suricata
detect-engine-address.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Address part of the detection engine.
24  */
25 
26 #include "suricata-common.h"
27 #include "decode.h"
28 #include "detect.h"
29 #include "flow-var.h"
30 
31 #include "util-cidr.h"
32 #include "util-unittest.h"
33 #include "util-rule-vars.h"
34 #include "conf.h"
35 #include "conf-yaml-loader.h"
36 
37 #include "detect-engine-siggroup.h"
38 #include "detect-engine-address.h"
39 #include "detect-engine-address-ipv4.h"
40 #include "detect-engine-address-ipv6.h"
41 #include "detect-engine-port.h"
42 
43 #include "util-debug.h"
44 #include "util-byte.h"
45 #include "util-print.h"
46 #include "util-var.h"
47 
48 /* prototypes */
49 #ifdef DEBUG
50 static void DetectAddressPrint(DetectAddress *);
51 #else
52 #define DetectAddressPrint(...)
53 #endif
54 static int DetectAddressCutNot(DetectAddress *, DetectAddress **);
55 static int DetectAddressCut(DetectEngineCtx *, DetectAddress *, DetectAddress *,
56  DetectAddress **);
57 static int DetectAddressParse2(const DetectEngineCtx *de_ctx, DetectAddressHead *gh,
58  DetectAddressHead *ghn, const char *s, int negate, ResolvedVariablesList *var_list,
59  int recur);
60 
61 int DetectAddressMergeNot(DetectAddressHead *gh, DetectAddressHead *ghn);
62 
63 /**
64  * \brief Creates and returns a new instance of a DetectAddress.
65  *
66  * \retval ag Pointer to the newly created DetectAddress on success;
67  * NULL on failure.
68  */
69 DetectAddress *DetectAddressInit(void)
70 {
71  DetectAddress *ag = SCCalloc(1, sizeof(DetectAddress));
72  if (unlikely(ag == NULL))
73  return NULL;
74  return ag;
75 }
76 
77 /**
78  * \brief Frees a DetectAddress instance.
79  *
80  * \param ag Pointer to the DetectAddress instance to be freed.
81  */
82 void DetectAddressFree(DetectAddress *ag)
83 {
84  if (ag == NULL)
85  return;
86 
87  SCFree(ag);
88 }
89 
90 /**
91  * \internal
92  * \brief Returns a new instance of DetectAddressHead.
93  *
94  * \retval gh Pointer to the new instance of DetectAddressHead.
95  */
96 static DetectAddressHead *DetectAddressHeadInit(void)
97 {
98  DetectAddressHead *gh = SCCalloc(1, sizeof(DetectAddressHead));
99  if (unlikely(gh == NULL))
100  return NULL;
101  return gh;
102 }
103 
104 /**
105  * \internal
106  * \brief Frees a DetectAddressHead instance.
107  *
108  * \param gh Pointer to the DetectAddressHead instance to be freed.
109  */
110 static void DetectAddressHeadFree(DetectAddressHead *gh)
111 {
112  if (gh != NULL) {
113  DetectAddressHeadCleanup(gh);
114  SCFree(gh);
115  }
116 }
117 
118 /**
119  * \brief copy a DetectAddress
120  *
121  * \param orig Pointer to the instance of DetectAddress that contains the
122  * address data to be copied to the new instance.
123  *
124  * \retval ag Pointer to the new instance of DetectAddress that contains the
125  * copied address.
126  */
127 DetectAddress *DetectAddressCopy(DetectAddress *orig)
128 {
129  DetectAddress *ag = DetectAddressInit();
130  if (ag == NULL)
131  return NULL;
132 
133  ag->flags = orig->flags;
134  COPY_ADDRESS(&orig->ip, &ag->ip);
135  COPY_ADDRESS(&orig->ip2, &ag->ip2);
136  return ag;
137 }
138 
139 /**
140  * \brief Frees a list of DetectAddress instances.
141  *
142  * \param head Pointer to a list of DetectAddress instances to be freed.
143  */
144 void DetectAddressCleanupList(DetectAddress *head)
145 {
146  for (DetectAddress *cur = head; cur != NULL; ) {
147  DetectAddress *next = cur->next;
148  cur->next = NULL;
149  DetectAddressFree(cur);
150  cur = next;
151  }
152 }
153 
154 /**
155  * \internal
156  * \brief Helper function for DetectAddressInsert. Sets one of the
157  * DetectAddressHead head pointers, to the DetectAddress argument
158  * based on its address family.
159  *
160  * \param gh Pointer to the DetectAddressHead.
161  * \param newhead Pointer to the DetectAddress.
162  *
163  * \retval 0 On success.
164  * \retval -1 On failure.
165  */
166 static int SetHeadPtr(DetectAddressHead *gh, DetectAddress *newhead)
167 {
168  if (newhead->ip.family == AF_INET) {
169  gh->ipv4_head = newhead;
170  } else if (newhead->ip.family == AF_INET6) {
171  gh->ipv6_head = newhead;
172  } else {
173  SCLogDebug("newhead->family %u not supported", newhead->ip.family);
174  return -1;
175  }
176 
177  return 0;
178 }
179 
180 /**
181  * \internal
182  * \brief Returns the DetectAddress head from the DetectAddressHeads,
183  * based on the address family of the incoming DetectAddress arg.
184  *
185  * \param gh Pointer to the DetectAddressHead.
186  * \param new Pointer to the DetectAddress.
187  *
188  * \retval head Pointer to the DetectAddress(the head from
189  * DetectAddressHead).
190  */
191 static DetectAddress *GetHeadPtr(DetectAddressHead *gh, DetectAddress *new)
192 {
193  DetectAddress *head = NULL;
194 
195  if (new->ip.family == AF_INET)
196  head = gh->ipv4_head;
197  else if (new->ip.family == AF_INET6)
198  head = gh->ipv6_head;
199 
200  return head;
201 }
202 
203 /**
204  * \internal
205  * \brief insert DetectAddress into a DetectAddressHead
206  *
207  * \param de_ctx Pointer to the detection engine context.
208  * \param gh Pointer to the DetectAddressHead list to which it has to
209  * be inserted.
210  * \param new Pointer to the DetectAddress, that has to be inserted.
211  *
212  * \retval 1 On successfully inserting it.
213  * \retval -1 On error.
214  * \retval 0 Not inserted, memory of new is freed.
215  */
216 static int DetectAddressInsert(DetectEngineCtx *de_ctx, DetectAddressHead *gh,
217  DetectAddress *new)
218 {
219  DetectAddress *head = NULL;
220  DetectAddress *cur = NULL;
221  DetectAddress *c = NULL;
222  int r = 0;
223 
224  if (new == NULL)
225  return 0;
226 
227  /* get our head ptr based on the address we want to insert */
228  head = GetHeadPtr(gh, new);
229 
230  /* see if it already exists or overlaps with existing ag's */
231  if (head != NULL) {
232  cur = NULL;
233 
234  for (cur = head; cur != NULL; cur = cur->next) {
235  r = DetectAddressCmp(new, cur);
236  BUG_ON(r == ADDRESS_ER);
237 
238  /* if so, handle that */
239  if (r == ADDRESS_EQ) {
240  /* exact overlap/match */
241  if (cur != new) {
242  DetectAddressFree(new);
243  return 0;
244  }
245 
246  return 1;
247  } else if (r == ADDRESS_GT) {
248  /* only add it now if we are bigger than the last group.
249  * Otherwise we'll handle it later. */
250  if (cur->next == NULL) {
251  /* put in the list */
252  new->prev = cur;
253  cur->next = new;
254 
255  return 1;
256  }
257  } else if (r == ADDRESS_LT) {
258  /* see if we need to insert the ag anywhere put in the list */
259  if (cur->prev != NULL)
260  cur->prev->next = new;
261  new->prev = cur->prev;
262  new->next = cur;
263  cur->prev = new;
264 
265  /* update head if required */
266  if (head == cur) {
267  head = new;
268 
269  if (SetHeadPtr(gh, head) < 0)
270  goto error;
271  }
272 
273  return 1;
274  /* alright, those were the simple cases, lets handle the more
275  * complex ones now */
276  } else if (r == ADDRESS_ES) {
277  c = NULL;
278  r = DetectAddressCut(de_ctx, cur, new, &c);
279  if (r == -1)
280  goto error;
281 
282  DetectAddressInsert(de_ctx, gh, new);
283  if (c != NULL)
284  DetectAddressInsert(de_ctx, gh, c);
285 
286  return 1;
287  } else if (r == ADDRESS_EB) {
288  c = NULL;
289  r = DetectAddressCut(de_ctx, cur, new, &c);
290  if (r == -1)
291  goto error;
292 
293  DetectAddressInsert(de_ctx, gh, new);
294  if (c != NULL)
295  DetectAddressInsert(de_ctx, gh, c);
296 
297  return 1;
298  } else if (r == ADDRESS_LE) {
299  c = NULL;
300  r = DetectAddressCut(de_ctx, cur, new, &c);
301  if (r == -1)
302  goto error;
303 
304  DetectAddressInsert(de_ctx, gh, new);
305  if (c != NULL)
306  DetectAddressInsert(de_ctx, gh, c);
307 
308  return 1;
309  } else if (r == ADDRESS_GE) {
310  c = NULL;
311  r = DetectAddressCut(de_ctx, cur,new,&c);
312  if (r == -1)
313  goto error;
314 
315  DetectAddressInsert(de_ctx, gh, new);
316  if (c != NULL)
317  DetectAddressInsert(de_ctx, gh, c);
318 
319  return 1;
320  }
321  }
322 
323  /* head is NULL, so get a group and set head to it */
324  } else {
325  head = new;
326  if (SetHeadPtr(gh, head) < 0) {
327  SCLogDebug("SetHeadPtr failed");
328  goto error;
329  }
330  }
331 
332  return 1;
333 
334 error:
335  /* XXX */
336  return -1;
337 }
338 
339 /**
340  * \brief Checks if two address group lists are equal.
341  *
342  * \param list1 Pointer to the first address group list.
343  * \param list2 Pointer to the second address group list.
344  *
345  * \retval true On success.
346  * \retval false On failure.
347  */
348 bool DetectAddressListsAreEqual(DetectAddress *list1, DetectAddress *list2)
349 {
350  DetectAddress *item = list1;
351  DetectAddress *it = list2;
352 
353  // First, compare items one by one.
354  while (item != NULL && it != NULL) {
355  if (DetectAddressCmp(item, it) != ADDRESS_EQ) {
356  return false;
357  }
358 
359  item = item->next;
360  it = it->next;
361  }
362 
363  // Are the lists of the same size?
364  return item == NULL && it == NULL;
365 }
366 
367 /**
368  * \internal
369  * \brief Parses an ipv4/ipv6 address string and updates the result into the
370  * DetectAddress instance sent as the argument.
371  *
372  * \param dd Pointer to the DetectAddress instance which should be updated with
373  * the address range details from the parsed ip string.
374  * \param str Pointer to address string that has to be parsed.
375  *
376  * \retval 0 On successfully parsing the address string.
377  * \retval -1 On failure.
378  */
379 static int DetectAddressParseString(DetectAddress *dd, const char *str)
380 {
381  char *ip = NULL;
382  char *ip2 = NULL;
383  char *mask = NULL;
384  int r = 0;
385  char ipstr[256];
386 
387  /* shouldn't see 'any' here */
388  BUG_ON(strcasecmp(str, "any") == 0);
389 
390  strlcpy(ipstr, str, sizeof(ipstr));
391  SCLogDebug("str %s", str);
392 
393  /* we work with a copy so that we can put a
394  * nul-termination in it later */
395  ip = ipstr;
396 
397  /* handle the negation case */
398  if (ip[0] == '!') {
399  dd->flags |= ADDRESS_FLAG_NOT;
400  ip++;
401  }
402 
403  /* see if the address is an ipv4 or ipv6 address */
404  if ((strchr(str, ':')) == NULL) {
405  /* IPv4 Address */
406  struct in_addr in;
407 
408  dd->ip.family = AF_INET;
409 
410  if ((mask = strchr(ip, '/')) != NULL) {
411  /* 1.2.3.4/xxx format (either dotted or cidr notation */
412  ip[mask - ip] = '\0';
413  mask++;
414  uint32_t ip4addr = 0;
415  uint32_t netmask = 0;
416 
417  if ((strchr (mask, '.')) == NULL) {
418  /* 1.2.3.4/24 format */
419 
420  for (size_t u = 0; u < strlen(mask); u++) {
421  if(!isdigit((unsigned char)mask[u]))
422  goto error;
423  }
424 
425  int cidr;
426  if (StringParseI32RangeCheck(&cidr, 10, 0, (const char *)mask, 0, 32) < 0)
427  goto error;
428  netmask = CIDRGet(cidr);
429  } else {
430  /* 1.2.3.4/255.255.255.0 format */
431  r = inet_pton(AF_INET, mask, &in);
432  if (r <= 0)
433  goto error;
434 
435  netmask = in.s_addr;
436 
437  /* validate netmask */
438  int cidr = CIDRFromMask(netmask);
439  if (cidr < 0) {
440  SCLogError(
441  "netmask \"%s\" is not usable. Only netmasks that are compatible with "
442  "CIDR notation are supported. See ticket #5168.",
443  mask);
444  goto error;
445  }
446  }
447 
448  r = inet_pton(AF_INET, ip, &in);
449  if (r <= 0)
450  goto error;
451 
452  ip4addr = in.s_addr;
453 
454  dd->ip.addr_data32[0] = dd->ip2.addr_data32[0] = ip4addr & netmask;
455  dd->ip2.addr_data32[0] |=~ netmask;
456  } else if ((ip2 = strchr(ip, '-')) != NULL) {
457  /* 1.2.3.4-1.2.3.6 range format */
458  ip[ip2 - ip] = '\0';
459  ip2++;
460 
461  r = inet_pton(AF_INET, ip, &in);
462  if (r <= 0)
463  goto error;
464  dd->ip.addr_data32[0] = in.s_addr;
465 
466  r = inet_pton(AF_INET, ip2, &in);
467  if (r <= 0)
468  goto error;
469  dd->ip2.addr_data32[0] = in.s_addr;
470 
471  /* a > b is illegal, a = b is ok */
472  if (SCNtohl(dd->ip.addr_data32[0]) > SCNtohl(dd->ip2.addr_data32[0]))
473  goto error;
474  } else {
475  /* 1.2.3.4 format */
476  r = inet_pton(AF_INET, ip, &in);
477  if (r <= 0)
478  goto error;
479  /* single host */
480  dd->ip.addr_data32[0] = in.s_addr;
481  dd->ip2.addr_data32[0] = in.s_addr;
482  }
483  } else {
484  /* IPv6 Address */
485  struct in6_addr in6, mask6;
486  uint32_t ip6addr[4], netmask[4];
487 
488  dd->ip.family = AF_INET6;
489 
490  if ((mask = strchr(ip, '/')) != NULL) {
491  ip[mask - ip] = '\0';
492  mask++;
493 
494  int cidr;
495  if (StringParseI32RangeCheck(&cidr, 10, 0, (const char *)mask, 0, 128) < 0)
496  goto error;
497 
498  r = inet_pton(AF_INET6, ip, &in6);
499  if (r <= 0)
500  goto error;
501  memcpy(&ip6addr, &in6.s6_addr, sizeof(ip6addr));
502 
503  CIDRGetIPv6(cidr, &mask6);
504  memcpy(&netmask, &mask6.s6_addr, sizeof(netmask));
505 
506  dd->ip2.addr_data32[0] = dd->ip.addr_data32[0] = ip6addr[0] & netmask[0];
507  dd->ip2.addr_data32[1] = dd->ip.addr_data32[1] = ip6addr[1] & netmask[1];
508  dd->ip2.addr_data32[2] = dd->ip.addr_data32[2] = ip6addr[2] & netmask[2];
509  dd->ip2.addr_data32[3] = dd->ip.addr_data32[3] = ip6addr[3] & netmask[3];
510 
511  dd->ip2.addr_data32[0] |=~ netmask[0];
512  dd->ip2.addr_data32[1] |=~ netmask[1];
513  dd->ip2.addr_data32[2] |=~ netmask[2];
514  dd->ip2.addr_data32[3] |=~ netmask[3];
515  } else if ((ip2 = strchr(ip, '-')) != NULL) {
516  dd->flags |= ADDRESS_FLAG_RANGE;
517  /* 2001::1-2001::4 range format */
518  ip[ip2 - ip] = '\0';
519  ip2++;
520 
521  r = inet_pton(AF_INET6, ip, &in6);
522  if (r <= 0)
523  goto error;
524  memcpy(&dd->ip.address, &in6.s6_addr, sizeof(ip6addr));
525 
526  r = inet_pton(AF_INET6, ip2, &in6);
527  if (r <= 0)
528  goto error;
529  memcpy(&dd->ip2.address, &in6.s6_addr, sizeof(ip6addr));
530 
531  /* a > b is illegal, a=b is ok */
532  if (AddressIPv6Gt(&dd->ip, &dd->ip2))
533  goto error;
534  } else {
535  r = inet_pton(AF_INET6, ip, &in6);
536  if (r <= 0)
537  goto error;
538 
539  memcpy(&dd->ip.address, &in6.s6_addr, sizeof(dd->ip.address));
540  memcpy(&dd->ip2.address, &in6.s6_addr, sizeof(dd->ip2.address));
541  }
542 
543  }
544 
545  BUG_ON(dd->ip.family == 0);
546 
547  return 0;
548 
549 error:
550  return -1;
551 }
552 
553 /**
554  * \internal
555  * \brief Simply parse an address and return a DetectAddress instance containing
556  * the address ranges of the parsed ip addressstring
557  *
558  * \param str Pointer to a character string containing the ip address
559  *
560  * \retval dd Pointer to the DetectAddress instance containing the address
561  * range details from the parsed ip string
562  */
563 static DetectAddress *DetectAddressParseSingle(const char *str)
564 {
565  SCLogDebug("str %s", str);
566 
567  DetectAddress *dd = DetectAddressInit();
568  if (dd == NULL)
569  return NULL;
570 
571  if (DetectAddressParseString(dd, str) < 0) {
572  SCLogDebug("AddressParse failed");
573  DetectAddressFree(dd);
574  return NULL;
575  }
576 
577  return dd;
578 }
579 
580 /**
581  * \brief Setup a single address string, parse it and add the resulting
582  * Address-Range(s) to the AddressHead(DetectAddressHead instance).
583  *
584  * \param gh Pointer to the Address-Head(DetectAddressHead) to which the
585  * resulting Address-Range(s) from the parsed ip string has to
586  * be added.
587  * \param s Pointer to the ip address string to be parsed.
588  *
589  * \retval 0 On success.
590  * \retval -1 On failure.
591  */
592 static int DetectAddressSetup(DetectAddressHead *gh, const char *s)
593 {
594  SCLogDebug("gh %p, s %s", gh, s);
595 
596  while (*s != '\0' && isspace(*s))
597  s++;
598 
599  if (strcasecmp(s, "any") == 0) {
600  SCLogDebug("adding 0.0.0.0/0 and ::/0 as we\'re handling \'any\'");
601 
602  DetectAddress *ad = DetectAddressParseSingle("0.0.0.0/0");
603  if (ad == NULL)
604  return -1;
605 
606  BUG_ON(ad->ip.family == 0);
607 
608  if (DetectAddressInsert(NULL, gh, ad) < 0) {
609  SCLogDebug("DetectAddressInsert failed");
610  DetectAddressFree(ad);
611  return -1;
612  }
613 
614  ad = DetectAddressParseSingle("::/0");
615  if (ad == NULL)
616  return -1;
617 
618  BUG_ON(ad->ip.family == 0);
619 
620  if (DetectAddressInsert(NULL, gh, ad) < 0) {
621  SCLogDebug("DetectAddressInsert failed");
622  DetectAddressFree(ad);
623  return -1;
624  }
625  return 0;
626  }
627 
628  /* parse the address */
629  DetectAddress *ad = DetectAddressParseSingle(s);
630  if (ad == NULL) {
631  SCLogError("failed to parse address \"%s\"", s);
632  return -1;
633  }
634 
635  /* handle the not case, we apply the negation then insert the part(s) */
636  if (ad->flags & ADDRESS_FLAG_NOT) {
637  DetectAddress *ad2 = NULL;
638 
639  if (DetectAddressCutNot(ad, &ad2) < 0) {
640  SCLogDebug("DetectAddressCutNot failed");
641  DetectAddressFree(ad);
642  return -1;
643  }
644 
645  /* normally a 'not' will result in two ad's unless the 'not' is on the start or end
646  * of the address space (e.g. 0.0.0.0 or 255.255.255.255). */
647  if (ad2 != NULL) {
648  if (DetectAddressInsert(NULL, gh, ad2) < 0) {
649  SCLogDebug("DetectAddressInsert failed");
650  DetectAddressFree(ad);
651  DetectAddressFree(ad2);
652  return -1;
653  }
654  }
655  }
656  if (ad->flags & ADDRESS_FLAG_RANGE) {
657  gh->contains_range = true;
658  }
659 
660  int r = DetectAddressInsert(NULL, gh, ad);
661  if (r < 0) {
662  SCLogDebug("DetectAddressInsert failed");
663  DetectAddressFree(ad);
664  return -1;
665  }
666  SCLogDebug("r %d",r);
667  return 0;
668 }
669 
670 /**
671  * \brief Parses an address string and updates the 2 address heads with the
672  * address data.
673  *
674  * Note that this function should only be called by the wrapping function
675  * DetectAddressParse2. The wrapping function provides long address handling
676  * when the address size exceeds a threshold value.
677  *
678  * \todo We don't seem to be handling negated cases, like [addr,![!addr,addr]],
679  * since we pass around negate without keeping a count of ! with depth.
680  * Can solve this by keeping a count of the negations with depth, so that
681  * an even no of negations would count as no negation and an odd no of
682  * negations would count as a negation.
683  *
684  * \param gh Pointer to the address head that should hold address ranges
685  * that are not negated.
686  * \param ghn Pointer to the address head that should hold address ranges
687  * that are negated.
688  * \param s Pointer to the character string holding the address to be
689  * parsed.
690  * \param negate Flag that indicates if the received address string is negated
691  * or not. 0 if it is not, 1 it it is.
692  *
693  * \retval 0 On successfully parsing.
694  * \retval -1 On failure.
