suricata
detect-engine-address-ipv4.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * IPV4 Address part of the detection engine.
24  */
25 
26 #include "suricata-common.h"
27 
28 #include "decode.h"
29 #include "detect.h"
30 #include "flow-var.h"
31 
32 #include "util-cidr.h"
33 #include "util-unittest.h"
34 
35 #include "detect-engine-address.h"
36 #include "detect-engine-address-ipv4.h"
37 #include "detect-engine-siggroup.h"
38 #include "detect-engine-port.h"
39 
40 #include "util-error.h"
41 #include "util-debug.h"
42 
43 /**
44  * \brief Compares 2 addresses(address ranges) and returns the relationship
45  * between the 2 addresses.
46  *
47  * \param a Pointer to the first address instance to be compared.
48  * \param b Pointer to the second address instance to be compared.
49  *
50  * \retval ADDRESS_EQ If the 2 address ranges a and b, are equal.
51  * \retval ADDRESS_ES b encapsulates a. b_ip1[...a_ip1...a_ip2...]b_ip2.
52  * \retval ADDRESS_EB a encapsulates b. a_ip1[...b_ip1....b_ip2...]a_ip2.
53  * \retval ADDRESS_LE a_ip1(...b_ip1==a_ip2...)b_ip2
54  * \retval ADDRESS_LT a_ip1(...b_ip1...a_ip2...)b_ip2
55  * \retval ADDRESS_GE b_ip1(...a_ip1==b_ip2...)a_ip2
56  * \retval ADDRESS_GT a_ip1 > b_ip2, i.e. the address range for 'a' starts only
57  * after the end of the address range for 'b'
58  */
59 int DetectAddressCmpIPv4(DetectAddress *a, DetectAddress *b)
60 {
61  uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]);
62  uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]);
63  uint32_t b_ip1 = SCNtohl(b->ip.addr_data32[0]);
64  uint32_t b_ip2 = SCNtohl(b->ip2.addr_data32[0]);
65 
66  if (a_ip1 == b_ip1 && a_ip2 == b_ip2) {
67  SCLogDebug("ADDRESS_EQ");
68  return ADDRESS_EQ;
69  } else if (a_ip1 >= b_ip1 && a_ip1 <= b_ip2 && a_ip2 <= b_ip2) {
70  SCLogDebug("ADDRESS_ES");
71  return ADDRESS_ES;
72  } else if (a_ip1 <= b_ip1 && a_ip2 >= b_ip2) {
73  SCLogDebug("ADDRESS_EB");
74  return ADDRESS_EB;
75  } else if (a_ip1 < b_ip1 && a_ip2 < b_ip2 && a_ip2 >= b_ip1) {
76  SCLogDebug("ADDRESS_LE");
77  return ADDRESS_LE;
78  } else if (a_ip1 < b_ip1 && a_ip2 < b_ip2) {
79  SCLogDebug("ADDRESS_LT");
80  return ADDRESS_LT;
81  } else if (a_ip1 > b_ip1 && a_ip1 <= b_ip2 && a_ip2 > b_ip2) {
82  SCLogDebug("ADDRESS_GE");
83  return ADDRESS_GE;
84  } else if (a_ip1 > b_ip2) {
85  SCLogDebug("ADDRESS_GT");
86  return ADDRESS_GT;
87  } else {
88  /* should be unreachable */
89  SCLogDebug("Internal Error: should be unreachable");
90  }
91 
92  return ADDRESS_ER;
93 }
94 
95 /**
96  * \brief Cut groups and merge sigs
97  *
98  * a = 1.2.3.4, b = 1.2.3.4-1.2.3.5
99  * must result in: a == 1.2.3.4, b == 1.2.3.5, c == NULL
100  *
101  * a = 1.2.3.4, b = 1.2.3.3-1.2.3.5
102  * must result in: a == 1.2.3.3, b == 1.2.3.4, c == 1.2.3.5
103  *
104  * a = 1.2.3.0/24 b = 1.2.3.128-1.2.4.10
105  * must result in: a == 1.2.3.0/24, b == 1.2.4.0-1.2.4.10, c == NULL
106  *
107  * a = 1.2.3.4, b = 1.2.3.0/24
108  * must result in: a == 1.2.3.0-1.2.3.3, b == 1.2.3.4, c == 1.2.3.5-1.2.3.255
109  *
110  * \retval 0 On success.
111  * \retval -1 On failure.
112  */
113 int DetectAddressCutIPv4(DetectEngineCtx *de_ctx, DetectAddress *a,
114  DetectAddress *b, DetectAddress **c)
115 {
116  uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]);
117  uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]);
118  uint32_t b_ip1 = SCNtohl(b->ip.addr_data32[0]);
119  uint32_t b_ip2 = SCNtohl(b->ip2.addr_data32[0]);
120  DetectAddress *tmp = NULL;
121  DetectAddress *tmp_c = NULL;
122  int r = 0;
123 
124  /* default to NULL */
125  *c = NULL;
126 
127  r = DetectAddressCmpIPv4(a, b);
128  if (r != ADDRESS_ES && r != ADDRESS_EB && r != ADDRESS_LE && r != ADDRESS_GE) {
129  SCLogDebug("we shouldn't be here");
130  goto error;
131  }
132 
133  /* get a place to temporary put sigs lists */
134  tmp = DetectAddressInit();
135  if (tmp == NULL)
136  goto error;
137 
138  /* we have 3 parts: [aaa[abab)bbb]
139  * part a: a_ip1 <-> b_ip1 - 1
140  * part b: b_ip1 <-> a_ip2
141  * part c: a_ip2 + 1 <-> b_ip2
142  */
143  if (r == ADDRESS_LE) {
144  SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_LE");
145 
146  a->ip.addr_data32[0] = htonl(a_ip1);
147  a->ip2.addr_data32[0] = htonl(b_ip1 - 1);
148 
149  b->ip.addr_data32[0] = htonl(b_ip1);
150  b->ip2.addr_data32[0] = htonl(a_ip2);
151 
152  tmp_c = DetectAddressInit();
153  if (tmp_c == NULL)
154  goto error;
