suricata
detect-engine-address-ipv4.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * IPV4 Address part of the detection engine.
24  */
25 
26 #include "suricata-common.h"
27 
28 #include "decode.h"
29 #include "detect.h"
30 #include "flow-var.h"
31 
32 #include "util-cidr.h"
33 #include "util-unittest.h"
34 
35 #include "detect-engine-address.h"
36 #include "detect-engine-address-ipv4.h"
37 #include "detect-engine-siggroup.h"
38 #include "detect-engine-port.h"
39 
40 #include "util-error.h"
41 #include "util-debug.h"
42 
43 /**
44  * \brief Compares 2 addresses(address ranges) and returns the relationship
45  * between the 2 addresses.
46  *
47  * \param a Pointer to the first address instance to be compared.
48  * \param b Pointer to the second address instance to be compared.
49  *
50  * \retval ADDRESS_EQ If the 2 address ranges a and b, are equal.
51  * \retval ADDRESS_ES b encapsulates a. b_ip1[...a_ip1...a_ip2...]b_ip2.
52  * \retval ADDRESS_EB a encapsulates b. a_ip1[...b_ip1....b_ip2...]a_ip2.
53  * \retval ADDRESS_LE a_ip1(...b_ip1==a_ip2...)b_ip2
54  * \retval ADDRESS_LT a_ip1(...b_ip1...a_ip2...)b_ip2
55  * \retval ADDRESS_GE b_ip1(...a_ip1==b_ip2...)a_ip2
56  * \retval ADDRESS_GT a_ip1 > b_ip2, i.e. the address range for 'a' starts only
57  * after the end of the address range for 'b'
58  */
59 int DetectAddressCmpIPv4(DetectAddress *a, DetectAddress *b)
60 {
61  uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]);
62  uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]);
63  uint32_t b_ip1 = SCNtohl(b->ip.addr_data32[0]);
64  uint32_t b_ip2 = SCNtohl(b->ip2.addr_data32[0]);
65 
66  if (a_ip1 == b_ip1 && a_ip2 == b_ip2) {
67  SCLogDebug("ADDRESS_EQ");
68  return ADDRESS_EQ;
69  } else if (a_ip1 >= b_ip1 && a_ip1 <= b_ip2 && a_ip2 <= b_ip2) {
70  SCLogDebug("ADDRESS_ES");
71  return ADDRESS_ES;
72  } else if (a_ip1 <= b_ip1 && a_ip2 >= b_ip2) {
73  SCLogDebug("ADDRESS_EB");
74  return ADDRESS_EB;
75  } else if (a_ip1 < b_ip1 && a_ip2 < b_ip2 && a_ip2 >= b_ip1) {
76  SCLogDebug("ADDRESS_LE");
77  return ADDRESS_LE;
78  } else if (a_ip1 < b_ip1 && a_ip2 < b_ip2) {
79  SCLogDebug("ADDRESS_LT");
80  return ADDRESS_LT;
81  } else if (a_ip1 > b_ip1 && a_ip1 <= b_ip2 && a_ip2 > b_ip2) {
82  SCLogDebug("ADDRESS_GE");
83  return ADDRESS_GE;
84  } else if (a_ip1 > b_ip2) {
85  SCLogDebug("ADDRESS_GT");
86  return ADDRESS_GT;
87  } else {
88  /* should be unreachable */
89  SCLogDebug("Internal Error: should be unreachable");
90  }
91 
92  return ADDRESS_ER;
93 }
94 
95 /**
96  * \brief Cut groups and merge sigs
97  *
98  * a = 1.2.3.4, b = 1.2.3.4-1.2.3.5
99  * must result in: a == 1.2.3.4, b == 1.2.3.5, c == NULL
100  *
101  * a = 1.2.3.4, b = 1.2.3.3-1.2.3.5
102  * must result in: a == 1.2.3.3, b == 1.2.3.4, c == 1.2.3.5
103  *
104  * a = 1.2.3.0/24 b = 1.2.3.128-1.2.4.10
105  * must result in: a == 1.2.3.0/24, b == 1.2.4.0-1.2.4.10, c == NULL
106  *
107  * a = 1.2.3.4, b = 1.2.3.0/24
108  * must result in: a == 1.2.3.0-1.2.3.3, b == 1.2.3.4, c == 1.2.3.5-1.2.3.255
109  *
110  * \retval 0 On success.
111  * \retval -1 On failure.