695  */
696 static int DetectAddressParseInternal(const DetectEngineCtx *de_ctx, DetectAddressHead *gh,
697  DetectAddressHead *ghn, const char *s, int negate, ResolvedVariablesList *var_list,
698  int recur, char *address, size_t address_length)
699 {
700  size_t x = 0;
701  size_t u = 0;
702  int o_set = 0, n_set = 0, d_set = 0;
703  int depth = 0;
704  const char *rule_var_address = NULL;
705  char *temp_rule_var_address = NULL;
706 
707  if (++recur > 64) {
708  SCLogError("address block recursion "
709  "limit reached (max 64)");
710  goto error;
711  }
712 
713  SCLogDebug("s %s negate %s", s, negate ? "true" : "false");
714 
715  size_t size = strlen(s);
716  for (u = 0, x = 0; u < size && x < address_length; u++) {
717  if (x == (address_length - 1)) {
718  SCLogError("Hit the address buffer"
719  " limit for the supplied address. Invalidating sig. "
720  "Please file a bug report on this.");
721  goto error;
722  }
723  address[x] = s[u];
724  x++;
725 
726  if (!o_set && s[u] == '!') {
727  n_set = 1;
728  x--;
729  } else if (s[u] == '[') {
730  if (!o_set) {
731  o_set = 1;
732  x = 0;
733  }
734  depth++;
735  } else if (s[u] == ']') {
736  if (depth == 1) {
737  address[x - 1] = '\0';
738  x = 0;
739  SCLogDebug("address %s negate %d, n_set %d", address, negate, n_set);
740  if (((negate + n_set) % 2) == 0) {
741  /* normal block */
742  SCLogDebug("normal block");
743 
744  if (DetectAddressParse2(de_ctx, gh, ghn, address, (negate + n_set) % 2, var_list, recur) < 0)
745  goto error;
746  } else {
747  /* negated block
748  *
749  * Extra steps are necessary. First consider it as a normal
750  * (non-negated) range. Merge the + and - ranges if
751  * applicable. Then insert the result into the ghn list. */
752  SCLogDebug("negated block");
753 
754  DetectAddressHead tmp_gh = { NULL, NULL, false };
755  DetectAddressHead tmp_ghn = { NULL, NULL, false };
756 
757  if (DetectAddressParse2(de_ctx, &tmp_gh, &tmp_ghn, address, 0, var_list, recur) < 0) {
758  DetectAddressHeadCleanup(&tmp_gh);
759  DetectAddressHeadCleanup(&tmp_ghn);
760  goto error;
761  }
762 
763  DetectAddress *tmp_ad;
764  DetectAddress *tmp_ad2;
765 #ifdef DEBUG
766  SCLogDebug("tmp_gh: IPv4");
767  for (tmp_ad = tmp_gh.ipv4_head; tmp_ad; tmp_ad = tmp_ad->next) {
768  DetectAddressPrint(tmp_ad);
769  }
770  SCLogDebug("tmp_ghn: IPv4");
771  for (tmp_ad = tmp_ghn.ipv4_head; tmp_ad; tmp_ad = tmp_ad->next) {
772  DetectAddressPrint(tmp_ad);
773  }
774  SCLogDebug("tmp_gh: IPv6");
775  for (tmp_ad = tmp_gh.ipv6_head; tmp_ad; tmp_ad = tmp_ad->next) {
776  DetectAddressPrint(tmp_ad);
777  }
778  SCLogDebug("tmp_ghn: IPv6");
779  for (tmp_ad = tmp_ghn.ipv6_head; tmp_ad; tmp_ad = tmp_ad->next) {
780  DetectAddressPrint(tmp_ad);
781  }
782 #endif
783  if (DetectAddressMergeNot(&tmp_gh, &tmp_ghn) < 0) {
784  DetectAddressHeadCleanup(&tmp_ghn);
785  DetectAddressHeadCleanup(&tmp_gh);
786  goto error;
787  }
788  DetectAddressHeadCleanup(&tmp_ghn);
789 
790  SCLogDebug("merged successfully");
791 
792  /* insert the IPv4 addresses into the negated list */
793  for (tmp_ad = tmp_gh.ipv4_head; tmp_ad; tmp_ad = tmp_ad->next) {
794  /* work with a copy of the address group */
795  tmp_ad2 = DetectAddressCopy(tmp_ad);
796  if (tmp_ad2 == NULL) {
797  SCLogDebug("DetectAddressCopy failed");
798  DetectAddressHeadCleanup(&tmp_gh);
799  goto error;
800  }
801  DetectAddressPrint(tmp_ad2);
802  DetectAddressInsert(NULL, ghn, tmp_ad2);
803  }
804 
805  /* insert the IPv6 addresses into the negated list */
806  for (tmp_ad = tmp_gh.ipv6_head; tmp_ad; tmp_ad = tmp_ad->next) {
807  /* work with a copy of the address group */
808  tmp_ad2 = DetectAddressCopy(tmp_ad);
809  if (tmp_ad2 == NULL) {
810  SCLogDebug("DetectAddressCopy failed");
811  DetectAddressHeadCleanup(&tmp_gh);
812  goto error;
813  }
814  DetectAddressPrint(tmp_ad2);
815  DetectAddressInsert(NULL, ghn, tmp_ad2);
816  }
817 
818  DetectAddressHeadCleanup(&tmp_gh);
819  }
820  n_set = 0;
821  }
822  depth--;
823  } else if (depth == 0 && s[u] == ',') {
824  if (o_set == 1) {
825  o_set = 0;
826  } else if (d_set == 1) {
827  address[x - 1] = '\0';
828 
829  rule_var_address = SCRuleVarsGetConfVar(de_ctx, address,
830  SC_RULE_VARS_ADDRESS_GROUPS);
831  if (rule_var_address == NULL)
832  goto error;
833 
834  if (strlen(rule_var_address) == 0) {
835  SCLogError("variable %s resolved "
836  "to nothing. This is likely a misconfiguration. "
837  "Note that a negated address needs to be quoted, "
838  "\"!$HOME_NET\" instead of !$HOME_NET. See issue #295.",
839  s);
840  goto error;
841  }
842 
843  SCLogDebug("rule_var_address %s", rule_var_address);
844  if ((negate + n_set) % 2) {
845  /* add +1 to safisfy gcc 15 + -Wformat-truncation=2 */
846  const size_t str_size = strlen(rule_var_address) + 3 + 1;
847  temp_rule_var_address = SCMalloc(str_size);
848  if (unlikely(temp_rule_var_address == NULL))
849  goto error;
850  snprintf(temp_rule_var_address, str_size, "[%s]", rule_var_address);
851  } else {
852  temp_rule_var_address = SCStrdup(rule_var_address);
853  if (unlikely(temp_rule_var_address == NULL))
854  goto error;
855  }
856 
857  if (DetectAddressParse2(de_ctx, gh, ghn, temp_rule_var_address,
858  (negate + n_set) % 2, var_list, recur) < 0) {
859  if (temp_rule_var_address != rule_var_address)
860  SCFree(temp_rule_var_address);
861  goto error;
862  }
863  d_set = 0;
864  n_set = 0;
865  SCFree(temp_rule_var_address);
866  } else {
867  address[x - 1] = '\0';
868 
869  if (!((negate + n_set) % 2)) {
870  SCLogDebug("DetectAddressSetup into gh, %s", address);
871  if (DetectAddressSetup(gh, address) < 0)
872  goto error;
873  } else {
874  SCLogDebug("DetectAddressSetup into ghn, %s", address);
875  if (DetectAddressSetup(ghn, address) < 0)
876  goto error;
877  }
878  n_set = 0;
879  }
880  x = 0;
881  } else if (depth == 0 && s[u] == '$') {
882  d_set = 1;
883  } else if (depth == 0 && u == size - 1) {
884  if (x == address_length) {
885  address[x - 1] = '\0';
886  } else {
887  address[x] = '\0';
888  }
889  x = 0;
890 
891  if (AddVariableToResolveList(var_list, address) == -1) {
892  SCLogError("Found a loop in a address "
893  "groups declaration. This is likely a misconfiguration.");
894  goto error;
895  }
896 
897  if (d_set == 1) {
898  rule_var_address = SCRuleVarsGetConfVar(de_ctx, address,
899  SC_RULE_VARS_ADDRESS_GROUPS);
900  if (rule_var_address == NULL)
901  goto error;
902 
903  if (strlen(rule_var_address) == 0) {
904  SCLogError("variable %s resolved "
905  "to nothing. This is likely a misconfiguration. "
906  "Note that a negated address needs to be quoted, "
907  "\"!$HOME_NET\" instead of !$HOME_NET. See issue #295.",
908  s);
909  goto error;
910  }
911 
912  SCLogDebug("rule_var_address %s", rule_var_address);
913  if ((negate + n_set) % 2) {
914  /* add +1 to safisfy gcc 15 + -Wformat-truncation=2 */
915  const size_t str_size = strlen(rule_var_address) + 3 + 1;
916  temp_rule_var_address = SCMalloc(str_size);
917  if (unlikely(temp_rule_var_address == NULL))
918  goto error;
919  snprintf(temp_rule_var_address, str_size, "[%s]", rule_var_address);
920  } else {
921  temp_rule_var_address = SCStrdup(rule_var_address);
922  if (unlikely(temp_rule_var_address == NULL))
923  goto error;
924  }
925 
926  if (DetectAddressParse2(de_ctx, gh, ghn, temp_rule_var_address,
927  (negate + n_set) % 2, var_list, recur) < 0) {
928  SCLogDebug("DetectAddressParse2 hates us");
929  if (temp_rule_var_address != rule_var_address)
930  SCFree(temp_rule_var_address);
931  goto error;
932  }
933  d_set = 0;
934  SCFree(temp_rule_var_address);
935  } else {
936  if (!((negate + n_set) % 2)) {
937  SCLogDebug("DetectAddressSetup into gh, %s", address);
938  if (DetectAddressSetup(gh, address) < 0) {
939  SCLogDebug("DetectAddressSetup gh fail");
940  goto error;
941  }
942  } else {
943  SCLogDebug("DetectAddressSetup into ghn, %s", address);
944  if (DetectAddressSetup(ghn, address) < 0) {
945  SCLogDebug("DetectAddressSetup ghn fail");
946  goto error;
947  }
948  }
949  }
950  n_set = 0;
951  }
952  }
953  if (depth > 0) {
954  SCLogError("not every address block was "
955  "properly closed in \"%s\", %d missing closing brackets (]). "
956  "Note: problem might be in a variable.",
957  s, depth);
958  goto error;
959  } else if (depth < 0) {
960  SCLogError("not every address block was "
961  "properly opened in \"%s\", %d missing opening brackets ([). "
962  "Note: problem might be in a variable.",
963  s, depth * -1);
964  goto error;
965  }
966 
967  return 0;
968 
969 error:
970 
971  return -1;
972 }
973 
974 /**
975  * \internal
976  * \brief Wrapper function for address parsing to minimize heap allocs during address parsing.
977  *
978  * \retval Return value from DetectAddressParseInternal
979  */
980 static int DetectAddressParse2(const DetectEngineCtx *de_ctx, DetectAddressHead *gh,
981  DetectAddressHead *ghn, const char *s, int negate, ResolvedVariablesList *var_list,
982  int recur)
983 {
984  int rc;
985 #define MAX_ADDRESS_LENGTH 8192
986 
987  size_t address_length = strlen(s);
988  if (address_length > (MAX_ADDRESS_LENGTH - 1)) {
989  char *address = SCCalloc(1, address_length);
990  if (address == NULL) {
991  SCLogError("Unable to allocate"
992  " memory for address parsing.");
993  return -1;
994  }
995  rc = DetectAddressParseInternal(
996  de_ctx, gh, ghn, s, negate, var_list, recur, address, address_length);
997  SCFree(address);
998  } else {
999  char address[MAX_ADDRESS_LENGTH] = "";
1000  rc = DetectAddressParseInternal(
1001  de_ctx, gh, ghn, s, negate, var_list, recur, address, MAX_ADDRESS_LENGTH);
1002  }
1003  return rc;
1004 }
1005 
1006 /**
1007  * \internal
1008  * \brief See if the addresses and ranges in an address head cover the
1009  * entire ip space.
1010  *
1011  * \param gh Pointer to the DetectAddressHead to check.
1012  *
1013  * \retval 0 No.
1014  * \retval 1 Yes.
1015  *
1016  * \todo do the same for IPv6
1017  */
1018 static int DetectAddressIsCompleteIPSpace(DetectAddressHead *gh)
1019 {
1020  int r = DetectAddressIsCompleteIPSpaceIPv4(gh->ipv4_head);
1021  if (r == 1)
1022  return 1;
1023 
1024  return 0;
1025 }
1026 
1027 /**
1028  * \brief Merge the + and the - list (+ positive match, - 'not' match)
1029  *
1030  * \param gh Pointer to the address head containing the non-NOT groups.
1031  * \param ghn Pointer to the address head containing the NOT groups.
1032  *
1033  * \retval 0 On success.
1034  * \retval -1 On failure.
1035  */
1036 int DetectAddressMergeNot(DetectAddressHead *gh, DetectAddressHead *ghn)
1037 {
1038  DetectAddress *ad;
1039  DetectAddress *ag, *ag2;
1040  int r = 0;
1041 
1042  SCLogDebug("gh->ipv4_head %p, ghn->ipv4_head %p", gh->ipv4_head,
1043  ghn->ipv4_head);
1044 
1045  /* check if the negated list covers the entire ip space. If so
1046  * the user screwed up the rules/vars. */
1047  if (DetectAddressIsCompleteIPSpace(ghn) == 1) {
1048  SCLogError("Complete IP space negated. "
1049  "Rule address range is NIL. Probably have a !any or "
1050  "an address range that supplies a NULL address range");
1051  goto error;
1052  }
1053 
1054  /* step 0: if the gh list is empty, but the ghn list isn't we have a pure
1055  * not thingy. In that case we add a 0.0.0.0/0 first. */
1056  if (gh->ipv4_head == NULL && ghn->ipv4_head != NULL) {
1057  r = DetectAddressSetup(gh, "0.0.0.0/0");
1058  if (r < 0) {
1059  SCLogDebug("DetectAddressSetup for 0.0.0.0/0 failed");
1060  goto error;
1061  }
1062  }
1063  /* ... or ::/0 for ipv6 */
1064  if (gh->ipv6_head == NULL && ghn->ipv6_head != NULL) {
1065  r = DetectAddressSetup(gh, "::/0");
1066  if (r < 0) {
1067  SCLogDebug("DetectAddressSetup for ::/0 failed");
1068  goto error;
1069  }
1070  }
1071 
1072  /* step 1: insert our ghn members into the gh list */
1073  for (ag = ghn->ipv4_head; ag != NULL; ag = ag->next) {
1074  /* work with a copy of the ad so we can easily clean up the ghn group
1075  * later. */
1076  ad = DetectAddressCopy(ag);
1077  if (ad == NULL) {
1078  SCLogDebug("DetectAddressCopy failed");
1079  goto error;
1080  }
1081 
1082  r = DetectAddressInsert(NULL, gh, ad);
1083  if (r < 0) {
1084  SCLogDebug("DetectAddressInsert failed");
1085  goto error;
1086  }
1087  }
1088  /* ... and the same for ipv6 */
1089  for (ag = ghn->ipv6_head; ag != NULL; ag = ag->next) {
1090  /* work with a copy of the ad so we can easily clean up the ghn group
1091  * later. */
1092  ad = DetectAddressCopy(ag);
1093  if (ad == NULL) {
1094  SCLogDebug("DetectAddressCopy failed");
1095  goto error;
1096  }
1097 
1098  r = DetectAddressInsert(NULL, gh, ad);
1099  if (r < 0) {
1100  SCLogDebug("DetectAddressInsert failed");
1101  goto error;
1102  }
1103  }
1104 #ifdef DEBUG
1105  DetectAddress *tmp_ad;
1106  for (tmp_ad = gh->ipv6_head; tmp_ad; tmp_ad = tmp_ad->next) {
1107  DetectAddressPrint(tmp_ad);
1108  }
1109 #endif
1110  int ipv4_applied = 0;
1111  int ipv6_applied = 0;
1112 
1113  /* step 2: pull the address blocks that match our 'not' blocks */
1114  for (ag = ghn->ipv4_head; ag != NULL; ag = ag->next) {
1115  SCLogDebug("ag %p", ag);
1116  DetectAddressPrint(ag);
1117 
1118  int applied = 0;
1119  for (ag2 = gh->ipv4_head; ag2 != NULL; ) {
1120  SCLogDebug("ag2 %p", ag2);
1121  DetectAddressPrint(ag2);
1122 
1123  r = DetectAddressCmp(ag, ag2);
1124  /* XXX more ??? */
1125  if (r == ADDRESS_EQ || r == ADDRESS_EB) {
1126  if (ag2->prev != NULL)
1127  ag2->prev->next = ag2->next;
1128  if (ag2->next != NULL)
1129  ag2->next->prev = ag2->prev;
1130  if (gh->ipv4_head == ag2)
1131  gh->ipv4_head = ag2->next;
1132  /* store the next ptr and remove the group */
1133  DetectAddress *next_ag2 = ag2->next;
1134  DetectAddressFree(ag2);
1135  ag2 = next_ag2;
1136  applied = 1;
1137  } else {
1138  ag2 = ag2->next;
1139  }
1140  }
1141 
1142  if (applied) {
1143  ipv4_applied++;
1144  }
1145  }
1146  /* ... and the same for ipv6 */
1147  for (ag = ghn->ipv6_head; ag != NULL; ag = ag->next) {
1148  int applied = 0;
1149  for (ag2 = gh->ipv6_head; ag2 != NULL; ) {
1150  r = DetectAddressCmp(ag, ag2);
1151  if (r == ADDRESS_EQ || r == ADDRESS_EB) { /* XXX more ??? */
1152  if (ag2->prev != NULL)
1153  ag2->prev->next = ag2->next;
1154  if (ag2->next != NULL)
1155  ag2->next->prev = ag2->prev;
1156  if (gh->ipv6_head == ag2)
1157  gh->ipv6_head = ag2->next;
1158  /* store the next ptr and remove the group */
1159  DetectAddress *next_ag2 = ag2->next;
1160  DetectAddressFree(ag2);
1161  ag2 = next_ag2;
1162 
1163  SCLogDebug("applied");
1164  applied = 1;
1165  } else {
1166  ag2 = ag2->next;
1167  }
1168  }
1169  if (applied) {
1170  ipv6_applied++;
1171  }
1172  }
1173 #ifdef DEBUG
1174  for (tmp_ad = gh->ipv6_head; tmp_ad; tmp_ad = tmp_ad->next) {
1175  DetectAddressPrint(tmp_ad);
1176  }
1177  for (tmp_ad = ghn->ipv6_head; tmp_ad; tmp_ad = tmp_ad->next) {
1178  DetectAddressPrint(tmp_ad);
1179  }
1180 #endif
1181  if (ghn->ipv4_head != NULL || ghn->ipv6_head != NULL) {
1182  int cnt = 0;
1183  for (ad = ghn->ipv4_head; ad; ad = ad->next)
1184  cnt++;
1185 
1186  if (ipv4_applied != cnt) {
1187  SCLogError("not all IPv4 negations "
1188  "could be applied: %d != %d",
1189  cnt, ipv4_applied);
1190  goto error;
1191  }
1192 
1193  cnt = 0;
1194  for (ad = ghn->ipv6_head; ad; ad = ad->next)
1195  cnt++;
1196 
1197  if (ipv6_applied != cnt) {
1198  SCLogError("not all IPv6 negations "
1199  "could be applied: %d != %d",
1200  cnt, ipv6_applied);
1201  goto error;
1202  }
1203  }
1204 
1205  /* if the result is that we have no addresses we return error */
1206  if (gh->ipv4_head == NULL && gh->ipv6_head == NULL) {
1207  SCLogError("no addresses left after "
1208  "merging addresses and negated addresses");
1209  goto error;
1210  }
1211 
1212  return 0;
1213 
1214 error:
1215  return -1;
1216 }
1217 
1218 int DetectAddressTestConfVars(void)
1219 {
1220  SCLogDebug("Testing address conf vars for any misconfigured values");
1221 
1222  ResolvedVariablesList var_list;
1223  TAILQ_INIT(&var_list);
1224 
1225  SCConfNode *address_vars_node = SCConfGetNode("vars.address-groups");
1226  if (address_vars_node == NULL) {
1227  return 0;
1228  }
1229 
1230  DetectAddressHead *gh = NULL;
1231  DetectAddressHead *ghn = NULL;
1232 
1233  SCConfNode *seq_node;
1234  TAILQ_FOREACH(seq_node, &address_vars_node->head, next) {
1235  SCLogDebug("Testing %s - %s", seq_node->name, seq_node->val);
1236 
1237  gh = DetectAddressHeadInit();
1238  if (gh == NULL) {
1239  goto error;
1240  }
1241  ghn = DetectAddressHeadInit();
1242  if (ghn == NULL) {
1243  goto error;
1244  }
1245 
1246  if (seq_node->val == NULL) {
1247  SCLogError("Address var \"%s\" probably has a sequence(something "
1248  "in brackets) value set without any quotes. Please "
1249  "quote it using \"..\".",
1250  seq_node->name);
1251  goto error;
1252  }
1253 
1254  int r = DetectAddressParse2(
1255  NULL, gh, ghn, seq_node->val, /* start with negate no */ 0, &var_list, 0);
1256 
1257  CleanVariableResolveList(&var_list);
1258 
1259  if (r < 0) {
1260  SCLogError("failed to parse address var \"%s\" with value \"%s\". "
1261  "Please check its syntax",
1262  seq_node->name, seq_node->val);
1263  goto error;
1264  }
1265 
1266  if (DetectAddressIsCompleteIPSpace(ghn)) {
1267  SCLogError("address var - \"%s\" has the complete IP space negated "
1268  "with its value \"%s\". Rule address range is NIL. "
1269  "Probably have a !any or an address range that supplies "
1270  "a NULL address range",
1271  seq_node->name, seq_node->val);
1272  goto error;
1273  }
1274 
1275  DetectAddressHeadFree(gh);
1276  DetectAddressHeadFree(ghn);
1277  ghn = NULL;
1278  }
1279 
1280  return 0;
1281  error:
1282  if (gh != NULL)
1283  DetectAddressHeadFree(gh);
1284  if (ghn != NULL)
1285  DetectAddressHeadFree(ghn);
1286  return -1;
1287 }
1288 
1289 #include "util-hash-lookup3.h"
1290 
1291 typedef struct DetectAddressMap_ {
1292  char *string;
1293  DetectAddressHead *address;
1294  bool contains_negation;
1295  bool contains_range;
1296 } DetectAddressMap;
1297 
1298 static uint32_t DetectAddressMapHashFunc(HashListTable *ht, void *data, uint16_t datalen)
1299 {
1300  const DetectAddressMap *map = (DetectAddressMap *)data;
1301  uint32_t hash = 0;
1302 
1303  hash = hashlittle_safe(map->string, strlen(map->string), 0);
1304  hash %= ht->array_size;
1305 
1306  return hash;
1307 }
1308 
1309 static char DetectAddressMapCompareFunc(void *data1, uint16_t len1, void *data2,
1310  uint16_t len2)
1311 {
1312  DetectAddressMap *map1 = (DetectAddressMap *)data1;
1313  DetectAddressMap *map2 = (DetectAddressMap *)data2;
1314 
1315  char r = (strcmp(map1->string, map2->string) == 0);
1316  return r;
1317 }
1318 
1319 static void DetectAddressMapFreeFunc(void *data)
1320 {
1321  DetectAddressMap *map = (DetectAddressMap *)data;
1322  if (map != NULL) {
1323  DetectAddressHeadFree(map->address);
1324  SCFree(map->string);
1325  }
1326  SCFree(map);
1327 }
1328 
1329 int DetectAddressMapInit(DetectEngineCtx *de_ctx)
1330 {
1331  de_ctx->address_table = HashListTableInit(4096, DetectAddressMapHashFunc,
1332  DetectAddressMapCompareFunc,
1333  DetectAddressMapFreeFunc);
1334  if (de_ctx->address_table == NULL)
1335  return -1;
1336 
1337  return 0;
1338 }
1339 
1340 void DetectAddressMapFree(DetectEngineCtx *de_ctx)
1341 {
1342  if (de_ctx->address_table == NULL)
1343  return;
1344 
1345  HashListTableFree(de_ctx->address_table);
1346  de_ctx->address_table = NULL;
1347 }
1348 
1349 static bool DetectAddressMapAdd(DetectEngineCtx *de_ctx, const char *string,
1350  DetectAddressHead *address, bool contains_negation, bool contains_range)
1351 {
1352  DetectAddressMap *map = SCCalloc(1, sizeof(*map));
1353  if (map == NULL)
1354  return false;
1355 
1356  map->string = SCStrdup(string);
1357  if (map->string == NULL) {
1358  SCFree(map);
1359  return false;
1360  }
1361  map->address = address;
1362  map->contains_negation = contains_negation;
1363  map->contains_range = contains_range;
1364 
1365  if (HashListTableAdd(de_ctx->address_table, map, 0) != 0) {
1366  SCFree(map->string);
1367  SCFree(map);
1368  return false;
1369  }
1370 
1371  return true;
1372 }
1373 
1374 static const DetectAddressMap *DetectAddressMapLookup(DetectEngineCtx *de_ctx,
1375  const char *string)
1376 {
1377  DetectAddressMap map = { (char *)string, NULL, false, false };
1378 
1379  const DetectAddressMap *res = HashListTableLookup(de_ctx->address_table,
1380  &map, 0);
1381  return res;
1382 }
1383 
1384 /**
1385  * \brief Parses an address group sent as a character string and updates the
1386  * DetectAddressHead sent as the argument with the relevant address
1387  * ranges from the parsed string.
1388  *
1389  * \param de_ctx Pointer to the detection engine context
1390  * \param gh Pointer to the DetectAddressHead.
1391  * \param str Pointer to the character string containing the address group
1392  * that has to be parsed.
1393  *
1394  * \retval 1 On success. Contained negation.
1395  * \retval 0 On success. Did not contain negation.
1396  * \retval -1 On failure.
1397  */
1398 int DetectAddressParse(
1399  const DetectEngineCtx *de_ctx, DetectAddressHead *gh, const char *str, bool *contains_range)
1400 {
1401  SCLogDebug("gh %p, str %s", gh, str);
1402 
1403  if (str == NULL) {
1404  SCLogDebug("DetectAddressParse can not be run with NULL address");
1405  return -1;
1406  }
1407 
1408  DetectAddressHead *ghn = DetectAddressHeadInit();
1409  if (ghn == NULL) {
1410  SCLogDebug("DetectAddressHeadInit for ghn failed");
1411  return -1;
1412  }
1413 
1414  int r = DetectAddressParse2(de_ctx, gh, ghn, str, /* start with negate no */ 0, NULL, 0);
1415  if (r < 0) {
1416  SCLogDebug("DetectAddressParse2 returned %d", r);
1417  DetectAddressHeadFree(ghn);
1418  return -1;
1419  }
1420 
1421  SCLogDebug("gh->ipv4_head %p, ghn->ipv4_head %p", gh->ipv4_head,
1422  ghn->ipv4_head);
1423 
1424  bool contains_negation = (ghn->ipv4_head != NULL || ghn->ipv6_head != NULL);
1425  if (contains_range != NULL) {
1426  *contains_range = (gh->contains_range == true || ghn->contains_range == true);
1427  }
1428 
1429  /* merge the 'not' address groups */
1430  if (DetectAddressMergeNot(gh, ghn) < 0) {
1431  SCLogDebug("DetectAddressMergeNot failed");
1432  DetectAddressHeadFree(ghn);
1433  return -1;
1434  }
1435 
1436  /* free the temp negate head */
1437  DetectAddressHeadFree(ghn);
1438  return contains_negation ? 1 : 0;
1439 }
1440 
1441 const DetectAddressHead *DetectParseAddress(
1442  DetectEngineCtx *de_ctx, const char *string, bool *contains_negation, bool *contains_range)
1443 {
1444  DEBUG_VALIDATE_BUG_ON(contains_range == NULL);
1445  if (contains_range == NULL) {
1446  SCLogError("contain_range should not be NULL");
1447  return NULL;
1448  }
1449 
1450  const DetectAddressMap *res = DetectAddressMapLookup(de_ctx, string);
1451  if (res != NULL) {
1452  SCLogDebug("found: %s :: %p", string, res);
1453  *contains_negation = res->contains_negation;
1454  *contains_range = res->contains_range;
1455  return res->address;
1456  }
1457 
1458  SCLogDebug("%s not found", string);
1459 
1460  DetectAddressHead *head = DetectAddressHeadInit();
1461  if (head == NULL)
1462  return NULL;
1463 
1464  const int r = DetectAddressParse(de_ctx, head, string, contains_range);
1465  if (r < 0) {
1466  DetectAddressHeadFree(head);
1467  return NULL;
1468  } else if (r == 1) {
1469  *contains_negation = true;
1470  } else {
1471  *contains_negation = false;
1472  }
1473 
1474  if (!DetectAddressMapAdd(
1475  (DetectEngineCtx *)de_ctx, string, head, *contains_negation, *contains_range)) {
1476  DetectAddressHeadFree(head);
1477  return NULL;
1478  }
1479 
1480  return head;
1481 }
1482 
1483 /**
1484  * \brief Cleans a DetectAddressHead. The functions frees the address
1485  * group heads(ipv4 and ipv6) inside the DetectAddressHead
1486  * instance.