155 
156  tmp_c->ip.family = AF_INET;
157  tmp_c->ip.addr_data32[0] = htonl(a_ip2 + 1);
158  tmp_c->ip2.addr_data32[0] = htonl(b_ip2);
159  *c = tmp_c;
160 
161  /* we have 3 parts: [bbb[baba]aaa]
162  * part a: b_ip1 <-> a_ip1 - 1
163  * part b: a_ip1 <-> b_ip2
164  * part c: b_ip2 + 1 <-> a_ip2
165  */
166  } else if (r == ADDRESS_GE) {
167  SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_GE");
168 
169  a->ip.addr_data32[0] = htonl(b_ip1);
170  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
171 
172  b->ip.addr_data32[0] = htonl(a_ip1);
173  b->ip2.addr_data32[0] = htonl(b_ip2);
174 
175  tmp_c = DetectAddressInit();
176  if (tmp_c == NULL)
177  goto error;
178 
179  tmp_c->ip.family = AF_INET;
180  tmp_c->ip.addr_data32[0] = htonl(b_ip2 + 1);
181  tmp_c->ip2.addr_data32[0] = htonl(a_ip2);
182  *c = tmp_c;
183 
184  /* we have 2 or three parts:
185  *
186  * 2 part: [[abab]bbb] or [bbb[baba]]
187  * part a: a_ip1 <-> a_ip2
188  * part b: a_ip2 + 1 <-> b_ip2
189  *
190  * part a: b_ip1 <-> a_ip1 - 1
191  * part b: a_ip1 <-> a_ip2
192  *
193  * 3 part [bbb[aaa]bbb]
194  * becomes[aaa[bbb]ccc]
195  *
196  * part a: b_ip1 <-> a_ip1 - 1
197  * part b: a_ip1 <-> a_ip2
198  * part c: a_ip2 + 1 <-> b_ip2
199  */
200  } else if (r == ADDRESS_ES) {
201  SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_ES");
202 
203  if (a_ip1 == b_ip1) {
204  SCLogDebug("DetectAddressCutIPv4: 1");
205 
206  a->ip.addr_data32[0] = htonl(a_ip1);
207  a->ip2.addr_data32[0] = htonl(a_ip2);
208 
209  b->ip.addr_data32[0] = htonl(a_ip2 + 1);
210  b->ip2.addr_data32[0] = htonl(b_ip2);
211 
212  } else if (a_ip2 == b_ip2) {
213  SCLogDebug("DetectAddressCutIPv4: 2");
214 
215  a->ip.addr_data32[0] = htonl(b_ip1);
216  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
217 
218  b->ip.addr_data32[0] = htonl(a_ip1);
219  b->ip2.addr_data32[0] = htonl(a_ip2);
220 
221  } else {
222  SCLogDebug("3");
223 
224  a->ip.addr_data32[0] = htonl(b_ip1);
225  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
226 
227  b->ip.addr_data32[0] = htonl(a_ip1);
228  b->ip2.addr_data32[0] = htonl(a_ip2);
229 
230  tmp_c = DetectAddressInit();
231  if (tmp_c == NULL)
232  goto error;
233 
234  tmp_c->ip.family = AF_INET;
235  tmp_c->ip.addr_data32[0] = htonl(a_ip2 + 1);
236  tmp_c->ip2.addr_data32[0] = htonl(b_ip2);
237  *c = tmp_c;
238  }
239  /* we have 2 or three parts:
240  *
241  * 2 part: [[baba]aaa] or [aaa[abab]]
242  * part a: b_ip1 <-> b_ip2
243  * part b: b_ip2 + 1 <-> a_ip2
244  *
245  * part a: a_ip1 <-> b_ip1 - 1
246  * part b: b_ip1 <-> b_ip2
247  *
248  * 3 part [aaa[bbb]aaa]
249  * becomes[aaa[bbb]ccc]
250  *
251  * part a: a_ip1 <-> b_ip2 - 1
252  * part b: b_ip1 <-> b_ip2
253  * part c: b_ip2 + 1 <-> a_ip2
254  */
255  } else if (r == ADDRESS_EB) {
256  SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_EB");
257 
258  if (a_ip1 == b_ip1) {
259  SCLogDebug("DetectAddressCutIPv4: 1");
260 
261  a->ip.addr_data32[0] = htonl(b_ip1);
262  a->ip2.addr_data32[0] = htonl(b_ip2);
263 
264  b->ip.addr_data32[0] = htonl(b_ip2 + 1);
265  b->ip2.addr_data32[0] = htonl(a_ip2);
266  } else if (a_ip2 == b_ip2) {
267  SCLogDebug("DetectAddressCutIPv4: 2");
268 
269  a->ip.addr_data32[0] = htonl(a_ip1);
270  a->ip2.addr_data32[0] = htonl(b_ip1 - 1);
271 
272  b->ip.addr_data32[0] = htonl(b_ip1);
273  b->ip2.addr_data32[0] = htonl(b_ip2);
274  } else {
275  SCLogDebug("DetectAddressCutIPv4: 3");
276 
277  a->ip.addr_data32[0] = htonl(a_ip1);
278  a->ip2.addr_data32[0] = htonl(b_ip1 - 1);
279 
280  b->ip.addr_data32[0] = htonl(b_ip1);
281  b->ip2.addr_data32[0] = htonl(b_ip2);
282 
283  tmp_c = DetectAddressInit();
284  if (tmp_c == NULL)
285  goto error;
286 
287  tmp_c->ip.family = AF_INET;
288  tmp_c->ip.addr_data32[0] = htonl(b_ip2 + 1);
289  tmp_c->ip2.addr_data32[0] = htonl(a_ip2);
290  *c = tmp_c;
291  }
292  }
293 
294  if (tmp != NULL)
295  DetectAddressFree(tmp);
296 
297  return 0;
298 
299 error:
300  if (tmp != NULL)
301  DetectAddressFree(tmp);
302  return -1;
303 }
304 
305 /**
306  * \brief Check if the address group list covers the complete IPv4 IP space.
307  *
308  * \param ag Pointer to a DetectAddress list head, which has to be checked to
309  * see if the address ranges in it, cover the entire IPv4 IP space.
310  *
311  * \retval 1 Yes, it covers the entire IPv4 address range.
312  * \retval 0 No, it doesn't cover the entire IPv4 address range.