112  */
113 int DetectAddressCutIPv4(DetectEngineCtx *de_ctx, DetectAddress *a,
114  DetectAddress *b, DetectAddress **c)
115 {
116  uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]);
117  uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]);
118  uint32_t b_ip1 = SCNtohl(b->ip.addr_data32[0]);
119  uint32_t b_ip2 = SCNtohl(b->ip2.addr_data32[0]);
120  DetectAddress *tmp = NULL;
121  DetectAddress *tmp_c = NULL;
122  int r = 0;
123 
124  /* default to NULL */
125  *c = NULL;
126 
127  r = DetectAddressCmpIPv4(a, b);
128  if (r != ADDRESS_ES && r != ADDRESS_EB && r != ADDRESS_LE && r != ADDRESS_GE) {
129  SCLogDebug("we shouldn't be here");
130  goto error;
131  }
132 
133  /* get a place to temporary put sigs lists */
134  tmp = DetectAddressInit();
135  if (tmp == NULL)
136  goto error;
137 
138  /* we have 3 parts: [aaa[abab)bbb]
139  * part a: a_ip1 <-> b_ip1 - 1
140  * part b: b_ip1 <-> a_ip2
141  * part c: a_ip2 + 1 <-> b_ip2
142  */
143  if (r == ADDRESS_LE) {
144  SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_LE");
145 
146  a->ip.addr_data32[0] = htonl(a_ip1);
147  a->ip2.addr_data32[0] = htonl(b_ip1 - 1);
148 
149  b->ip.addr_data32[0] = htonl(b_ip1);
150  b->ip2.addr_data32[0] = htonl(a_ip2);
151 
152  tmp_c = DetectAddressInit();
153  if (tmp_c == NULL)
154  goto error;
155 
156  tmp_c->ip.family = AF_INET;
157  tmp_c->ip.addr_data32[0] = htonl(a_ip2 + 1);
158  tmp_c->ip2.addr_data32[0] = htonl(b_ip2);
159  *c = tmp_c;
160 
161  /* we have 3 parts: [bbb[baba]aaa]
162  * part a: b_ip1 <-> a_ip1 - 1
163  * part b: a_ip1 <-> b_ip2
164  * part c: b_ip2 + 1 <-> a_ip2
165  */
166  } else if (r == ADDRESS_GE) {
167  SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_GE");
168 
169  a->ip.addr_data32[0] = htonl(b_ip1);
170  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
171 
172  b->ip.addr_data32[0] = htonl(a_ip1);
173  b->ip2.addr_data32[0] = htonl(b_ip2);
174 
175  tmp_c = DetectAddressInit();
176  if (tmp_c == NULL)
177  goto error;
178 
179  tmp_c->ip.family = AF_INET;
180  tmp_c->ip.addr_data32[0] = htonl(b_ip2 + 1);
181  tmp_c->ip2.addr_data32[0] = htonl(a_ip2);
182  *c = tmp_c;
183 
184  /* we have 2 or three parts:
185  *
186  * 2 part: [[abab]bbb] or [bbb[baba]]
187  * part a: a_ip1 <-> a_ip2
188  * part b: a_ip2 + 1 <-> b_ip2
189  *
190  * part a: b_ip1 <-> a_ip1 - 1
191  * part b: a_ip1 <-> a_ip2
192  *
193  * 3 part [bbb[aaa]bbb]
194  * becomes[aaa[bbb]ccc]
195  *
196  * part a: b_ip1 <-> a_ip1 - 1
197  * part b: a_ip1 <-> a_ip2
198  * part c: a_ip2 + 1 <-> b_ip2
199  */
200  } else if (r == ADDRESS_ES) {
201  SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_ES");
202 
203  if (a_ip1 == b_ip1) {
204  SCLogDebug("DetectAddressCutIPv4: 1");
205 
206  a->ip.addr_data32[0] = htonl(a_ip1);
207  a->ip2.addr_data32[0] = htonl(a_ip2);
208 
209  b->ip.addr_data32[0] = htonl(a_ip2 + 1);
210  b->ip2.addr_data32[0] = htonl(b_ip2);
211 
212  } else if (a_ip2 == b_ip2) {
213  SCLogDebug("DetectAddressCutIPv4: 2");
214 
215  a->ip.addr_data32[0] = htonl(b_ip1);
216  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
217 
218  b->ip.addr_data32[0] = htonl(a_ip1);
219  b->ip2.addr_data32[0] = htonl(a_ip2);
220 
221  } else {
222  SCLogDebug("3");
223 
224  a->ip.addr_data32[0] = htonl(b_ip1);
225  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
226 
227  b->ip.addr_data32[0] = htonl(a_ip1);
228  b->ip2.addr_data32[0] = htonl(a_ip2);
229 
230  tmp_c = DetectAddressInit();
231  if (tmp_c == NULL)
232  goto error;
233 
234  tmp_c->ip.family = AF_INET;
235  tmp_c->ip.addr_data32[0] = htonl(a_ip2 + 1);
236  tmp_c->ip2.addr_data32[0] = htonl(b_ip2);
237  *c = tmp_c;
238  }
239  /* we have 2 or three parts:
240  *
241  * 2 part: [[baba]aaa] or [aaa[abab]]
242  * part a: b_ip1 <-> b_ip2
243  * part b: b_ip2 + 1 <-> a_ip2
244  *
245  * part a: a_ip1 <-> b_ip1 - 1
246  * part b: b_ip1 <-> b_ip2
247  *
248  * 3 part [aaa[bbb]aaa]
249  * becomes[aaa[bbb]ccc]
250  *
251  * part a: a_ip1 <-> b_ip2 - 1
252  * part b: b_ip1 <-> b_ip2
253  * part c: b_ip2 + 1 <-> a_ip2
254  */
255  } else if (r == ADDRESS_EB) {
256  SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_EB");
257 
258  if (a_ip1 == b_ip1) {
259  SCLogDebug("DetectAddressCutIPv4: 1");
260 
261  a->ip.addr_data32[0] = htonl(b_ip1);
262  a->ip2.addr_data32[0] = htonl(b_ip2);
263 
264  b->ip.addr_data32[0] = htonl(b_ip2 + 1);
265  b->ip2.addr_data32[0] = htonl(a_ip2);
266  } else if (a_ip2 == b_ip2) {
267  SCLogDebug("DetectAddressCutIPv4: 2");
268 
269  a->ip.addr_data32[0] = htonl(a_ip1);
270  a->ip2.addr_data32[0] = htonl(b_ip1 - 1);
271 
272  b->ip.addr_data32[0] = htonl(b_ip1);
273  b->ip2.addr_data32[0] = htonl(b_ip2);
274  } else {
275  SCLogDebug("DetectAddressCutIPv4: 3");
276 
277  a->ip.addr_data32[0] = htonl(a_ip1);
278  a->ip2.addr_data32[0] = htonl(b_ip1 - 1);
279 
280  b->ip.addr_data32[0] = htonl(b_ip1);
281  b->ip2.addr_data32[0] = htonl(b_ip2);
282 
283  tmp_c = DetectAddressInit();
284  if (tmp_c == NULL)
285  goto error;
286 
287  tmp_c->ip.family = AF_INET;
288  tmp_c->ip.addr_data32[0] = htonl(b_ip2 + 1);
289  tmp_c->ip2.addr_data32[0] = htonl(a_ip2);
290  *c = tmp_c;
291  }
292  }
293 
294  if (tmp != NULL)
295  DetectAddressFree(tmp);
296 
297  return 0;
298 
299 error:
300  if (tmp != NULL)
301  DetectAddressFree(tmp);
302  return -1;
303 }
304 
305 /**
306  * \brief Check if the address group list covers the complete IPv4 IP space.
