suricata
detect-engine-address-ipv4.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * IPV4 Address part of the detection engine.
24  */
25 
26 #include "suricata-common.h"
27 
28 #include "decode.h"
29 #include "detect.h"
30 #include "flow-var.h"
31 
32 #include "util-cidr.h"
33 
34 #include "detect-engine-address.h"
35 #include "detect-engine-address-ipv4.h"
36 #include "detect-engine-siggroup.h"
37 #include "detect-engine-port.h"
38 
39 #include "util-error.h"
40 #include "util-debug.h"
41 
42 /**
43  * \brief Compares 2 addresses(address ranges) and returns the relationship
44  * between the 2 addresses.
45  *
46  * \param a Pointer to the first address instance to be compared.
47  * \param b Pointer to the second address instance to be compared.
48  *
49  * \retval ADDRESS_EQ If the 2 address ranges a and b, are equal.
50  * \retval ADDRESS_ES b encapsulates a. b_ip1[...a_ip1...a_ip2...]b_ip2.
51  * \retval ADDRESS_EB a encapsulates b. a_ip1[...b_ip1....b_ip2...]a_ip2.
52  * \retval ADDRESS_LE a_ip1(...b_ip1==a_ip2...)b_ip2
53  * \retval ADDRESS_LT a_ip1(...b_ip1...a_ip2...)b_ip2
54  * \retval ADDRESS_GE b_ip1(...a_ip1==b_ip2...)a_ip2
55  * \retval ADDRESS_GT a_ip1 > b_ip2, i.e. the address range for 'a' starts only
56  * after the end of the address range for 'b'
57  */
58 int DetectAddressCmpIPv4(DetectAddress *a, DetectAddress *b)
59 {
60  uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]);
61  uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]);
62  uint32_t b_ip1 = SCNtohl(b->ip.addr_data32[0]);
63  uint32_t b_ip2 = SCNtohl(b->ip2.addr_data32[0]);
64 
65  if (a_ip1 == b_ip1 && a_ip2 == b_ip2) {
66  SCLogDebug("ADDRESS_EQ");
67  return ADDRESS_EQ;
68  } else if (a_ip1 >= b_ip1 && a_ip1 <= b_ip2 && a_ip2 <= b_ip2) {
69  SCLogDebug("ADDRESS_ES");
70  return ADDRESS_ES;
71  } else if (a_ip1 <= b_ip1 && a_ip2 >= b_ip2) {
72  SCLogDebug("ADDRESS_EB");
73  return ADDRESS_EB;
74  } else if (a_ip1 < b_ip1 && a_ip2 < b_ip2 && a_ip2 >= b_ip1) {
75  SCLogDebug("ADDRESS_LE");
76  return ADDRESS_LE;
77  } else if (a_ip1 < b_ip1 && a_ip2 < b_ip2) {
78  SCLogDebug("ADDRESS_LT");
79  return ADDRESS_LT;
80  } else if (a_ip1 > b_ip1 && a_ip1 <= b_ip2 && a_ip2 > b_ip2) {
81  SCLogDebug("ADDRESS_GE");
82  return ADDRESS_GE;
83  } else if (a_ip1 > b_ip2) {
84  SCLogDebug("ADDRESS_GT");
85  return ADDRESS_GT;
86  } else {
87  /* should be unreachable */
88  SCLogDebug("Internal Error: should be unreachable");
89  }
90 
91  return ADDRESS_ER;
92 }
93 
94 /**
95  * \brief Cut groups and merge sigs
96  *
97  * a = 1.2.3.4, b = 1.2.3.4-1.2.3.5
98  * must result in: a == 1.2.3.4, b == 1.2.3.5, c == NULL
99  *
100  * a = 1.2.3.4, b = 1.2.3.3-1.2.3.5
101  * must result in: a == 1.2.3.3, b == 1.2.3.4, c == 1.2.3.5
102  *
103  * a = 1.2.3.0/24 b = 1.2.3.128-1.2.4.10
104  * must result in: a == 1.2.3.0/24, b == 1.2.4.0-1.2.4.10, c == NULL
105  *
106  * a = 1.2.3.4, b = 1.2.3.0/24
107  * must result in: a == 1.2.3.0-1.2.3.3, b == 1.2.3.4, c == 1.2.3.5-1.2.3.255
108  *
109  * \retval 0 On success.
110  * \retval -1 On failure.
