suricata
detect-engine-state.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \defgroup sigstate State support
20  *
21  * State is stored in the ::DetectEngineState structure. This is
22  * basically a containter for storage item of type ::DeStateStore.
23  * They contains an array of ::DeStateStoreItem which store the
24  * state of match for an individual signature identified by
25  * DeStateStoreItem::sid.
26  *
27  * @{
28  */
29 
30 /**
31  * \file
32  *
33  * \author Victor Julien <victor@inliniac.net>
34  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
35  *
36  * \brief State based signature handling.
37  */
38 
39 #include "suricata-common.h"
40 
41 #include "decode.h"
42 
43 #include "detect.h"
44 #include "detect-engine.h"
45 #include "detect-parse.h"
46 #include "detect-engine-state.h"
47 #include "detect-engine-dcepayload.h"
48 #include "detect-engine-build.h"
49 
50 #include "detect-flowvar.h"
51 
52 #include "stream-tcp.h"
53 #include "stream-tcp-private.h"
54 #include "stream-tcp-reassemble.h"
55 
56 #include "app-layer.h"
57 #include "app-layer-parser.h"
58 #include "app-layer-protos.h"
59 #include "app-layer-htp.h"
60 
61 #include "util-unittest.h"
62 #include "util-unittest-helper.h"
63 #include "util-profiling.h"
64 
65 #include "flow-util.h"
66 
67 /** convert enum to string */
68 #define CASE_CODE(E) case E: return #E
69 
70 static inline int StateIsValid(uint16_t alproto, void *alstate)
71 {
72  if (alstate != NULL) {
73  if (alproto == ALPROTO_HTTP1) {
74  HtpState *htp_state = (HtpState *)alstate;
75  if (htp_state->conn != NULL) {
76  return 1;
77  }
78  } else {
79  return 1;
80  }
81  }
82  return 0;
83 }
84 
85 static DeStateStore *DeStateStoreAlloc(void)
86 {
87  DeStateStore *d = SCMalloc(sizeof(DeStateStore));
88  if (unlikely(d == NULL))
89  return NULL;
90  memset(d, 0, sizeof(DeStateStore));
91 
92  return d;
93 }
94 
95 #ifdef DEBUG_VALIDATION
96 static int DeStateSearchState(DetectEngineState *state, uint8_t direction, SigIntId num)
97 {
98  DetectEngineStateDirection *dir_state = &state->dir_state[direction & STREAM_TOSERVER ? 0 : 1];
99  DeStateStore *tx_store = dir_state->head;
100  SigIntId store_cnt;
101  SigIntId state_cnt = 0;
102 
103  for (; tx_store != NULL; tx_store = tx_store->next) {
104  SCLogDebug("tx_store %p", tx_store);
105  for (store_cnt = 0;
106  store_cnt < DE_STATE_CHUNK_SIZE && state_cnt < dir_state->cnt;
107  store_cnt++, state_cnt++)
108  {
109  DeStateStoreItem *item = &tx_store->store[store_cnt];
110  if (item->sid == num) {
111  SCLogDebug("sid %u already in state: %p %p %p %u %u, direction %s",
112  num, state, dir_state, tx_store, state_cnt,
113  store_cnt, direction & STREAM_TOSERVER ? "toserver" : "toclient");
114  return 1;
115  }
116  }
117  }
118  return 0;
119 }
120 #endif
121 
122 static void DeStateSignatureAppend(DetectEngineState *state,
123  const Signature *s, uint32_t inspect_flags, uint8_t direction)
124 {
125  SCEnter();
126 
127  DetectEngineStateDirection *dir_state =
128  &state->dir_state[(direction & STREAM_TOSERVER) ? 0 : 1];
129 
130 #ifdef DEBUG_VALIDATION
131  BUG_ON(DeStateSearchState(state, direction, s->num));
132 #endif
133  DeStateStore *store = dir_state->tail;
134  if (store == NULL) {
135  store = DeStateStoreAlloc();
136  dir_state->head = store;
137  dir_state->cur = store;
138  dir_state->tail = store;
139  } else if (dir_state->cur) {
140  store = dir_state->cur;
141  } else {
142  store = DeStateStoreAlloc();
143  if (store != NULL) {
144  dir_state->tail->next = store;
145  dir_state->tail = store;
146  dir_state->cur = store;
147  }
148  }
149  if (store == NULL)
150  SCReturn;
151 
152  SigIntId idx = dir_state->cnt % DE_STATE_CHUNK_SIZE;
153  store->store[idx].sid = s->num;
154  store->store[idx].flags = inspect_flags;
155  dir_state->cnt++;
156  /* if current chunk is full, progress cur */
157  if (dir_state->cnt % DE_STATE_CHUNK_SIZE == 0) {