307  *
308  * \param ag Pointer to a DetectAddress list head, which has to be checked to
309  * see if the address ranges in it, cover the entire IPv4 IP space.
310  *
311  * \retval 1 Yes, it covers the entire IPv4 address range.
312  * \retval 0 No, it doesn't cover the entire IPv4 address range.
313  */
314 int DetectAddressIsCompleteIPSpaceIPv4(DetectAddress *ag)
315 {
316  uint32_t next_ip = 0;
317 
318  if (ag == NULL)
319  return 0;
320 
321  /* if we don't start with 0.0.0.0 we know we're good */
322  if (SCNtohl(ag->ip.addr_data32[0]) != 0x00000000)
323  return 0;
324 
325  /* if we're ending with 255.255.255.255 while we know we started with
326  * 0.0.0.0 it's the complete space */
327  if (SCNtohl(ag->ip2.addr_data32[0]) == 0xFFFFFFFF)
328  return 1;
329 
330  next_ip = htonl(SCNtohl(ag->ip2.addr_data32[0]) + 1);
331  ag = ag->next;
332 
333  for ( ; ag != NULL; ag = ag->next) {
334 
335  if (ag->ip.addr_data32[0] != next_ip)
336  return 0;
337 
338  if (SCNtohl(ag->ip2.addr_data32[0]) == 0xFFFFFFFF)
339  return 1;
340 
341  next_ip = htonl(SCNtohl(ag->ip2.addr_data32[0]) + 1);
342  }
343 
344  return 0;
345 }
346 
347 /**
348  * \brief Cuts and returns an address range, which is the complement of the
349  * address range that is supplied as the argument.
350  *
351  * For example:
352  *
353  * If a = 0.0.0.0-1.2.3.4,
354  * then a = 1.2.3.4-255.255.255.255 and b = NULL
355  * If a = 1.2.3.4-255.255.255.255,
356  * then a = 0.0.0.0-1.2.3.4 and b = NULL
357  * If a = 1.2.3.4-192.168.1.1,
358  * then a = 0.0.0.0-1.2.3.3 and b = 192.168.1.2-255.255.255.255
359  *
360  * \param a Pointer to an address range (DetectAddress) instance whose complement
361  * has to be returned in a and b.
362  * \param b Pointer to DetectAddress pointer, that will be supplied back with a
363  * new DetectAddress instance, if the complement demands so.
364  *
365  * \retval 0 On success.
366  * \retval -1 On failure.
367  */
368 int DetectAddressCutNotIPv4(DetectAddress *a, DetectAddress **b)
369 {
370  uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]);
371  uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]);
372  DetectAddress *tmp_b = NULL;
373 
374  /* default to NULL */
375  *b = NULL;
376 
377  if (a_ip1 != 0x00000000 && a_ip2 != 0xFFFFFFFF) {
378  a->ip.addr_data32[0] = htonl(0x00000000);
379  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
380 
381  tmp_b = DetectAddressInit();
382  if (tmp_b == NULL)
383  goto error;
384 
385  tmp_b->ip.family = AF_INET;
386  tmp_b->ip.addr_data32[0] = htonl(a_ip2 + 1);
387  tmp_b->ip2.addr_data32[0] = htonl(0xFFFFFFFF);
388  *b = tmp_b;
389  } else if (a_ip1 == 0x00000000 && a_ip2 != 0xFFFFFFFF) {
390  a->ip.addr_data32[0] = htonl(a_ip2 + 1);
391  a->ip2.addr_data32[0] = htonl(0xFFFFFFFF);
392  } else if (a_ip1 != 0x00000000 && a_ip2 == 0xFFFFFFFF) {
393  a->ip.addr_data32[0] = htonl(0x00000000);
394  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
395  } else {
396  goto error;
397  }
398 
399  return 0;
400 
401 error:
402  return -1;
403 }
404 
405 /********************************Unittests*************************************/
406 
407 #ifdef UNITTESTS
408 
409 static int DetectAddressIPv4TestAddressCmp01(void)
410 {
411  struct in_addr in;
412  int result = 1;
413 
414  DetectAddress *a = DetectAddressInit();
415  if (a == NULL)
416  return 0;
417 
418  DetectAddress *b = DetectAddressInit();
419  if (b == NULL) {
420  DetectAddressFree(a);
421  return 0;
422  }
423 
424  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
425  goto error;
426  a->ip.addr_data32[0] = in.s_addr;
427  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
428  goto error;
429  a->ip2.addr_data32[0] = in.s_addr;
430  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
431  goto error;
432  b->ip.addr_data32[0] = in.s_addr;
433  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
434  goto error;
435  b->ip2.addr_data32[0] = in.s_addr;
436  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_EQ);
437 
438  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
439  goto error;
440  a->ip.addr_data32[0] = in.s_addr;
441  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
442  goto error;
443  a->ip2.addr_data32[0] = in.s_addr;
444  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
445  goto error;
446  b->ip.addr_data32[0] = in.s_addr;
447  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
448  goto error;
449  b->ip2.addr_data32[0] = in.s_addr;
450  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_ES);
451 
452  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
453  goto error;
454  a->ip.addr_data32[0] = in.s_addr;
455  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
456  goto error;
457  a->ip2.addr_data32[0] = in.s_addr;
458  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
459  goto error;
460  b->ip.addr_data32[0] = in.s_addr;
461  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
462  goto error;
463  b->ip2.addr_data32[0] = in.s_addr;
464  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_ES);
465 
466  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
467  goto error;
468  a->ip.addr_data32[0] = in.s_addr;
469  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
470  goto error;
471  a->ip2.addr_data32[0] = in.s_addr;
472  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
473  goto error;
474  b->ip.addr_data32[0] = in.s_addr;
475  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
476  goto error;
477  b->ip2.addr_data32[0] = in.s_addr;
478  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_ES);
479 
480  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
481  goto error;
482  a->ip.addr_data32[0] = in.s_addr;