1487  *
1488  * \param gh Pointer to the DetectAddressHead instance that has to be
1489  * cleaned.
1490  */
1491 void DetectAddressHeadCleanup(DetectAddressHead *gh)
1492 {
1493  if (gh != NULL) {
1494  if (gh->ipv4_head != NULL) {
1495  DetectAddressCleanupList(gh->ipv4_head);
1496  gh->ipv4_head = NULL;
1497  }
1498  if (gh->ipv6_head != NULL) {
1499  DetectAddressCleanupList(gh->ipv6_head);
1500  gh->ipv6_head = NULL;
1501  }
1502  }
1503 }
1504 
1505 /**
1506  * \brief Dispatcher function that calls the ipv4 and ipv6 address cut functions.
1507  * Have a look at DetectAddressCutIPv4() and DetectAddressCutIPv6() for
1508  * explanations on what these functions do.
1509  *
1510  * \param de_ctx Pointer to the DetectEngineCtx.
1511  * \param a Pointer to the first address to be cut.
1512  * \param b Pointer to the second address to be cut.
1513  * \param c Pointer to a pointer to a third DetectAddressData, in case the
1514  * ranges from a and b, demand a third address range.
1515  *
1516  * \retval 0 On success.
1517  * \retval -1 On failure.
1518  */
1519 int DetectAddressCut(DetectEngineCtx *de_ctx, DetectAddress *a,
1520  DetectAddress *b, DetectAddress **c)
1521 {
1522  if (a->ip.family == AF_INET)
1523  return DetectAddressCutIPv4(de_ctx, a, b, c);
1524  else if (a->ip.family == AF_INET6)
1525  return DetectAddressCutIPv6(de_ctx, a, b, c);
1526 
1527  return -1;
1528 }
1529 
1530 /**
1531  * \brief Cuts a negated address range with respect to the entire ip range, and
1532  * supplies with the address range that doesn't belong to the negated
1533  * address range.
1534  *
1535  * There are 2 cases here -
1536  *
1537  * The first case includes the address being located at the extreme ends
1538  * of the ip space, in which we get a single range.
1539  * For example: !0.0.0.0, in which case we get 0.0.0.1 to 255.255.255.255.
1540  *
1541  * The second case includes the address not present at either of the
1542  * ip space extremes, in which case we get 2 ranges. The second range
1543  * would be supplied back with the argument "b" supplied to this function.
1544  * For example: !10.20.30.40, in which case we the 2 ranges, 0.0.0.0 -
1545  * 10.20.30.39 and 10.20.30.41 - 255.255.255.255.
1546  *
1547  * The above negation cases can similarly be extended to ranges, i.e.
1548  * ![0.0.0.0 - 10.20.30.40], ![255.255.240.240 - 255.255.255.255] and
1549  * ![10.20.30.40 - 10.20.30.50].
1550  *
1551  *
1552  * \param a Pointer to the DetectAddressData instance, that contains the negated
1553  * address range that has to be cut.
1554  * \param b Pointer to a pointer to a DetectAddressData instance, that should be
1555  * filled with the address range, if the argument "a", doesn't fall at
1556  * the extreme ends of the ip address space.
1557  *
1558  * \retval 0 On success.
1559  * \retval -1 On failure.
1560  */
1561 int DetectAddressCutNot(DetectAddress *a, DetectAddress **b)
1562 {
1563  if (a->ip.family == AF_INET)
1564  return DetectAddressCutNotIPv4(a, b);
1565  else if (a->ip.family == AF_INET6)
1566  return DetectAddressCutNotIPv6(a, b);
1567 
1568  return -1;
1569 }
1570 
1571 /**
1572  * \brief Used to compare 2 address ranges.
1573  *
1574  * \param a Pointer to the first DetectAddressData to be compared.
1575  * \param b Pointer to the second DetectAddressData to be compared.
1576  */
1577 int DetectAddressCmp(DetectAddress *a, DetectAddress *b)
1578 {
1579  if (a->ip.family != b->ip.family)
1580  return ADDRESS_ER;
1581 
1582  if (a->ip.family == AF_INET)
1583  return DetectAddressCmpIPv4(a, b);
1584  else if (a->ip.family == AF_INET6)
1585  return DetectAddressCmpIPv6(a, b);
1586 
1587  return ADDRESS_ER;
1588 }
1589 
1590 /**
1591  * \brief Match a packets address against a signatures addrs array
1592  *
1593  * \param addrs array of DetectMatchAddressIPv4's
1594  * \param addrs_cnt array size in members
1595  * \param a packets address
1596  *
1597  * \retval 0 no match
1598  * \retval 1 match
1599  *
1600  * \note addresses in addrs are in host order
1601  *
1602  * \todo array should be ordered, so we can break out of the loop
1603  */
1604 int DetectAddressMatchIPv4(const DetectMatchAddressIPv4 *addrs,
1605  uint16_t addrs_cnt, const Address *a)
1606 {
1607  SCEnter();
1608 
1609  if (addrs == NULL || addrs_cnt == 0) {
1610  SCReturnInt(0);
1611  }
1612 
1613  uint32_t match_addr = SCNtohl(a->addr_data32[0]);
1614  for (uint16_t idx = 0; idx < addrs_cnt; idx++) {
1615  if (match_addr >= addrs[idx].ip && match_addr <= addrs[idx].ip2) {
1616  SCReturnInt(1);
1617  }
1618  }
1619 
1620  SCReturnInt(0);
1621 }
1622 
1623 /**
1624  * \brief Match a packets address against a signatures addrs array
1625  *
1626  * \param addrs array of DetectMatchAddressIPv6's
1627  * \param addrs_cnt array size in members
1628  * \param a packets address
1629  *
1630  * \retval 0 no match
1631  * \retval 1 match
1632  *
1633  * \note addresses in addrs are in host order
1634  *
1635  * \todo array should be ordered, so we can break out of the loop
1636  */
1637 int DetectAddressMatchIPv6(const DetectMatchAddressIPv6 *addrs,
1638  uint16_t addrs_cnt, const Address *a)
1639 {
1640  SCEnter();
1641 
1642  if (addrs == NULL || addrs_cnt == 0) {
1643  SCReturnInt(0);
1644  }
1645 
1646  uint32_t match_addr[4];
1647  match_addr[0] = SCNtohl(a->addr_data32[0]);
1648  match_addr[1] = SCNtohl(a->addr_data32[1]);
1649  match_addr[2] = SCNtohl(a->addr_data32[2]);
1650  match_addr[3] = SCNtohl(a->addr_data32[3]);
1651 
1652  /* See if the packet address is within the range of any entry in the
1653  * signature's address match array.
1654  */
1655  for (uint16_t idx = 0; idx < addrs_cnt; idx++) {
1656  uint16_t result1 = 0, result2 = 0;
1657 
1658  /* See if packet address equals either limit. Return 1 if true. */
1659  if (0 == memcmp(match_addr, addrs[idx].ip, sizeof(match_addr))) {
1660  SCReturnInt(1);
1661  }
1662  if (0 == memcmp(match_addr, addrs[idx].ip2, sizeof(match_addr))) {
1663  SCReturnInt(1);
1664  }
1665 
1666  /* See if packet address is greater than lower limit
1667  * of the current signature address match pair.
1668  */
1669  for (int i = 0; i < 4; i++) {
1670  if (match_addr[i] > addrs[idx].ip[i]) {
1671  result1 = 1;
1672  break;
1673  }
1674  if (match_addr[i] < addrs[idx].ip[i]) {
1675  result1 = 0;
1676  break;
1677  }
1678  }
1679 
1680  /* If not greater than lower limit, try next address match entry */
1681  if (result1 == 0)
1682  continue;
1683 
1684  /* See if packet address is less than upper limit
1685  * of the current signature address match pair.
1686  */
1687  for (int i = 0; i < 4; i++) {
1688  if (match_addr[i] < addrs[idx].ip2[i]) {
1689  result2 = 1;
1690  break;
1691  }
1692  if (match_addr[i] > addrs[idx].ip2[i]) {
1693  result2 = 0;
1694  break;
1695  }
1696  }
1697 
1698  /* Return a match if packet address is between the two
1699  * signature address match limits.
1700  */
1701  if (result1 == 1 && result2 == 1)
1702  SCReturnInt(1);
1703  }
1704 
1705  SCReturnInt(0);
1706 }
1707 
1708 /**
1709  * \brief Check if a particular address(ipv4 or ipv6) matches the address
1710  * range in the DetectAddress instance.
1711  *
1712  * We basically check that the address falls in between the address
1713  * range in DetectAddress.
1714  *
1715  * \param dd Pointer to the DetectAddress instance.
1716  * \param a Pointer to an Address instance.
1717  *
1718  * \param 1 On a match.
1719  * \param 0 On no match.
1720  */
1721 static int DetectAddressMatch(DetectAddress *dd, Address *a)
1722 {
1723  SCEnter();
1724 
1725  if (dd->ip.family != a->family) {
1726  SCReturnInt(0);
1727  }
1728 
1729  //DetectAddressPrint(dd);
1730  //AddressDebugPrint(a);
1731 
1732  switch (a->family) {
1733  case AF_INET:
1734 
1735  /* XXX figure out a way to not need to do this SCNtohl if we switch to
1736  * Address inside DetectAddressData we can do uint8_t checks */
1737  if (SCNtohl(a->addr_data32[0]) >= SCNtohl(dd->ip.addr_data32[0]) &&
1738  SCNtohl(a->addr_data32[0]) <= SCNtohl(dd->ip2.addr_data32[0]))
1739  {
1740  SCReturnInt(1);
1741  } else {
1742  SCReturnInt(0);
1743  }
1744 
1745  break;
1746  case AF_INET6:
1747  if (AddressIPv6Ge(a, &dd->ip) == 1 &&
1748  AddressIPv6Le(a, &dd->ip2) == 1)
1749  {
1750  SCReturnInt(1);
1751  } else {
1752  SCReturnInt(0);
1753  }
1754 
1755  break;
1756  default:
1757  SCLogDebug("What other address type can we have :-/");
1758  break;
1759  }
1760 
1761  SCReturnInt(0);
1762 }
1763 
1764 #ifdef DEBUG
1765 /**
1766  * \brief Prints the address data held by the DetectAddress. If the address
1767  * data family is IPv4, we print the ipv4 address and mask, and
1768  * if the address data family is IPv6, we print the ipv6 address and
1769  * mask.
1770  *
1771  * \param ad Pointer to the DetectAddress instance to be printed.
1772  */
1773 static void DetectAddressPrint(DetectAddress *gr)
1774 {
1775  if (gr == NULL)
1776  return;
1777 
1778  if (gr->ip.family == AF_INET) {
1779  struct in_addr in;
1780  char ip[16], mask[16];
1781 
1782  memcpy(&in, &gr->ip.addr_data32[0], sizeof(in));
1783  PrintInet(AF_INET, &in, ip, sizeof(ip));
1784  memcpy(&in, &gr->ip2.addr_data32[0], sizeof(in));
1785  PrintInet(AF_INET, &in, mask, sizeof(mask));
1786 
1787  SCLogDebug("%s/%s", ip, mask);
1788 // printf("%s/%s", ip, mask);
1789  } else if (gr->ip.family == AF_INET6) {
1790  struct in6_addr in6;
1791  char ip[66], mask[66];
1792 
1793  memcpy(&in6, &gr->ip.addr_data32, sizeof(in6));
1794  PrintInet(AF_INET6, &in6, ip, sizeof(ip));
1795  memcpy(&in6, &gr->ip2.addr_data32, sizeof(in6));
1796  PrintInet(AF_INET6, &in6, mask, sizeof(mask));
1797 
1798  SCLogDebug("%s/%s", ip, mask);
1799 // printf("%s/%s", ip, mask);
1800  }
1801 }
1802 #endif
1803 
1804 /**
1805  * \brief Find the group matching address in a group head.
1806  *
1807  * \param gh Pointer to the address group head(DetectAddressHead instance).
1808  * \param a Pointer to an Address instance.
1809  *
1810  * \retval g On success pointer to an DetectAddress if we find a match
1811  * for the Address "a", in the DetectAddressHead "gh".
1812  */
1813 DetectAddress *DetectAddressLookupInHead(const DetectAddressHead *gh, Address *a)
1814 {
1815  SCEnter();
1816 
1817  DetectAddress *g = NULL;
1818 
1819  if (gh == NULL) {
1820  SCReturnPtr(NULL, "DetectAddress");
1821  }
1822 
1823  /* XXX should we really do this check every time we run this function? */
1824  if (a->family == AF_INET) {
1825  SCLogDebug("IPv4");
1826  g = gh->ipv4_head;
1827  } else if (a->family == AF_INET6) {
1828  SCLogDebug("IPv6");
1829  g = gh->ipv6_head;
1830  }
1831 
1832  for ( ; g != NULL; g = g->next) {
1833  if (DetectAddressMatch(g,a) == 1) {
1834  SCReturnPtr(g, "DetectAddress");
1835  }
1836  }
1837 
1838  SCReturnPtr(NULL, "DetectAddress");
1839 }
1840 
1841 /********************************Unittests*************************************/
1842 
1843 #ifdef UNITTESTS
1844 
1845 static bool UTHValidateDetectAddress(DetectAddress *ad, const char *one, const char *two)
1846 {
1847  char str1[46] = "", str2[46] = "";
1848 
1849  if (ad == NULL)
1850  return false;
1851 
1852  switch(ad->ip.family) {
1853  case AF_INET:
1854  PrintInet(AF_INET, (const void *)&ad->ip.addr_data32[0], str1, sizeof(str1));
1855  SCLogDebug("%s", str1);
1856  PrintInet(AF_INET, (const void *)&ad->ip2.addr_data32[0], str2, sizeof(str2));
1857  SCLogDebug("%s", str2);
1858 
1859  if (strcmp(str1, one) != 0) {
1860  SCLogInfo("%s != %s", str1, one);
1861  return false;
1862  }
1863 
1864  if (strcmp(str2, two) != 0) {
1865  SCLogInfo("%s != %s", str2, two);
1866  return false;
1867  }
1868 
1869  return true;
1870  break;
1871 
1872  case AF_INET6:
1873  PrintInet(AF_INET6, (const void *)&ad->ip.addr_data32[0], str1, sizeof(str1));
1874  SCLogDebug("%s", str1);
1875  PrintInet(AF_INET6, (const void *)&ad->ip2.addr_data32[0], str2, sizeof(str2));
1876  SCLogDebug("%s", str2);
1877 
1878  if (strcmp(str1, one) != 0) {
1879  SCLogInfo("%s != %s", str1, one);
1880  return false;
1881  }
1882 
1883  if (strcmp(str2, two) != 0) {
1884  SCLogInfo("%s != %s", str2, two);
1885  return false;
1886  }
1887 
1888  return true;
1889  break;
1890  }
1891 
1892  return false;
1893 }
1894 
1895 typedef struct UTHValidateDetectAddressHeadRange_ {
1896  const char *one;
1897  const char *two;
1898 } UTHValidateDetectAddressHeadRange;
1899 
1900 static int UTHValidateDetectAddressHead(DetectAddressHead *gh, int nranges, UTHValidateDetectAddressHeadRange *expectations)
1901 {
1902  int expect = nranges;
1903  int have = 0;
1904 
1905  if (gh == NULL)
1906  return false;
1907 
1908  DetectAddress *ad = NULL;
1909  ad = gh->ipv4_head;
1910  if (ad == NULL)
1911  ad = gh->ipv6_head;
1912  while (have < expect) {
1913  if (ad == NULL) {
1914  printf("bad head: have %d ranges, expected %d: ", have, expect);
1915  return false;
1916  }
1917 
1918  if (!UTHValidateDetectAddress(ad, expectations[have].one, expectations[have].two))
1919  return false;
1920 
1921  ad = ad->next;
1922  have++;
1923  }
1924 
1925  return true;
1926 }
1927 
1928 static int AddressTestParse01(void)
1929 {
1930  DetectAddress *dd = DetectAddressParseSingle("1.2.3.4");
1931 
1932  if (dd) {
1933  DetectAddressFree(dd);
1934  return 1;
1935  }
1936 
1937  return 0;
1938 }
1939 
1940 static int AddressTestParse02(void)
1941 {
1942  int result = 1;
1943  DetectAddress *dd = DetectAddressParseSingle("1.2.3.4");
1944 
1945  if (dd) {
1946  if (dd->ip2.addr_data32[0] != SCNtohl(16909060) ||
1947  dd->ip.addr_data32[0] != SCNtohl(16909060)) {
1948  result = 0;
1949  }
1950 
1951  printf("ip %"PRIu32", ip2 %"PRIu32"\n", dd->ip.addr_data32[0], dd->ip2.addr_data32[0]);
1952  DetectAddressFree(dd);
1953  return result;
1954  }
1955 
1956  return 0;
1957 }
1958 
1959 static int AddressTestParse03(void)
1960 {
1961  DetectAddress *dd = DetectAddressParseSingle("1.2.3.4/255.255.255.0");
1962 
1963  if (dd) {
1964  DetectAddressFree(dd);
1965  return 1;
1966  }
1967 
1968  return 0;
1969 }
1970 
1971 static int AddressTestParse04(void)
1972 {
1973  DetectAddress *dd = DetectAddressParseSingle("1.2.3.4/255.255.255.0");
1974  FAIL_IF_NULL(dd);
1975 
1976  char left[16], right[16];
1977  PrintInet(AF_INET, (const void *)&dd->ip.addr_data32[0], left, sizeof(left));
1978  PrintInet(AF_INET, (const void *)&dd->ip2.addr_data32[0], right, sizeof(right));
1979  SCLogDebug("left %s right %s", left, right);
1980  FAIL_IF_NOT(dd->ip.addr_data32[0] == SCNtohl(16909056));
1981  FAIL_IF_NOT(dd->ip2.addr_data32[0] == SCNtohl(16909311));
1982  FAIL_IF_NOT(strcmp(left, "1.2.3.0") == 0);
1983  FAIL_IF_NOT(strcmp(right, "1.2.3.255") == 0);
1984 
1985  DetectAddressFree(dd);
1986  PASS;
1987 }
1988 
1989 /** \test that address range sets proper start address */
1990 static int AddressTestParse04bug5081(void)
1991 {
1992  DetectAddress *dd = DetectAddressParseSingle("1.2.3.64/26");
1993  FAIL_IF_NULL(dd);
1994 
1995  char left[16], right[16];
1996  PrintInet(AF_INET, (const void *)&dd->ip.addr_data32[0], left, sizeof(left));
1997  PrintInet(AF_INET, (const void *)&dd->ip2.addr_data32[0], right, sizeof(right));
1998  SCLogDebug("left %s right %s", left, right);
1999  FAIL_IF_NOT(strcmp(left, "1.2.3.64") == 0);
2000  FAIL_IF_NOT(strcmp(right, "1.2.3.127") == 0);
2001 
2002  DetectAddressFree(dd);
2003  PASS;
2004 }
2005 
2006 static int AddressTestParse05(void)
2007 {
2008  DetectAddress *dd = DetectAddressParseSingle("1.2.3.4/24");
2009 
2010  if (dd) {
2011  DetectAddressFree(dd);
2012  return 1;
2013  }
2014 
2015  return 0;
2016 }
2017 
2018 static int AddressTestParse06(void)
2019 {
2020  int result = 1;
2021  DetectAddress *dd = DetectAddressParseSingle("1.2.3.4/24");
2022 
2023  if (dd) {
2024  if (dd->ip2.addr_data32[0] != SCNtohl(16909311) ||
2025  dd->ip.addr_data32[0] != SCNtohl(16909056)) {
2026  result = 0;
2027  }
2028 
2029  DetectAddressFree(dd);
2030  return result;
2031  }
2032 
2033  return 0;
2034 }
2035 
2036 static int AddressTestParse07(void)
2037 {
2038  DetectAddress *dd = DetectAddressParseSingle("2001::/3");
2039 
2040  if (dd) {
2041  DetectAddressFree(dd);
2042  return 1;
2043  }
2044 
2045  return 0;
2046 }
2047 
2048 static int AddressTestParse08(void)
2049 {
2050  int result = 1;
2051  DetectAddress *dd = DetectAddressParseSingle("2001::/3");
2052 
2053  if (dd) {
2054  if (dd->ip.addr_data32[0] != SCNtohl(536870912) || dd->ip.addr_data32[1] != 0x00000000 ||
2055  dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 ||
2056 
2057  dd->ip2.addr_data32[0] != SCNtohl(1073741823) || dd->ip2.addr_data32[1] != 0xFFFFFFFF ||
2058  dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) {
2059  DetectAddressPrint(dd);
2060  result = 0;
2061  }
2062 
2063  DetectAddressFree(dd);
2064  return result;
2065  }
2066 
2067  return 0;
2068 }
2069 
2070 static int AddressTestParse09(void)
2071 {
2072  DetectAddress *dd = DetectAddressParseSingle("2001::1/128");
2073 
2074  if (dd) {
2075  DetectAddressFree(dd);
2076  return 1;
2077  }
2078 
2079  return 0;
2080 }
2081 
2082 static int AddressTestParse10(void)
2083 {
2084  int result = 1;
2085  DetectAddress *dd = DetectAddressParseSingle("2001::/128");
2086 
2087  if (dd) {
2088  if (dd->ip.addr_data32[0] != SCNtohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 ||
2089  dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 ||
2090 
2091  dd->ip2.addr_data32[0] != SCNtohl(536936448) || dd->ip2.addr_data32[1] != 0x00000000 ||
2092  dd->ip2.addr_data32[2] != 0x00000000 || dd->ip2.addr_data32[3] != 0x00000000) {
2093  DetectAddressPrint(dd);
2094  result = 0;
2095  }
2096 
2097  DetectAddressFree(dd);
2098  return result;
2099  }
2100 
2101  return 0;
2102 }
2103 