313  */
314 int DetectAddressIsCompleteIPSpaceIPv4(DetectAddress *ag)
315 {
316  uint32_t next_ip = 0;
317 
318  if (ag == NULL)
319  return 0;
320 
321  /* if we don't start with 0.0.0.0 we know we're good */
322  if (SCNtohl(ag->ip.addr_data32[0]) != 0x00000000)
323  return 0;
324 
325  /* if we're ending with 255.255.255.255 while we know we started with
326  * 0.0.0.0 it's the complete space */
327  if (SCNtohl(ag->ip2.addr_data32[0]) == 0xFFFFFFFF)
328  return 1;
329 
330  next_ip = htonl(SCNtohl(ag->ip2.addr_data32[0]) + 1);
331  ag = ag->next;
332 
333  for ( ; ag != NULL; ag = ag->next) {
334 
335  if (ag->ip.addr_data32[0] != next_ip)
336  return 0;
337 
338  if (SCNtohl(ag->ip2.addr_data32[0]) == 0xFFFFFFFF)
339  return 1;
340 
341  next_ip = htonl(SCNtohl(ag->ip2.addr_data32[0]) + 1);
342  }
343 
344  return 0;
345 }
346 
347 /**
348  * \brief Cuts and returns an address range, which is the complement of the
349  * address range that is supplied as the argument.
350  *
351  * For example:
352  *
353  * If a = 0.0.0.0-1.2.3.4,
354  * then a = 1.2.3.4-255.255.255.255 and b = NULL
355  * If a = 1.2.3.4-255.255.255.255,
356  * then a = 0.0.0.0-1.2.3.4 and b = NULL
357  * If a = 1.2.3.4-192.168.1.1,
358  * then a = 0.0.0.0-1.2.3.3 and b = 192.168.1.2-255.255.255.255
359  *
360  * \param a Pointer to an address range (DetectAddress) instance whose complement
361  * has to be returned in a and b.
362  * \param b Pointer to DetectAddress pointer, that will be supplied back with a
363  * new DetectAddress instance, if the complement demands so.
364  *
365  * \retval 0 On success.
366  * \retval -1 On failure.
367  */
368 int DetectAddressCutNotIPv4(DetectAddress *a, DetectAddress **b)
369 {
370  uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]);
371  uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]);
372  DetectAddress *tmp_b = NULL;
373 
374  /* default to NULL */
375  *b = NULL;
376 
377  if (a_ip1 != 0x00000000 && a_ip2 != 0xFFFFFFFF) {
378  a->ip.addr_data32[0] = htonl(0x00000000);
379  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
380 
381  tmp_b = DetectAddressInit();
382  if (tmp_b == NULL)
383  goto error;
384 
385  tmp_b->ip.family = AF_INET;
386  tmp_b->ip.addr_data32[0] = htonl(a_ip2 + 1);
387  tmp_b->ip2.addr_data32[0] = htonl(0xFFFFFFFF);
388  *b = tmp_b;
389  } else if (a_ip1 == 0x00000000 && a_ip2 != 0xFFFFFFFF) {
390  a->ip.addr_data32[0] = htonl(a_ip2 + 1);
391  a->ip2.addr_data32[0] = htonl(0xFFFFFFFF);
392  } else if (a_ip1 != 0x00000000 && a_ip2 == 0xFFFFFFFF) {
393  a->ip.addr_data32[0] = htonl(0x00000000);
394  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
395  } else {
396  goto error;
397  }
398 
399  return 0;
400 
401 error:
402  return -1;
403 }
404 
405 /**
406  * \brief Extends a target address range if the the source address range is
407  * wider than the target address range on either sides.
408  *
409  * Every address is a range, i.e. address->ip1....address->ip2. For
410  * example 1.2.3.4 to 192.168.1.1.
411  * if source->ip1 is smaller than target->ip1, it indicates that the
412  * source's left address limit is greater(range wise) than the target's
413  * left address limit, and hence we reassign the target's left address
414  * limit to source's left address limit.
415  * Similary if source->ip2 is greater than target->ip2, it indicates that
416  * the source's right address limit is greater(range wise) than the
417  * target's right address limit, and hence we reassign the target's right
418  * address limit to source's right address limit.
419  *
420  * \param de_ctx Pointer to the detection engine context.
421  * \param target Pointer to the target DetectAddress instance that has to be
422  * updated.
423  * \param source Pointer to the source DetectAddress instance that is used
424  * to decided whether we extend the target's address range.
425  *
426  * \retval 0 On success.
427  * \retval -1 On failure.
428  */
429 int DetectAddressJoinIPv4(DetectEngineCtx *de_ctx, DetectAddress *target,
430  DetectAddress *source)
431 {
432  if (source == NULL || target == NULL)
433  return -1;
434 
435  if (SCNtohl(source->ip.addr_data32[0]) < SCNtohl(target->ip.addr_data32[0]))
436  target->ip.addr_data32[0] = source->ip.addr_data32[0];
437 
438  if (SCNtohl(source->ip2.addr_data32[0]) > SCNtohl(target->ip2.addr_data32[0]))
439  target->ip2.addr_data32[0] = source->ip2.addr_data32[0];
440 
441  return 0;
442 }
443 
444 /********************************Unittests*************************************/
445 
446 #ifdef UNITTESTS
447 
448 static int DetectAddressIPv4TestAddressCmp01(void)
449 {
450  struct in_addr in;
451  int result = 1;
452 
453  DetectAddress *a = DetectAddressInit();
454  if (a == NULL)
455  return 0;
456 
457  DetectAddress *b = DetectAddressInit();
458  if (b == NULL) {
459  DetectAddressFree(a);
460  return 0;
461  }
462 
463  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
464  goto error;
465  a->ip.addr_data32[0] = in.s_addr;
466  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
467  goto error;
468  a->ip2.addr_data32[0] = in.s_addr;
469  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
470  goto error;
471  b->ip.addr_data32[0] = in.s_addr;
472  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
473  goto error;
474  b->ip2.addr_data32[0] = in.s_addr;
475  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_EQ);
476 
477  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
478  goto error;
479  a->ip.addr_data32[0] = in.s_addr;
480  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
481  goto error;
482  a->ip2.addr_data32[0] = in.s_addr;
483  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
484  goto error;
485  b->ip.addr_data32[0] = in.s_addr;
486  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
487  goto error;
488  b->ip2.addr_data32[0] = in.s_addr;
489  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_ES);
490 
491  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
492  goto error;
493  a->ip.addr_data32[0] = in.s_addr;
494  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
495  goto error;
496  a->ip2.addr_data32[0] = in.s_addr;
497  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
498  goto error;
499  b->ip.addr_data32[0] = in.s_addr;
500  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
501  goto error;
502  b->ip2.addr_data32[0] = in.s_addr;
503  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_ES);
504 
505  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
506  goto error;
507  a->ip.addr_data32[0] = in.s_addr;
508  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
509  goto error;
510  a->ip2.addr_data32[0] = in.s_addr;