483  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
484  goto error;
485  a->ip2.addr_data32[0] = in.s_addr;
486  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
487  goto error;
488  b->ip.addr_data32[0] = in.s_addr;
489  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
490  goto error;
491  b->ip2.addr_data32[0] = in.s_addr;
492  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_ES);
493 
494  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
495  goto error;
496  a->ip.addr_data32[0] = in.s_addr;
497  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
498  goto error;
499  a->ip2.addr_data32[0] = in.s_addr;
500  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
501  goto error;
502  b->ip.addr_data32[0] = in.s_addr;
503  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
504  goto error;
505  b->ip2.addr_data32[0] = in.s_addr;
506  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_ES);
507 
508  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
509  goto error;
510  a->ip.addr_data32[0] = in.s_addr;
511  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
512  goto error;
513  a->ip2.addr_data32[0] = in.s_addr;
514  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
515  goto error;
516  b->ip.addr_data32[0] = in.s_addr;
517  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
518  goto error;
519  b->ip2.addr_data32[0] = in.s_addr;
520  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_EB);
521 
522  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
523  goto error;
524  a->ip.addr_data32[0] = in.s_addr;
525  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
526  goto error;
527  a->ip2.addr_data32[0] = in.s_addr;
528  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
529  goto error;
530  b->ip.addr_data32[0] = in.s_addr;
531  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
532  goto error;
533  b->ip2.addr_data32[0] = in.s_addr;
534  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_EB);
535 
536  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
537  goto error;
538  a->ip.addr_data32[0] = in.s_addr;
539  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
540  goto error;
541  a->ip2.addr_data32[0] = in.s_addr;
542  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
543  goto error;
544  b->ip.addr_data32[0] = in.s_addr;
545  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
546  goto error;
547  b->ip2.addr_data32[0] = in.s_addr;
548  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_EB);
549 
550  if (inet_pton(AF_INET, "1.2.3.5", &in) < 0)
551  goto error;
552  a->ip.addr_data32[0] = in.s_addr;
553  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
554  goto error;
555  a->ip2.addr_data32[0] = in.s_addr;
556  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
557  goto error;
558  b->ip.addr_data32[0] = in.s_addr;
559  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
560  goto error;
561  b->ip2.addr_data32[0] = in.s_addr;
562  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_EB);
563 
564  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
565  goto error;
566  a->ip.addr_data32[0] = in.s_addr;
567  if (inet_pton(AF_INET, "128.128.128.128", &in) < 0)
568  goto error;
569  a->ip2.addr_data32[0] = in.s_addr;
570  if (inet_pton(AF_INET, "128.128.128.128", &in) < 0)
571  goto error;
572  b->ip.addr_data32[0] = in.s_addr;
573  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
574  goto error;
575  b->ip2.addr_data32[0] = in.s_addr;
576  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_LE);
577 
578  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
579  goto error;
580  a->ip.addr_data32[0] = in.s_addr;
581  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
582  goto error;
583  a->ip2.addr_data32[0] = in.s_addr;
584  if (inet_pton(AF_INET, "128.128.128.128", &in) < 0)
585  goto error;
586  b->ip.addr_data32[0] = in.s_addr;
587  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
588  goto error;
589  b->ip2.addr_data32[0] = in.s_addr;
590  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_LE);
591 
592  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
593  goto error;
594  a->ip.addr_data32[0] = in.s_addr;
595  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
596  goto error;
597  a->ip2.addr_data32[0] = in.s_addr;
598  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
599  goto error;
600  b->ip.addr_data32[0] = in.s_addr;
601  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
602  goto error;
603  b->ip2.addr_data32[0] = in.s_addr;
604  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LE);
605 
606  if (inet_pton(AF_INET, "170.170.170.169", &in) < 0)
607  goto error;
608  a->ip.addr_data32[0] = in.s_addr;
609  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
610  goto error;
611  a->ip2.addr_data32[0] = in.s_addr;
612  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
613  goto error;
614  b->ip.addr_data32[0] = in.s_addr;
615  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
616  goto error;
617  b->ip2.addr_data32[0] = in.s_addr;
618  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_LE);
619 
620  if (inet_pton(AF_INET, "170.170.170.169", &in) < 0)
621  goto error;
622  a->ip.addr_data32[0] = in.s_addr;
623  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
624  goto error;
625  a->ip2.addr_data32[0] = in.s_addr;
626  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
627  goto error;
628  b->ip.addr_data32[0] = in.s_addr;
629  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
630  goto error;
631  b->ip2.addr_data32[0] = in.s_addr;
632  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LE);
633 
634  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