2104 static int AddressTestParse11(void)
2105 {
2106  DetectAddress *dd = DetectAddressParseSingle("2001::/48");
2107 
2108  if (dd) {
2109  DetectAddressFree(dd);
2110  return 1;
2111  }
2112 
2113  return 0;
2114 }
2115 
2116 static int AddressTestParse12(void)
2117 {
2118  int result = 1;
2119  DetectAddress *dd = DetectAddressParseSingle("2001::/48");
2120 
2121  if (dd) {
2122  if (dd->ip.addr_data32[0] != SCNtohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 ||
2123  dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 ||
2124 
2125  dd->ip2.addr_data32[0] != SCNtohl(536936448) || dd->ip2.addr_data32[1] != SCNtohl(65535) ||
2126  dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) {
2127  DetectAddressPrint(dd);
2128  result = 0;
2129  }
2130 
2131  DetectAddressFree(dd);
2132  return result;
2133  }
2134 
2135  return 0;
2136 }
2137 static int AddressTestParse13(void)
2138 {
2139  DetectAddress *dd = DetectAddressParseSingle("2001::/16");
2140 
2141  if (dd) {
2142  DetectAddressFree(dd);
2143  return 1;
2144  }
2145 
2146  return 0;
2147 }
2148 
2149 static int AddressTestParse14(void)
2150 {
2151  int result = 1;
2152  DetectAddress *dd = DetectAddressParseSingle("2001::/16");
2153 
2154  if (dd) {
2155  if (dd->ip.addr_data32[0] != SCNtohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 ||
2156  dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 ||
2157 
2158  dd->ip2.addr_data32[0] != SCNtohl(537001983) || dd->ip2.addr_data32[1] != 0xFFFFFFFF ||
2159  dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) {
2160  result = 0;
2161  }
2162 
2163  DetectAddressFree(dd);
2164  return result;
2165  }
2166 
2167  return 0;
2168 }
2169 
2170 static int AddressTestParse15(void)
2171 {
2172  DetectAddress *dd = DetectAddressParseSingle("2001::/0");
2173 
2174  if (dd) {
2175  DetectAddressFree(dd);
2176  return 1;
2177  }
2178 
2179  return 0;
2180 }
2181 
2182 static int AddressTestParse16(void)
2183 {
2184  int result = 1;
2185  DetectAddress *dd = DetectAddressParseSingle("2001::/0");
2186 
2187  if (dd) {
2188  if (dd->ip.addr_data32[0] != 0x00000000 || dd->ip.addr_data32[1] != 0x00000000 ||
2189  dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 ||
2190 
2191  dd->ip2.addr_data32[0] != 0xFFFFFFFF || dd->ip2.addr_data32[1] != 0xFFFFFFFF ||
2192  dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) {
2193  result = 0;
2194  }
2195 
2196  DetectAddressFree(dd);
2197  return result;
2198  }
2199 
2200  return 0;
2201 }
2202 
2203 static int AddressTestParse17(void)
2204 {
2205  DetectAddress *dd = DetectAddressParseSingle("1.2.3.4-1.2.3.6");
2206 
2207  if (dd) {
2208  DetectAddressFree(dd);
2209  return 1;
2210  }
2211 
2212  return 0;
2213 }
2214 
2215 static int AddressTestParse18(void)
2216 {
2217  int result = 1;
2218  DetectAddress *dd = DetectAddressParseSingle("1.2.3.4-1.2.3.6");
2219 
2220  if (dd) {
2221  if (dd->ip2.addr_data32[0] != SCNtohl(16909062) ||
2222  dd->ip.addr_data32[0] != SCNtohl(16909060)) {
2223  result = 0;
2224  }
2225 
2226  DetectAddressFree(dd);
2227  return result;
2228  }
2229 
2230  return 0;
2231 }
2232 
2233 static int AddressTestParse19(void)
2234 {
2235  DetectAddress *dd = DetectAddressParseSingle("1.2.3.6-1.2.3.4");
2236 
2237  if (dd) {
2238  DetectAddressFree(dd);
2239  return 0;
2240  }
2241 
2242  return 1;
2243 }
2244 
2245 static int AddressTestParse20(void)
2246 {
2247  DetectAddress *dd = DetectAddressParseSingle("2001::1-2001::4");
2248 
2249  if (dd) {
2250  DetectAddressFree(dd);
2251  return 1;
2252  }
2253 
2254  return 0;
2255 }
2256 
2257 static int AddressTestParse21(void)
2258 {
2259  int result = 1;
2260  DetectAddress *dd = DetectAddressParseSingle("2001::1-2001::4");
2261 
2262  if (dd) {
2263  if (dd->ip.addr_data32[0] != SCNtohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 ||
2264  dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != SCNtohl(1) ||
2265 
2266  dd->ip2.addr_data32[0] != SCNtohl(536936448) || dd->ip2.addr_data32[1] != 0x00000000 ||
2267  dd->ip2.addr_data32[2] != 0x00000000 || dd->ip2.addr_data32[3] != SCNtohl(4)) {
2268  result = 0;
2269  }
2270 
2271  DetectAddressFree(dd);
2272  return result;
2273  }
2274 
2275  return 0;
2276 }
2277 
2278 static int AddressTestParse22(void)
2279 {
2280  DetectAddress *dd = DetectAddressParseSingle("2001::4-2001::1");
2281 
2282  if (dd) {
2283  DetectAddressFree(dd);
2284  return 0;
2285  }
2286 
2287  return 1;
2288 }
2289 
2290 static int AddressTestParse23(void)
2291 {
2292  DetectAddressHead *gh = DetectAddressHeadInit();
2293  FAIL_IF_NULL(gh);
2294  int r = DetectAddressParse(NULL, gh, "any", NULL);
2295  FAIL_IF_NOT(r == 0);
2296  DetectAddressHeadFree(gh);
2297  PASS;
2298 }
2299 
2300 static int AddressTestParse24(void)
2301 {
2302  DetectAddressHead *gh = DetectAddressHeadInit();
2303  FAIL_IF_NULL(gh);
2304  int r = DetectAddressParse(NULL, gh, "Any", NULL);
2305  FAIL_IF_NOT(r == 0);
2306  DetectAddressHeadFree(gh);
2307  PASS;
2308 }
2309 
2310 static int AddressTestParse25(void)
2311 {
2312  DetectAddressHead *gh = DetectAddressHeadInit();
2313  FAIL_IF_NULL(gh);
2314  int r = DetectAddressParse(NULL, gh, "ANY", NULL);
2315  FAIL_IF_NOT(r == 0);
2316  DetectAddressHeadFree(gh);
2317  PASS;
2318 }
2319 
2320 /** \test recursion limit */
2321 static int AddressTestParse26(void)
2322 {
2323  DetectAddressHead *gh = DetectAddressHeadInit();
2324  FAIL_IF_NULL(gh);
2325  /* exactly 64: should pass */
2326  int r = DetectAddressParse(NULL, gh,
2327  "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["
2328  "1.2.3.4"
2329  "]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]",
2330  NULL);
2331  FAIL_IF_NOT(r == 0);
2332  DetectAddressHeadFree(gh);
2333  gh = DetectAddressHeadInit();
2334  FAIL_IF_NULL(gh);
2335  /* exactly 65: should fail */
2336  r = DetectAddressParse(NULL, gh,
2337  "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["
2338  "1.2.3.4"
2339  "]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]",
2340  NULL);
2341  FAIL_IF(r == 0);
2342  DetectAddressHeadFree(gh);
2343  PASS;
2344 }
2345 
2346 static int AddressTestParse27(void)
2347 {
2348  DetectAddress *dd = DetectAddressParseSingle("!192.168.0.1");
2349 
2350  if (dd) {
2351  DetectAddressFree(dd);
2352  return 1;
2353  }
2354 
2355  return 0;
2356 }
2357 
2358 static int AddressTestParse28(void)
2359 {
2360  int result = 0;
2361  DetectAddress *dd = DetectAddressParseSingle("!1.2.3.4");
2362 
2363  if (dd) {
2364  if (dd->flags & ADDRESS_FLAG_NOT &&
2365  dd->ip.addr_data32[0] == SCNtohl(16909060)) {
2366  result = 1;
2367  }
2368 
2369  DetectAddressFree(dd);
2370  return result;
2371  }
2372 
2373  return 0;
2374 }
2375 
2376 static int AddressTestParse29(void)
2377 {
2378  DetectAddress *dd = DetectAddressParseSingle("!1.2.3.0/24");
2379 
2380  if (dd) {
2381  DetectAddressFree(dd);
2382  return 1;
2383  }
2384 
2385  return 0;
2386 }
2387 
2388 static int AddressTestParse30(void)
2389 {
2390  int result = 0;
2391  DetectAddress *dd = DetectAddressParseSingle("!1.2.3.4/24");
2392 
2393  if (dd) {
2394  if (dd->flags & ADDRESS_FLAG_NOT &&
2395  dd->ip.addr_data32[0] == SCNtohl(16909056) &&
2396  dd->ip2.addr_data32[0] == SCNtohl(16909311)) {
2397  result = 1;
2398  }
2399 
2400  DetectAddressFree(dd);
2401  return result;
2402  }
2403 
2404  return 0;
2405 }
2406 
2407 /**
2408  * \test make sure !any is rejected
2409  */
2410 static int AddressTestParse31(void)
2411 {
2412  DetectAddress *dd = DetectAddressParseSingle("!any");
2413 
2414  if (dd) {
2415  DetectAddressFree(dd);
2416  return 0;
2417  }
2418 
2419  return 1;
2420 }
2421 
2422 static int AddressTestParse32(void)
2423 {
2424  DetectAddress *dd = DetectAddressParseSingle("!2001::1");
2425 
2426  if (dd) {
2427  DetectAddressFree(dd);
2428  return 1;
2429  }
2430 
2431  return 0;
2432 }
2433 
2434 static int AddressTestParse33(void)
2435 {
2436  int result = 0;
2437  DetectAddress *dd = DetectAddressParseSingle("!2001::1");
2438 
2439  if (dd) {
2440  if (dd->flags & ADDRESS_FLAG_NOT &&
2441  dd->ip.addr_data32[0] == SCNtohl(536936448) && dd->ip.addr_data32[1] == 0x00000000 &&
2442  dd->ip.addr_data32[2] == 0x00000000 && dd->ip.addr_data32[3] == SCNtohl(1)) {
2443  result = 1;
2444  }
2445 
2446  DetectAddressFree(dd);
2447  return result;
2448  }
2449 
2450  return 0;
2451 }
2452 
2453 static int AddressTestParse34(void)
2454 {
2455  DetectAddress *dd = DetectAddressParseSingle("!2001::/16");
2456 
2457  if (dd) {
2458  DetectAddressFree(dd);
2459  return 1;
2460  }
2461 
2462  return 0;
2463 }
2464 
2465 static int AddressTestParse35(void)
2466 {
2467  int result = 0;
2468  DetectAddress *dd = DetectAddressParseSingle("!2001::/16");
2469 
2470  if (dd) {
2471  if (dd->flags & ADDRESS_FLAG_NOT &&
2472  dd->ip.addr_data32[0] == SCNtohl(536936448) && dd->ip.addr_data32[1] == 0x00000000 &&
2473  dd->ip.addr_data32[2] == 0x00000000 && dd->ip.addr_data32[3] == 0x00000000 &&
2474 
2475  dd->ip2.addr_data32[0] == SCNtohl(537001983) && dd->ip2.addr_data32[1] == 0xFFFFFFFF &&
2476  dd->ip2.addr_data32[2] == 0xFFFFFFFF && dd->ip2.addr_data32[3] == 0xFFFFFFFF) {
2477  result = 1;
2478  }
2479 
2480  DetectAddressFree(dd);
2481  return result;
2482  }
2483 
2484  return 0;
2485 }
2486 
2487 static int AddressTestParse36(void)
2488 {
2489  int result = 1;
2490  DetectAddress *dd = DetectAddressParseSingle("ffff::/16");
2491 
2492  if (dd) {
2493  if (dd->ip.addr_data32[0] != SCNtohl(0xFFFF0000) || dd->ip.addr_data32[1] != 0x00000000 ||
2494  dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 ||
2495 
2496  dd->ip2.addr_data32[0] != 0xFFFFFFFF || dd->ip2.addr_data32[1] != 0xFFFFFFFF ||
2497  dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) {
2498 
2499  DetectAddressPrint(dd);
2500  result = 0;
2501  }
2502  DetectAddressPrint(dd);
2503 
2504  DetectAddressFree(dd);
2505  return result;
2506  }
2507 
2508  return 0;
2509 }
2510 
2511 static int AddressTestParse37(void)
2512 {
2513  int result = 1;
2514  DetectAddress *dd = DetectAddressParseSingle("::/0");
2515 
2516  if (dd) {
2517  if (dd->ip.addr_data32[0] != 0x00000000 || dd->ip.addr_data32[1] != 0x00000000 ||
2518  dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 ||
2519 
2520  dd->ip2.addr_data32[0] != 0xFFFFFFFF || dd->ip2.addr_data32[1] != 0xFFFFFFFF ||
2521  dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) {
2522  DetectAddressPrint(dd);
2523  result = 0;
2524  }
2525  DetectAddressPrint(dd);
2526 
2527  DetectAddressFree(dd);
2528  return result;
2529  }
2530 
2531  return 0;
2532 }
2533 
2534 static int AddressTestMatch01(void)
2535 {
2536  DetectAddress *dd = NULL;
2537  int result = 1;
2538  struct in_addr in;
2539  Address a;
2540 
2541  if (inet_pton(AF_INET, "1.2.3.4", &in) != 1)
2542  return 0;
2543  memset(&a, 0, sizeof(Address));
2544  a.family = AF_INET;
2545  a.addr_data32[0] = in.s_addr;
2546 
2547  dd = DetectAddressParseSingle("1.2.3.4/24");
2548  if (dd) {
2549  if (DetectAddressMatch(dd, &a) == 0)
2550  result = 0;
2551 
2552  DetectAddressFree(dd);
2553  return result;
2554  }
2555 
2556  return 0;
2557 }
2558 
2559 static int AddressTestMatch02(void)
2560 {
2561  DetectAddress *dd = NULL;
2562  int result = 1;
2563  struct in_addr in;
2564  Address a;
2565 
2566  if (inet_pton(AF_INET, "1.2.3.127", &in) != 1)
2567  return 0;
2568  memset(&a, 0, sizeof(Address));
2569  a.family = AF_INET;
2570  a.addr_data32[0] = in.s_addr;
2571 
2572  dd = DetectAddressParseSingle("1.2.3.4/25");
2573  if (dd) {
2574  if (DetectAddressMatch(dd, &a) == 0)
2575  result = 0;
2576 
2577  DetectAddressFree(dd);
2578  return result;
2579  }
2580 
2581  return 0;
2582 }
2583 
2584 static int AddressTestMatch03(void)
2585 {
2586  DetectAddress *dd = NULL;
2587  int result = 1;
2588  struct in_addr in;
2589  Address a;
2590 
2591  if (inet_pton(AF_INET, "1.2.3.128", &in) != 1)
2592  return 0;
2593  memset(&a, 0, sizeof(Address));
2594  a.family = AF_INET;
2595  a.addr_data32[0] = in.s_addr;
2596 
2597  dd = DetectAddressParseSingle("1.2.3.4/25");
2598  if (dd) {
2599  if (DetectAddressMatch(dd, &a) == 1)
2600  result = 0;
2601 
2602  DetectAddressFree(dd);
2603  return result;
2604  }
2605 
2606  return 0;
2607 }
2608 
2609 static int AddressTestMatch04(void)
2610 {
2611  DetectAddress *dd = NULL;
2612  int result = 1;
2613  struct in_addr in;
2614  Address a;
2615 
2616  if (inet_pton(AF_INET, "1.2.2.255", &in) != 1)
2617  return 0;
2618  memset(&a, 0, sizeof(Address));
2619  a.family = AF_INET;
2620  a.addr_data32[0] = in.s_addr;
2621 
2622  dd = DetectAddressParseSingle("1.2.3.4/25");
2623  if (dd) {
2624  if (DetectAddressMatch(dd, &a) == 1)
2625  result = 0;
2626 
2627  DetectAddressFree(dd);
2628  return result;
2629  }
2630 
2631  return 0;
2632 }
2633 
2634 static int AddressTestMatch05(void)
2635 {
2636  DetectAddress *dd = NULL;
2637  int result = 1;
2638  struct in_addr in;
2639  Address a;
2640 
2641  if (inet_pton(AF_INET, "1.2.3.4", &in) != 1)
2642  return 0;
2643  memset(&a, 0, sizeof(Address));
2644  a.family = AF_INET;
2645  a.addr_data32[0] = in.s_addr;
2646 
2647  dd = DetectAddressParseSingle("1.2.3.4/32");
2648  if (dd) {
2649  if (DetectAddressMatch(dd, &a) == 0)
2650  result = 0;
2651 
2652  DetectAddressFree(dd);
2653  return result;
2654  }
2655 
2656  return 0;
2657 }
2658 
2659 static int AddressTestMatch06(void)
2660 {
2661  DetectAddress *dd = NULL;
2662  int result = 1;
2663  struct in_addr in;
2664  Address a;
2665 
2666  if (inet_pton(AF_INET, "1.2.3.4", &in) != 1)
2667  return 0;
2668  memset(&a, 0, sizeof(Address));
2669  a.family = AF_INET;
2670  a.addr_data32[0] = in.s_addr;
2671 
2672  dd = DetectAddressParseSingle("0.0.0.0/0.0.0.0");
2673  if (dd) {
2674  if (DetectAddressMatch(dd, &a) == 0)
2675  result = 0;
2676 
2677  DetectAddressFree(dd);
2678  return result;
2679  }
2680 
2681  return 0;
2682 }
2683 
2684 static int AddressTestMatch07(void)
2685 {
2686  DetectAddress *dd = NULL;
2687  int result = 1;
2688  struct in6_addr in6;
2689  Address a;
2690 
2691  if (inet_pton(AF_INET6, "2001::1", &in6) != 1)
2692  return 0;
2693  memset(&a, 0, sizeof(Address));
2694  a.family = AF_INET6;
2695  memcpy(&a.addr_data32, &in6.s6_addr, sizeof(in6.s6_addr));
2696 
2697  dd = DetectAddressParseSingle("2001::/3");
2698  if (dd) {
2699  if (DetectAddressMatch(dd, &a) == 0)
2700  result = 0;
2701 
2702  DetectAddressFree(dd);
2703  return result;
2704  }
2705 
2706  return 0;
2707 }
2708 
2709 static int AddressTestMatch08(void)
2710 {
2711  DetectAddress *dd = NULL;
2712  int result = 1;
2713  struct in6_addr in6;
2714  Address a;
2715 
2716  if (inet_pton(AF_INET6, "1999:ffff:ffff:ffff:ffff:ffff:ffff:ffff", &in6) != 1)
2717  return 0;
2718  memset(&a, 0, sizeof(Address));
2719  a.family = AF_INET6;
2720  memcpy(&a.addr_data32, &in6.s6_addr, sizeof(in6.s6_addr));
2721 
2722  dd = DetectAddressParseSingle("2001::/3");
2723  if (dd) {
2724  if (DetectAddressMatch(dd, &a) == 1)
2725  result = 0;
2726 
2727  DetectAddressFree(dd);
2728  return result;
2729  }
2730 
2731  return 0;
2732 }
2733 
2734 static int AddressTestMatch09(void)
2735 {
2736  DetectAddress *dd = NULL;
2737  int result = 1;
2738  struct in6_addr in6;
2739  Address a;
2740 
2741  if (inet_pton(AF_INET6, "2001::2", &in6) != 1)
2742  return 0;
2743  memset(&a, 0, sizeof(Address));
2744  a.family = AF_INET6;
2745  memcpy(&a.addr_data32, &in6.s6_addr, sizeof(in6.s6_addr));
2746 
2747  dd = DetectAddressParseSingle("2001::1/128");
2748  if (dd) {
2749  if (DetectAddressMatch(dd, &a) == 1)
2750  result = 0;
2751 
2752  DetectAddressFree(dd);
2753  return result;
2754  }
2755 
2756  return 0;
2757 }
2758 
2759 static int AddressTestMatch10(void)
2760 {
2761  DetectAddress *dd = NULL;
2762  int result = 1;
2763  struct in6_addr in6;
2764  Address a;
2765 
2766  if (inet_pton(AF_INET6, "2001::2", &in6) != 1)
2767  return 0;
2768  memset(&a, 0, sizeof(Address));
2769  a.family = AF_INET6;
2770  memcpy(&a.addr_data32, &in6.s6_addr, sizeof(in6.s6_addr));
2771 
2772  dd = DetectAddressParseSingle("2001::1/126");
2773  if (dd) {
2774  if (DetectAddressMatch(dd, &a) == 0)
2775  result = 0;
2776 
2777  DetectAddressFree(dd);
2778  return result;
2779  }
2780 
2781  return 0;
2782 }
2783 
2784 static int AddressTestMatch11(void)
2785 {
2786  DetectAddress *dd = NULL;
2787  int result = 1;
2788  struct in6_addr in6;
2789  Address a;
2790 
2791  if (inet_pton(AF_INET6, "2001::3", &in6) != 1)
2792  return 0;
2793  memset(&a, 0, sizeof(Address));
2794  a.family = AF_INET6;
2795  memcpy(&a.addr_data32, &in6.s6_addr, sizeof(in6.s6_addr));
2796 
2797  dd = DetectAddressParseSingle("2001::1/127");
2798  if (dd) {
2799  if (DetectAddressMatch(dd, &a) == 1)
2800  result = 0;
2801 
2802  DetectAddressFree(dd);
2803  return result;
2804  }
2805 
2806  return 0;
2807 }
2808 
2809 static int AddressTestCmp01(void)
2810 {
2811  DetectAddress *da = NULL, *db = NULL;
2812  int result = 1;
2813 
2814  da = DetectAddressParseSingle("192.168.0.0/255.255.255.0");
2815  if (da == NULL) goto error;
2816  db = DetectAddressParseSingle("192.168.0.0/255.255.255.0");
2817  if (db == NULL) goto error;
2818 
2819  if (DetectAddressCmp(da, db) != ADDRESS_EQ)
2820  result = 0;
2821 
2822  DetectAddressFree(da);
2823  DetectAddressFree(db);
2824  return result;
2825 
2826 error:
2827  if (da) DetectAddressFree(da);
2828  if (db) DetectAddressFree(db);
2829  return 0;
2830 }
2831 
2832 static int AddressTestCmp02(void)
2833 {
2834  DetectAddress *da = NULL, *db = NULL;
2835  int result = 1;
2836 
2837  da = DetectAddressParseSingle("192.168.0.0/255.255.0.0");
2838  if (da == NULL) goto error;
2839  db = DetectAddressParseSingle("192.168.0.0/255.255.255.0");
2840  if (db == NULL) goto error;
2841 