511  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
512  goto error;
513  b->ip.addr_data32[0] = in.s_addr;
514  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
515  goto error;
516  b->ip2.addr_data32[0] = in.s_addr;
517  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_ES);
518 
519  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
520  goto error;
521  a->ip.addr_data32[0] = in.s_addr;
522  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
523  goto error;
524  a->ip2.addr_data32[0] = in.s_addr;
525  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
526  goto error;
527  b->ip.addr_data32[0] = in.s_addr;
528  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
529  goto error;
530  b->ip2.addr_data32[0] = in.s_addr;
531  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_ES);
532 
533  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
534  goto error;
535  a->ip.addr_data32[0] = in.s_addr;
536  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
537  goto error;
538  a->ip2.addr_data32[0] = in.s_addr;
539  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
540  goto error;
541  b->ip.addr_data32[0] = in.s_addr;
542  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
543  goto error;
544  b->ip2.addr_data32[0] = in.s_addr;
545  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_ES);
546 
547  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
548  goto error;
549  a->ip.addr_data32[0] = in.s_addr;
550  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
551  goto error;
552  a->ip2.addr_data32[0] = in.s_addr;
553  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
554  goto error;
555  b->ip.addr_data32[0] = in.s_addr;
556  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
557  goto error;
558  b->ip2.addr_data32[0] = in.s_addr;
559  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_EB);
560 
561  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
562  goto error;
563  a->ip.addr_data32[0] = in.s_addr;
564  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
565  goto error;
566  a->ip2.addr_data32[0] = in.s_addr;
567  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
568  goto error;
569  b->ip.addr_data32[0] = in.s_addr;
570  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
571  goto error;
572  b->ip2.addr_data32[0] = in.s_addr;
573  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_EB);
574 
575  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
576  goto error;
577  a->ip.addr_data32[0] = in.s_addr;
578  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
579  goto error;
580  a->ip2.addr_data32[0] = in.s_addr;
581  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
582  goto error;
583  b->ip.addr_data32[0] = in.s_addr;
584  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
585  goto error;
586  b->ip2.addr_data32[0] = in.s_addr;
587  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_EB);
588 
589  if (inet_pton(AF_INET, "1.2.3.5", &in) < 0)
590  goto error;
591  a->ip.addr_data32[0] = in.s_addr;
592  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
593  goto error;
594  a->ip2.addr_data32[0] = in.s_addr;
595  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
596  goto error;
597  b->ip.addr_data32[0] = in.s_addr;
598  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
599  goto error;
600  b->ip2.addr_data32[0] = in.s_addr;
601  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_EB);
602 
603  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
604  goto error;
605  a->ip.addr_data32[0] = in.s_addr;
606  if (inet_pton(AF_INET, "128.128.128.128", &in) < 0)
607  goto error;
608  a->ip2.addr_data32[0] = in.s_addr;
609  if (inet_pton(AF_INET, "128.128.128.128", &in) < 0)
610  goto error;
611  b->ip.addr_data32[0] = in.s_addr;
612  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
613  goto error;
614  b->ip2.addr_data32[0] = in.s_addr;
615  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_LE);
616 
617  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
618  goto error;
619  a->ip.addr_data32[0] = in.s_addr;
620  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
621  goto error;
622  a->ip2.addr_data32[0] = in.s_addr;
623  if (inet_pton(AF_INET, "128.128.128.128", &in) < 0)
624  goto error;
625  b->ip.addr_data32[0] = in.s_addr;
626  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
627  goto error;
628  b->ip2.addr_data32[0] = in.s_addr;
629  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_LE);
630 
631  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
632  goto error;
633  a->ip.addr_data32[0] = in.s_addr;
634  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
635  goto error;
636  a->ip2.addr_data32[0] = in.s_addr;
637  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
638  goto error;
639  b->ip.addr_data32[0] = in.s_addr;
640  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
641  goto error;
642  b->ip2.addr_data32[0] = in.s_addr;
643  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LE);
644 
645  if (inet_pton(AF_INET, "170.170.170.169", &in) < 0)
646  goto error;
647  a->ip.addr_data32[0] = in.s_addr;
648  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
649  goto error;
650  a->ip2.addr_data32[0] = in.s_addr;
651  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
652  goto error;
653  b->ip.addr_data32[0] = in.s_addr;
654  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
655  goto error;
656  b->ip2.addr_data32[0] = in.s_addr;
657  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_LE);
658 
659  if (inet_pton(AF_INET, "170.170.170.169", &in) < 0)
660  goto error;
661  a->ip.addr_data32[0] = in.s_addr;
662  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
663  goto error;
664  a->ip2.addr_data32[0] = in.s_addr;
665  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
666  goto error;
667  b->ip.addr_data32[0] = in.s_addr;
668  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
669  goto error;
670  b->ip2.addr_data32[0] = in.s_addr;
671  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LE);
672 
673  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
674  goto error;
675  a->ip.addr_data32[0] = in.s_addr;
676  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
677  goto error;
678  a->ip2.addr_data32[0] = in.s_addr;
679  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
680  goto error;
681  b->ip.addr_data32[0] = in.s_addr;
682  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
683  goto error;
684  b->ip2.addr_data32[0] = in.s_addr;
685  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_LT);
686 
687  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
688  goto error;