635  goto error;
636  a->ip.addr_data32[0] = in.s_addr;
637  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
638  goto error;
639  a->ip2.addr_data32[0] = in.s_addr;
640  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
641  goto error;
642  b->ip.addr_data32[0] = in.s_addr;
643  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
644  goto error;
645  b->ip2.addr_data32[0] = in.s_addr;
646  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_LT);
647 
648  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
649  goto error;
650  a->ip.addr_data32[0] = in.s_addr;
651  if (inet_pton(AF_INET, "185.185.185.185", &in) < 0)
652  goto error;
653  a->ip2.addr_data32[0] = in.s_addr;
654  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
655  goto error;
656  b->ip.addr_data32[0] = in.s_addr;
657  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
658  goto error;
659  b->ip2.addr_data32[0] = in.s_addr;
660  /* we could get a LE */
661  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
662 
663  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
664  goto error;
665  a->ip.addr_data32[0] = in.s_addr;
666  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
667  goto error;
668  a->ip2.addr_data32[0] = in.s_addr;
669  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
670  goto error;
671  b->ip.addr_data32[0] = in.s_addr;
672  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
673  goto error;
674  b->ip2.addr_data32[0] = in.s_addr;
675  /* we could get a LE */
676  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
677 
678  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
679  goto error;
680  a->ip.addr_data32[0] = in.s_addr;
681  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
682  goto error;
683  a->ip2.addr_data32[0] = in.s_addr;
684  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
685  goto error;
686  b->ip.addr_data32[0] = in.s_addr;
687  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
688  goto error;
689  b->ip2.addr_data32[0] = in.s_addr;
690  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
691 
692  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
693  goto error;
694  a->ip.addr_data32[0] = in.s_addr;
695  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
696  goto error;
697  a->ip2.addr_data32[0] = in.s_addr;
698  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
699  goto error;
700  b->ip.addr_data32[0] = in.s_addr;
701  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
702  goto error;
703  b->ip2.addr_data32[0] = in.s_addr;
704  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
705 
706  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
707  goto error;
708  a->ip.addr_data32[0] = in.s_addr;
709  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
710  goto error;
711  a->ip2.addr_data32[0] = in.s_addr;
712  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
713  goto error;
714  b->ip.addr_data32[0] = in.s_addr;
715  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
716  goto error;
717  b->ip2.addr_data32[0] = in.s_addr;
718  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
719 
720  if (inet_pton(AF_INET, "128.128.128.128", &in) < 0)
721  goto error;
722  a->ip.addr_data32[0] = in.s_addr;
723  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
724  goto error;
725  a->ip2.addr_data32[0] = in.s_addr;
726  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
727  goto error;
728  b->ip.addr_data32[0] = in.s_addr;
729  if (inet_pton(AF_INET, "128.128.128.128", &in) < 0)
730  goto error;
731  b->ip2.addr_data32[0] = in.s_addr;
732  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_GE);
733 
734  if (inet_pton(AF_INET, "128.128.128.128", &in) < 0)
735  goto error;
736  a->ip.addr_data32[0] = in.s_addr;
737  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
738  goto error;
739  a->ip2.addr_data32[0] = in.s_addr;
740  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
741  goto error;
742  b->ip.addr_data32[0] = in.s_addr;
743  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
744  goto error;
745  b->ip2.addr_data32[0] = in.s_addr;
746  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_GE);
747 
748  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
749  goto error;
750  a->ip.addr_data32[0] = in.s_addr;
751  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
752  goto error;
753  a->ip2.addr_data32[0] = in.s_addr;
754  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
755  goto error;
756  b->ip.addr_data32[0] = in.s_addr;
757  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
758  goto error;
759  b->ip2.addr_data32[0] = in.s_addr;
760  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GE);
761 
762  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
763  goto error;
764  a->ip.addr_data32[0] = in.s_addr;
765  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
766  goto error;
767  a->ip2.addr_data32[0] = in.s_addr;
768  if (inet_pton(AF_INET, "170.170.170.169", &in) < 0)
769  goto error;
770  b->ip.addr_data32[0] = in.s_addr;
771  if (inet_pton(AF_INET, "180.180.180.180", &in) < 0)
772  goto error;
773  b->ip2.addr_data32[0] = in.s_addr;
774  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_GE);
775 
776  if (inet_pton(AF_INET, "170.170.170.169", &in) < 0)
777  goto error;
778  a->ip.addr_data32[0] = in.s_addr;
779  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
780  goto error;
781  a->ip2.addr_data32[0] = in.s_addr;
782  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
783  goto error;
784  b->ip.addr_data32[0] = in.s_addr;
785  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
786  goto error;
787  b->ip2.addr_data32[0] = in.s_addr;