2842  if (DetectAddressCmp(da, db) != ADDRESS_EB)
2843  result = 0;
2844 
2845  DetectAddressFree(da);
2846  DetectAddressFree(db);
2847  return result;
2848 
2849 error:
2850  if (da) DetectAddressFree(da);
2851  if (db) DetectAddressFree(db);
2852  return 0;
2853 }
2854 
2855 static int AddressTestCmp03(void)
2856 {
2857  DetectAddress *da = NULL, *db = NULL;
2858  int result = 1;
2859 
2860  da = DetectAddressParseSingle("192.168.0.0/255.255.255.0");
2861  if (da == NULL) goto error;
2862  db = DetectAddressParseSingle("192.168.0.0/255.255.0.0");
2863  if (db == NULL) goto error;
2864 
2865  if (DetectAddressCmp(da, db) != ADDRESS_ES)
2866  result = 0;
2867 
2868  DetectAddressFree(da);
2869  DetectAddressFree(db);
2870  return result;
2871 
2872 error:
2873  if (da) DetectAddressFree(da);
2874  if (db) DetectAddressFree(db);
2875  return 0;
2876 }
2877 
2878 static int AddressTestCmp04(void)
2879 {
2880  DetectAddress *da = NULL, *db = NULL;
2881  int result = 1;
2882 
2883  da = DetectAddressParseSingle("192.168.0.0/255.255.255.0");
2884  if (da == NULL) goto error;
2885  db = DetectAddressParseSingle("192.168.1.0/255.255.255.0");
2886  if (db == NULL) goto error;
2887 
2888  if (DetectAddressCmp(da, db) != ADDRESS_LT)
2889  result = 0;
2890 
2891  DetectAddressFree(da);
2892  DetectAddressFree(db);
2893  return result;
2894 
2895 error:
2896  if (da) DetectAddressFree(da);
2897  if (db) DetectAddressFree(db);
2898  return 0;
2899 }
2900 
2901 static int AddressTestCmp05(void)
2902 {
2903  DetectAddress *da = NULL, *db = NULL;
2904  int result = 1;
2905 
2906  da = DetectAddressParseSingle("192.168.1.0/255.255.255.0");
2907  if (da == NULL) goto error;
2908  db = DetectAddressParseSingle("192.168.0.0/255.255.255.0");
2909  if (db == NULL) goto error;
2910 
2911  if (DetectAddressCmp(da, db) != ADDRESS_GT)
2912  result = 0;
2913 
2914  DetectAddressFree(da);
2915  DetectAddressFree(db);
2916  return result;
2917 
2918 error:
2919  if (da) DetectAddressFree(da);
2920  if (db) DetectAddressFree(db);
2921  return 0;
2922 }
2923 
2924 static int AddressTestCmp06(void)
2925 {
2926  DetectAddress *da = NULL, *db = NULL;
2927  int result = 1;
2928 
2929  da = DetectAddressParseSingle("192.168.1.0/255.255.0.0");
2930  if (da == NULL) goto error;
2931  db = DetectAddressParseSingle("192.168.0.0/255.255.0.0");
2932  if (db == NULL) goto error;
2933 
2934  if (DetectAddressCmp(da, db) != ADDRESS_EQ)
2935  result = 0;
2936 
2937  DetectAddressFree(da);
2938  DetectAddressFree(db);
2939  return result;
2940 
2941 error:
2942  if (da) DetectAddressFree(da);
2943  if (db) DetectAddressFree(db);
2944  return 0;
2945 }
2946 
2947 static int AddressTestCmpIPv407(void)
2948 {
2949  DetectAddress *da = NULL, *db = NULL;
2950  int result = 1;
2951 
2952  da = DetectAddressParseSingle("192.168.1.0/255.255.255.0");
2953  if (da == NULL) goto error;
2954  db = DetectAddressParseSingle("192.168.1.128-192.168.2.128");
2955  if (db == NULL) goto error;
2956 
2957  if (DetectAddressCmp(da, db) != ADDRESS_LE)
2958  result = 0;
2959 
2960  DetectAddressFree(da);
2961  DetectAddressFree(db);
2962  return result;
2963 
2964 error:
2965  if (da) DetectAddressFree(da);
2966  if (db) DetectAddressFree(db);
2967  return 0;
2968 }
2969 
2970 static int AddressTestCmpIPv408(void)
2971 {
2972  DetectAddress *da = NULL, *db = NULL;
2973  int result = 1;
2974 
2975  da = DetectAddressParseSingle("192.168.1.128-192.168.2.128");
2976  if (da == NULL) goto error;
2977  db = DetectAddressParseSingle("192.168.1.0/255.255.255.0");
2978  if (db == NULL) goto error;
2979 
2980  if (DetectAddressCmp(da, db) != ADDRESS_GE)
2981  result = 0;
2982 
2983  DetectAddressFree(da);
2984  DetectAddressFree(db);
2985  return result;
2986 
2987 error:
2988  if (da) DetectAddressFree(da);
2989  if (db) DetectAddressFree(db);
2990  return 0;
2991 }
2992 
2993 static int AddressTestCmp07(void)
2994 {
2995  DetectAddress *da = NULL, *db = NULL;
2996  int result = 1;
2997 
2998  da = DetectAddressParseSingle("2001::/3");
2999  if (da == NULL) goto error;
3000  db = DetectAddressParseSingle("2001::1/3");
3001  if (db == NULL) goto error;
3002 
3003  if (DetectAddressCmp(da, db) != ADDRESS_EQ)
3004  result = 0;
3005 
3006  DetectAddressFree(da);
3007  DetectAddressFree(db);
3008  return result;
3009 
3010 error:
3011  if (da) DetectAddressFree(da);
3012  if (db) DetectAddressFree(db);
3013  return 0;
3014 }
3015 
3016 static int AddressTestCmp08(void)
3017 {
3018  DetectAddress *da = NULL, *db = NULL;
3019  int result = 1;
3020 
3021  da = DetectAddressParseSingle("2001::/3");
3022  if (da == NULL) goto error;
3023  db = DetectAddressParseSingle("2001::/8");
3024  if (db == NULL) goto error;
3025 
3026  if (DetectAddressCmp(da, db) != ADDRESS_EB)
3027  result = 0;
3028 
3029  DetectAddressFree(da);
3030  DetectAddressFree(db);
3031  return result;
3032 
3033 error:
3034  if (da) DetectAddressFree(da);
3035  if (db) DetectAddressFree(db);
3036  return 0;
3037 }
3038 
3039 static int AddressTestCmp09(void)
3040 {
3041  DetectAddress *da = NULL, *db = NULL;
3042  int result = 1;
3043 
3044  da = DetectAddressParseSingle("2001::/8");
3045  if (da == NULL) goto error;
3046  db = DetectAddressParseSingle("2001::/3");
3047  if (db == NULL) goto error;
3048 
3049  if (DetectAddressCmp(da, db) != ADDRESS_ES)
3050  result = 0;
3051 
3052  DetectAddressFree(da);
3053  DetectAddressFree(db);
3054  return result;
3055 
3056 error:
3057  if (da) DetectAddressFree(da);
3058  if (db) DetectAddressFree(db);
3059  return 0;
3060 }
3061 
3062 static int AddressTestCmp10(void)
3063 {
3064  DetectAddress *da = NULL, *db = NULL;
3065  int result = 1;
3066 
3067  da = DetectAddressParseSingle("2001:1:2:3:0:0:0:0/64");
3068  if (da == NULL) goto error;
3069  db = DetectAddressParseSingle("2001:1:2:4:0:0:0:0/64");
3070  if (db == NULL) goto error;
3071 
3072  if (DetectAddressCmp(da, db) != ADDRESS_LT)
3073  result = 0;
3074 
3075  DetectAddressFree(da);
3076  DetectAddressFree(db);
3077  return result;
3078 
3079 error:
3080  if (da) DetectAddressFree(da);
3081  if (db) DetectAddressFree(db);
3082  return 0;
3083 }
3084 
3085 static int AddressTestCmp11(void)
3086 {
3087  DetectAddress *da = NULL, *db = NULL;
3088  int result = 1;
3089 
3090  da = DetectAddressParseSingle("2001:1:2:4:0:0:0:0/64");
3091  if (da == NULL) goto error;
3092  db = DetectAddressParseSingle("2001:1:2:3:0:0:0:0/64");
3093  if (db == NULL) goto error;
3094 
3095  if (DetectAddressCmp(da, db) != ADDRESS_GT)
3096  result = 0;
3097 
3098  DetectAddressFree(da);
3099  DetectAddressFree(db);
3100  return result;
3101 
3102 error:
3103  if (da) DetectAddressFree(da);
3104  if (db) DetectAddressFree(db);
3105  return 0;
3106 }
3107 
3108 static int AddressTestCmp12(void)
3109 {
3110  DetectAddress *da = NULL, *db = NULL;
3111  int result = 1;
3112 
3113  da = DetectAddressParseSingle("2001:1:2:3:1:0:0:0/64");
3114  if (da == NULL) goto error;
3115  db = DetectAddressParseSingle("2001:1:2:3:2:0:0:0/64");
3116  if (db == NULL) goto error;
3117 
3118  if (DetectAddressCmp(da, db) != ADDRESS_EQ)
3119  result = 0;
3120 
3121  DetectAddressFree(da);
3122  DetectAddressFree(db);
3123  return result;
3124 
3125 error:
3126  if (da) DetectAddressFree(da);
3127  if (db) DetectAddressFree(db);
3128  return 0;
3129 }
3130 
3131 static int AddressTestAddressGroupSetup01(void)
3132 {
3133  int result = 0;
3134  DetectAddressHead *gh = DetectAddressHeadInit();
3135 
3136  if (gh != NULL) {
3137  int r = DetectAddressParse(NULL, gh, "1.2.3.4", NULL);
3138  if (r == 0)
3139  result = 1;
3140 
3141  DetectAddressHeadFree(gh);
3142  }
3143  return result;
3144 }
3145 
3146 static int AddressTestAddressGroupSetup02(void)
3147 {
3148  int result = 0;
3149  DetectAddressHead *gh = DetectAddressHeadInit();
3150 
3151  if (gh != NULL) {
3152  int r = DetectAddressParse(NULL, gh, "1.2.3.4", NULL);
3153  if (r == 0 && gh->ipv4_head != NULL)
3154  result = 1;
3155 
3156  DetectAddressHeadFree(gh);
3157  }
3158  return result;
3159 }
3160 
3161 static int AddressTestAddressGroupSetup03(void)
3162 {
3163  int result = 0;
3164  DetectAddressHead *gh = DetectAddressHeadInit();
3165 
3166  if (gh != NULL) {
3167  int r = DetectAddressParse(NULL, gh, "1.2.3.4", NULL);
3168  if (r == 0 && gh->ipv4_head != NULL) {
3169  DetectAddress *prev_head = gh->ipv4_head;
3170 
3171  r = DetectAddressParse(NULL, gh, "1.2.3.3", NULL);
3172  if (r == 0 && gh->ipv4_head != prev_head &&
3173  gh->ipv4_head != NULL && gh->ipv4_head->next == prev_head) {
3174  result = 1;
3175  }
3176  }
3177 
3178  DetectAddressHeadFree(gh);
3179  }
3180  return result;
3181 }
3182 
3183 static int AddressTestAddressGroupSetup04(void)
3184 {
3185  int result = 0;
3186  DetectAddressHead *gh = DetectAddressHeadInit();
3187 
3188  if (gh != NULL) {
3189  int r = DetectAddressParse(NULL, gh, "1.2.3.4", NULL);
3190  if (r == 0 && gh->ipv4_head != NULL) {
3191  DetectAddress *prev_head = gh->ipv4_head;
3192 
3193  r = DetectAddressParse(NULL, gh, "1.2.3.3", NULL);
3194  if (r == 0 && gh->ipv4_head != prev_head &&
3195  gh->ipv4_head != NULL && gh->ipv4_head->next == prev_head) {
3196  DetectAddress *ph = gh->ipv4_head;
3197 
3198  r = DetectAddressParse(NULL, gh, "1.2.3.2", NULL);
3199  if (r == 0 && gh->ipv4_head != ph &&
3200  gh->ipv4_head != NULL && gh->ipv4_head->next == ph) {
3201  result = 1;
3202  }
3203  }
3204  }
3205 
3206  DetectAddressHeadFree(gh);
3207  }
3208  return result;
3209 }
3210 
3211 static int AddressTestAddressGroupSetup05(void)
3212 {
3213  int result = 0;
3214  DetectAddressHead *gh = DetectAddressHeadInit();
3215 
3216  if (gh != NULL) {
3217  int r = DetectAddressParse(NULL, gh, "1.2.3.2", NULL);
3218  if (r == 0 && gh->ipv4_head != NULL) {
3219  DetectAddress *prev_head = gh->ipv4_head;
3220 
3221  r = DetectAddressParse(NULL, gh, "1.2.3.3", NULL);
3222  if (r == 0 && gh->ipv4_head == prev_head &&
3223  gh->ipv4_head != NULL && gh->ipv4_head->next != prev_head) {
3224  DetectAddress *ph = gh->ipv4_head;
3225 
3226  r = DetectAddressParse(NULL, gh, "1.2.3.4", NULL);
3227  if (r == 0 && gh->ipv4_head == ph &&
3228  gh->ipv4_head != NULL && gh->ipv4_head->next != ph) {
3229  result = 1;
3230  }
3231  }
3232  }
3233 
3234  DetectAddressHeadFree(gh);
3235  }
3236  return result;
3237 }
3238 
3239 static int AddressTestAddressGroupSetup06(void)
3240 {
3241  int result = 0;
3242  DetectAddressHead *gh = DetectAddressHeadInit();
3243 
3244  if (gh != NULL) {
3245  int r = DetectAddressParse(NULL, gh, "1.2.3.2", NULL);
3246  if (r == 0 && gh->ipv4_head != NULL) {
3247  DetectAddress *prev_head = gh->ipv4_head;
3248 
3249  r = DetectAddressParse(NULL, gh, "1.2.3.2", NULL);
3250  if (r == 0 && gh->ipv4_head == prev_head &&
3251  gh->ipv4_head != NULL && gh->ipv4_head->next == NULL) {
3252  result = 1;
3253  }
3254  }
3255 
3256  DetectAddressHeadFree(gh);
3257  }
3258  return result;
3259 }
3260 
3261 static int AddressTestAddressGroupSetup07(void)
3262 {
3263  int result = 0;
3264  DetectAddressHead *gh = DetectAddressHeadInit();
3265 
3266  if (gh != NULL) {
3267  int r = DetectAddressParse(NULL, gh, "10.0.0.0/8", NULL);
3268  if (r == 0 && gh->ipv4_head != NULL) {
3269  r = DetectAddressParse(NULL, gh, "10.10.10.10", NULL);
3270  if (r == 0 && gh->ipv4_head != NULL &&
3271  gh->ipv4_head->next != NULL &&
3272  gh->ipv4_head->next->next != NULL) {
3273  result = 1;
3274  }
3275  }
3276 
3277  DetectAddressHeadFree(gh);
3278  }
3279  return result;
3280 }
3281 
3282 static int AddressTestAddressGroupSetup08(void)
3283 {
3284  int result = 0;
3285  DetectAddressHead *gh = DetectAddressHeadInit();
3286 
3287  if (gh != NULL) {
3288  int r = DetectAddressParse(NULL, gh, "10.10.10.10", NULL);
3289  if (r == 0 && gh->ipv4_head != NULL) {
3290  r = DetectAddressParse(NULL, gh, "10.0.0.0/8", NULL);
3291  if (r == 0 && gh->ipv4_head != NULL &&
3292  gh->ipv4_head->next != NULL &&
3293  gh->ipv4_head->next->next != NULL) {
3294  result = 1;
3295  }
3296  }
3297 
3298  DetectAddressHeadFree(gh);
3299  }
3300  return result;
3301 }
3302 
3303 static int AddressTestAddressGroupSetup09(void)
3304 {
3305  int result = 0;
3306  DetectAddressHead *gh = DetectAddressHeadInit();
3307 
3308  if (gh != NULL) {
3309  int r = DetectAddressParse(NULL, gh, "10.10.10.0/24", NULL);
3310  if (r == 0 && gh->ipv4_head != NULL) {
3311  r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1", NULL);
3312  if (r == 0 && gh->ipv4_head != NULL &&
3313  gh->ipv4_head->next != NULL &&
3314  gh->ipv4_head->next->next != NULL) {
3315  result = 1;
3316  }
3317  }
3318 
3319  DetectAddressHeadFree(gh);
3320  }
3321  return result;
3322 }
3323 
3324 static int AddressTestAddressGroupSetup10(void)
3325 {
3326  int result = 0;
3327  DetectAddressHead *gh = DetectAddressHeadInit();
3328 
3329  if (gh != NULL) {
3330  int r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1", NULL);
3331  if (r == 0 && gh->ipv4_head != NULL) {
3332  r = DetectAddressParse(NULL, gh, "10.10.10.0/24", NULL);
3333  if (r == 0 && gh->ipv4_head != NULL &&
3334  gh->ipv4_head->next != NULL &&
3335  gh->ipv4_head->next->next != NULL) {
3336  result = 1;
3337  }
3338  }
3339 
3340  DetectAddressHeadFree(gh);
3341  }
3342  return result;
3343 }
3344 
3345 static int AddressTestAddressGroupSetup11(void)
3346 {
3347  int result = 0;
3348  DetectAddressHead *gh = DetectAddressHeadInit();
3349 
3350  if (gh != NULL) {
3351  int r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1", NULL);
3352  if (r == 0) {
3353  r = DetectAddressParse(NULL, gh, "10.10.10.0/24", NULL);
3354  if (r == 0) {
3355  r = DetectAddressParse(NULL, gh, "0.0.0.0/0", NULL);
3356  if (r == 0) {
3357  DetectAddress *one = gh->ipv4_head, *two = one->next,
3358  *three = two->next, *four = three->next,
3359  *five = four->next;
3360 
3361  /* result should be:
3362  * 0.0.0.0/10.10.9.255
3363  * 10.10.10.0/10.10.10.9
3364  * 10.10.10.10/10.10.10.255
3365  * 10.10.11.0/10.10.11.1
3366  * 10.10.11.2/255.255.255.255
3367  */
3368  if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == SCNtohl(168430079) &&
3369  two->ip.addr_data32[0] == SCNtohl(168430080) && two->ip2.addr_data32[0] == SCNtohl(168430089) &&
3370  three->ip.addr_data32[0] == SCNtohl(168430090) && three->ip2.addr_data32[0] == SCNtohl(168430335) &&
3371  four->ip.addr_data32[0] == SCNtohl(168430336) && four->ip2.addr_data32[0] == SCNtohl(168430337) &&
3372  five->ip.addr_data32[0] == SCNtohl(168430338) && five->ip2.addr_data32[0] == 0xFFFFFFFF) {
3373  result = 1;
3374  }
3375  }
3376  }
3377  }
3378 
3379  DetectAddressHeadFree(gh);
3380  }
3381  return result;
3382 }
3383 
3384 static int AddressTestAddressGroupSetup12 (void)
3385 {
3386  int result = 0;
3387  DetectAddressHead *gh = DetectAddressHeadInit();
3388 
3389  if (gh != NULL) {
3390  int r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1", NULL);
3391  if (r == 0) {
3392  r = DetectAddressParse(NULL, gh, "0.0.0.0/0", NULL);
3393  if (r == 0) {
3394  r = DetectAddressParse(NULL, gh, "10.10.10.0/24", NULL);
3395  if (r == 0) {
3396  DetectAddress *one = gh->ipv4_head, *two = one->next,
3397  *three = two->next, *four = three->next,
3398  *five = four->next;
3399 
3400  /* result should be:
3401  * 0.0.0.0/10.10.9.255
3402  * 10.10.10.0/10.10.10.9
3403  * 10.10.10.10/10.10.10.255
3404  * 10.10.11.0/10.10.11.1
3405  * 10.10.11.2/255.255.255.255
3406  */
3407  if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == SCNtohl(168430079) &&
3408  two->ip.addr_data32[0] == SCNtohl(168430080) && two->ip2.addr_data32[0] == SCNtohl(168430089) &&
3409  three->ip.addr_data32[0] == SCNtohl(168430090) && three->ip2.addr_data32[0] == SCNtohl(168430335) &&
3410  four->ip.addr_data32[0] == SCNtohl(168430336) && four->ip2.addr_data32[0] == SCNtohl(168430337) &&
3411  five->ip.addr_data32[0] == SCNtohl(168430338) && five->ip2.addr_data32[0] == 0xFFFFFFFF) {
3412  result = 1;
3413  }
3414  }
3415  }
3416  }
3417 
3418  DetectAddressHeadFree(gh);
3419  }
3420  return result;
3421 }
3422 
3423 static int AddressTestAddressGroupSetup13(void)
3424 {
3425  int result = 0;
3426  DetectAddressHead *gh = DetectAddressHeadInit();
3427 
3428  if (gh != NULL) {
3429  int r = DetectAddressParse(NULL, gh, "0.0.0.0/0", NULL);
3430  if (r == 0) {
3431  r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1", NULL);
3432  if (r == 0) {
3433  r = DetectAddressParse(NULL, gh, "10.10.10.0/24", NULL);
3434  if (r == 0) {
3435  DetectAddress *one = gh->ipv4_head, *two = one->next,
3436  *three = two->next, *four = three->next,
3437  *five = four->next;
3438 
3439  /* result should be:
3440  * 0.0.0.0/10.10.9.255
3441  * 10.10.10.0/10.10.10.9
3442  * 10.10.10.10/10.10.10.255
3443  * 10.10.11.0/10.10.11.1
3444  * 10.10.11.2/255.255.255.255
3445  */
3446  if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == SCNtohl(168430079) &&
3447  two->ip.addr_data32[0] == SCNtohl(168430080) && two->ip2.addr_data32[0] == SCNtohl(168430089) &&
3448  three->ip.addr_data32[0] == SCNtohl(168430090) && three->ip2.addr_data32[0] == SCNtohl(168430335) &&
3449  four->ip.addr_data32[0] == SCNtohl(168430336) && four->ip2.addr_data32[0] == SCNtohl(168430337) &&
3450  five->ip.addr_data32[0] == SCNtohl(168430338) && five->ip2.addr_data32[0] == 0xFFFFFFFF) {
3451  result = 1;
3452  }
3453  }
3454  }
3455  }
3456 
3457  DetectAddressHeadFree(gh);
3458  }
3459  return result;
3460 }
3461 
3462 static int AddressTestAddressGroupSetupIPv414(void)
3463 {
3464  DetectAddressHead *gh = DetectAddressHeadInit();
3465  FAIL_IF_NULL(gh);
3466 
3467  int r = DetectAddressParse(NULL, gh, "!1.2.3.4", NULL);
3468  FAIL_IF_NOT(r == 1);
3469 
3470  DetectAddress *one = gh->ipv4_head;
3471  FAIL_IF_NULL(one);
