any any -> any any (msg:\"Testing id 3\"; "
433 "content:\"lalala\"; asn1: oversize_length 2000; sid:3;)";
435 uint32_t sid[3] = {1, 2, 3};
452 static void DetectAsn1RegisterTests(
void)