111  */
112 int DetectAddressCutIPv4(DetectEngineCtx *de_ctx, DetectAddress *a,
113  DetectAddress *b, DetectAddress **c)
114 {
115  uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]);
116  uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]);
117  uint32_t b_ip1 = SCNtohl(b->ip.addr_data32[0]);
118  uint32_t b_ip2 = SCNtohl(b->ip2.addr_data32[0]);
119  DetectAddress *tmp = NULL;
120  DetectAddress *tmp_c = NULL;
121  int r = 0;
122 
123  /* default to NULL */
124  *c = NULL;
125 
126  r = DetectAddressCmpIPv4(a, b);
127  if (r != ADDRESS_ES && r != ADDRESS_EB && r != ADDRESS_LE && r != ADDRESS_GE) {
128  SCLogDebug("we shouldn't be here");
129  goto error;
130  }
131 
132  /* get a place to temporary put sigs lists */
133  tmp = DetectAddressInit();
134  if (tmp == NULL)
135  goto error;
136 
137  /* we have 3 parts: [aaa[abab)bbb]
138  * part a: a_ip1 <-> b_ip1 - 1
139  * part b: b_ip1 <-> a_ip2
140  * part c: a_ip2 + 1 <-> b_ip2
141  */
142  if (r == ADDRESS_LE) {
143  SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_LE");
144 
145  a->ip.addr_data32[0] = htonl(a_ip1);
146  a->ip2.addr_data32[0] = htonl(b_ip1 - 1);
147 
148  b->ip.addr_data32[0] = htonl(b_ip1);
149  b->ip2.addr_data32[0] = htonl(a_ip2);
150 
151  tmp_c = DetectAddressInit();
152  if (tmp_c == NULL)
153  goto error;
154 
155  tmp_c->ip.family = AF_INET;
156  tmp_c->ip.addr_data32[0] = htonl(a_ip2 + 1);
157  tmp_c->ip2.addr_data32[0] = htonl(b_ip2);
158  *c = tmp_c;
159 
160  /* we have 3 parts: [bbb[baba]aaa]
161  * part a: b_ip1 <-> a_ip1 - 1
162  * part b: a_ip1 <-> b_ip2
163  * part c: b_ip2 + 1 <-> a_ip2
164  */
165  } else if (r == ADDRESS_GE) {
166  SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_GE");
167 
168  a->ip.addr_data32[0] = htonl(b_ip1);
169  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
170 
171  b->ip.addr_data32[0] = htonl(a_ip1);
172  b->ip2.addr_data32[0] = htonl(b_ip2);
173 
174  tmp_c = DetectAddressInit();
175  if (tmp_c == NULL)
176  goto error;
177 
178  tmp_c->ip.family = AF_INET;
179  tmp_c->ip.addr_data32[0] = htonl(b_ip2 + 1);
180  tmp_c->ip2.addr_data32[0] = htonl(a_ip2);
181  *c = tmp_c;
182 
183  /* we have 2 or three parts:
184  *
185  * 2 part: [[abab]bbb] or [bbb[baba]]
186  * part a: a_ip1 <-> a_ip2
187  * part b: a_ip2 + 1 <-> b_ip2
188  *
189  * part a: b_ip1 <-> a_ip1 - 1
190  * part b: a_ip1 <-> a_ip2
191  *
192  * 3 part [bbb[aaa]bbb]
193  * becomes[aaa[bbb]ccc]
194  *
195  * part a: b_ip1 <-> a_ip1 - 1
196  * part b: a_ip1 <-> a_ip2
197  * part c: a_ip2 + 1 <-> b_ip2
198  */
199  } else if (r == ADDRESS_ES) {
200  SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_ES");
201 
202  if (a_ip1 == b_ip1) {
203  SCLogDebug("DetectAddressCutIPv4: 1");
204 
205  a->ip.addr_data32[0] = htonl(a_ip1);
206  a->ip2.addr_data32[0] = htonl(a_ip2);
207 
208  b->ip.addr_data32[0] = htonl(a_ip2 + 1);
209  b->ip2.addr_data32[0] = htonl(b_ip2);
210 
211  } else if (a_ip2 == b_ip2) {
212  SCLogDebug("DetectAddressCutIPv4: 2");
213 
214  a->ip.addr_data32[0] = htonl(b_ip1);
215  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
216 
217  b->ip.addr_data32[0] = htonl(a_ip1);
218  b->ip2.addr_data32[0] = htonl(a_ip2);
219 
220  } else {
221  SCLogDebug("3");
222 
223  a->ip.addr_data32[0] = htonl(b_ip1);
224  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
225 
226  b->ip.addr_data32[0] = htonl(a_ip1);
227  b->ip2.addr_data32[0] = htonl(a_ip2);
228 
229  tmp_c = DetectAddressInit();
230  if (tmp_c == NULL)
231  goto error;
232 
233  tmp_c->ip.family = AF_INET;
234  tmp_c->ip.addr_data32[0] = htonl(a_ip2 + 1);
235  tmp_c->ip2.addr_data32[0] = htonl(b_ip2);
236  *c = tmp_c;
237  }
