49 #define PARSE_REGEX "^\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*,\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*,\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*$"
57 static void DetectDetectionFilterRegisterTests(
void);
101 const char *str_ptr = NULL;
102 char *args[6] = { NULL, NULL, NULL, NULL, NULL, NULL};
103 char *copy_str = NULL, *df_opt = NULL;
104 int seconds_found = 0, count_found = 0, track_found = 0;
105 int seconds_pos = 0, count_pos = 0;
108 char *saveptr = NULL;
115 for (pos = 0, df_opt = strtok_r(copy_str,
",", &saveptr);
116 pos < strlen(copy_str) && df_opt != NULL;
117 pos++, df_opt = strtok_r(NULL,
",", &saveptr))
119 if(strstr(df_opt,
"count"))
121 if(strstr(df_opt,
"second"))
123 if(strstr(df_opt,
"track"))
129 if (count_found != 1 || seconds_found != 1 || track_found != 1)
146 for (i = 0; i < (ret - 1); i++) {
147 res = pcre2_substring_get_bynumber(
148 parse_regex.
match, i + 1, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len);
154 args[i] = (
char *)str_ptr;
156 if (strncasecmp(args[i],
"by_dst",strlen(
"by_dst")) == 0)
158 if (strncasecmp(args[i],
"by_src",strlen(
"by_src")) == 0)
160 if (strncasecmp(args[i],
"count",strlen(
"count")) == 0)
162 if (strncasecmp(args[i],
"seconds",strlen(
"seconds")) == 0)
166 if (args[count_pos] == NULL || args[seconds_pos] == NULL) {
171 args[count_pos]) <= 0) {
176 args[seconds_pos]) <= 0) {
185 for (i = 0; i < 6; i++){
187 pcre2_substring_free((PCRE2_UCHAR *)args[i]);
192 for (i = 0; i < 6; i++){
194 pcre2_substring_free((PCRE2_UCHAR *)args[i]);
233 df = DetectDetectionFilterParse(rawstr);
285 static int DetectDetectionFilterTestParse01 (
void)
288 df = DetectDetectionFilterParse(
"track by_dst,count 10,seconds 60");
290 DetectDetectionFilterFree(NULL, df);
303 static int DetectDetectionFilterTestParse02 (
void)
306 df = DetectDetectionFilterParse(
"track both,count 10,seconds 60");
308 DetectDetectionFilterFree(NULL, df);
321 static int DetectDetectionFilterTestParse03 (
void)
324 df = DetectDetectionFilterParse(
"track by_dst, seconds 60, count 10");
326 DetectDetectionFilterFree(NULL, df);
340 static int DetectDetectionFilterTestParse04 (
void)
343 df = DetectDetectionFilterParse(
"count 10, track by_dst, seconds 60, count 10");
345 DetectDetectionFilterFree(NULL, df);
358 static int DetectDetectionFilterTestParse05 (
void)
361 df = DetectDetectionFilterParse(
"count 10, track by_dst, seconds 60");
363 DetectDetectionFilterFree(NULL, df);
376 static int DetectDetectionFilterTestParse06 (
void)
379 df = DetectDetectionFilterParse(
"count 10, track by_dst, seconds 0");
381 DetectDetectionFilterFree(NULL, df);
396 static int DetectDetectionFilterTestSig1(
void)
407 memset(&th_v, 0,
sizeof(th_v));
418 s =
de_ctx->
sig_list =
SigInit(
de_ctx,
"alert tcp any any -> any 80 (msg:\"detection_filter Test\"; detection_filter: track by_dst, count 4, seconds 60; sid:1;)");
467 static int DetectDetectionFilterTestSig2(
void)
479 memset (&
ts, 0,
sizeof(
struct timeval));
482 memset(&th_v, 0,
sizeof(th_v));
493 s =
de_ctx->
sig_list =
SigInit(
de_ctx,
"alert tcp any any -> any 80 (msg:\"detection_filter Test 2\"; detection_filter: track by_dst, count 4, seconds 60; sid:10;)");
539 static int DetectDetectionFilterTestSig3(
void)
552 memset (&
ts, 0,
sizeof(
struct timeval));
555 memset(&th_v, 0,
sizeof(th_v));
566 s =
de_ctx->
sig_list =
SigInit(
de_ctx,
"drop tcp any any -> any 80 (msg:\"detection_filter Test 2\"; detection_filter: track by_dst, count 2, seconds 60; sid:10;)");
578 drops += ((PacketTestAction(p,
ACTION_DROP)) ? 1 : 0);
583 drops += ((PacketTestAction(p,
ACTION_DROP)) ? 1 : 0);
588 drops += ((PacketTestAction(p,
ACTION_DROP)) ? 1 : 0);
596 drops += ((PacketTestAction(p,
ACTION_DROP)) ? 1 : 0);
601 drops += ((PacketTestAction(p,
ACTION_DROP)) ? 1 : 0);
606 drops += ((PacketTestAction(p,
ACTION_DROP)) ? 1 : 0);
611 drops += ((PacketTestAction(p,
ACTION_DROP)) ? 1 : 0);
614 if (alerts == 3 && drops == 3)
618 printf(
"alerts: %d != 3: ", alerts);
620 printf(
"drops: %d != 3: ", drops);
634 static void DetectDetectionFilterRegisterTests(
void)
637 DetectDetectionFilterTestParse01);
639 DetectDetectionFilterTestParse02);
641 DetectDetectionFilterTestParse03);
643 DetectDetectionFilterTestParse04);
645 DetectDetectionFilterTestParse05);
647 DetectDetectionFilterTestParse06);
649 DetectDetectionFilterTestSig1);
651 DetectDetectionFilterTestSig2);
653 DetectDetectionFilterTestSig3);