689  a->ip.addr_data32[0] = in.s_addr;
690  if (inet_pton(AF_INET, "185.185.185.185", &in) < 0)
691  goto error;
692  a->ip2.addr_data32[0] = in.s_addr;
693  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
694  goto error;
695  b->ip.addr_data32[0] = in.s_addr;
696  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
697  goto error;
698  b->ip2.addr_data32[0] = in.s_addr;
699  /* we could get a LE */
700  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
701 
702  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
703  goto error;
704  a->ip.addr_data32[0] = in.s_addr;
705  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
706  goto error;
707  a->ip2.addr_data32[0] = in.s_addr;
708  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
709  goto error;
710  b->ip.addr_data32[0] = in.s_addr;
711  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
712  goto error;
713  b->ip2.addr_data32[0] = in.s_addr;
714  /* we could get a LE */
715  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
716 
717  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
718  goto error;
719  a->ip.addr_data32[0] = in.s_addr;
720  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
721  goto error;
722  a->ip2.addr_data32[0] = in.s_addr;
723  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
724  goto error;
725  b->ip.addr_data32[0] = in.s_addr;
726  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
727  goto error;
728  b->ip2.addr_data32[0] = in.s_addr;
729  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
730 
731  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
732  goto error;
733  a->ip.addr_data32[0] = in.s_addr;
734  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
735  goto error;
736  a->ip2.addr_data32[0] = in.s_addr;
737  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
738  goto error;
739  b->ip.addr_data32[0] = in.s_addr;
740  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
741  goto error;
742  b->ip2.addr_data32[0] = in.s_addr;
743  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
744 
745  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
746  goto error;
747  a->ip.addr_data32[0] = in.s_addr;
748  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
749  goto error;
750  a->ip2.addr_data32[0] = in.s_addr;
751  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
752  goto error;
753  b->ip.addr_data32[0] = in.s_addr;
754  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
755  goto error;
756  b->ip2.addr_data32[0] = in.s_addr;
757  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
758 
759  if (inet_pton(AF_INET, "128.128.128.128", &in) < 0)
760  goto error;
761  a->ip.addr_data32[0] = in.s_addr;
762  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
763  goto error;
764  a->ip2.addr_data32[0] = in.s_addr;
765  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
766  goto error;
767  b->ip.addr_data32[0] = in.s_addr;
768  if (inet_pton(AF_INET, "128.128.128.128", &in) < 0)
769  goto error;
770  b->ip2.addr_data32[0] = in.s_addr;
771  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_GE);
772 
773  if (inet_pton(AF_INET, "128.128.128.128", &in) < 0)
774  goto error;
775  a->ip.addr_data32[0] = in.s_addr;
776  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
777  goto error;
778  a->ip2.addr_data32[0] = in.s_addr;
779  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
780  goto error;
781  b->ip.addr_data32[0] = in.s_addr;
782  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
783  goto error;
784  b->ip2.addr_data32[0] = in.s_addr;
785  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_GE);
786 
787  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
788  goto error;
789  a->ip.addr_data32[0] = in.s_addr;
790  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
791  goto error;
792  a->ip2.addr_data32[0] = in.s_addr;
793  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
794  goto error;
795  b->ip.addr_data32[0] = in.s_addr;
796  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
797  goto error;
798  b->ip2.addr_data32[0] = in.s_addr;
799  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GE);
800 
801  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
802  goto error;
803  a->ip.addr_data32[0] = in.s_addr;
804  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
805  goto error;
806  a->ip2.addr_data32[0] = in.s_addr;
807  if (inet_pton(AF_INET, "170.170.170.169", &in) < 0)
808  goto error;
809  b->ip.addr_data32[0] = in.s_addr;
810  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
811  goto error;
812  b->ip2.addr_data32[0] = in.s_addr;
813  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_GE);
814 
815  if (inet_pton(AF_INET, "170.170.170.169", &in) < 0)
816  goto error;
817  a->ip.addr_data32[0] = in.s_addr;
818  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
819  goto error;
820  a->ip2.addr_data32[0] = in.s_addr;
821  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
822  goto error;
823  b->ip.addr_data32[0] = in.s_addr;
824  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
825  goto error;
826  b->ip2.addr_data32[0] = in.s_addr;
827  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GE);
828 
829  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
830  goto error;
831  a->ip.addr_data32[0] = in.s_addr;
832  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
833  goto error;
834  a->ip2.addr_data32[0] = in.s_addr;
835  if (inet_pton(AF_INET, "170.170.169.170", &in) < 0)
836  goto error;
837  b->ip.addr_data32[0] = in.s_addr;
838  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
839  goto error;
840  b->ip2.addr_data32[0] = in.s_addr;
841  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GE);
842 
843  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
844  goto error;
845  a->ip.addr_data32[0] = in.s_addr;
846  if (inet_pton(AF_INET, "200.200.200.200", &in) < 0)
847  goto error;
848  a->ip2.addr_data32[0] = in.s_addr;
849  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
850  goto error;
851  b->ip.addr_data32[0] = in.s_addr;
852  if (inet_pton(AF_INET, "185.185.185.185", &in) < 0)
853  goto error;
854  b->ip2.addr_data32[0] = in.s_addr;
855  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_GT);
856 
857  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
858  goto error;
859  a->ip.addr_data32[0] = in.s_addr;
860  if (inet_pton(AF_INET, "200.200.200.200", &in) < 0)
861  goto error;
862  a->ip2.addr_data32[0] = in.s_addr;
863  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
864  goto error;
865  b->ip.addr_data32[0] = in.s_addr;
866  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
867  goto error;