238  /* we have 2 or three parts:
239  *
240  * 2 part: [[baba]aaa] or [aaa[abab]]
241  * part a: b_ip1 <-> b_ip2
242  * part b: b_ip2 + 1 <-> a_ip2
243  *
244  * part a: a_ip1 <-> b_ip1 - 1
245  * part b: b_ip1 <-> b_ip2
246  *
247  * 3 part [aaa[bbb]aaa]
248  * becomes[aaa[bbb]ccc]
249  *
250  * part a: a_ip1 <-> b_ip2 - 1
251  * part b: b_ip1 <-> b_ip2
252  * part c: b_ip2 + 1 <-> a_ip2
253  */
254  } else if (r == ADDRESS_EB) {
255  SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_EB");
256 
257  if (a_ip1 == b_ip1) {
258  SCLogDebug("DetectAddressCutIPv4: 1");
259 
260  a->ip.addr_data32[0] = htonl(b_ip1);
261  a->ip2.addr_data32[0] = htonl(b_ip2);
262 
263  b->ip.addr_data32[0] = htonl(b_ip2 + 1);
264  b->ip2.addr_data32[0] = htonl(a_ip2);
265  } else if (a_ip2 == b_ip2) {
266  SCLogDebug("DetectAddressCutIPv4: 2");
267 
268  a->ip.addr_data32[0] = htonl(a_ip1);
269  a->ip2.addr_data32[0] = htonl(b_ip1 - 1);
270 
271  b->ip.addr_data32[0] = htonl(b_ip1);
272  b->ip2.addr_data32[0] = htonl(b_ip2);
273  } else {
274  SCLogDebug("DetectAddressCutIPv4: 3");
275 
276  a->ip.addr_data32[0] = htonl(a_ip1);
277  a->ip2.addr_data32[0] = htonl(b_ip1 - 1);
278 
279  b->ip.addr_data32[0] = htonl(b_ip1);
280  b->ip2.addr_data32[0] = htonl(b_ip2);
281 
282  tmp_c = DetectAddressInit();
283  if (tmp_c == NULL)
284  goto error;
285 
286  tmp_c->ip.family = AF_INET;
287  tmp_c->ip.addr_data32[0] = htonl(b_ip2 + 1);
288  tmp_c->ip2.addr_data32[0] = htonl(a_ip2);
289  *c = tmp_c;
290  }
291  }
292 
293  if (tmp != NULL)
294  DetectAddressFree(tmp);
295 
296  return 0;
297 
298 error:
299  if (tmp != NULL)
300  DetectAddressFree(tmp);
301  return -1;
302 }
303 
304 /**
305  * \brief Check if the address group list covers the complete IPv4 IP space.
306  *
307  * \param ag Pointer to a DetectAddress list head, which has to be checked to
308  * see if the address ranges in it, cover the entire IPv4 IP space.
309  *
310  * \retval 1 Yes, it covers the entire IPv4 address range.
311  * \retval 0 No, it doesn't cover the entire IPv4 address range.
312  */
313 int DetectAddressIsCompleteIPSpaceIPv4(DetectAddress *ag)
314 {
315  uint32_t next_ip = 0;
316 
317  if (ag == NULL)
318  return 0;
319 
320  /* if we don't start with 0.0.0.0 we know we're good */
321  if (SCNtohl(ag->ip.addr_data32[0]) != 0x00000000)
322  return 0;
323 
324  /* if we're ending with 255.255.255.255 while we know we started with
325  * 0.0.0.0 it's the complete space */
326  if (SCNtohl(ag->ip2.addr_data32[0]) == 0xFFFFFFFF)
327  return 1;
328 
329  next_ip = htonl(SCNtohl(ag->ip2.addr_data32[0]) + 1);
330  ag = ag->next;
331 
332  for ( ; ag != NULL; ag = ag->next) {
333 
334  if (ag->ip.addr_data32[0] != next_ip)
335  return 0;
336 
337  if (SCNtohl(ag->ip2.addr_data32[0]) == 0xFFFFFFFF)
338  return 1;
339 
340  next_ip = htonl(SCNtohl(ag->ip2.addr_data32[0]) + 1);
341  }
342 
343  return 0;
344 }
345 
346 /**
347  * \brief Cuts and returns an address range, which is the complement of the
348  * address range that is supplied as the argument.
349  *
350  * For example:
351  *
352  * If a = 0.0.0.0-1.2.3.4,
353  * then a = 1.2.3.4-255.255.255.255 and b = NULL
354  * If a = 1.2.3.4-255.255.255.255,
355  * then a = 0.0.0.0-1.2.3.4 and b = NULL
356  * If a = 1.2.3.4-192.168.1.1,
357  * then a = 0.0.0.0-1.2.3.3 and b = 192.168.1.2-255.255.255.255
358  *
359  * \param a Pointer to an address range (DetectAddress) instance whose complement
360  * has to be returned in a and b.
361  * \param b Pointer to DetectAddress pointer, that will be supplied back with a
362  * new DetectAddress instance, if the complement demands so.
363  *
364  * \retval 0 On success.
365  * \retval -1 On failure.