788  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GE);
789 
790  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
791  goto error;
792  a->ip.addr_data32[0] = in.s_addr;
793  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
794  goto error;
795  a->ip2.addr_data32[0] = in.s_addr;
796  if (inet_pton(AF_INET, "170.170.169.170", &in) < 0)
797  goto error;
798  b->ip.addr_data32[0] = in.s_addr;
799  if (inet_pton(AF_INET, "192.168.1.1", &in) < 0)
800  goto error;
801  b->ip2.addr_data32[0] = in.s_addr;
802  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GE);
803 
804  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
805  goto error;
806  a->ip.addr_data32[0] = in.s_addr;
807  if (inet_pton(AF_INET, "200.200.200.200", &in) < 0)
808  goto error;
809  a->ip2.addr_data32[0] = in.s_addr;
810  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
811  goto error;
812  b->ip.addr_data32[0] = in.s_addr;
813  if (inet_pton(AF_INET, "185.185.185.185", &in) < 0)
814  goto error;
815  b->ip2.addr_data32[0] = in.s_addr;
816  result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_GT);
817 
818  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
819  goto error;
820  a->ip.addr_data32[0] = in.s_addr;
821  if (inet_pton(AF_INET, "200.200.200.200", &in) < 0)
822  goto error;
823  a->ip2.addr_data32[0] = in.s_addr;
824  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
825  goto error;
826  b->ip.addr_data32[0] = in.s_addr;
827  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
828  goto error;
829  b->ip2.addr_data32[0] = in.s_addr;
830  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GT);
831 
832  if (inet_pton(AF_INET, "182.168.1.2", &in) < 0)
833  goto error;
834  a->ip.addr_data32[0] = in.s_addr;
835  if (inet_pton(AF_INET, "200.200.200.200", &in) < 0)
836  goto error;
837  a->ip2.addr_data32[0] = in.s_addr;
838  if (inet_pton(AF_INET, "170.170.170.170", &in) < 0)
839  goto error;
840  b->ip.addr_data32[0] = in.s_addr;
841  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
842  goto error;
843  b->ip2.addr_data32[0] = in.s_addr;
844  result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GT);
845 
846  DetectAddressFree(a);
847  DetectAddressFree(b);
848  return result;
849 
850  error:
851  DetectAddressFree(a);
852  DetectAddressFree(b);
853  return 0;
854 }
855 
856 static int DetectAddressIPv4IsCompleteIPSpace02(void)
857 {
858  DetectAddress *a = NULL;
859  struct in_addr in;
860  int result = 1;
861 
862  if ( (a = DetectAddressInit()) == NULL)
863  goto error;
864 
865  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
866  goto error;
867  a->ip.addr_data32[0] = in.s_addr;
868  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
869  goto error;
870  a->ip2.addr_data32[0] = in.s_addr;
871  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 1);
872 
873  if (inet_pton(AF_INET, "0.0.0.1", &in) < 0)
874  goto error;
875  a->ip.addr_data32[0] = in.s_addr;
876  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
877  goto error;
878  a->ip2.addr_data32[0] = in.s_addr;
879  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
880 
881  DetectAddressFree(a);
882 
883  if ( (a = DetectAddressInit()) == NULL)
884  goto error;
885 
886  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
887  goto error;
888  a->ip.addr_data32[0] = in.s_addr;
889  if (inet_pton(AF_INET, "255.255.255.254", &in) < 0)
890  goto error;
891  a->ip2.addr_data32[0] = in.s_addr;
892  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
893 
894  DetectAddressFree(a);
895 
896  return result;
897 
898  error:
899  if (a != NULL)
900  DetectAddressFree(a);
901  return 0;
902 }
903 
904 static int DetectAddressIPv4IsCompleteIPSpace03(void)
905 {
906  DetectAddress *a = NULL;
907  DetectAddress *temp = NULL;
908  struct in_addr in;
909  int result = 1;
910 
911  if ( (a = DetectAddressInit()) == NULL)
912  goto error;
913  temp = a;
914 
915  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
916  goto error;
917  a->ip.addr_data32[0] = in.s_addr;
918  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
919  goto error;
920  a->ip2.addr_data32[0] = in.s_addr;
921  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
922 
923  if ( (temp->next = DetectAddressInit()) == NULL)
924  goto error;
925  temp = temp->next;
926 
927  if (inet_pton(AF_INET, "1.2.3.5", &in) < 0)
928  goto error;
929  temp->ip.addr_data32[0] = in.s_addr;
930  if (inet_pton(AF_INET, "126.36.62.61", &in) < 0)
931  goto error;
932  temp->ip2.addr_data32[0] = in.s_addr;
933  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
934 
935  if ( (temp->next = DetectAddressInit()) == NULL)
936  goto error;
937  temp = temp->next;
938 
939  if (inet_pton(AF_INET, "126.36.62.62", &in) < 0)
940  goto error;
941  temp->ip.addr_data32[0] = in.s_addr;
942  if (inet_pton(AF_INET, "222.52.21.62", &in) < 0)
943  goto error;
944  temp->ip2.addr_data32[0] = in.s_addr;
945  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
946 
947  if ( (temp->next = DetectAddressInit()) == NULL)
948  goto error;
949  temp = temp->next;
950 
951  if (inet_pton(AF_INET, "222.52.21.63", &in) < 0)
952  goto error;
953  temp->ip.addr_data32[0] = in.s_addr;
954  if (inet_pton(AF_INET, "255.255.255.254", &in) < 0)
955  goto error;
956  temp->ip2.addr_data32[0] = in.s_addr;
957  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
958 
959  if ( (temp->next = DetectAddressInit()) == NULL)
960  goto error;
961  temp = temp->next;
962 
963  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
964  goto error;
965  temp->ip.addr_data32[0] = in.s_addr;
966  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
967  goto error;
968  temp->ip2.addr_data32[0] = in.s_addr;