3472  DetectAddress *two = one->next;
3473  FAIL_IF_NULL(two);
3474 
3475  /* result should be:
3476  * 0.0.0.0/1.2.3.3
3477  * 1.2.3.5/255.255.255.255
3478  */
3479  FAIL_IF_NOT(one->ip.addr_data32[0] == 0x00000000);
3480  FAIL_IF_NOT(one->ip2.addr_data32[0] == SCNtohl(16909059));
3481  FAIL_IF_NOT(two->ip.addr_data32[0] == SCNtohl(16909061));
3482  FAIL_IF_NOT(two->ip2.addr_data32[0] == 0xFFFFFFFF);
3483  DetectAddressHeadFree(gh);
3484 
3485  PASS;
3486 }
3487 
3488 static int AddressTestAddressGroupSetupIPv415(void)
3489 {
3490  DetectAddressHead *gh = DetectAddressHeadInit();
3491  FAIL_IF_NULL(gh);
3492 
3493  int r = DetectAddressParse(NULL, gh, "!0.0.0.0", NULL);
3494  FAIL_IF_NOT(r == 1);
3495 
3496  DetectAddress *one = gh->ipv4_head;
3497  FAIL_IF_NULL(one);
3498  FAIL_IF_NOT_NULL(one->next);
3499 
3500  /* result should be:
3501  * 0.0.0.1/255.255.255.255
3502  */
3503  FAIL_IF_NOT(one->ip.addr_data32[0] == SCNtohl(1));
3504  FAIL_IF_NOT(one->ip2.addr_data32[0] == 0xFFFFFFFF);
3505 
3506  DetectAddressHeadFree(gh);
3507  PASS;
3508 }
3509 
3510 static int AddressTestAddressGroupSetupIPv416(void)
3511 {
3512  DetectAddressHead *gh = DetectAddressHeadInit();
3513  FAIL_IF_NULL(gh);
3514 
3515  int r = DetectAddressParse(NULL, gh, "!255.255.255.255", NULL);
3516  FAIL_IF_NOT(r == 1);
3517 
3518  DetectAddress *one = gh->ipv4_head;
3519  FAIL_IF_NULL(one);
3520  FAIL_IF_NOT_NULL(one->next);
3521 
3522  /* result should be:
3523  * 0.0.0.0/255.255.255.254
3524  */
3525  FAIL_IF_NOT(one->ip.addr_data32[0] == 0x00000000);
3526  FAIL_IF_NOT(one->ip2.addr_data32[0] == SCNtohl(4294967294));
3527 
3528  DetectAddressHeadFree(gh);
3529  PASS;
3530 }
3531 
3532 static int AddressTestAddressGroupSetup14(void)
3533 {
3534  int result = 0;
3535  DetectAddressHead *gh = DetectAddressHeadInit();
3536 
3537  if (gh != NULL) {
3538  int r = DetectAddressParse(NULL, gh, "2001::1", NULL);
3539  if (r == 0)
3540  result = 1;
3541 
3542  DetectAddressHeadFree(gh);
3543  }
3544  return result;
3545 }
3546 
3547 static int AddressTestAddressGroupSetup15(void)
3548 {
3549  int result = 0;
3550  DetectAddressHead *gh = DetectAddressHeadInit();
3551 
3552  if (gh != NULL) {
3553  int r = DetectAddressParse(NULL, gh, "2001::1", NULL);
3554  if (r == 0 && gh->ipv6_head != NULL)
3555  result = 1;
3556 
3557  DetectAddressHeadFree(gh);
3558  }
3559  return result;
3560 }
3561 
3562 static int AddressTestAddressGroupSetup16(void)
3563 {
3564  int result = 0;
3565  DetectAddressHead *gh = DetectAddressHeadInit();
3566 
3567  if (gh != NULL) {
3568  int r = DetectAddressParse(NULL, gh, "2001::4", NULL);
3569  if (r == 0 && gh->ipv6_head != NULL) {
3570  DetectAddress *prev_head = gh->ipv6_head;
3571 
3572  r = DetectAddressParse(NULL, gh, "2001::3", NULL);
3573  if (r == 0 && gh->ipv6_head != prev_head &&
3574  gh->ipv6_head != NULL && gh->ipv6_head->next == prev_head) {
3575  result = 1;
3576  }
3577  }
3578 
3579  DetectAddressHeadFree(gh);
3580  }
3581  return result;
3582 }
3583 
3584 static int AddressTestAddressGroupSetup17(void)
3585 {
3586  int result = 0;
3587  DetectAddressHead *gh = DetectAddressHeadInit();
3588 
3589  if (gh != NULL) {
3590  int r = DetectAddressParse(NULL, gh, "2001::4", NULL);
3591  if (r == 0 && gh->ipv6_head != NULL) {
3592  DetectAddress *prev_head = gh->ipv6_head;
3593 
3594  r = DetectAddressParse(NULL, gh, "2001::3", NULL);
3595  if (r == 0 && gh->ipv6_head != prev_head &&
3596  gh->ipv6_head != NULL && gh->ipv6_head->next == prev_head) {
3597  DetectAddress *ph = gh->ipv6_head;
3598 
3599  r = DetectAddressParse(NULL, gh, "2001::2", NULL);
3600  if (r == 0 && gh->ipv6_head != ph &&
3601  gh->ipv6_head != NULL && gh->ipv6_head->next == ph) {
3602  result = 1;
3603  }
3604  }
3605  }
3606 
3607  DetectAddressHeadFree(gh);
3608  }
3609  return result;
3610 }
3611 
3612 static int AddressTestAddressGroupSetup18(void)
3613 {
3614  int result = 0;
3615  DetectAddressHead *gh = DetectAddressHeadInit();
3616 
3617  if (gh != NULL) {
3618  int r = DetectAddressParse(NULL, gh, "2001::2", NULL);
3619  if (r == 0 && gh->ipv6_head != NULL) {
3620  DetectAddress *prev_head = gh->ipv6_head;
3621 
3622  r = DetectAddressParse(NULL, gh, "2001::3", NULL);
3623  if (r == 0 && gh->ipv6_head == prev_head &&
3624  gh->ipv6_head != NULL && gh->ipv6_head->next != prev_head) {
3625  DetectAddress *ph = gh->ipv6_head;
3626 
3627  r = DetectAddressParse(NULL, gh, "2001::4", NULL);
3628  if (r == 0 && gh->ipv6_head == ph &&
3629  gh->ipv6_head != NULL && gh->ipv6_head->next != ph) {
3630  result = 1;
3631  }
3632  }
3633  }
3634 
3635  DetectAddressHeadFree(gh);
3636  }
3637  return result;
3638 }
3639 
3640 static int AddressTestAddressGroupSetup19(void)
3641 {
3642  int result = 0;
3643  DetectAddressHead *gh = DetectAddressHeadInit();
3644 
3645  if (gh != NULL) {
3646  int r = DetectAddressParse(NULL, gh, "2001::2", NULL);
3647  if (r == 0 && gh->ipv6_head != NULL) {
3648  DetectAddress *prev_head = gh->ipv6_head;
3649 
3650  r = DetectAddressParse(NULL, gh, "2001::2", NULL);
3651  if (r == 0 && gh->ipv6_head == prev_head &&
3652  gh->ipv6_head != NULL && gh->ipv6_head->next == NULL) {
3653  result = 1;
3654  }
3655  }
3656 
3657  DetectAddressHeadFree(gh);
3658  }
3659  return result;
3660 }
3661 
3662 static int AddressTestAddressGroupSetup20(void)
3663 {
3664  int result = 0;
3665  DetectAddressHead *gh = DetectAddressHeadInit();
3666 
3667  if (gh != NULL) {
3668  int r = DetectAddressParse(NULL, gh, "2000::/3", NULL);
3669  if (r == 0 && gh->ipv6_head != NULL) {
3670  r = DetectAddressParse(NULL, gh, "2001::4", NULL);
3671  if (r == 0 && gh->ipv6_head != NULL &&
3672  gh->ipv6_head->next != NULL &&
3673  gh->ipv6_head->next->next != NULL) {
3674  result = 1;
3675  }
3676  }
3677 
3678  DetectAddressHeadFree(gh);
3679  }
3680  return result;
3681 }
3682 
3683 static int AddressTestAddressGroupSetup21(void)
3684 {
3685  int result = 0;
3686  DetectAddressHead *gh = DetectAddressHeadInit();
3687 
3688  if (gh != NULL) {
3689  int r = DetectAddressParse(NULL, gh, "2001::4", NULL);
3690  if (r == 0 && gh->ipv6_head != NULL) {
3691  r = DetectAddressParse(NULL, gh, "2000::/3", NULL);
3692  if (r == 0 && gh->ipv6_head != NULL &&
3693  gh->ipv6_head->next != NULL &&
3694  gh->ipv6_head->next->next != NULL) {
3695  result = 1;
3696  }
3697  }
3698 
3699  DetectAddressHeadFree(gh);
3700  }
3701  return result;
3702 }
3703 
3704 static int AddressTestAddressGroupSetup22(void)
3705 {
3706  int result = 0;
3707  DetectAddressHead *gh = DetectAddressHeadInit();
3708 
3709  if (gh != NULL) {
3710  int r = DetectAddressParse(NULL, gh, "2000::/3", NULL);
3711  if (r == 0 && gh->ipv6_head != NULL) {
3712  r = DetectAddressParse(NULL, gh, "2001::4-2001::6", NULL);
3713  if (r == 0 && gh->ipv6_head != NULL &&
3714  gh->ipv6_head->next != NULL &&
3715  gh->ipv6_head->next->next != NULL) {
3716  result = 1;
3717  }
3718  }
3719 
3720  DetectAddressHeadFree(gh);
3721  }
3722  return result;
3723 }
3724 
3725 static int AddressTestAddressGroupSetup23(void)
3726 {
3727  int result = 0;
3728  DetectAddressHead *gh = DetectAddressHeadInit();
3729 
3730  if (gh != NULL) {
3731  int r = DetectAddressParse(NULL, gh, "2001::4-2001::6", NULL);
3732  if (r == 0 && gh->ipv6_head != NULL) {
3733  r = DetectAddressParse(NULL, gh, "2000::/3", NULL);
3734  if (r == 0 && gh->ipv6_head != NULL &&
3735  gh->ipv6_head->next != NULL &&
3736  gh->ipv6_head->next->next != NULL) {
3737  result = 1;
3738  }
3739  }
3740 
3741  DetectAddressHeadFree(gh);
3742  }
3743  return result;
3744 }
3745 
3746 static int AddressTestAddressGroupSetup24(void)
3747 {
3748  int result = 0;
3749  DetectAddressHead *gh = DetectAddressHeadInit();
3750 
3751  if (gh != NULL) {
3752  int r = DetectAddressParse(NULL, gh, "2001::4-2001::6", NULL);
3753  if (r == 0) {
3754  r = DetectAddressParse(NULL, gh, "2001::/3", NULL);
3755  if (r == 0) {
3756  r = DetectAddressParse(NULL, gh, "::/0", NULL);
3757  if (r == 0) {
3758  DetectAddress *one = gh->ipv6_head, *two = one->next,
3759  *three = two->next, *four = three->next,
3760  *five = four->next;
3761  if (one->ip.addr_data32[0] == 0x00000000 &&
3762  one->ip.addr_data32[1] == 0x00000000 &&
3763  one->ip.addr_data32[2] == 0x00000000 &&
3764  one->ip.addr_data32[3] == 0x00000000 &&
3765  one->ip2.addr_data32[0] == SCNtohl(536870911) &&
3766  one->ip2.addr_data32[1] == 0xFFFFFFFF &&
3767  one->ip2.addr_data32[2] == 0xFFFFFFFF &&
3768  one->ip2.addr_data32[3] == 0xFFFFFFFF &&
3769 
3770  two->ip.addr_data32[0] == SCNtohl(536870912) &&
3771  two->ip.addr_data32[1] == 0x00000000 &&
3772  two->ip.addr_data32[2] == 0x00000000 &&
3773  two->ip.addr_data32[3] == 0x00000000 &&
3774  two->ip2.addr_data32[0] == SCNtohl(536936448) &&
3775  two->ip2.addr_data32[1] == 0x00000000 &&
3776  two->ip2.addr_data32[2] == 0x00000000 &&
3777  two->ip2.addr_data32[3] == SCNtohl(3) &&
3778 
3779  three->ip.addr_data32[0] == SCNtohl(536936448) &&
3780  three->ip.addr_data32[1] == 0x00000000 &&
3781  three->ip.addr_data32[2] == 0x00000000 &&
3782  three->ip.addr_data32[3] == SCNtohl(4) &&
3783  three->ip2.addr_data32[0] == SCNtohl(536936448) &&
3784  three->ip2.addr_data32[1] == 0x00000000 &&
3785  three->ip2.addr_data32[2] == 0x00000000 &&
3786  three->ip2.addr_data32[3] == SCNtohl(6) &&
3787 
3788  four->ip.addr_data32[0] == SCNtohl(536936448) &&
3789  four->ip.addr_data32[1] == 0x00000000 &&
3790  four->ip.addr_data32[2] == 0x00000000 &&
3791  four->ip.addr_data32[3] == SCNtohl(7) &&
3792  four->ip2.addr_data32[0] == SCNtohl(1073741823) &&
3793  four->ip2.addr_data32[1] == 0xFFFFFFFF &&
3794  four->ip2.addr_data32[2] == 0xFFFFFFFF &&
3795  four->ip2.addr_data32[3] == 0xFFFFFFFF &&
3796 
3797  five->ip.addr_data32[0] == SCNtohl(1073741824) &&
3798  five->ip.addr_data32[1] == 0x00000000 &&
3799  five->ip.addr_data32[2] == 0x00000000 &&
3800  five->ip.addr_data32[3] == 0x00000000 &&
3801  five->ip2.addr_data32[0] == 0xFFFFFFFF &&
3802  five->ip2.addr_data32[1] == 0xFFFFFFFF &&
3803  five->ip2.addr_data32[2] == 0xFFFFFFFF &&
3804  five->ip2.addr_data32[3] == 0xFFFFFFFF) {
3805  result = 1;
3806  }
3807  }
3808  }
3809  }
3810 
3811  DetectAddressHeadFree(gh);
3812  }
3813  return result;
3814 }
3815 
3816 static int AddressTestAddressGroupSetup25(void)
3817 {
3818  int result = 0;
3819  DetectAddressHead *gh = DetectAddressHeadInit();
3820 
3821  if (gh != NULL) {
3822  int r = DetectAddressParse(NULL, gh, "2001::4-2001::6", NULL);
3823  if (r == 0) {
3824  r = DetectAddressParse(NULL, gh, "::/0", NULL);
3825  if (r == 0) {
3826  r = DetectAddressParse(NULL, gh, "2001::/3", NULL);
3827  if (r == 0) {
3828  DetectAddress *one = gh->ipv6_head, *two = one->next,
3829  *three = two->next, *four = three->next,
3830  *five = four->next;
3831  if (one->ip.addr_data32[0] == 0x00000000 &&
3832  one->ip.addr_data32[1] == 0x00000000 &&
3833  one->ip.addr_data32[2] == 0x00000000 &&
3834  one->ip.addr_data32[3] == 0x00000000 &&
3835  one->ip2.addr_data32[0] == SCNtohl(536870911) &&
3836  one->ip2.addr_data32[1] == 0xFFFFFFFF &&
3837  one->ip2.addr_data32[2] == 0xFFFFFFFF &&
3838  one->ip2.addr_data32[3] == 0xFFFFFFFF &&
3839 
3840  two->ip.addr_data32[0] == SCNtohl(536870912) &&
3841  two->ip.addr_data32[1] == 0x00000000 &&
3842  two->ip.addr_data32[2] == 0x00000000 &&
3843  two->ip.addr_data32[3] == 0x00000000 &&
3844  two->ip2.addr_data32[0] == SCNtohl(536936448) &&
3845  two->ip2.addr_data32[1] == 0x00000000 &&
3846  two->ip2.addr_data32[2] == 0x00000000 &&
3847  two->ip2.addr_data32[3] == SCNtohl(3) &&
3848 
3849  three->ip.addr_data32[0] == SCNtohl(536936448) &&
3850  three->ip.addr_data32[1] == 0x00000000 &&
3851  three->ip.addr_data32[2] == 0x00000000 &&
3852  three->ip.addr_data32[3] == SCNtohl(4) &&
3853  three->ip2.addr_data32[0] == SCNtohl(536936448) &&
3854  three->ip2.addr_data32[1] == 0x00000000 &&
3855  three->ip2.addr_data32[2] == 0x00000000 &&
3856  three->ip2.addr_data32[3] == SCNtohl(6) &&
3857 
3858  four->ip.addr_data32[0] == SCNtohl(536936448) &&
3859  four->ip.addr_data32[1] == 0x00000000 &&
3860  four->ip.addr_data32[2] == 0x00000000 &&
3861  four->ip.addr_data32[3] == SCNtohl(7) &&
3862  four->ip2.addr_data32[0] == SCNtohl(1073741823) &&
3863  four->ip2.addr_data32[1] == 0xFFFFFFFF &&
3864  four->ip2.addr_data32[2] == 0xFFFFFFFF &&
3865  four->ip2.addr_data32[3] == 0xFFFFFFFF &&
3866 
3867  five->ip.addr_data32[0] == SCNtohl(1073741824) &&
3868  five->ip.addr_data32[1] == 0x00000000 &&
3869  five->ip.addr_data32[2] == 0x00000000 &&
3870  five->ip.addr_data32[3] == 0x00000000 &&
3871  five->ip2.addr_data32[0] == 0xFFFFFFFF &&
3872  five->ip2.addr_data32[1] == 0xFFFFFFFF &&
3873  five->ip2.addr_data32[2] == 0xFFFFFFFF &&
3874  five->ip2.addr_data32[3] == 0xFFFFFFFF) {
3875  result = 1;
3876  }
3877  }
3878  }
3879  }
3880 
3881  DetectAddressHeadFree(gh);
3882  }
3883  return result;
3884 }
3885 
3886 static int AddressTestAddressGroupSetup26(void)
3887 {
3888  int result = 0;
3889  DetectAddressHead *gh = DetectAddressHeadInit();
3890 
3891  if (gh != NULL) {
3892  int r = DetectAddressParse(NULL, gh, "::/0", NULL);
3893  if (r == 0) {
3894  r = DetectAddressParse(NULL, gh, "2001::4-2001::6", NULL);
3895  if (r == 0) {
3896  r = DetectAddressParse(NULL, gh, "2001::/3", NULL);
3897  if (r == 0) {
3898  DetectAddress *one = gh->ipv6_head, *two = one->next,
3899  *three = two->next, *four = three->next,
3900  *five = four->next;
3901  if (one->ip.addr_data32[0] == 0x00000000 &&
3902  one->ip.addr_data32[1] == 0x00000000 &&
3903  one->ip.addr_data32[2] == 0x00000000 &&
3904  one->ip.addr_data32[3] == 0x00000000 &&
3905  one->ip2.addr_data32[0] == SCNtohl(536870911) &&
3906  one->ip2.addr_data32[1] == 0xFFFFFFFF &&
3907  one->ip2.addr_data32[2] == 0xFFFFFFFF &&
3908  one->ip2.addr_data32[3] == 0xFFFFFFFF &&
3909 
3910  two->ip.addr_data32[0] == SCNtohl(536870912) &&
3911  two->ip.addr_data32[1] == 0x00000000 &&
3912  two->ip.addr_data32[2] == 0x00000000 &&
3913  two->ip.addr_data32[3] == 0x00000000 &&
3914  two->ip2.addr_data32[0] == SCNtohl(536936448) &&
3915  two->ip2.addr_data32[1] == 0x00000000 &&
3916  two->ip2.addr_data32[2] == 0x00000000 &&
3917  two->ip2.addr_data32[3] == SCNtohl(3) &&
3918 
3919  three->ip.addr_data32[0] == SCNtohl(536936448) &&
3920  three->ip.addr_data32[1] == 0x00000000 &&
3921  three->ip.addr_data32[2] == 0x00000000 &&
3922  three->ip.addr_data32[3] == SCNtohl(4) &&
3923  three->ip2.addr_data32[0] == SCNtohl(536936448) &&
3924  three->ip2.addr_data32[1] == 0x00000000 &&
3925  three->ip2.addr_data32[2] == 0x00000000 &&
3926  three->ip2.addr_data32[3] == SCNtohl(6) &&
3927 
3928  four->ip.addr_data32[0] == SCNtohl(536936448) &&
3929  four->ip.addr_data32[1] == 0x00000000 &&
3930  four->ip.addr_data32[2] == 0x00000000 &&
3931  four->ip.addr_data32[3] == SCNtohl(7) &&
3932  four->ip2.addr_data32[0] == SCNtohl(1073741823) &&
3933  four->ip2.addr_data32[1] == 0xFFFFFFFF &&
3934  four->ip2.addr_data32[2] == 0xFFFFFFFF &&
3935  four->ip2.addr_data32[3] == 0xFFFFFFFF &&
3936 
3937  five->ip.addr_data32[0] == SCNtohl(1073741824) &&
3938  five->ip.addr_data32[1] == 0x00000000 &&
3939  five->ip.addr_data32[2] == 0x00000000 &&
3940  five->ip.addr_data32[3] == 0x00000000 &&
3941  five->ip2.addr_data32[0] == 0xFFFFFFFF &&
3942  five->ip2.addr_data32[1] == 0xFFFFFFFF &&
3943  five->ip2.addr_data32[2] == 0xFFFFFFFF &&
3944  five->ip2.addr_data32[3] == 0xFFFFFFFF) {
3945  result = 1;
3946  }
3947  }
3948  }
3949  }
3950 
3951  DetectAddressHeadFree(gh);
3952  }
3953  return result;
3954 }
3955 
3956 static int AddressTestAddressGroupSetup27(void)
3957 {
3958  int result = 0;
3959  DetectAddressHead *gh = DetectAddressHeadInit();
3960 
3961  if (gh != NULL) {
3962  int r = DetectAddressParse(NULL, gh, "[1.2.3.4]", NULL);
3963  if (r == 0)
3964  result = 1;
3965 
3966  DetectAddressHeadFree(gh);
3967  }
3968  return result;
3969 }
3970 
3971 static int AddressTestAddressGroupSetup28(void)
3972 {
3973  int result = 0;
3974  DetectAddressHead *gh = DetectAddressHeadInit();
3975 
3976  if (gh != NULL) {
3977  int r = DetectAddressParse(NULL, gh, "[1.2.3.4,4.3.2.1]", NULL);
3978  if (r == 0)
3979  result = 1;
3980 
3981  DetectAddressHeadFree(gh);
3982  }
3983  return result;
3984 }
3985 
3986 static int AddressTestAddressGroupSetup29(void)
3987 {
3988  int result = 0;
3989  DetectAddressHead *gh = DetectAddressHeadInit();
3990 
3991  if (gh != NULL) {
3992  int r = DetectAddressParse(NULL, gh, "[1.2.3.4,4.3.2.1,10.10.10.10]", NULL);
3993  if (r == 0)
3994  result = 1;
3995 
3996  DetectAddressHeadFree(gh);
3997  }
3998  return result;
3999 }
4000 
4001 static int AddressTestAddressGroupSetup30(void)
4002 {
4003  int result = 0;
4004  DetectAddressHead *gh = DetectAddressHeadInit();
4005 
4006  if (gh != NULL) {
4007  int r = DetectAddressParse(
4008  NULL, gh, "[[1.2.3.4,2.3.4.5],4.3.2.1,[10.10.10.10,11.11.11.11]]", NULL);
4009  if (r == 0)
4010  result = 1;
4011 
4012  DetectAddressHeadFree(gh);
4013  }
4014  return result;
4015 }
4016 
4017 static int AddressTestAddressGroupSetup31(void)
4018 {
4019  int result = 0;
4020  DetectAddressHead *gh = DetectAddressHeadInit();
4021 
4022  if (gh != NULL) {
4023  int r = DetectAddressParse(NULL, gh,
4024  "[[1.2.3.4,[2.3.4.5,3.4.5.6]],4.3.2.1,[10.10.10.10,[11.11.11.11,12.12.12.12]]]",
4025  NULL);
4026  if (r == 0)
4027  result = 1;
4028 
4029  DetectAddressHeadFree(gh);
4030  }
4031  return result;
4032 }
4033 
4034 static int AddressTestAddressGroupSetup32(void)
4035 {
4036  int result = 0;
4037  DetectAddressHead *gh = DetectAddressHeadInit();
4038 
4039  if (gh != NULL) {
4040  int r = DetectAddressParse(NULL, gh,
4041  "[[1.2.3.4,[2.3.4.5,[3.4.5.6,4.5.6.7]]],4.3.2.1,[10.10.10.10,[11.11.11.11,[12.12."