868  b->ip2.addr_data32[0] = in.s_addr;
869  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GT);
870 
871  if (inet_pton(AF_INET, "182.168.1.2", &in) < 0)
872  goto error;
873  a->ip.addr_data32[0] = in.s_addr;
874  if (inet_pton(AF_INET, "200.200.200.200", &in) < 0)
875  goto error;
876  a->ip2.addr_data32[0] = in.s_addr;
877  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
878  goto error;
879  b->ip.addr_data32[0] = in.s_addr;
880  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
881  goto error;
882  b->ip2.addr_data32[0] = in.s_addr;
883  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GT);
884 
885  DetectAddressFree(a);
886  DetectAddressFree(b);
887  return result;
888 
889  error:
890  DetectAddressFree(a);
891  DetectAddressFree(b);
892  return 0;
893 }
894 
895 static int DetectAddressIPv4IsCompleteIPSpace02(void)
896 {
897  DetectAddress *a = NULL;
898  struct in_addr in;
899  int result = 1;
900 
901  if ( (a = DetectAddressInit()) == NULL)
902  goto error;
903 
904  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
905  goto error;
906  a->ip.addr_data32[0] = in.s_addr;
907  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
908  goto error;
909  a->ip2.addr_data32[0] = in.s_addr;
910  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 1);
911 
912  if (inet_pton(AF_INET, "0.0.0.1", &in) < 0)
913  goto error;
914  a->ip.addr_data32[0] = in.s_addr;
915  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
916  goto error;
917  a->ip2.addr_data32[0] = in.s_addr;
918  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
919 
920  DetectAddressFree(a);
921 
922  if ( (a = DetectAddressInit()) == NULL)
923  goto error;
924 
925  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
926  goto error;
927  a->ip.addr_data32[0] = in.s_addr;
928  if (inet_pton(AF_INET, "255.255.255.254", &in) < 0)
929  goto error;
930  a->ip2.addr_data32[0] = in.s_addr;
931  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
932 
933  DetectAddressFree(a);
934 
935  return result;
936 
937  error:
938  if (a != NULL)
939  DetectAddressFree(a);
940  return 0;
941 }
942 
943 static int DetectAddressIPv4IsCompleteIPSpace03(void)
944 {
945  DetectAddress *a = NULL;
946  DetectAddress *temp = NULL;
947  struct in_addr in;
948  int result = 1;
949 
950  if ( (a = DetectAddressInit()) == NULL)
951  goto error;
952  temp = a;
953 
954  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
955  goto error;
956  a->ip.addr_data32[0] = in.s_addr;
957  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
958  goto error;
959  a->ip2.addr_data32[0] = in.s_addr;
960  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
961 
962  if ( (temp->next = DetectAddressInit()) == NULL)
963  goto error;
964  temp = temp->next;
965 
966  if (inet_pton(AF_INET, "1.2.3.5", &in) < 0)
967  goto error;
968  temp->ip.addr_data32[0] = in.s_addr;
969  if (inet_pton(AF_INET, "126.36.62.61", &in) < 0)
970  goto error;
971  temp->ip2.addr_data32[0] = in.s_addr;
972  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
973 
974  if ( (temp->next = DetectAddressInit()) == NULL)
975  goto error;
976  temp = temp->next;
977 
978  if (inet_pton(AF_INET, "126.36.62.62", &in) < 0)
979  goto error;
980  temp->ip.addr_data32[0] = in.s_addr;
981  if (inet_pton(AF_INET, "222.52.21.62", &in) < 0)
982  goto error;
983  temp->ip2.addr_data32[0] = in.s_addr;
984  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
985 
986  if ( (temp->next = DetectAddressInit()) == NULL)
987  goto error;
988  temp = temp->next;
989 
990  if (inet_pton(AF_INET, "222.52.21.63", &in) < 0)
991  goto error;
992  temp->ip.addr_data32[0] = in.s_addr;
993  if (inet_pton(AF_INET, "255.255.255.254", &in) < 0)
994  goto error;
995  temp->ip2.addr_data32[0] = in.s_addr;
996  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
997 
998  if ( (temp->next = DetectAddressInit()) == NULL)
999  goto error;
1000  temp = temp->next;
1001 
1002  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1003  goto error;
1004  temp->ip.addr_data32[0] = in.s_addr;
1005  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1006  goto error;
1007  temp->ip2.addr_data32[0] = in.s_addr;
1008  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 1);
1009 
1010  DetectAddressFree(a);
1011 
1012  return result;
1013 
1014  error:
1015  if (a != NULL)
1016  DetectAddressFree(a);
1017  return 0;
1018 }
1019 
1020 static int DetectAddressIPv4IsCompleteIPSpace04(void)
1021 {
1022  DetectAddress *a = NULL;
1023  DetectAddress *temp = NULL;
1024  struct in_addr in;
1025  int result = 1;
1026 
1027  if ( (a = DetectAddressInit()) == NULL)
1028  goto error;
1029  temp = a;
1030 
1031  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
1032  goto error;
1033  a->ip.addr_data32[0] = in.s_addr;
1034  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1035  goto error;
1036  a->ip2.addr_data32[0] = in.s_addr;
1037  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
1038 
1039  if ( (temp->next = DetectAddressInit()) == NULL)
1040  goto error;
1041  temp = temp->next;
1042 
1043  if (inet_pton(AF_INET, "1.2.3.5", &in) < 0)
1044  goto error;
1045  temp->ip.addr_data32[0] = in.s_addr;
1046  if (inet_pton(AF_INET, "126.36.62.61", &in) < 0)
1047  goto error;
1048  temp->ip2.addr_data32[0] = in.s_addr;
1049  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
1050 
1051  if ( (temp->next = DetectAddressInit()) == NULL)
1052  goto error;
1053  temp = temp->next;
1054 
1055  if (inet_pton(AF_INET, "126.36.62.62", &in) < 0)
1056  goto error;
1057  temp->ip.addr_data32[0] = in.s_addr;
1058  if (inet_pton(AF_INET, "222.52.21.62", &in) < 0)
1059  goto error;
1060  temp->ip2.addr_data32[0] = in.s_addr;
1061  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
1062 
1063  if ( (temp->next = DetectAddressInit()) == NULL)
1064  goto error;
1065  temp = temp->next;
1066 
1067  if (inet_pton(AF_INET, "222.52.21.64", &in) < 0)
1068  goto error;
1069  temp->ip.addr_data32[0] = in.s_addr;
1070  if (inet_pton(AF_INET, "255.255.255.254", &in) < 0)
1071  goto error;
1072  temp->ip2.addr_data32[0] = in.s_addr;
1073  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
1074 
1075  if ( (temp->next = DetectAddressInit()) == NULL)
1076  goto error;
1077  temp = temp->next;
1078 
1079  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1080  goto error;
1081  temp->ip.addr_data32[0] = in.s_addr;
1082  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1083  goto error;
1084  temp->ip2.addr_data32[0] = in.s_addr;
1085  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
1086 
1087  DetectAddressFree(a);
1088 
1089  return result;
1090 
1091  error:
1092  if (a != NULL)
1093  DetectAddressFree(a);