969  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 1);
970 
971  DetectAddressFree(a);
972 
973  return result;
974 
975  error:
976  if (a != NULL)
977  DetectAddressFree(a);
978  return 0;
979 }
980 
981 static int DetectAddressIPv4IsCompleteIPSpace04(void)
982 {
983  DetectAddress *a = NULL;
984  DetectAddress *temp = NULL;
985  struct in_addr in;
986  int result = 1;
987 
988  if ( (a = DetectAddressInit()) == NULL)
989  goto error;
990  temp = a;
991 
992  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
993  goto error;
994  a->ip.addr_data32[0] = in.s_addr;
995  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
996  goto error;
997  a->ip2.addr_data32[0] = in.s_addr;
998  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
999 
1000  if ( (temp->next = DetectAddressInit()) == NULL)
1001  goto error;
1002  temp = temp->next;
1003 
1004  if (inet_pton(AF_INET, "1.2.3.5", &in) < 0)
1005  goto error;
1006  temp->ip.addr_data32[0] = in.s_addr;
1007  if (inet_pton(AF_INET, "126.36.62.61", &in) < 0)
1008  goto error;
1009  temp->ip2.addr_data32[0] = in.s_addr;
1010  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
1011 
1012  if ( (temp->next = DetectAddressInit()) == NULL)
1013  goto error;
1014  temp = temp->next;
1015 
1016  if (inet_pton(AF_INET, "126.36.62.62", &in) < 0)
1017  goto error;
1018  temp->ip.addr_data32[0] = in.s_addr;
1019  if (inet_pton(AF_INET, "222.52.21.62", &in) < 0)
1020  goto error;
1021  temp->ip2.addr_data32[0] = in.s_addr;
1022  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
1023 
1024  if ( (temp->next = DetectAddressInit()) == NULL)
1025  goto error;
1026  temp = temp->next;
1027 
1028  if (inet_pton(AF_INET, "222.52.21.64", &in) < 0)
1029  goto error;
1030  temp->ip.addr_data32[0] = in.s_addr;
1031  if (inet_pton(AF_INET, "255.255.255.254", &in) < 0)
1032  goto error;
1033  temp->ip2.addr_data32[0] = in.s_addr;
1034  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
1035 
1036  if ( (temp->next = DetectAddressInit()) == NULL)
1037  goto error;
1038  temp = temp->next;
1039 
1040  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1041  goto error;
1042  temp->ip.addr_data32[0] = in.s_addr;
1043  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1044  goto error;
1045  temp->ip2.addr_data32[0] = in.s_addr;
1046  result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
1047 
1048  DetectAddressFree(a);
1049 
1050  return result;
1051 
1052  error:
1053  if (a != NULL)
1054  DetectAddressFree(a);
1055  return 0;
1056 }
1057 
1058 static int DetectAddressIPv4CutNot05(void)
1059 {
1060  DetectAddress *a = NULL;
1061  DetectAddress *b = NULL;
1062  struct in_addr in;
1063  int result = 1;
1064 
1065  if ( (a = DetectAddressInit()) == NULL)
1066  return 0;
1067 
1068  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
1069  goto error;
1070  a->ip.addr_data32[0] = in.s_addr;
1071  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1072  goto error;
1073  a->ip2.addr_data32[0] = in.s_addr;
1074  result &= (DetectAddressCutNotIPv4(a, &b) == -1);
1075 
1076  DetectAddressFree(a);
1077  if (b != NULL)
1078  DetectAddressFree(b);
1079  return result;
1080 
1081  error:
1082  DetectAddressFree(a);
1083  if (b != NULL)
1084  DetectAddressFree(b);
1085  return 0;
1086 }
1087 
1088 static int DetectAddressIPv4CutNot06(void)
1089 {
1090  DetectAddress *a = NULL;
1091  DetectAddress *b = NULL;
1092  struct in_addr in;
1093  int result = 1;
1094 
1095  if ( (a = DetectAddressInit()) == NULL)
1096  return 0;
1097 
1098  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
1099  goto error;
1100  a->ip.addr_data32[0] = in.s_addr;
1101  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1102  goto error;
1103  a->ip2.addr_data32[0] = in.s_addr;
1104  result &= (DetectAddressCutNotIPv4(a, &b) == 0);
1105 
1106  if (inet_pton(AF_INET, "1.2.3.5", &in) < 0)
1107  goto error;
1108  result = (a->ip.addr_data32[0] == in.s_addr);
1109  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1110  goto error;
1111  result &= (a->ip2.addr_data32[0] = in.s_addr);
1112 
1113  DetectAddressFree(a);
1114  if (b != NULL)
1115  DetectAddressFree(b);
1116  return result;
1117 
1118  error:
1119  DetectAddressFree(a);
1120  if (b != NULL)
1121  DetectAddressFree(b);
1122  return 0;
1123 }
1124 
1125 static int DetectAddressIPv4CutNot07(void)
1126 {
1127  DetectAddress *a = NULL;
1128  DetectAddress *b = NULL;
1129  struct in_addr in;
1130  int result = 1;
1131 
1132  if ( (a = DetectAddressInit()) == NULL)
1133  return 0;
1134 
1135  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1136  goto error;
1137  a->ip.addr_data32[0] = in.s_addr;
1138  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1139  goto error;
1140  a->ip2.addr_data32[0] = in.s_addr;
1141  result &= (DetectAddressCutNotIPv4(a, &b) == 0);
1142 
1143  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
1144  goto error;
1145  result = (a->ip.addr_data32[0] == in.s_addr);
1146  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
1147  goto error;
1148  result &= (a->ip2.addr_data32[0] = in.s_addr);
1149 
1150  DetectAddressFree(a);
1151  if (b != NULL)
1152  DetectAddressFree(b);
1153  return result;
1154 
1155  error:
1156  DetectAddressFree(a);
1157  if (b != NULL)
1158  DetectAddressFree(b);
1159  return 0;
1160 }
1161 
1162 static int DetectAddressIPv4CutNot08(void)
1163 {
1164  DetectAddress *a = NULL;
1165  DetectAddress *b = NULL;
1166  struct in_addr in;
1167  int result = 1;
1168 
1169  if ( (a = DetectAddressInit()) == NULL)
1170  return 0;
1171 
1172  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1173  goto error;
1174  a->ip.addr_data32[0] = in.s_addr;