4042  "12.12,13.13.13.13]]]]",
4043  NULL);
4044  if (r == 0)
4045  result = 1;
4046 
4047  DetectAddressHeadFree(gh);
4048  }
4049  return result;
4050 }
4051 
4052 static int AddressTestAddressGroupSetup33(void)
4053 {
4054  int result = 0;
4055  DetectAddressHead *gh = DetectAddressHeadInit();
4056 
4057  if (gh != NULL) {
4058  int r = DetectAddressParse(NULL, gh, "![1.1.1.1,[2.2.2.2,[3.3.3.3,4.4.4.4]]]", NULL);
4059  if (r == 1)
4060  result = 1;
4061 
4062  DetectAddressHeadFree(gh);
4063  }
4064  return result;
4065 }
4066 
4067 static int AddressTestAddressGroupSetup34(void)
4068 {
4069  int result = 0;
4070  DetectAddressHead *gh = DetectAddressHeadInit();
4071 
4072  if (gh != NULL) {
4073  int r = DetectAddressParse(NULL, gh, "[1.0.0.0/8,![1.1.1.1,[1.2.1.1,1.3.1.1]]]", NULL);
4074  if (r == 1)
4075  result = 1;
4076 
4077  DetectAddressHeadFree(gh);
4078  }
4079  return result;
4080 }
4081 
4082 static int AddressTestAddressGroupSetup35(void)
4083 {
4084  int result = 0;
4085  DetectAddressHead *gh = DetectAddressHeadInit();
4086 
4087  if (gh != NULL) {
4088  int r = DetectAddressParse(NULL, gh, "[1.0.0.0/8,[2.0.0.0/8,![1.1.1.1,2.2.2.2]]]", NULL);
4089  if (r == 1)
4090  result = 1;
4091 
4092  DetectAddressHeadFree(gh);
4093  }
4094  return result;
4095 }
4096 
4097 static int AddressTestAddressGroupSetup36 (void)
4098 {
4099  int result = 0;
4100 
4101  DetectAddressHead *gh = DetectAddressHeadInit();
4102  if (gh != NULL) {
4103  int r = DetectAddressParse(NULL, gh, "[1.0.0.0/8,[2.0.0.0/8,[3.0.0.0/8,!1.1.1.1]]]", NULL);
4104  if (r == 1)
4105  result = 1;
4106 
4107  DetectAddressHeadFree(gh);
4108  }
4109  return result;
4110 }
4111 
4112 static int AddressTestAddressGroupSetup37(void)
4113 {
4114  int result = 0;
4115  DetectAddressHead *gh = DetectAddressHeadInit();
4116 
4117  if (gh != NULL) {
4118  int r = DetectAddressParse(NULL, gh, "[0.0.0.0/0,::/0]", NULL);
4119  if (r == 0)
4120  result = 1;
4121 
4122  DetectAddressHeadFree(gh);
4123  }
4124  return result;
4125 }
4126 
4127 static int AddressTestAddressGroupSetup38(void)
4128 {
4129  UTHValidateDetectAddressHeadRange expectations[3] = {
4130  { "0.0.0.0", "192.167.255.255" },
4131  { "192.168.14.0", "192.168.14.255" },
4132  { "192.169.0.0", "255.255.255.255" } };
4133  int result = 0;
4134  DetectAddressHead *gh = DetectAddressHeadInit();
4135 
4136  if (gh != NULL) {
4137  int r = DetectAddressParse(NULL, gh, "![192.168.0.0/16,!192.168.14.0/24]", NULL);
4138  if (r == 1) {
4139  if (UTHValidateDetectAddressHead(gh, 3, expectations))
4140  result = 1;
4141  }
4142 
4143  DetectAddressHeadFree(gh);
4144  }
4145  return result;
4146 }
4147 
4148 static int AddressTestAddressGroupSetup39(void)
4149 {
4150  UTHValidateDetectAddressHeadRange expectations[3] = {
4151  { "0.0.0.0", "192.167.255.255" },
4152  { "192.168.14.0", "192.168.14.255" },
4153  { "192.169.0.0", "255.255.255.255" } };
4154  int result = 0;
4155  DetectAddressHead *gh = DetectAddressHeadInit();
4156 
4157  if (gh != NULL) {
4158  int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,!192.168.14.0/24]]", NULL);
4159  if (r == 1) {
4160  if (UTHValidateDetectAddressHead(gh, 3, expectations))
4161  result = 1;
4162  }
4163 
4164  DetectAddressHeadFree(gh);
4165  }
4166  return result;
4167 }
4168 
4169 static int AddressTestAddressGroupSetup40(void)
4170 {
4171  UTHValidateDetectAddressHeadRange expectations[3] = {
4172  { "0.0.0.0", "192.167.255.255" },
4173  { "192.168.14.0", "192.168.14.255" },
4174  { "192.169.0.0", "255.255.255.255" } };
4175  int result = 0;
4176  DetectAddressHead *gh = DetectAddressHeadInit();
4177  if (gh != NULL) {
4178  int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,[!192.168.14.0/24]]]", NULL);
4179  if (r == 1) {
4180  if (UTHValidateDetectAddressHead(gh, 3, expectations))
4181  result = 1;
4182  }
4183 
4184  DetectAddressHeadFree(gh);
4185  }
4186  return result;
4187 }
4188 
4189 static int AddressTestAddressGroupSetup41(void)
4190 {
4191  UTHValidateDetectAddressHeadRange expectations[3] = {
4192  { "0.0.0.0", "192.167.255.255" },
4193  { "192.168.14.0", "192.168.14.255" },
4194  { "192.169.0.0", "255.255.255.255" } };
4195  int result = 0;
4196  DetectAddressHead *gh = DetectAddressHeadInit();
4197  if (gh != NULL) {
4198  int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,![192.168.14.0/24]]]", NULL);
4199  if (r == 1) {
4200  if (UTHValidateDetectAddressHead(gh, 3, expectations))
4201  result = 1;
4202  }
4203 
4204  DetectAddressHeadFree(gh);
4205  }
4206  return result;
4207 }
4208 
4209 static int AddressTestAddressGroupSetup42(void)
4210 {
4211  UTHValidateDetectAddressHeadRange expectations[1] = {
4212  { "2000:0000:0000:0000:0000:0000:0000:0000", "3fff:ffff:ffff:ffff:ffff:ffff:ffff:ffff" } };
4213  int result = 0;
4214  DetectAddressHead *gh = DetectAddressHeadInit();
4215  if (gh != NULL) {
4216  int r = DetectAddressParse(NULL, gh, "[2001::/3]", NULL);
4217  if (r == 0) {
4218  if (UTHValidateDetectAddressHead(gh, 1, expectations))
4219  result = 1;
4220  }
4221 
4222  DetectAddressHeadFree(gh);
4223  }
4224  return result;
4225 }
4226 
4227 static int AddressTestAddressGroupSetup43(void)
4228 {
4229  UTHValidateDetectAddressHeadRange expectations[2] = {
4230  { "2000:0000:0000:0000:0000:0000:0000:0000", "2fff:ffff:ffff:ffff:ffff:ffff:ffff:ffff" },
4231  { "3800:0000:0000:0000:0000:0000:0000:0000", "3fff:ffff:ffff:ffff:ffff:ffff:ffff:ffff" } };
4232  int result = 0;
4233  DetectAddressHead *gh = DetectAddressHeadInit();
4234  if (gh != NULL) {
4235  int r = DetectAddressParse(NULL, gh, "[2001::/3,!3000::/5]", NULL);
4236  if (r == 1) {
4237  if (UTHValidateDetectAddressHead(gh, 2, expectations))
4238  result = 1;
4239  }
4240 
4241  DetectAddressHeadFree(gh);
4242  }
4243  return result;
4244 }
4245 
4246 static int AddressTestAddressGroupSetup44(void)
4247 {
4248  UTHValidateDetectAddressHeadRange expectations[2] = {
4249  { "3ffe:ffff:7654:feda:1245:ba98:0000:0000", "3ffe:ffff:7654:feda:1245:ba98:ffff:ffff" }};
4250  int result = 0;
4251  DetectAddressHead *gh = DetectAddressHeadInit();
4252  if (gh != NULL) {
4253  int r = DetectAddressParse(NULL, gh, "3ffe:ffff:7654:feda:1245:ba98:3210:4562/96", NULL);
4254  if (r == 0) {
4255  if (UTHValidateDetectAddressHead(gh, 1, expectations))
4256  result = 1;
4257  }
4258 
4259  DetectAddressHeadFree(gh);
4260  }
4261  return result;
4262 }
4263 
4264 static int AddressTestAddressGroupSetup45(void)
4265 {
4266  int result = 0;
4267  DetectAddressHead *gh = DetectAddressHeadInit();
4268  if (gh != NULL) {
4269  int r = DetectAddressParse(NULL, gh, "[192.168.1.3,!192.168.0.0/16]", NULL);
4270  if (r != 0) {
4271  result = 1;
4272  }
4273 
4274  DetectAddressHeadFree(gh);
4275  }
4276  return result;
4277 }
4278 
4279 static int AddressTestAddressGroupSetup46(void)
4280 {
4281  UTHValidateDetectAddressHeadRange expectations[4] = {
4282  { "0.0.0.0", "192.167.255.255" },
4283  { "192.168.1.0", "192.168.1.255" },
4284  { "192.168.3.0", "192.168.3.255" },
4285  { "192.169.0.0", "255.255.255.255" } };
4286  int result = 0;
4287  DetectAddressHead *gh = DetectAddressHeadInit();
4288  if (gh != NULL) {
4289  int r = DetectAddressParse(
4290  NULL, gh, "[![192.168.0.0/16,![192.168.1.0/24,192.168.3.0/24]]]", NULL);
4291  if (r == 1) {
4292  if (UTHValidateDetectAddressHead(gh, 4, expectations))
4293  result = 1;
4294  }
4295 
4296  DetectAddressHeadFree(gh);
4297  }
4298  return result;
4299 }
4300 
4301 /** \test net with some negations, then all negated */
4302 static int AddressTestAddressGroupSetup47(void)
4303 {
4304  UTHValidateDetectAddressHeadRange expectations[5] = {
4305  { "0.0.0.0", "192.167.255.255" },
4306  { "192.168.1.0", "192.168.1.255" },
4307  { "192.168.3.0", "192.168.3.255" },
4308  { "192.168.5.0", "192.168.5.255" },
4309  { "192.169.0.0", "255.255.255.255" } };
4310  int result = 0;
4311  DetectAddressHead *gh = DetectAddressHeadInit();
4312  if (gh != NULL) {
4313  int r = DetectAddressParse(NULL, gh,
4314  "[![192.168.0.0/16,![192.168.1.0/24,192.168.3.0/24],!192.168.5.0/24]]", NULL);
4315  if (r == 1) {
4316  if (UTHValidateDetectAddressHead(gh, 5, expectations))
4317  result = 1;
4318  }
4319 
4320  DetectAddressHeadFree(gh);
4321  }
4322  return result;
4323 }
4324 
4325 /** \test same as AddressTestAddressGroupSetup47, but not negated */
4326 static int AddressTestAddressGroupSetup48(void)
4327 {
4328  UTHValidateDetectAddressHeadRange expectations[4] = {
4329  { "192.168.0.0", "192.168.0.255" },
4330  { "192.168.2.0", "192.168.2.255" },
4331  { "192.168.4.0", "192.168.4.255" },
4332  { "192.168.6.0", "192.168.255.255" } };
4333  int result = 0;
4334  DetectAddressHead *gh = DetectAddressHeadInit();
4335  if (gh != NULL) {
4336  int r = DetectAddressParse(NULL, gh,
4337  "[192.168.0.0/16,![192.168.1.0/24,192.168.3.0/24],!192.168.5.0/24]", NULL);
4338  if (r == 1) {
4339  if (UTHValidateDetectAddressHead(gh, 4, expectations))
4340  result = 1;
4341  }
4342 
4343  DetectAddressHeadFree(gh);
4344  }
4345  return result;
4346 }
4347 
4348 static int AddressTestCutIPv401(void)
4349 {
4350  DetectAddress *c;
4351  DetectAddress *a = DetectAddressParseSingle("1.2.3.0/255.255.255.0");
4352  FAIL_IF_NULL(a);
4353  DetectAddress *b = DetectAddressParseSingle("1.2.2.0-1.2.3.4");
4354  FAIL_IF_NULL(b);
4355 
4356  FAIL_IF(DetectAddressCut(NULL, a, b, &c) == -1);
4357 
4358  DetectAddressFree(a);
4359  DetectAddressFree(b);
4360  DetectAddressFree(c);
4361  PASS;
4362 }
4363 
4364 static int AddressTestCutIPv402(void)
4365 {
4366  DetectAddress *a, *b, *c = NULL;
4367  a = DetectAddressParseSingle("1.2.3.0/255.255.255.0");
4368  b = DetectAddressParseSingle("1.2.2.0-1.2.3.4");
4369 
4370  if (DetectAddressCut(NULL, a, b, &c) == -1)
4371  goto error;
4372 
4373  if (c == NULL)
4374  goto error;
4375 
4376  DetectAddressFree(a);
4377  DetectAddressFree(b);
4378  DetectAddressFree(c);
4379  return 1;
4380 
4381 error:
4382  DetectAddressFree(a);
4383  DetectAddressFree(b);
4384  DetectAddressFree(c);
4385  return 0;
4386 }
4387 
4388 static int AddressTestCutIPv403(void)
4389 {
4390  DetectAddress *a, *b, *c = NULL;
4391  a = DetectAddressParseSingle("1.2.3.0/255.255.255.0");
4392  b = DetectAddressParseSingle("1.2.2.0-1.2.3.4");
4393 
4394  if (DetectAddressCut(NULL, a, b, &c) == -1)
4395  goto error;
4396 
4397  if (c == NULL)
4398  goto error;
4399 
4400  if (a->ip.addr_data32[0] != SCNtohl(16908800) || a->ip2.addr_data32[0] != SCNtohl(16909055))
4401  goto error;
4402  if (b->ip.addr_data32[0] != SCNtohl(16909056) || b->ip2.addr_data32[0] != SCNtohl(16909060))
4403  goto error;
4404  if (c->ip.addr_data32[0] != SCNtohl(16909061) || c->ip2.addr_data32[0] != SCNtohl(16909311))
4405  goto error;
4406 
4407  DetectAddressFree(a);
4408  DetectAddressFree(b);
4409  DetectAddressFree(c);
4410  return 1;
4411 
4412 error:
4413  DetectAddressFree(a);
4414  DetectAddressFree(b);
4415  DetectAddressFree(c);
4416  return 0;
4417 }
4418 
4419 static int AddressTestCutIPv404(void)
4420 {
4421  DetectAddress *a, *b, *c = NULL;
4422  a = DetectAddressParseSingle("1.2.3.3-1.2.3.6");
4423  b = DetectAddressParseSingle("1.2.3.0-1.2.3.5");
4424 
4425  if (DetectAddressCut(NULL, a, b, &c) == -1)
4426  goto error;
4427 
4428  if (c == NULL)
4429  goto error;
4430 
4431  if (a->ip.addr_data32[0] != SCNtohl(16909056) || a->ip2.addr_data32[0] != SCNtohl(16909058))
4432  goto error;
4433  if (b->ip.addr_data32[0] != SCNtohl(16909059) || b->ip2.addr_data32[0] != SCNtohl(16909061))
4434  goto error;
4435  if (c->ip.addr_data32[0] != SCNtohl(16909062) || c->ip2.addr_data32[0] != SCNtohl(16909062))
4436  goto error;
4437 
4438 
4439  DetectAddressFree(a);
4440  DetectAddressFree(b);
4441  DetectAddressFree(c);
4442  return 1;
4443 
4444 error:
4445  DetectAddressFree(a);
4446  DetectAddressFree(b);
4447  DetectAddressFree(c);
4448  return 0;
4449 }
4450 
4451 static int AddressTestCutIPv405(void)
4452 {
4453  DetectAddress *a, *b, *c = NULL;
4454  a = DetectAddressParseSingle("1.2.3.3-1.2.3.6");
4455  b = DetectAddressParseSingle("1.2.3.0-1.2.3.9");
4456 
4457  if (DetectAddressCut(NULL, a, b, &c) == -1)
4458  goto error;
4459 
4460  if (c == NULL)
4461  goto error;
4462 
4463  if (a->ip.addr_data32[0] != SCNtohl(16909056) || a->ip2.addr_data32[0] != SCNtohl(16909058))
4464  goto error;
4465  if (b->ip.addr_data32[0] != SCNtohl(16909059) || b->ip2.addr_data32[0] != SCNtohl(16909062))
4466  goto error;
4467  if (c->ip.addr_data32[0] != SCNtohl(16909063) || c->ip2.addr_data32[0] != SCNtohl(16909065))
4468  goto error;
4469 
4470  DetectAddressFree(a);
4471  DetectAddressFree(b);
4472  DetectAddressFree(c);
4473  return 1;
4474 
4475 error:
4476  DetectAddressFree(a);
4477  DetectAddressFree(b);
4478  DetectAddressFree(c);
4479  return 0;
4480 }
4481 
4482 static int AddressTestCutIPv406(void)
4483 {
4484  DetectAddress *a, *b, *c = NULL;
4485  a = DetectAddressParseSingle("1.2.3.0-1.2.3.9");
4486  b = DetectAddressParseSingle("1.2.3.3-1.2.3.6");
4487 
4488  if (DetectAddressCut(NULL, a, b, &c) == -1)
4489  goto error;
4490 
4491  if (c == NULL)
4492  goto error;
4493 
4494  if (a->ip.addr_data32[0] != SCNtohl(16909056) || a->ip2.addr_data32[0] != SCNtohl(16909058))
4495  goto error;
4496  if (b->ip.addr_data32[0] != SCNtohl(16909059) || b->ip2.addr_data32[0] != SCNtohl(16909062))
4497  goto error;
4498  if (c->ip.addr_data32[0] != SCNtohl(16909063) || c->ip2.addr_data32[0] != SCNtohl(16909065))
4499  goto error;
4500 
4501  DetectAddressFree(a);
4502  DetectAddressFree(b);
4503  DetectAddressFree(c);
4504  return 1;
4505 
4506 error:
4507  DetectAddressFree(a);
4508  DetectAddressFree(b);
4509  DetectAddressFree(c);
4510  return 0;
4511 }
4512 
4513 static int AddressTestCutIPv407(void)
4514 {
4515  DetectAddress *a, *b, *c = NULL;
4516  a = DetectAddressParseSingle("1.2.3.0-1.2.3.6");
4517  b = DetectAddressParseSingle("1.2.3.0-1.2.3.9");
4518 
4519  if (DetectAddressCut(NULL, a, b, &c) == -1)
4520  goto error;
4521 
4522  if (c != NULL)
4523  goto error;
4524 
4525  if (a->ip.addr_data32[0] != SCNtohl(16909056) || a->ip2.addr_data32[0] != SCNtohl(16909062))
4526  goto error;
4527  if (b->ip.addr_data32[0] != SCNtohl(16909063) || b->ip2.addr_data32[0] != SCNtohl(16909065))
4528  goto error;
4529 
4530  DetectAddressFree(a);
4531  DetectAddressFree(b);
4532  DetectAddressFree(c);
4533  return 1;
4534 
4535 error:
4536  DetectAddressFree(a);
4537  DetectAddressFree(b);
4538  DetectAddressFree(c);
4539  return 0;
4540 }
4541 
4542 static int AddressTestCutIPv408(void)
4543 {
4544  DetectAddress *a, *b, *c = NULL;
4545  a = DetectAddressParseSingle("1.2.3.3-1.2.3.9");
4546  b = DetectAddressParseSingle("1.2.3.0-1.2.3.9");
4547 
4548  if (DetectAddressCut(NULL, a, b, &c) == -1)
4549  goto error;
4550 
4551  if (c != NULL)
4552  goto error;
4553 
4554  if (a->ip.addr_data32[0] != SCNtohl(16909056) || a->ip2.addr_data32[0] != SCNtohl(16909058))
4555  goto error;
4556  if (b->ip.addr_data32[0] != SCNtohl(16909059) || b->ip2.addr_data32[0] != SCNtohl(16909065))
4557  goto error;
4558 
4559  DetectAddressFree(a);
4560  DetectAddressFree(b);
4561  DetectAddressFree(c);
4562  return 1;
4563 
4564 error:
4565  DetectAddressFree(a);
4566  DetectAddressFree(b);
4567  DetectAddressFree(c);
4568  return 0;
4569 }
4570 
4571 static int AddressTestCutIPv409(void)
4572 {
4573  DetectAddress *a, *b, *c = NULL;
4574  a = DetectAddressParseSingle("1.2.3.0-1.2.3.9");
4575  b = DetectAddressParseSingle("1.2.3.0-1.2.3.6");
4576 
4577  if (DetectAddressCut(NULL, a, b, &c) == -1)
4578  goto error;
4579 
4580  if (c != NULL)
4581  goto error;
4582 
4583  if (a->ip.addr_data32[0] != SCNtohl(16909056) || a->ip2.addr_data32[0] != SCNtohl(16909062))
4584  goto error;
4585  if (b->ip.addr_data32[0] != SCNtohl(16909063) || b->ip2.addr_data32[0] != SCNtohl(16909065))
4586  goto error;
4587 
4588  DetectAddressFree(a);
4589  DetectAddressFree(b);
4590  DetectAddressFree(c);
4591  return 1;
4592 
4593 error:
4594  DetectAddressFree(a);
4595  DetectAddressFree(b);
4596  DetectAddressFree(c);
4597  return 0;
4598 }
4599 
4600 static int AddressTestCutIPv410(void)
4601 {
4602  DetectAddress *a, *b, *c = NULL;
4603  a = DetectAddressParseSingle("1.2.3.0-1.2.3.9");
4604  b = DetectAddressParseSingle("1.2.3.3-1.2.3.9");
4605 
4606  if (DetectAddressCut(NULL, a, b, &c) == -1)
4607  goto error;
4608 
4609  if (c != NULL)
4610  goto error;
4611 
4612  if (a->ip.addr_data32[0] != SCNtohl(16909056) || a->ip2.addr_data32[0] != SCNtohl(16909058))
4613  goto error;
4614  if (b->ip.addr_data32[0] != SCNtohl(16909059) || b->ip2.addr_data32[0] != SCNtohl(16909065))
4615  goto error;
4616 
4617  printf("ip %u ip2 %u ", (uint32_t)htonl(a->ip.addr_data32[0]), (uint32_t)htonl(a->ip2.addr_data32[0]));
4618 
4619  DetectAddressFree(a);
4620  DetectAddressFree(b);
4621  DetectAddressFree(c);
4622  return 1;
4623 
4624 error:
4625  DetectAddressFree(a);
4626  DetectAddressFree(b);
4627  DetectAddressFree(c);
4628  return 0;
4629 }
4630 
4631 static int AddressTestParseInvalidMask01(void)
4632 {
4633  int result = 1;
4634  DetectAddress *dd = NULL;
4635 
4636  dd = DetectAddressParseSingle("192.168.2.0/33");
4637  if (dd != NULL) {
4638  DetectAddressFree(dd);
4639  result = 0;
4640  }
4641  return result;
4642 }
4643 
4644 static int AddressTestParseInvalidMask02(void)
4645 {
4646  int result = 1;
4647  DetectAddress *dd = NULL;
4648 
4649  dd = DetectAddressParseSingle("192.168.2.0/255.255.257.0");
4650  if (dd != NULL) {
4651  DetectAddressFree(dd);
4652  result = 0;
4653  }
4654  return result;
4655 }
4656 
4657 static int AddressTestParseInvalidMask03(void)
4658 {
4659  int result = 1;
4660  DetectAddress *dd = NULL;
4661 
4662  dd = DetectAddressParseSingle("192.168.2.0/blue");
4663  if (dd != NULL) {
4664  DetectAddressFree(dd);
4665  result = 0;
4666  }
4667  return result;
4668 }
4669 
4670 static int AddressConfVarsTest01(void)
4671 {
4672  static const char *dummy_conf_string =
4673  "%YAML 1.1\n"
4674  "---\n"
4675  "\n"
4676  "vars:\n"
4677  "\n"
4678  " address-groups:\n"
4679  "\n"
4680  " HOME_NET: \"any\"\n"
4681  "\n"
4682  " EXTERNAL_NET: \"!any\"\n"
4683  "\n"
4684  " port-groups:\n"
4685  "\n"
4686  " HTTP_PORTS: \"any\"\n"
4687  "\n"
4688  " SHELLCODE_PORTS: \"!any\"\n"
4689  "\n";
4690 
4691  int result = 0;
4692 
4693  SCConfCreateContextBackup();
4694  SCConfInit();
4695  SCConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
4696 
4697  if (DetectAddressTestConfVars() < 0 && DetectPortTestConfVars() < 0)
4698  result = 1;
4699 
4700  SCConfDeInit();
4701  SCConfRestoreContextBackup();
4702 
4703  return result;
4704 }
4705 
4706 static int AddressConfVarsTest02(void)
4707 {
4708  static const char *dummy_conf_string =
4709  "%YAML 1.1\n"
4710  "---\n"
4711  "\n"
4712  "vars:\n"
4713  "\n"
4714  " address-groups:\n"
4715  "\n"
4716  " HOME_NET: \"any\"\n"
4717  "\n"
4718  " EXTERNAL_NET: \"any\"\n"
4719  "\n"
4720  " port-groups:\n"
4721  "\n"
4722  " HTTP_PORTS: \"any\"\n"
4723  "\n"
4724  " SHELLCODE_PORTS: \"!any\"\n"
4725  "\n";
4726 
4727  int result = 0;
4728 
4729  SCConfCreateContextBackup();
4730  SCConfInit();
4731  SCConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
4732 
4733  if (DetectAddressTestConfVars() == 0 && DetectPortTestConfVars() < 0)
4734  result = 1;
4735 
4736  SCConfDeInit();
4737  SCConfRestoreContextBackup();
4738 
4739  return result;
4740 }
4741 
4742 static int AddressConfVarsTest03(void)
4743 {
4744  static const char *dummy_conf_string =
4745  "%YAML 1.1\n"
4746  "---\n"
4747  "\n"
4748  "vars:\n"
4749  "\n"
4750  " address-groups:\n"
4751  "\n"
4752  " HOME_NET: \"any\"\n"
4753  "\n"
4754  " EXTERNAL_NET: \"!$HOME_NET\"\n"
4755  "\n"
4756  " port-groups:\n"
4757  "\n"
4758  " HTTP_PORTS: \"any\"\n"
4759  "\n"
4760  " SHELLCODE_PORTS: \"!$HTTP_PORTS\"\n"
4761  "\n";
4762 
4763  int result = 0;
4764 
4765  SCConfCreateContextBackup();
4766  SCConfInit();
4767  SCConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
4768 
4769  if (DetectAddressTestConfVars() < 0 && DetectPortTestConfVars() < 0)
4770  result = 1;
4771 
4772  SCConfDeInit();
4773  SCConfRestoreContextBackup();
4774 
4775  return result;
4776 }
4777 
4778 static int AddressConfVarsTest04(void)
4779 {
4780  static const char *dummy_conf_string =
4781  "%YAML 1.1\n"
4782  "---\n"
4783  "\n"
4784  "vars:\n"
4785  "\n"
4786  " address-groups:\n"
4787  "\n"
4788  " HOME_NET: \"any\"\n"
4789  "\n"
4790  " EXTERNAL_NET: \"$HOME_NET\"\n"
4791  "\n"
4792  " port-groups:\n"
4793  "\n"
4794  " HTTP_PORTS: \"any\"\n"
4795  "\n"
4796  " SHELLCODE_PORTS: \"$HTTP_PORTS\"\n"
4797  "\n";
4798 
4799  int result = 0;
4800 
4801  SCConfCreateContextBackup();
4802  SCConfInit();
4803  SCConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
4804 
4805  if (DetectAddressTestConfVars() == 0 && DetectPortTestConfVars() == 0)
4806  result = 1;
4807 
4808  SCConfDeInit();
4809  SCConfRestoreContextBackup();
4810 
4811  return result;
4812 }
4813 
4814 static int AddressConfVarsTest05(void)
4815 {
4816  static const char *dummy_conf_string =
4817  "%YAML 1.1\n"
4818  "---\n"
4819  "\n"
4820  "vars:\n"
4821  "\n"
4822  " address-groups:\n"
4823  "\n"
4824  " HOME_NET: \"any\"\n"
4825  "\n"
4826  " EXTERNAL_NET: [192.168.0.1]\n"
4827  "\n"
4828  " port-groups:\n"
4829  "\n"
4830  " HTTP_PORTS: \"any\"\n"
4831  "\n"
4832  " SHELLCODE_PORTS: [80]\n"
4833  "\n";
4834 
4835  int result = 0;
4836 
4837  SCConfCreateContextBackup();
4838  SCConfInit();
4839  SCConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
4840 
4841  if (DetectAddressTestConfVars() != -1 && DetectPortTestConfVars() != -1)
4842  goto end;
4843 
4844  result = 1;
4845 
4846  end:
4847  SCConfDeInit();
4848  SCConfRestoreContextBackup();
4849 
4850  return result;
4851 }
4852 
4853 static int AddressConfVarsTest06(void)
4854 {
4855  // HOME_NET value size = 10261 bytes
4856  static const char *dummy_conf_string =
4857  "%YAML 1.1\n"
4858  "---\n"
4859  "\n"
4860  "vars:\n"
4861  "\n"
4862  " address-groups:\n"
4863  "\n"
4864  " HOME_NET: "
4865  "\"[2002:0000:3238:DFE1:63:0000:0000:FEFB,2002:0000:3238:DFE1:63:0000:0000:FEFB,"
4866  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4867  "2004:0000:3238:DFE1:63:0000:0000:FEFB,2005:0000:3238:DFE1:63:0000:0000:FEFB,"
4868  "2006:0000:3238:DFE1:63:0000:0000:FEFB,2007:0000:3238:DFE1:63:0000:0000:FEFB,"
4869  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4870  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4871  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4872  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4873  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4874  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4875  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4876  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4877  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4878  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4879  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4880  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4881  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4882  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4883  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4884  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4885  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4886  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4887  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4888  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4889  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4890  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4891  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4892  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4893  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4894  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4895  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4896  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4897  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4898  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4899  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4900  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4901  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4902  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4903  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4904  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4905  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4906  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4907  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4908  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4909  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4910  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4911  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4912  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4913  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4914  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4915  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4916  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4917  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4918  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4919  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4920  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4921  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4922  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4923  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4924  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4925  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4926  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4927  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4928  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4929  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4930  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4931  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4932  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4933  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4934  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4935  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4936  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4937  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4938  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4939  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4940  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4941  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4942  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4943  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4944  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4945  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4946  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4947  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4948  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4949  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4950  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4951  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4952  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4953  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4954  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4955  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4956  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4957  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4958  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4959  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4960  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4961  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4962  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4963  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4964  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4965  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4966  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4967  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4968  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4969  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4970  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4971  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4972  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4973  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4974  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4975  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4976  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4977  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4978  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4979  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4980  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4981  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4982  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4983  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4984  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4985  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4986  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4987  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4988  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4989  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4990  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4991  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4992  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4993  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4994  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4995  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4996  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4997  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4998  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB,"