366  */
367 int DetectAddressCutNotIPv4(DetectAddress *a, DetectAddress **b)
368 {
369  uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]);
370  uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]);
371  DetectAddress *tmp_b = NULL;
372 
373  /* default to NULL */
374  *b = NULL;
375 
376  if (a_ip1 != 0x00000000 && a_ip2 != 0xFFFFFFFF) {
377  a->ip.addr_data32[0] = htonl(0x00000000);
378  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
379 
380  tmp_b = DetectAddressInit();
381  if (tmp_b == NULL)
382  goto error;
383 
384  tmp_b->ip.family = AF_INET;
385  tmp_b->ip.addr_data32[0] = htonl(a_ip2 + 1);
386  tmp_b->ip2.addr_data32[0] = htonl(0xFFFFFFFF);
387  *b = tmp_b;
388  } else if (a_ip1 == 0x00000000 && a_ip2 != 0xFFFFFFFF) {
389  a->ip.addr_data32[0] = htonl(a_ip2 + 1);
390  a->ip2.addr_data32[0] = htonl(0xFFFFFFFF);
391  } else if (a_ip1 != 0x00000000 && a_ip2 == 0xFFFFFFFF) {
392  a->ip.addr_data32[0] = htonl(0x00000000);
393  a->ip2.addr_data32[0] = htonl(a_ip1 - 1);
394  } else {
395  goto error;
396  }
397 
398  return 0;
399 
400 error:
401  return -1;
402 }
403 
404 /********************************Unittests*************************************/
405 
406 #ifdef UNITTESTS
407 
408 static int DetectAddressIPv4TestAddressCmp01(void)
409 {
410  struct in_addr in;
411 
412  DetectAddress *a = DetectAddressInit();
413  FAIL_IF_NULL(a);
414 
415  DetectAddress *b = DetectAddressInit();
416  FAIL_IF_NULL(b);
417 
418  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
419  a->ip.addr_data32[0] = in.s_addr;
420  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
421  a->ip2.addr_data32[0] = in.s_addr;
422  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
423  b->ip.addr_data32[0] = in.s_addr;
424  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
425  b->ip2.addr_data32[0] = in.s_addr;
426  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_EQ);
427 
428  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
429  a->ip.addr_data32[0] = in.s_addr;
430  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
431  a->ip2.addr_data32[0] = in.s_addr;
432  FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0);
433  b->ip.addr_data32[0] = in.s_addr;
434  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
435  b->ip2.addr_data32[0] = in.s_addr;
436  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_ES);
437 
438  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
439  a->ip.addr_data32[0] = in.s_addr;
440  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
441  a->ip2.addr_data32[0] = in.s_addr;
442  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
443  b->ip.addr_data32[0] = in.s_addr;
444  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
445  b->ip2.addr_data32[0] = in.s_addr;
446  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_ES);
447 
448  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
449  a->ip.addr_data32[0] = in.s_addr;
450  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
451  a->ip2.addr_data32[0] = in.s_addr;
452  FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0);
453  b->ip.addr_data32[0] = in.s_addr;
454  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
455  b->ip2.addr_data32[0] = in.s_addr;
456  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_ES);
457 
458  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
459  a->ip.addr_data32[0] = in.s_addr;
460  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
461  a->ip2.addr_data32[0] = in.s_addr;
462  FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0);
463  b->ip.addr_data32[0] = in.s_addr;
464  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
465  b->ip2.addr_data32[0] = in.s_addr;
466  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_ES);
467 
468  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
469  a->ip.addr_data32[0] = in.s_addr;
470  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
471  a->ip2.addr_data32[0] = in.s_addr;
472  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
473  b->ip.addr_data32[0] = in.s_addr;
474  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
475  b->ip2.addr_data32[0] = in.s_addr;
476  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_ES);
477 
478  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
479  a->ip.addr_data32[0] = in.s_addr;
480  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
481  a->ip2.addr_data32[0] = in.s_addr;
482  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
483  b->ip.addr_data32[0] = in.s_addr;
484  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
485  b->ip2.addr_data32[0] = in.s_addr;
486  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_EB);
487 
488  FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0);
489  a->ip.addr_data32[0] = in.s_addr;
490  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
491  a->ip2.addr_data32[0] = in.s_addr;
492  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
493  b->ip.addr_data32[0] = in.s_addr;
494  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
495  b->ip2.addr_data32[0] = in.s_addr;
496  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_EB);
497 
498  FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0);
499  a->ip.addr_data32[0] = in.s_addr;
500  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
501  a->ip2.addr_data32[0] = in.s_addr;
502  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
503  b->ip.addr_data32[0] = in.s_addr;
504  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
505  b->ip2.addr_data32[0] = in.s_addr;
506  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_EB);
507 
508  FAIL_IF(inet_pton(AF_INET, "1.2.3.5", &in) < 0);