1094  return 0;
1095 }
1096 
1097 static int DetectAddressIPv4CutNot05(void)
1098 {
1099  DetectAddress *a = NULL;
1100  DetectAddress *b = NULL;
1101  struct in_addr in;
1102  int result = 1;
1103 
1104  if ( (a = DetectAddressInit()) == NULL)
1105  return 0;
1106 
1107  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
1108  goto error;
1109  a->ip.addr_data32[0] = in.s_addr;
1110  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1111  goto error;
1112  a->ip2.addr_data32[0] = in.s_addr;
1113  result &= (DetectAddressCutNotIPv4(a, &b) == -1);
1114 
1115  DetectAddressFree(a);
1116  if (b != NULL)
1117  DetectAddressFree(b);
1118  return result;
1119 
1120  error:
1121  DetectAddressFree(a);
1122  if (b != NULL)
1123  DetectAddressFree(b);
1124  return 0;
1125 }
1126 
1127 static int DetectAddressIPv4CutNot06(void)
1128 {
1129  DetectAddress *a = NULL;
1130  DetectAddress *b = NULL;
1131  struct in_addr in;
1132  int result = 1;
1133 
1134  if ( (a = DetectAddressInit()) == NULL)
1135  return 0;
1136 
1137  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
1138  goto error;
1139  a->ip.addr_data32[0] = in.s_addr;
1140  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1141  goto error;
1142  a->ip2.addr_data32[0] = in.s_addr;
1143  result &= (DetectAddressCutNotIPv4(a, &b) == 0);
1144 
1145  if (inet_pton(AF_INET, "1.2.3.5", &in) < 0)
1146  goto error;
1147  result = (a->ip.addr_data32[0] == in.s_addr);
1148  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1149  goto error;
1150  result &= (a->ip2.addr_data32[0] = in.s_addr);
1151 
1152  DetectAddressFree(a);
1153  if (b != NULL)
1154  DetectAddressFree(b);
1155  return result;
1156 
1157  error:
1158  DetectAddressFree(a);
1159  if (b != NULL)
1160  DetectAddressFree(b);
1161  return 0;
1162 }
1163 
1164 static int DetectAddressIPv4CutNot07(void)
1165 {
1166  DetectAddress *a = NULL;
1167  DetectAddress *b = NULL;
1168  struct in_addr in;
1169  int result = 1;
1170 
1171  if ( (a = DetectAddressInit()) == NULL)
1172  return 0;
1173 
1174  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1175  goto error;
1176  a->ip.addr_data32[0] = in.s_addr;
1177  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1178  goto error;
1179  a->ip2.addr_data32[0] = in.s_addr;
1180  result &= (DetectAddressCutNotIPv4(a, &b) == 0);
1181 
1182  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
1183  goto error;
1184  result = (a->ip.addr_data32[0] == in.s_addr);
1185  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
1186  goto error;
1187  result &= (a->ip2.addr_data32[0] = in.s_addr);
1188 
1189  DetectAddressFree(a);
1190  if (b != NULL)
1191  DetectAddressFree(b);
1192  return result;
1193 
1194  error:
1195  DetectAddressFree(a);
1196  if (b != NULL)
1197  DetectAddressFree(b);
1198  return 0;
1199 }
1200 
1201 static int DetectAddressIPv4CutNot08(void)
1202 {
1203  DetectAddress *a = NULL;
1204  DetectAddress *b = NULL;
1205  struct in_addr in;
1206  int result = 1;
1207 
1208  if ( (a = DetectAddressInit()) == NULL)
1209  return 0;
1210 
1211  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1212  goto error;
1213  a->ip.addr_data32[0] = in.s_addr;
1214  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1215  goto error;
1216  a->ip2.addr_data32[0] = in.s_addr;
1217  result &= (DetectAddressCutNotIPv4(a, &b) == 0);
1218 
1219  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
1220  goto error;
1221  result &= (a->ip.addr_data32[0] == in.s_addr);
1222  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
1223  goto error;
1224  result &= (a->ip2.addr_data32[0] = in.s_addr);
1225 
1226  if (b == NULL) {
1227  result = 0;
1228  goto error;
1229  } else {
1230  result &= 1;
1231  }
1232  if (inet_pton(AF_INET, "1.2.3.5", &in) < 0)
1233  goto error;
1234  result &= (b->ip.addr_data32[0] == in.s_addr);
1235  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1236  goto error;
1237  result &= (b->ip2.addr_data32[0] = in.s_addr);
1238 
1239  DetectAddressFree(a);
1240  if (b != NULL)
1241  DetectAddressFree(b);
1242  return result;
1243 
1244  error:
1245  DetectAddressFree(a);
1246  if (b != NULL)
1247  DetectAddressFree(b);
1248  return 0;
1249 }
1250 
1251 static int DetectAddressIPv4CutNot09(void)
1252 {
1253  DetectAddress *a = NULL;
1254  DetectAddress *b = NULL;
1255  struct in_addr in;
1256  int result = 1;
1257 
1258  if ( (a = DetectAddressInit()) == NULL)
1259  return 0;
1260 
1261  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1262  goto error;
1263  a->ip.addr_data32[0] = in.s_addr;
1264  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
1265  goto error;
1266  a->ip2.addr_data32[0] = in.s_addr;
1267  result &= (DetectAddressCutNotIPv4(a, &b) == 0);
1268 
1269  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
1270  goto error;
1271  result &= (a->ip.addr_data32[0] == in.s_addr);
1272  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
1273  goto error;
1274  result &= (a->ip2.addr_data32[0] = in.s_addr);
1275 
1276  if (b == NULL) {
1277  result = 0;
1278  goto error;
1279  } else {
1280  result &= 1;
1281  }
1282  if (inet_pton(AF_INET, "192.168.1.3", &in) < 0)
1283  goto error;
1284  result &= (b->ip.addr_data32[0] == in.s_addr);
1285  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1286  goto error;
1287  result &= (b->ip2.addr_data32[0] = in.s_addr);
1288 
1289  DetectAddressFree(a);
1290  if (b != NULL)
1291  DetectAddressFree(b);
1292  return result;
1293 
1294  error:
1295  DetectAddressFree(a);
1296  if (b != NULL)
1297  DetectAddressFree(b);
1298  return 0;
1299 }
1300 
1301 static int DetectAddressIPv4Join10(void)
1302 {
1303  struct in_addr in;
1304  int result = 1;
1305 
1306  DetectAddress *source = DetectAddressInit();
1307  if (source == NULL)
1308  return 0;
1309 
1310  DetectAddress *target = DetectAddressInit();
1311  if (target == NULL) {
1312  DetectAddressFree(source);
1313  return 0;
1314  }
1315 
1316  if (inet_pton(AF_INET, "128.51.61.124", &in) < 0)
1317  goto error;
1318  target->ip.addr_data32[0] = in.s_addr;
1319  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
1320  goto error;
1321  target->ip2.addr_data32[0] = in.s_addr;
1322 
1323  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1324  goto error;
1325  source->ip.addr_data32[0] = in.s_addr;
1326  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
1327  goto error;
1328  source->ip2.addr_data32[0] = in.s_addr;
1329 
1330  result &= (DetectAddressJoinIPv4(NULL, target, source) == 0);
1331  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1332  goto error;
1333  result &= (target->ip.addr_data32[0] == in.s_addr);
1334  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
1335  goto error;