4999  "2002:0000:3238:DFE1:63:0000:0000:FEFB,2003:0000:3238:DFE1:63:0000:0000:FEFB]\"\n"
5000  "\n"
5001  " EXTERNAL_NET: \"any\"\n"
5002  "\n";
5003 
5004  SCConfCreateContextBackup();
5005  SCConfInit();
5006  SCConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
5007 
5008  FAIL_IF(0 != DetectAddressTestConfVars());
5009 
5010  SCConfDeInit();
5011  SCConfRestoreContextBackup();
5012 
5013  PASS;
5014 }
5015 
5016 #endif /* UNITTESTS */
5017 
5018 void DetectAddressTests(void)
5019 {
5020 #ifdef UNITTESTS
5021  DetectAddressIPv4Tests();
5022  DetectAddressIPv6Tests();
5023 
5024  UtRegisterTest("AddressTestParse01", AddressTestParse01);
5025  UtRegisterTest("AddressTestParse02", AddressTestParse02);
5026  UtRegisterTest("AddressTestParse03", AddressTestParse03);
5027  UtRegisterTest("AddressTestParse04", AddressTestParse04);
5028  UtRegisterTest("AddressTestParse04bug5081", AddressTestParse04bug5081);
5029  UtRegisterTest("AddressTestParse05", AddressTestParse05);
5030  UtRegisterTest("AddressTestParse06", AddressTestParse06);
5031  UtRegisterTest("AddressTestParse07", AddressTestParse07);
5032  UtRegisterTest("AddressTestParse08", AddressTestParse08);
5033  UtRegisterTest("AddressTestParse09", AddressTestParse09);
5034  UtRegisterTest("AddressTestParse10", AddressTestParse10);
5035  UtRegisterTest("AddressTestParse11", AddressTestParse11);
5036  UtRegisterTest("AddressTestParse12", AddressTestParse12);
5037  UtRegisterTest("AddressTestParse13", AddressTestParse13);
5038  UtRegisterTest("AddressTestParse14", AddressTestParse14);
5039  UtRegisterTest("AddressTestParse15", AddressTestParse15);
5040  UtRegisterTest("AddressTestParse16", AddressTestParse16);
5041  UtRegisterTest("AddressTestParse17", AddressTestParse17);
5042  UtRegisterTest("AddressTestParse18", AddressTestParse18);
5043  UtRegisterTest("AddressTestParse19", AddressTestParse19);
5044  UtRegisterTest("AddressTestParse20", AddressTestParse20);
5045  UtRegisterTest("AddressTestParse21", AddressTestParse21);
5046  UtRegisterTest("AddressTestParse22", AddressTestParse22);
5047  UtRegisterTest("AddressTestParse23", AddressTestParse23);
5048  UtRegisterTest("AddressTestParse24", AddressTestParse24);
5049  UtRegisterTest("AddressTestParse25", AddressTestParse25);
5050  UtRegisterTest("AddressTestParse26", AddressTestParse26);
5051  UtRegisterTest("AddressTestParse27", AddressTestParse27);
5052  UtRegisterTest("AddressTestParse28", AddressTestParse28);
5053  UtRegisterTest("AddressTestParse29", AddressTestParse29);
5054  UtRegisterTest("AddressTestParse30", AddressTestParse30);
5055  UtRegisterTest("AddressTestParse31", AddressTestParse31);
5056  UtRegisterTest("AddressTestParse32", AddressTestParse32);
5057  UtRegisterTest("AddressTestParse33", AddressTestParse33);
5058  UtRegisterTest("AddressTestParse34", AddressTestParse34);
5059  UtRegisterTest("AddressTestParse35", AddressTestParse35);
5060  UtRegisterTest("AddressTestParse36", AddressTestParse36);
5061  UtRegisterTest("AddressTestParse37", AddressTestParse37);
5062 
5063  UtRegisterTest("AddressTestMatch01", AddressTestMatch01);
5064  UtRegisterTest("AddressTestMatch02", AddressTestMatch02);
5065  UtRegisterTest("AddressTestMatch03", AddressTestMatch03);
5066  UtRegisterTest("AddressTestMatch04", AddressTestMatch04);
5067  UtRegisterTest("AddressTestMatch05", AddressTestMatch05);
5068  UtRegisterTest("AddressTestMatch06", AddressTestMatch06);
5069  UtRegisterTest("AddressTestMatch07", AddressTestMatch07);
5070  UtRegisterTest("AddressTestMatch08", AddressTestMatch08);
5071  UtRegisterTest("AddressTestMatch09", AddressTestMatch09);
5072  UtRegisterTest("AddressTestMatch10", AddressTestMatch10);
5073  UtRegisterTest("AddressTestMatch11", AddressTestMatch11);
5074 
5075  UtRegisterTest("AddressTestCmp01", AddressTestCmp01);
5076  UtRegisterTest("AddressTestCmp02", AddressTestCmp02);
5077  UtRegisterTest("AddressTestCmp03", AddressTestCmp03);
5078  UtRegisterTest("AddressTestCmp04", AddressTestCmp04);
5079  UtRegisterTest("AddressTestCmp05", AddressTestCmp05);
5080  UtRegisterTest("AddressTestCmp06", AddressTestCmp06);
5081  UtRegisterTest("AddressTestCmpIPv407", AddressTestCmpIPv407);
5082  UtRegisterTest("AddressTestCmpIPv408", AddressTestCmpIPv408);
5083 
5084  UtRegisterTest("AddressTestCmp07", AddressTestCmp07);
5085  UtRegisterTest("AddressTestCmp08", AddressTestCmp08);
5086  UtRegisterTest("AddressTestCmp09", AddressTestCmp09);
5087  UtRegisterTest("AddressTestCmp10", AddressTestCmp10);
5088  UtRegisterTest("AddressTestCmp11", AddressTestCmp11);
5089  UtRegisterTest("AddressTestCmp12", AddressTestCmp12);
5090 
5091  UtRegisterTest("AddressTestAddressGroupSetup01",
5092  AddressTestAddressGroupSetup01);
5093  UtRegisterTest("AddressTestAddressGroupSetup02",
5094  AddressTestAddressGroupSetup02);
5095  UtRegisterTest("AddressTestAddressGroupSetup03",
5096  AddressTestAddressGroupSetup03);
5097  UtRegisterTest("AddressTestAddressGroupSetup04",
5098  AddressTestAddressGroupSetup04);
5099  UtRegisterTest("AddressTestAddressGroupSetup05",
5100  AddressTestAddressGroupSetup05);
5101  UtRegisterTest("AddressTestAddressGroupSetup06",
5102  AddressTestAddressGroupSetup06);
5103  UtRegisterTest("AddressTestAddressGroupSetup07",
5104  AddressTestAddressGroupSetup07);
5105  UtRegisterTest("AddressTestAddressGroupSetup08",
5106  AddressTestAddressGroupSetup08);
5107  UtRegisterTest("AddressTestAddressGroupSetup09",
5108  AddressTestAddressGroupSetup09);
5109  UtRegisterTest("AddressTestAddressGroupSetup10",
5110  AddressTestAddressGroupSetup10);
5111  UtRegisterTest("AddressTestAddressGroupSetup11",
5112  AddressTestAddressGroupSetup11);
5113  UtRegisterTest("AddressTestAddressGroupSetup12",
5114  AddressTestAddressGroupSetup12);
5115  UtRegisterTest("AddressTestAddressGroupSetup13",
5116  AddressTestAddressGroupSetup13);
5117  UtRegisterTest("AddressTestAddressGroupSetupIPv414",
5118  AddressTestAddressGroupSetupIPv414);
5119  UtRegisterTest("AddressTestAddressGroupSetupIPv415",
5120  AddressTestAddressGroupSetupIPv415);
5121  UtRegisterTest("AddressTestAddressGroupSetupIPv416",
5122  AddressTestAddressGroupSetupIPv416);
5123 
5124  UtRegisterTest("AddressTestAddressGroupSetup14",
5125  AddressTestAddressGroupSetup14);
5126  UtRegisterTest("AddressTestAddressGroupSetup15",
5127  AddressTestAddressGroupSetup15);
5128  UtRegisterTest("AddressTestAddressGroupSetup16",
5129  AddressTestAddressGroupSetup16);
5130  UtRegisterTest("AddressTestAddressGroupSetup17",
5131  AddressTestAddressGroupSetup17);
5132  UtRegisterTest("AddressTestAddressGroupSetup18",
5133  AddressTestAddressGroupSetup18);
5134  UtRegisterTest("AddressTestAddressGroupSetup19",
5135  AddressTestAddressGroupSetup19);
5136  UtRegisterTest("AddressTestAddressGroupSetup20",
5137  AddressTestAddressGroupSetup20);
5138  UtRegisterTest("AddressTestAddressGroupSetup21",
5139  AddressTestAddressGroupSetup21);
5140  UtRegisterTest("AddressTestAddressGroupSetup22",
5141  AddressTestAddressGroupSetup22);
5142  UtRegisterTest("AddressTestAddressGroupSetup23",
5143  AddressTestAddressGroupSetup23);
5144  UtRegisterTest("AddressTestAddressGroupSetup24",
5145  AddressTestAddressGroupSetup24);
5146  UtRegisterTest("AddressTestAddressGroupSetup25",
5147  AddressTestAddressGroupSetup25);
5148  UtRegisterTest("AddressTestAddressGroupSetup26",
5149  AddressTestAddressGroupSetup26);
5150 
5151  UtRegisterTest("AddressTestAddressGroupSetup27",
5152  AddressTestAddressGroupSetup27);
5153  UtRegisterTest("AddressTestAddressGroupSetup28",
5154  AddressTestAddressGroupSetup28);
5155  UtRegisterTest("AddressTestAddressGroupSetup29",
5156  AddressTestAddressGroupSetup29);
5157  UtRegisterTest("AddressTestAddressGroupSetup30",
5158  AddressTestAddressGroupSetup30);
5159  UtRegisterTest("AddressTestAddressGroupSetup31",
5160  AddressTestAddressGroupSetup31);
5161  UtRegisterTest("AddressTestAddressGroupSetup32",
5162  AddressTestAddressGroupSetup32);
5163  UtRegisterTest("AddressTestAddressGroupSetup33",
5164  AddressTestAddressGroupSetup33);
5165  UtRegisterTest("AddressTestAddressGroupSetup34",
5166  AddressTestAddressGroupSetup34);
5167  UtRegisterTest("AddressTestAddressGroupSetup35",
5168  AddressTestAddressGroupSetup35);
5169  UtRegisterTest("AddressTestAddressGroupSetup36",
5170  AddressTestAddressGroupSetup36);
5171  UtRegisterTest("AddressTestAddressGroupSetup37",
5172  AddressTestAddressGroupSetup37);
5173  UtRegisterTest("AddressTestAddressGroupSetup38",
5174  AddressTestAddressGroupSetup38);
5175  UtRegisterTest("AddressTestAddressGroupSetup39",
5176  AddressTestAddressGroupSetup39);
5177  UtRegisterTest("AddressTestAddressGroupSetup40",
5178  AddressTestAddressGroupSetup40);
5179  UtRegisterTest("AddressTestAddressGroupSetup41",
5180  AddressTestAddressGroupSetup41);
5181  UtRegisterTest("AddressTestAddressGroupSetup42",
5182  AddressTestAddressGroupSetup42);
5183  UtRegisterTest("AddressTestAddressGroupSetup43",
5184  AddressTestAddressGroupSetup43);
5185  UtRegisterTest("AddressTestAddressGroupSetup44",
5186  AddressTestAddressGroupSetup44);
5187  UtRegisterTest("AddressTestAddressGroupSetup45",
5188  AddressTestAddressGroupSetup45);
5189  UtRegisterTest("AddressTestAddressGroupSetup46",
5190  AddressTestAddressGroupSetup46);
5191  UtRegisterTest("AddressTestAddressGroupSetup47",
5192  AddressTestAddressGroupSetup47);
5193  UtRegisterTest("AddressTestAddressGroupSetup48",
5194  AddressTestAddressGroupSetup48);
5195 
5196  UtRegisterTest("AddressTestCutIPv401", AddressTestCutIPv401);
5197  UtRegisterTest("AddressTestCutIPv402", AddressTestCutIPv402);
5198  UtRegisterTest("AddressTestCutIPv403", AddressTestCutIPv403);
5199  UtRegisterTest("AddressTestCutIPv404", AddressTestCutIPv404);
5200  UtRegisterTest("AddressTestCutIPv405", AddressTestCutIPv405);
5201  UtRegisterTest("AddressTestCutIPv406", AddressTestCutIPv406);
5202  UtRegisterTest("AddressTestCutIPv407", AddressTestCutIPv407);
5203  UtRegisterTest("AddressTestCutIPv408", AddressTestCutIPv408);
5204  UtRegisterTest("AddressTestCutIPv409", AddressTestCutIPv409);
5205  UtRegisterTest("AddressTestCutIPv410", AddressTestCutIPv410);
5206 
5207  UtRegisterTest("AddressTestParseInvalidMask01",
5208  AddressTestParseInvalidMask01);
5209  UtRegisterTest("AddressTestParseInvalidMask02",
5210  AddressTestParseInvalidMask02);
5211  UtRegisterTest("AddressTestParseInvalidMask03",
5212  AddressTestParseInvalidMask03);
5213 
5214  UtRegisterTest("AddressConfVarsTest01 ", AddressConfVarsTest01);
5215  UtRegisterTest("AddressConfVarsTest02 ", AddressConfVarsTest02);
5216  UtRegisterTest("AddressConfVarsTest03 ", AddressConfVarsTest03);
5217  UtRegisterTest("AddressConfVarsTest04 ", AddressConfVarsTest04);
5218  UtRegisterTest("AddressConfVarsTest05 ", AddressConfVarsTest05);
5219  UtRegisterTest("AddressConfVarsTest06 ", AddressConfVarsTest06);
5220 #endif /* UNITTESTS */
5221 }
DetectAddressListsAreEqual
bool DetectAddressListsAreEqual(DetectAddress *list1, DetectAddress *list2)
Checks if two address group lists are equal.
Definition: detect-engine-address.c:348
DetectAddressCutNotIPv4
int DetectAddressCutNotIPv4(DetectAddress *a, DetectAddress **b)
Cuts and returns an address range, which is the complement of the address range that is supplied as t...
Definition: detect-engine-address-ipv4.c:368
util-byte.h
DetectAddress_::ip
Address ip
Definition: detect.h:171
SCConfYamlLoadString
int SCConfYamlLoadString(const char *string, size_t len)
Load configuration from a YAML string.
Definition: conf-yaml-loader.c:536
DetectAddressFree
void DetectAddressFree(DetectAddress *ag)
Frees a DetectAddress instance.
Definition: detect-engine-address.c:82
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
DetectAddressTests
void DetectAddressTests(void)
ADDRESS_EB
@ ADDRESS_EB
Definition: detect.h:157
ADDRESS_LE
@ ADDRESS_LE
Definition: detect.h:154
DetectAddressMap_::contains_negation
bool contains_negation
Definition: detect-engine-address.c:1294
DetectAddressCutIPv6
int DetectAddressCutIPv6(DetectEngineCtx *de_ctx, DetectAddress *a, DetectAddress *b, DetectAddress **c)
Definition: detect-engine-address-ipv6.c:353
TAILQ_INIT
#define TAILQ_INIT(head)
Definition: queue.h:262
DetectAddressHead_::contains_range
bool contains_range
Definition: detect.h:188
detect-engine-siggroup.h
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
AddressIPv6Le
int AddressIPv6Le(const Address *a, const Address *b)
Compares 2 ipv6 addresses and returns if the first address(a) is less than or equal to the second add...
Definition: detect-engine-address-ipv6.c:162
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DetectAddressMatchIPv4
int DetectAddressMatchIPv4(const DetectMatchAddressIPv4 *addrs, uint16_t addrs_cnt, const Address *a)
Match a packets address against a signatures addrs array.
Definition: detect-engine-address.c:1604
DetectAddress_
address structure for use in the detection engine.
Definition: detect.h:169
SC_RULE_VARS_ADDRESS_GROUPS
@ SC_RULE_VARS_ADDRESS_GROUPS
Definition: util-rule-vars.h:31
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:282
DetectAddressHead_
Definition: detect.h:184
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
DetectAddressHeadCleanup
void DetectAddressHeadCleanup(DetectAddressHead *gh)
Cleans a DetectAddressHead. The functions frees the address group heads(ipv4 and ipv6) inside the Det...
Definition: detect-engine-address.c:1491
ADDRESS_LT
@ ADDRESS_LT
Definition: detect.h:153
DetectAddressMap
struct DetectAddressMap_ DetectAddressMap
CIDRGet
uint32_t CIDRGet(int cidr)
Definition: util-cidr.c:57
DetectAddressMapFree
void DetectAddressMapFree(DetectEngineCtx *de_ctx)
Definition: detect-engine-address.c:1340
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:987
DetectAddressIPv4Tests
void DetectAddressIPv4Tests(void)
Definition: detect-engine-address-ipv4.c:1008
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
ADDRESS_EQ
@ ADDRESS_EQ
Definition: detect.h:155
Address_
Definition: decode.h:113
HashListTableLookup
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:245
CleanVariableResolveList
void CleanVariableResolveList(ResolvedVariablesList *var_list)
Definition: util-var.c:168
DetectPortTestConfVars
int DetectPortTestConfVars(void)
Definition: detect-engine-port.c:1058
util-var.h
util-unittest.h
DetectAddressLookupInHead
DetectAddress * DetectAddressLookupInHead(const DetectAddressHead *gh, Address *a)
Find the group matching address in a group head.
Definition: detect-engine-address.c:1813
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
HashListTableAdd
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:114
DetectAddress_::prev
struct DetectAddress_ * prev
Definition: detect.h:178
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
HashListTable_::array_size
uint32_t array_size
Definition: util-hashlist.h:41
DetectAddressCmpIPv4
int DetectAddressCmpIPv4(DetectAddress *a, DetectAddress *b)
Compares 2 addresses(address ranges) and returns the relationship between the 2 addresses.
Definition: detect-engine-address-ipv4.c:59
Address_::address
union Address_::@29 address
SCConfInit
void SCConfInit(void)
Initialize the configuration system.
Definition: conf.c:121
util-cidr.h
HashListTableInit
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hashlist.c:35
decode.h
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:22
DetectAddressIsCompleteIPSpaceIPv4
int DetectAddressIsCompleteIPSpaceIPv4(DetectAddress *ag)
Check if the address group list covers the complete IPv4 IP space.
Definition: detect-engine-address-ipv4.c:314
StringParseI32RangeCheck
int StringParseI32RangeCheck(int32_t *res, int base, size_t len, const char *str, int32_t min, int32_t max)
Definition: util-byte.c:681
DetectAddressCutIPv4
int DetectAddressCutIPv4(DetectEngineCtx *de_ctx, DetectAddress *a, DetectAddress *b, DetectAddress **c)
Cut groups and merge sigs.
Definition: detect-engine-address-ipv4.c:113
ADDRESS_GE
@ ADDRESS_GE
Definition: detect.h:158
UTHValidateDetectAddressHeadRange_::one
const char * one
Definition: detect-engine-address.c:1896
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:284
detect.h
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:238
detect-engine-port.h
DetectAddress_::ip2
Address ip2
Definition: detect.h:172
DetectAddressMergeNot
int DetectAddressMergeNot(DetectAddressHead *gh, DetectAddressHead *ghn)
Merge the + and the - list (+ positive match, - 'not' match)
Definition: detect-engine-address.c:1036
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:325
hashlittle_safe
uint32_t hashlittle_safe(const void *key, size_t length, uint32_t initval)
Definition: util-hash-lookup3.c:482
DetectAddressCopy
DetectAddress * DetectAddressCopy(DetectAddress *orig)
copy a DetectAddress
Definition: detect-engine-address.c:127
CIDRFromMask
int CIDRFromMask(uint32_t netmask)
Turn 32 bit mask into CIDR.
Definition: util-cidr.c:35
util-rule-vars.h
conf-yaml-loader.h
conf.h
UTHValidateDetectAddressHeadRange
struct UTHValidateDetectAddressHeadRange_ UTHValidateDetectAddressHeadRange
DetectAddressCleanupList
void DetectAddressCleanupList(DetectAddress *head)
Frees a list of DetectAddress instances.
Definition: detect-engine-address.c:144
SCReturnPtr
#define SCReturnPtr(x, type)
Definition: util-debug.h:300
MAX_ADDRESS_LENGTH
#define MAX_ADDRESS_LENGTH
SCConfCreateContextBackup
void SCConfCreateContextBackup(void)
Creates a backup of the conf_hash hash_table used by the conf API.
Definition: conf.c:741
HashListTable_
Definition: util-hashlist.h:37
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:232
DetectAddressMap_
Definition: detect-engine-address.c:1291
DetectAddressHead_::ipv6_head
DetectAddress * ipv6_head
Definition: detect.h:186
CIDRGetIPv6
void CIDRGetIPv6(int cidr, struct in6_addr *in6)
Creates a cidr ipv6 netblock, based on the cidr netblock value.
Definition: util-cidr.c:82
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
DetectAddressMatchIPv6
int DetectAddressMatchIPv6(const DetectMatchAddressIPv6 *addrs, uint16_t addrs_cnt, const Address *a)
Match a packets address against a signatures addrs array.
Definition: detect-engine-address.c:1637
DetectEngineCtx_::address_table
HashListTable * address_table
Definition: detect.h:1134
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
suricata-common.h
HashListTableFree
void HashListTableFree(HashListTable *ht)
Definition: util-hashlist.c:88
ADDRESS_FLAG_RANGE
#define ADDRESS_FLAG_RANGE
Definition: detect.h:163
SCConfDeInit
void SCConfDeInit(void)
De-initializes the configuration system.
Definition: conf.c:760
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
util-hash-lookup3.h
detect-engine-address-ipv6.h
DetectAddressMap_::contains_range
bool contains_range
Definition: detect-engine-address.c:1295
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
DetectAddressMapInit
int DetectAddressMapInit(DetectEngineCtx *de_ctx)
Definition: detect-engine-address.c:1329
DetectAddressCmpIPv6
int DetectAddressCmpIPv6(DetectAddress *a, DetectAddress *b)
Compares 2 addresses(address ranges) and returns the relationship between the 2 addresses.
Definition: detect-engine-address-ipv6.c:232
HtpBodyChunk_::next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:124
str
#define str(s)
Definition: suricata-common.h:316
SCConfGetNode
SCConfNode * SCConfGetNode(const char *name)
Get a SCConfNode by name.
Definition: conf.c:184
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:274
UTHValidateDetectAddressHeadRange_
Definition: detect-engine-address.c:1895
head
Flow * head
Definition: flow-hash.h:1
DetectAddressMap_::address
DetectAddressHead * address
Definition: detect-engine-address.c:1293
SCFree
#define SCFree(p)
Definition: util-mem.h:61
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:438
detect-engine-address-ipv4.h
DetectParseAddress
const DetectAddressHead * DetectParseAddress(DetectEngineCtx *de_ctx, const char *string, bool *contains_negation, bool *contains_range)
Definition: detect-engine-address.c:1441
SCConfRestoreContextBackup
void SCConfRestoreContextBackup(void)
Restores the backup of the hash_table present in backup_conf_hash back to conf_hash.
Definition: conf.c:751
DetectAddressCutNotIPv6
int DetectAddressCutNotIPv6(DetectAddress *a, DetectAddress **b)
Cuts and returns an address range, which is the complement of the address range that is supplied as t...
Definition: detect-engine-address-ipv6.c:704
AddVariableToResolveList
int AddVariableToResolveList(ResolvedVariablesList *list, const char *var)
Definition: util-var.c:139
address
uint8_t address
Definition: decode-ppp.h:0
DetectAddress_::next
struct DetectAddress_ * next
Definition: detect.h:180
DetectMatchAddressIPv6_
Definition: detect.h:197
DetectMatchAddressIPv4_
Definition: detect.h:192
Address_::family
char family
Definition: decode.h:114
ADDRESS_ES
@ ADDRESS_ES
Definition: detect.h:156
SCConfNode_::name
char * name
Definition: conf.h:38
DetectAddressIPv6Tests
void DetectAddressIPv6Tests(void)
Definition: detect-engine-address-ipv6.c:1531
ADDRESS_FLAG_NOT
#define ADDRESS_FLAG_NOT
Definition: detect.h:162
UTHValidateDetectAddressHeadRange_::two
const char * two
Definition: detect-engine-address.c:1897
DetectAddressParse
int DetectAddressParse(const DetectEngineCtx *de_ctx, DetectAddressHead *gh, const char *str, bool *contains_range)
Parses an address group sent as a character string and updates the DetectAddressHead sent as the argu...
Definition: detect-engine-address.c:1398
COPY_ADDRESS
#define COPY_ADDRESS(a, b)
Definition: decode.h:128
AddressIPv6Gt
int AddressIPv6Gt(const Address *a, const Address *b)
Compares 2 ipv6 addresses and returns if the first address(a) is greater than the second address(b) o...
Definition: detect-engine-address-ipv6.c:90
SCRuleVarsGetConfVar
const char * SCRuleVarsGetConfVar(const DetectEngineCtx *de_ctx, const char *conf_var_name, SCRuleVarsType conf_vars_type)
Definition: util-rule-vars.c:65
AddressIPv6Ge
int AddressIPv6Ge(const Address *a, const Address *b)
Compares 2 ipv6 addresses and returns if the first address(a) is greater than or equal to the second ...
Definition: detect-engine-address-ipv6.c:194
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:288
SCConfNode_
Definition: conf.h:37
flow-var.h
SCConfNode_::val
char * val
Definition: conf.h:39
DetectAddress_::flags
uint8_t flags
Definition: detect.h:175
DetectAddressCmp
int DetectAddressCmp(DetectAddress *a, DetectAddress *b)
Used to compare 2 address ranges.
Definition: detect-engine-address.c:1577
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:109
DetectAddressHead_::ipv4_head
DetectAddress * ipv4_head
Definition: detect.h:185
DetectAddressPrint
#define DetectAddressPrint(...)
Definition: detect-engine-address.c:52
detect-engine-address.h
DetectAddressMap_::string
char * string
Definition: detect-engine-address.c:1292
DetectAddressInit
DetectAddress * DetectAddressInit(void)
Creates and returns a new instance of a DetectAddress.
Definition: detect-engine-address.c:69
DetectAddressTestConfVars
int DetectAddressTestConfVars(void)
Definition: detect-engine-address.c:1218
ADDRESS_ER
@ ADDRESS_ER
Definition: detect.h:152
ADDRESS_GT
@ ADDRESS_GT
Definition: detect.h:159