509  a->ip.addr_data32[0] = in.s_addr;
510  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
511  a->ip2.addr_data32[0] = in.s_addr;
512  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
513  b->ip.addr_data32[0] = in.s_addr;
514  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
515  b->ip2.addr_data32[0] = in.s_addr;
516  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_EB);
517 
518  FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0);
519  a->ip.addr_data32[0] = in.s_addr;
520  FAIL_IF(inet_pton(AF_INET, "128.128.128.128", &in) < 0);
521  a->ip2.addr_data32[0] = in.s_addr;
522  FAIL_IF(inet_pton(AF_INET, "128.128.128.128", &in) < 0);
523  b->ip.addr_data32[0] = in.s_addr;
524  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
525  b->ip2.addr_data32[0] = in.s_addr;
526  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_LE);
527 
528  FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0);
529  a->ip.addr_data32[0] = in.s_addr;
530  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
531  a->ip2.addr_data32[0] = in.s_addr;
532  FAIL_IF(inet_pton(AF_INET, "128.128.128.128", &in) < 0);
533  b->ip.addr_data32[0] = in.s_addr;
534  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
535  b->ip2.addr_data32[0] = in.s_addr;
536  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_LE);
537 
538  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
539  a->ip.addr_data32[0] = in.s_addr;
540  FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0);
541  a->ip2.addr_data32[0] = in.s_addr;
542  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
543  b->ip.addr_data32[0] = in.s_addr;
544  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
545  b->ip2.addr_data32[0] = in.s_addr;
546  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_LE);
547 
548  FAIL_IF(inet_pton(AF_INET, "170.170.170.169", &in) < 0);
549  a->ip.addr_data32[0] = in.s_addr;
550  FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0);
551  a->ip2.addr_data32[0] = in.s_addr;
552  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
553  b->ip.addr_data32[0] = in.s_addr;
554  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
555  b->ip2.addr_data32[0] = in.s_addr;
556  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_LE);
557 
558  FAIL_IF(inet_pton(AF_INET, "170.170.170.169", &in) < 0);
559  a->ip.addr_data32[0] = in.s_addr;
560  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
561  a->ip2.addr_data32[0] = in.s_addr;
562  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
563  b->ip.addr_data32[0] = in.s_addr;
564  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
565  b->ip2.addr_data32[0] = in.s_addr;
566  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_LE);
567 
568  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
569  a->ip.addr_data32[0] = in.s_addr;
570  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
571  a->ip2.addr_data32[0] = in.s_addr;
572  FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0);
573  b->ip.addr_data32[0] = in.s_addr;
574  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
575  b->ip2.addr_data32[0] = in.s_addr;
576  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_LT);
577 
578  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
579  a->ip.addr_data32[0] = in.s_addr;
580  FAIL_IF(inet_pton(AF_INET, "185.185.185.185", &in) < 0);
581  a->ip2.addr_data32[0] = in.s_addr;
582  FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0);
583  b->ip.addr_data32[0] = in.s_addr;
584  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
585  b->ip2.addr_data32[0] = in.s_addr;
586  /* we could get a LE */
587  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
588 
589  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
590  a->ip.addr_data32[0] = in.s_addr;
591  FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0);
592  a->ip2.addr_data32[0] = in.s_addr;
593  FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0);
594  b->ip.addr_data32[0] = in.s_addr;
595  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
596  b->ip2.addr_data32[0] = in.s_addr;
597  /* we could get a LE */
598  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
599 
600  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
601  a->ip.addr_data32[0] = in.s_addr;
602  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
603  a->ip2.addr_data32[0] = in.s_addr;
604  FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0);
605  b->ip.addr_data32[0] = in.s_addr;
606  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
607  b->ip2.addr_data32[0] = in.s_addr;
608  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
609 
610  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
611  a->ip.addr_data32[0] = in.s_addr;
612  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
613  a->ip2.addr_data32[0] = in.s_addr;
614  FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0);
615  b->ip.addr_data32[0] = in.s_addr;
616  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
617  b->ip2.addr_data32[0] = in.s_addr;
618  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
619 
620  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
621  a->ip.addr_data32[0] = in.s_addr;
622  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
623  a->ip2.addr_data32[0] = in.s_addr;
624  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
625  b->ip.addr_data32[0] = in.s_addr;
626  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
627  b->ip2.addr_data32[0] = in.s_addr;
628  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_LT);
629 
630  FAIL_IF(inet_pton(AF_INET, "128.128.128.128", &in) < 0);
631  a->ip.addr_data32[0] = in.s_addr;