1336  result &= (target->ip2.addr_data32[0] == in.s_addr);
1337 
1338  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1339  goto error;
1340  target->ip.addr_data32[0] = in.s_addr;
1341  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
1342  goto error;
1343  target->ip2.addr_data32[0] = in.s_addr;
1344 
1345  if (inet_pton(AF_INET, "1.2.3.5", &in) < 0)
1346  goto error;
1347  source->ip.addr_data32[0] = in.s_addr;
1348  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
1349  goto error;
1350  source->ip2.addr_data32[0] = in.s_addr;
1351 
1352  result &= (DetectAddressJoinIPv4(NULL, target, source) == 0);
1353  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1354  goto error;
1355  result &= (target->ip.addr_data32[0] == in.s_addr);
1356  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
1357  goto error;
1358  result &= (target->ip2.addr_data32[0] == in.s_addr);
1359 
1360  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1361  goto error;
1362  target->ip.addr_data32[0] = in.s_addr;
1363  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
1364  goto error;
1365  target->ip2.addr_data32[0] = in.s_addr;
1366 
1367  if (inet_pton(AF_INET, "128.1.5.15", &in) < 0)
1368  goto error;
1369  source->ip.addr_data32[0] = in.s_addr;
1370  if (inet_pton(AF_INET, "200.202.200.200", &in) < 0)
1371  goto error;
1372  source->ip2.addr_data32[0] = in.s_addr;
1373 
1374  result &= (DetectAddressJoinIPv4(NULL, target, source) == 0);
1375  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1376  goto error;
1377  result &= (target->ip.addr_data32[0] == in.s_addr);
1378  if (inet_pton(AF_INET, "200.202.200.200", &in) < 0)
1379  goto error;
1380  result &= (target->ip2.addr_data32[0] == in.s_addr);
1381 
1382  if (inet_pton(AF_INET, "128.51.61.124", &in) < 0)
1383  goto error;
1384  target->ip.addr_data32[0] = in.s_addr;
1385  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
1386  goto error;
1387  target->ip2.addr_data32[0] = in.s_addr;
1388 
1389  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1390  goto error;
1391  source->ip.addr_data32[0] = in.s_addr;
1392  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
1393  goto error;
1394  source->ip2.addr_data32[0] = in.s_addr;
1395 
1396  result &= (DetectAddressJoinIPv4(NULL, target, source) == 0);
1397  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1398  goto error;
1399  result &= (target->ip.addr_data32[0] == in.s_addr);
1400  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
1401  goto error;
1402  result &= (target->ip2.addr_data32[0] == in.s_addr);
1403 
1404  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1405  goto error;
1406  target->ip.addr_data32[0] = in.s_addr;
1407  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
1408  goto error;
1409  target->ip2.addr_data32[0] = in.s_addr;
1410 
1411  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1412  goto error;
1413  source->ip.addr_data32[0] = in.s_addr;
1414  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
1415  goto error;
1416  source->ip2.addr_data32[0] = in.s_addr;
1417 
1418  result &= (DetectAddressJoinIPv4(NULL, target, source) == 0);
1419  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1420  goto error;
1421  result &= (target->ip.addr_data32[0] == in.s_addr);
1422  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
1423  goto error;
1424  result &= (target->ip2.addr_data32[0] == in.s_addr);
1425 
1426  DetectAddressFree(source);
1427  DetectAddressFree(target);
1428  return result;
1429 
1430  error:
1431  DetectAddressFree(source);
1432  DetectAddressFree(target);
1433  return 0;
1434 }
1435 
1436 #endif
1437 
1438 void DetectAddressIPv4Tests(void)
1439 {
1440 #ifdef UNITTESTS
1441  UtRegisterTest("DetectAddressIPv4TestAddressCmp01",
1442  DetectAddressIPv4TestAddressCmp01);
1443  UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace02",
1444  DetectAddressIPv4IsCompleteIPSpace02);
1445  UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace03",
1446  DetectAddressIPv4IsCompleteIPSpace03);
1447  UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace04",
1448  DetectAddressIPv4IsCompleteIPSpace04);
1449  UtRegisterTest("DetectAddressIPv4CutNot05", DetectAddressIPv4CutNot05);
1450  UtRegisterTest("DetectAddressIPv4CutNot06", DetectAddressIPv4CutNot06);
1451  UtRegisterTest("DetectAddressIPv4CutNot07", DetectAddressIPv4CutNot07);
1452  UtRegisterTest("DetectAddressIPv4CutNot08", DetectAddressIPv4CutNot08);
1453  UtRegisterTest("DetectAddressIPv4CutNot09", DetectAddressIPv4CutNot09);
1454  UtRegisterTest("DetectAddressIPv4Join10", DetectAddressIPv4Join10);
1455 #endif
1456 }
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:335
DetectAddressJoinIPv4
int DetectAddressJoinIPv4(DetectEngineCtx *de_ctx, DetectAddress *target, DetectAddress *source)
Extends a target address range if the the source address range is wider than the target address range...
Definition: detect-engine-address-ipv4.c:429
DetectAddress_::ip
Address ip
Definition: detect.h:141
DetectAddress_
address structure for use in the detection engine.
Definition: detect.h:139
DetectAddressCutIPv4
int DetectAddressCutIPv4(DetectEngineCtx *de_ctx, DetectAddress *a, DetectAddress *b, DetectAddress **c)
Cut groups and merge sigs.
Definition: detect-engine-address-ipv4.c:113
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:761
DetectAddress_::next
struct DetectAddress_ * next
Definition: detect.h:150
Address_::family
char family
Definition: decode.h:111
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DetectAddressCmpIPv4
int DetectAddressCmpIPv4(DetectAddress *a, DetectAddress *b)
Compares 2 addresses(address ranges) and returns the relationship between the 2 addresses.
Definition: detect-engine-address-ipv4.c:59
DetectAddress_::ip2
Address ip2
Definition: detect.h:142
DetectAddressFree
void DetectAddressFree(DetectAddress *ag)
Frees a DetectAddress instance.
Definition: detect-engine-address.c:78
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:374
DetectAddressInit
DetectAddress * DetectAddressInit(void)
Creates and returns a new instance of a DetectAddress.
Definition: detect-engine-address.c:63
DetectAddressIsCompleteIPSpaceIPv4
int DetectAddressIsCompleteIPSpaceIPv4(DetectAddress *ag)
Check if the address group list covers the complete IPv4 IP space.
Definition: detect-engine-address-ipv4.c:314
DetectAddressCutNotIPv4
int DetectAddressCutNotIPv4(DetectAddress *a, DetectAddress **b)
Cuts and returns an address range, which is the complement of the address range that is supplied as t...
Definition: detect-engine-address-ipv4.c:368
DetectAddressIPv4Tests
void DetectAddressIPv4Tests(void)
Definition: detect-engine-address-ipv4.c:1438