1175  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1176  goto error;
1177  a->ip2.addr_data32[0] = in.s_addr;
1178  result &= (DetectAddressCutNotIPv4(a, &b) == 0);
1179 
1180  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
1181  goto error;
1182  result &= (a->ip.addr_data32[0] == in.s_addr);
1183  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
1184  goto error;
1185  result &= (a->ip2.addr_data32[0] = in.s_addr);
1186 
1187  if (b == NULL) {
1188  result = 0;
1189  goto error;
1190  } else {
1191  result &= 1;
1192  }
1193  if (inet_pton(AF_INET, "1.2.3.5", &in) < 0)
1194  goto error;
1195  result &= (b->ip.addr_data32[0] == in.s_addr);
1196  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1197  goto error;
1198  result &= (b->ip2.addr_data32[0] = in.s_addr);
1199 
1200  DetectAddressFree(a);
1201  if (b != NULL)
1202  DetectAddressFree(b);
1203  return result;
1204 
1205  error:
1206  DetectAddressFree(a);
1207  if (b != NULL)
1208  DetectAddressFree(b);
1209  return 0;
1210 }
1211 
1212 static int DetectAddressIPv4CutNot09(void)
1213 {
1214  DetectAddress *a = NULL;
1215  DetectAddress *b = NULL;
1216  struct in_addr in;
1217  int result = 1;
1218 
1219  if ( (a = DetectAddressInit()) == NULL)
1220  return 0;
1221 
1222  if (inet_pton(AF_INET, "1.2.3.4", &in) < 0)
1223  goto error;
1224  a->ip.addr_data32[0] = in.s_addr;
1225  if (inet_pton(AF_INET, "192.168.1.2", &in) < 0)
1226  goto error;
1227  a->ip2.addr_data32[0] = in.s_addr;
1228  result &= (DetectAddressCutNotIPv4(a, &b) == 0);
1229 
1230  if (inet_pton(AF_INET, "0.0.0.0", &in) < 0)
1231  goto error;
1232  result &= (a->ip.addr_data32[0] == in.s_addr);
1233  if (inet_pton(AF_INET, "1.2.3.3", &in) < 0)
1234  goto error;
1235  result &= (a->ip2.addr_data32[0] = in.s_addr);
1236 
1237  if (b == NULL) {
1238  result = 0;
1239  goto error;
1240  } else {
1241  result &= 1;
1242  }
1243  if (inet_pton(AF_INET, "192.168.1.3", &in) < 0)
1244  goto error;
1245  result &= (b->ip.addr_data32[0] == in.s_addr);
1246  if (inet_pton(AF_INET, "255.255.255.255", &in) < 0)
1247  goto error;
1248  result &= (b->ip2.addr_data32[0] = in.s_addr);
1249 
1250  DetectAddressFree(a);
1251  if (b != NULL)
1252  DetectAddressFree(b);
1253  return result;
1254 
1255  error:
1256  DetectAddressFree(a);
1257  if (b != NULL)
1258  DetectAddressFree(b);
1259  return 0;
1260 }
1261 
1262 #endif
1263 
1264 void DetectAddressIPv4Tests(void)
1265 {
1266 #ifdef UNITTESTS
1267  UtRegisterTest("DetectAddressIPv4TestAddressCmp01",
1268  DetectAddressIPv4TestAddressCmp01);
1269  UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace02",
1270  DetectAddressIPv4IsCompleteIPSpace02);
1271  UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace03",
1272  DetectAddressIPv4IsCompleteIPSpace03);
1273  UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace04",
1274  DetectAddressIPv4IsCompleteIPSpace04);
1275  UtRegisterTest("DetectAddressIPv4CutNot05", DetectAddressIPv4CutNot05);
1276  UtRegisterTest("DetectAddressIPv4CutNot06", DetectAddressIPv4CutNot06);
1277  UtRegisterTest("DetectAddressIPv4CutNot07", DetectAddressIPv4CutNot07);
1278  UtRegisterTest("DetectAddressIPv4CutNot08", DetectAddressIPv4CutNot08);
1279  UtRegisterTest("DetectAddressIPv4CutNot09", DetectAddressIPv4CutNot09);
1280 #endif
1281 }
ADDRESS_EB
@ ADDRESS_EB
Definition: detect.h:128
DetectAddressCutNotIPv4
int DetectAddressCutNotIPv4(DetectAddress *a, DetectAddress **b)
Cuts and returns an address range, which is the complement of the address range that is supplied as t...
Definition: detect-engine-address-ipv4.c:368
DetectAddress_::ip
Address ip
Definition: detect.h:141
DetectAddressFree
void DetectAddressFree(DetectAddress *ag)
Frees a DetectAddress instance.
Definition: detect-engine-address.c:80
detect-engine-siggroup.h
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DetectAddress_
address structure for use in the detection engine.
Definition: detect.h:139
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:335
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:761
DetectAddressIPv4Tests
void DetectAddressIPv4Tests(void)
Definition: detect-engine-address-ipv4.c:1264
util-unittest.h
DetectAddressCmpIPv4
int DetectAddressCmpIPv4(DetectAddress *a, DetectAddress *b)
Compares 2 addresses(address ranges) and returns the relationship between the 2 addresses.
Definition: detect-engine-address-ipv4.c:59
util-cidr.h
ADDRESS_GT
@ ADDRESS_GT
Definition: detect.h:130
ADDRESS_ER
@ ADDRESS_ER
Definition: detect.h:123
decode.h
util-debug.h
util-error.h
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:16
DetectAddressIsCompleteIPSpaceIPv4
int DetectAddressIsCompleteIPSpaceIPv4(DetectAddress *ag)
Check if the address group list covers the complete IPv4 IP space.
Definition: detect-engine-address-ipv4.c:314
DetectAddressCutIPv4
int DetectAddressCutIPv4(DetectEngineCtx *de_ctx, DetectAddress *a, DetectAddress *b, DetectAddress **c)
Cut groups and merge sigs.
Definition: detect-engine-address-ipv4.c:113
detect.h
detect-engine-port.h
ADDRESS_GE
@ ADDRESS_GE
Definition: detect.h:129
DetectAddress_::ip2
Address ip2
Definition: detect.h:142
ADDRESS_LT
@ ADDRESS_LT
Definition: detect.h:124
suricata-common.h
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:374
detect-engine-address-ipv4.h
DetectAddress_::next
struct DetectAddress_ * next
Definition: detect.h:150
ADDRESS_ES
@ ADDRESS_ES
Definition: detect.h:127
Address_::family
char family
Definition: decode.h:112
ADDRESS_LE
@ ADDRESS_LE
Definition: detect.h:125
flow-var.h
detect-engine-address.h
ADDRESS_EQ
@ ADDRESS_EQ
Definition: detect.h:126
DetectAddressInit
DetectAddress * DetectAddressInit(void)
Creates and returns a new instance of a DetectAddress.
Definition: detect-engine-address.c:67