632  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
633  a->ip2.addr_data32[0] = in.s_addr;
634  FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0);
635  b->ip.addr_data32[0] = in.s_addr;
636  FAIL_IF(inet_pton(AF_INET, "128.128.128.128", &in) < 0);
637  b->ip2.addr_data32[0] = in.s_addr;
638  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_GE);
639 
640  FAIL_IF(inet_pton(AF_INET, "128.128.128.128", &in) < 0);
641  a->ip.addr_data32[0] = in.s_addr;
642  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
643  a->ip2.addr_data32[0] = in.s_addr;
644  FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0);
645  b->ip.addr_data32[0] = in.s_addr;
646  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
647  b->ip2.addr_data32[0] = in.s_addr;
648  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_GE);
649 
650  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
651  a->ip.addr_data32[0] = in.s_addr;
652  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
653  a->ip2.addr_data32[0] = in.s_addr;
654  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
655  b->ip.addr_data32[0] = in.s_addr;
656  FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0);
657  b->ip2.addr_data32[0] = in.s_addr;
658  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_GE);
659 
660  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
661  a->ip.addr_data32[0] = in.s_addr;
662  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
663  a->ip2.addr_data32[0] = in.s_addr;
664  FAIL_IF(inet_pton(AF_INET, "170.170.170.169", &in) < 0);
665  b->ip.addr_data32[0] = in.s_addr;
666  FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0);
667  b->ip2.addr_data32[0] = in.s_addr;
668  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_GE);
669 
670  FAIL_IF(inet_pton(AF_INET, "170.170.170.169", &in) < 0);
671  a->ip.addr_data32[0] = in.s_addr;
672  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
673  a->ip2.addr_data32[0] = in.s_addr;
674  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
675  b->ip.addr_data32[0] = in.s_addr;
676  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
677  b->ip2.addr_data32[0] = in.s_addr;
678  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_GE);
679 
680  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
681  a->ip.addr_data32[0] = in.s_addr;
682  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
683  a->ip2.addr_data32[0] = in.s_addr;
684  FAIL_IF(inet_pton(AF_INET, "170.170.169.170", &in) < 0);
685  b->ip.addr_data32[0] = in.s_addr;
686  FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0);
687  b->ip2.addr_data32[0] = in.s_addr;
688  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_GE);
689 
690  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
691  a->ip.addr_data32[0] = in.s_addr;
692  FAIL_IF(inet_pton(AF_INET, "200.200.200.200", &in) < 0);
693  a->ip2.addr_data32[0] = in.s_addr;
694  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
695  b->ip.addr_data32[0] = in.s_addr;
696  FAIL_IF(inet_pton(AF_INET, "185.185.185.185", &in) < 0);
697  b->ip2.addr_data32[0] = in.s_addr;
698  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_GT);
699 
700  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
701  a->ip.addr_data32[0] = in.s_addr;
702  FAIL_IF(inet_pton(AF_INET, "200.200.200.200", &in) < 0);
703  a->ip2.addr_data32[0] = in.s_addr;
704  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
705  b->ip.addr_data32[0] = in.s_addr;
706  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
707  b->ip2.addr_data32[0] = in.s_addr;
708  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_GT);
709 
710  FAIL_IF(inet_pton(AF_INET, "182.168.1.2", &in) < 0);
711  a->ip.addr_data32[0] = in.s_addr;
712  FAIL_IF(inet_pton(AF_INET, "200.200.200.200", &in) < 0);
713  a->ip2.addr_data32[0] = in.s_addr;
714  FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0);
715  b->ip.addr_data32[0] = in.s_addr;
716  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
717  b->ip2.addr_data32[0] = in.s_addr;
718  FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_GT);
719 
720  DetectAddressFree(a);
721  DetectAddressFree(b);
722  PASS;
723 }
724 
725 static int DetectAddressIPv4IsCompleteIPSpace02(void)
726 {
727  struct in_addr in;
728 
729  DetectAddress *a = DetectAddressInit();
730  FAIL_IF_NULL(a);
731 
732  FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0);
733  a->ip.addr_data32[0] = in.s_addr;
734  FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0);
735  a->ip2.addr_data32[0] = in.s_addr;
736  FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 1);
737 
738  FAIL_IF(inet_pton(AF_INET, "0.0.0.1", &in) < 0);
739  a->ip.addr_data32[0] = in.s_addr;
740  FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0);
741  a->ip2.addr_data32[0] = in.s_addr;
742  FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
743 
744  DetectAddressFree(a);
745 
746  a = DetectAddressInit();
747  FAIL_IF_NULL(a);
748 
749  FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0);
750  a->ip.addr_data32[0] = in.s_addr;
751  FAIL_IF(inet_pton(AF_INET, "255.255.255.254", &in) < 0);
752  a->ip2.addr_data32[0] = in.s_addr;
753  FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
754 
755  DetectAddressFree(a);
756 
757  PASS;
758 }
759 
760 static int DetectAddressIPv4IsCompleteIPSpace03(void)
761 {
762  struct in_addr in;
763 
764  DetectAddress *a = DetectAddressInit();
765  FAIL_IF_NULL(a);
766  DetectAddress *temp = a;
767 
768  FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0);
769  a->ip.addr_data32[0] = in.s_addr;
770  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
771  a->ip2.addr_data32[0] = in.s_addr;
772  FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
773 
774  temp->next = DetectAddressInit();
775  FAIL_IF_NULL(temp->next);
776  temp = temp->next;
777 
778  FAIL_IF(inet_pton(AF_INET, "1.2.3.5", &in) < 0);
779  temp->ip.addr_data32[0] = in.s_addr;
780  FAIL_IF(inet_pton(AF_INET, "126.36.62.61", &in) < 0);
781  temp->ip2.addr_data32[0] = in.s_addr;
782  FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
783 
784  temp->next = DetectAddressInit();
785  FAIL_IF_NULL(temp->next);
786  temp = temp->next;
787 
788  FAIL_IF(inet_pton(AF_INET, "126.36.62.62", &in) < 0);
789  temp->ip.addr_data32[0] = in.s_addr;
790  FAIL_IF(inet_pton(AF_INET, "222.52.21.62", &in) < 0);
791  temp->ip2.addr_data32[0] = in.s_addr;
792  FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
793 
794  temp->next = DetectAddressInit();
795  FAIL_IF_NULL(temp->next);
796  temp = temp->next;
797 
798  FAIL_IF(inet_pton(AF_INET, "222.52.21.63", &in) < 0);
799  temp->ip.addr_data32[0] = in.s_addr;
800  FAIL_IF(inet_pton(AF_INET, "255.255.255.254", &in) < 0);
801  temp->ip2.addr_data32[0] = in.s_addr;
802  FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
803 
804  temp->next = DetectAddressInit();
805  FAIL_IF_NULL(temp->next);
806  temp = temp->next;
807 
808  FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0);
809  temp->ip.addr_data32[0] = in.s_addr;
810  FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0);
811  temp->ip2.addr_data32[0] = in.s_addr;
812  FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 1);
813 
814  DetectAddressCleanupList(a);
815 
816  PASS;
817 }
818 
819 static int DetectAddressIPv4IsCompleteIPSpace04(void)
820 {
821  struct in_addr in;
822 
823  DetectAddress *a = DetectAddressInit();
824  FAIL_IF_NULL(a);
825  DetectAddress *temp = a;
826 
827  FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0);
828  a->ip.addr_data32[0] = in.s_addr;
829  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
830  a->ip2.addr_data32[0] = in.s_addr;
831  FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
832 
833  temp->next = DetectAddressInit();
834  FAIL_IF_NULL(temp->next);
835  temp = temp->next;
836 
837  FAIL_IF(inet_pton(AF_INET, "1.2.3.5", &in) < 0);
838  temp->ip.addr_data32[0] = in.s_addr;
839  FAIL_IF(inet_pton(AF_INET, "126.36.62.61", &in) < 0);
840  temp->ip2.addr_data32[0] = in.s_addr;
841  FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
842 
843  temp->next = DetectAddressInit();
844  FAIL_IF_NULL(temp->next);
845  temp = temp->next;
846 
847  FAIL_IF(inet_pton(AF_INET, "126.36.62.62", &in) < 0);
848  temp->ip.addr_data32[0] = in.s_addr;
849  FAIL_IF(inet_pton(AF_INET, "222.52.21.62", &in) < 0);
850  temp->ip2.addr_data32[0] = in.s_addr;
851  FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
852 
853  temp->next = DetectAddressInit();
854  FAIL_IF_NULL(temp->next);
855  temp = temp->next;
856 
857  FAIL_IF(inet_pton(AF_INET, "222.52.21.64", &in) < 0);
858  temp->ip.addr_data32[0] = in.s_addr;
859  FAIL_IF(inet_pton(AF_INET, "255.255.255.254", &in) < 0);
860  temp->ip2.addr_data32[0] = in.s_addr;
861  FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
862 
863  temp->next = DetectAddressInit();
864  FAIL_IF_NULL(temp->next);
865  temp = temp->next;
866 
867  FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0);
868  temp->ip.addr_data32[0] = in.s_addr;
869  FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0);
870  temp->ip2.addr_data32[0] = in.s_addr;
871  FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0);
872 
873  DetectAddressCleanupList(a);
874 
875  PASS;
876 }
877 
878 static int DetectAddressIPv4CutNot05(void)
879 {
880  DetectAddress *b = NULL;
881  struct in_addr in;
882 
883  DetectAddress *a = DetectAddressInit();
884  FAIL_IF_NULL(a);
885 
886  FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0);
887  a->ip.addr_data32[0] = in.s_addr;
888  FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0);
889  a->ip2.addr_data32[0] = in.s_addr;
890  FAIL_IF_NOT(DetectAddressCutNotIPv4(a, &b) == -1);
891 
892  DetectAddressFree(a);
893  DetectAddressFree(b);
894  PASS;
895 }
896 
897 static int DetectAddressIPv4CutNot06(void)
898 {
899  DetectAddress *b = NULL;
900  struct in_addr in;
901 
902  DetectAddress *a = DetectAddressInit();
903  FAIL_IF_NULL(a);
904 
905  FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0);
906  a->ip.addr_data32[0] = in.s_addr;
907  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
908  a->ip2.addr_data32[0] = in.s_addr;
909  FAIL_IF_NOT(DetectAddressCutNotIPv4(a, &b) == 0);
910 
911  FAIL_IF(inet_pton(AF_INET, "1.2.3.5", &in) < 0);
912  FAIL_IF_NOT(a->ip.addr_data32[0] == in.s_addr);
913  FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0);
914  FAIL_IF_NOT(a->ip2.addr_data32[0] = in.s_addr);
915 
916  DetectAddressFree(a);
917  DetectAddressFree(b);
918  PASS;
919 }
920 
921 static int DetectAddressIPv4CutNot07(void)
922 {
923  DetectAddress *b = NULL;
924  struct in_addr in;
925 
926  DetectAddress *a = DetectAddressInit();
927  FAIL_IF_NULL(a);
928 
929  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
930  a->ip.addr_data32[0] = in.s_addr;
931  FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0);
932  a->ip2.addr_data32[0] = in.s_addr;
933  FAIL_IF_NOT(DetectAddressCutNotIPv4(a, &b) == 0);
934 
935  FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0);
936  FAIL_IF_NOT(a->ip.addr_data32[0] == in.s_addr);
937  FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0);
938  FAIL_IF_NOT(a->ip2.addr_data32[0] = in.s_addr);
939 
940  DetectAddressFree(a);
941  DetectAddressFree(b);
942  PASS;
943 }
944 
945 static int DetectAddressIPv4CutNot08(void)
946 {
947  DetectAddress *b = NULL;
948  struct in_addr in;
949 
950  DetectAddress *a = DetectAddressInit();
951  FAIL_IF_NULL(a);
952 
953  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
954  a->ip.addr_data32[0] = in.s_addr;
955  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
956  a->ip2.addr_data32[0] = in.s_addr;
957  FAIL_IF_NOT(DetectAddressCutNotIPv4(a, &b) == 0);
958 
959  FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0);
960  FAIL_IF_NOT(a->ip.addr_data32[0] == in.s_addr);
961  FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0);
962  FAIL_IF_NOT(a->ip2.addr_data32[0] = in.s_addr);
963 
964  FAIL_IF_NULL(b);
965  FAIL_IF(inet_pton(AF_INET, "1.2.3.5", &in) < 0);
966  FAIL_IF_NOT(b->ip.addr_data32[0] == in.s_addr);
967  FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0);
968  FAIL_IF_NOT(b->ip2.addr_data32[0] = in.s_addr);
969 
970  DetectAddressFree(a);
971  DetectAddressFree(b);
972  PASS;
973 }
974 
975 static int DetectAddressIPv4CutNot09(void)
976 {
977  DetectAddress *b = NULL;
978  struct in_addr in;
979 
980  DetectAddress *a = DetectAddressInit();
981  FAIL_IF_NULL(a);
982 
983  FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0);
984  a->ip.addr_data32[0] = in.s_addr;
985  FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0);
986  a->ip2.addr_data32[0] = in.s_addr;
987  FAIL_IF_NOT(DetectAddressCutNotIPv4(a, &b) == 0);
988 
989  FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0);
990  FAIL_IF_NOT(a->ip.addr_data32[0] == in.s_addr);
991  FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0);
992  FAIL_IF_NOT(a->ip2.addr_data32[0] = in.s_addr);
993 
994  FAIL_IF_NULL(b);
995  FAIL_IF(inet_pton(AF_INET, "192.168.1.3", &in) < 0);
996  FAIL_IF_NOT(b->ip.addr_data32[0] == in.s_addr);
997  FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0);
998  FAIL_IF_NOT(b->ip2.addr_data32[0] = in.s_addr);
999 
1000  DetectAddressFree(a);
1001  DetectAddressFree(b);
1002  PASS;
1003 }
1004 
1005 #endif
1006 
1007 void DetectAddressIPv4Tests(void)
1008 {
1009 #ifdef UNITTESTS
1010  UtRegisterTest("DetectAddressIPv4TestAddressCmp01",
1011  DetectAddressIPv4TestAddressCmp01);
1012  UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace02",
1013  DetectAddressIPv4IsCompleteIPSpace02);
1014  UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace03",
1015  DetectAddressIPv4IsCompleteIPSpace03);
1016  UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace04",
1017  DetectAddressIPv4IsCompleteIPSpace04);
1018  UtRegisterTest("DetectAddressIPv4CutNot05", DetectAddressIPv4CutNot05);
1019  UtRegisterTest("DetectAddressIPv4CutNot06", DetectAddressIPv4CutNot06);
1020  UtRegisterTest("DetectAddressIPv4CutNot07", DetectAddressIPv4CutNot07);
1021  UtRegisterTest("DetectAddressIPv4CutNot08", DetectAddressIPv4CutNot08);
1022  UtRegisterTest("DetectAddressIPv4CutNot09", DetectAddressIPv4CutNot09);
1023 #endif
1024 }
DetectAddressCutNotIPv4
int DetectAddressCutNotIPv4(DetectAddress *a, DetectAddress **b)
Cuts and returns an address range, which is the complement of the address range that is supplied as t...
Definition: detect-engine-address-ipv4.c:367
DetectAddress_::ip
Address ip
Definition: detect.h:172
DetectAddressFree
void DetectAddressFree(DetectAddress *ag)
Frees a DetectAddress instance.
Definition: detect-engine-address.c:81
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
ADDRESS_EB
@ ADDRESS_EB
Definition: detect.h:158
ADDRESS_LE
@ ADDRESS_LE
Definition: detect.h:155
detect-engine-siggroup.h
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:101
DetectAddress_
address structure for use in the detection engine.
Definition: detect.h:170
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:282
ADDRESS_LT
@ ADDRESS_LT
Definition: detect.h:154
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:995
DetectAddressIPv4Tests
void DetectAddressIPv4Tests(void)
Definition: detect-engine-address-ipv4.c:1007
ADDRESS_EQ
@ ADDRESS_EQ
Definition: detect.h:156
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
DetectAddressCmpIPv4
int DetectAddressCmpIPv4(DetectAddress *a, DetectAddress *b)
Compares 2 addresses(address ranges) and returns the relationship between the 2 addresses.
Definition: detect-engine-address-ipv4.c:58
util-cidr.h
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
util-error.h
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:22
DetectAddressIsCompleteIPSpaceIPv4
int DetectAddressIsCompleteIPSpaceIPv4(DetectAddress *ag)
Check if the address group list covers the complete IPv4 IP space.
Definition: detect-engine-address-ipv4.c:313
DetectAddressCutIPv4
int DetectAddressCutIPv4(DetectEngineCtx *de_ctx, DetectAddress *a, DetectAddress *b, DetectAddress **c)
Cut groups and merge sigs.
Definition: detect-engine-address-ipv4.c:112
ADDRESS_GE
@ ADDRESS_GE
Definition: detect.h:159
detect.h
detect-engine-port.h
DetectAddress_::ip2
Address ip2
Definition: detect.h:173
DetectAddressCleanupList
void DetectAddressCleanupList(DetectAddress *head)
Frees a list of DetectAddress instances.
Definition: detect-engine-address.c:143
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
suricata-common.h
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:435
detect-engine-address-ipv4.h
DetectAddress_::next
struct DetectAddress_ * next
Definition: detect.h:181
Address_::family
char family
Definition: decode.h:114
ADDRESS_ES
@ ADDRESS_ES
Definition: detect.h:157
flow-var.h
detect-engine-address.h
DetectAddressInit
DetectAddress * DetectAddressInit(void)
Creates and returns a new instance of a DetectAddress.
Definition: detect-engine-address.c:68
ADDRESS_ER
@ ADDRESS_ER
Definition: detect.h:153
ADDRESS_GT
@ ADDRESS_GT
Definition: detect.h:160