158  dir_state->cur = dir_state->cur->next;
159  }
160 
161  SCReturn;
162 }
163 
164 DetectEngineState *DetectEngineStateAlloc(void)
165 {
166  DetectEngineState *d = SCMalloc(sizeof(DetectEngineState));
167  if (unlikely(d == NULL))
168  return NULL;
169  memset(d, 0, sizeof(DetectEngineState));
170 
171  return d;
172 }
173 
174 void DetectEngineStateFree(DetectEngineState *state)
175 {
176  DeStateStore *store;
177  DeStateStore *store_next;
178  int i = 0;
179 
180  for (i = 0; i < 2; i++) {
181  store = state->dir_state[i].head;
182  while (store != NULL) {
183  store_next = store->next;
184  SCFree(store);
185  store = store_next;
186  }
187  }
188  SCFree(state);
189 
190  return;
191 }
192 
193 static void StoreFileNoMatchCnt(DetectEngineState *de_state, uint16_t file_no_match, uint8_t direction)
194 {
195  de_state->dir_state[(direction & STREAM_TOSERVER) ? 0 : 1].filestore_cnt += file_no_match;
196 
197  return;
198 }
199 
200 static bool StoreFilestoreSigsCantMatch(const SigGroupHead *sgh, const DetectEngineState *de_state, uint8_t direction)
201 {
202  if (de_state->dir_state[(direction & STREAM_TOSERVER) ? 0 : 1].filestore_cnt ==
203  sgh->filestore_cnt)
204  return true;
205  else
206  return false;
207 }
208 
209 static void StoreStateTxHandleFiles(const SigGroupHead *sgh, Flow *f, DetectEngineState *destate,
210  const uint8_t flow_flags, void *tx, const uint64_t tx_id, const uint16_t file_no_match)
211 {
212  SCLogDebug("tx %"PRIu64", file_no_match %u", tx_id, file_no_match);
213  StoreFileNoMatchCnt(destate, file_no_match, flow_flags);
214  if (StoreFilestoreSigsCantMatch(sgh, destate, flow_flags)) {
215  SCLogDebug("filestore sigs can't match");
216  FileDisableStoringForTransaction(
217  f, flow_flags & (STREAM_TOCLIENT | STREAM_TOSERVER), tx, tx_id);
218  } else {
219  SCLogDebug("filestore sigs can still match");
220  }
221 }
222 
223 void DetectRunStoreStateTx(
224  const SigGroupHead *sgh,
225  Flow *f, void *tx, uint64_t tx_id,
226  const Signature *s,
227  uint32_t inspect_flags, uint8_t flow_flags,
228  const uint16_t file_no_match)
229 {
230  AppLayerTxData *tx_data = AppLayerParserGetTxData(f->proto, f->alproto, tx);
231  BUG_ON(tx_data == NULL);
232  if (tx_data == NULL) {
233  SCLogDebug("No TX data for %" PRIu64, tx_id);
234  return;
235  }
236  if (tx_data->de_state == NULL) {
237  tx_data->de_state = DetectEngineStateAlloc();
238  if (tx_data->de_state == NULL)
239  return;
240  SCLogDebug("destate created for %"PRIu64, tx_id);
241  }
242  DeStateSignatureAppend(tx_data->de_state, s, inspect_flags, flow_flags);
243  StoreStateTxHandleFiles(sgh, f, tx_data->de_state, flow_flags, tx, tx_id, file_no_match);
244 
245  SCLogDebug("Stored for TX %"PRIu64, tx_id);
246 }
247 
248 static inline void ResetTxState(DetectEngineState *s)
249 {
250  if (s) {
251  s->dir_state[0].cnt = 0;
252  s->dir_state[0].filestore_cnt = 0;
253  s->dir_state[0].flags = 0;
254  /* reset 'cur' back to the list head */
255  s->dir_state[0].cur = s->dir_state[0].head;
256 
257  s->dir_state[1].cnt = 0;
258  s->dir_state[1].filestore_cnt = 0;
259  s->dir_state[1].flags = 0;
260  /* reset 'cur' back to the list head */
261  s->dir_state[1].cur = s->dir_state[1].head;
262  }
263 }
264 
265 /** \brief Reset de state for active tx'
266  * To be used on detect engine reload.
267  * \param f write LOCKED flow
268  */
269 void DetectEngineStateResetTxs(Flow *f)
270 {
271  void *alstate = FlowGetAppState(f);
272  if (!StateIsValid(f->alproto, alstate)) {
273  return;
274  }
275 
276  uint64_t inspect_ts = AppLayerParserGetTransactionInspectId(f->alparser, STREAM_TOCLIENT);
277  uint64_t inspect_tc = AppLayerParserGetTransactionInspectId(f->alparser, STREAM_TOSERVER);
278 
279  uint64_t inspect_tx_id = MIN(inspect_ts, inspect_tc);
280 
281  uint64_t total_txs = AppLayerParserGetTxCnt(f, alstate);
282 
283  for ( ; inspect_tx_id < total_txs; inspect_tx_id++) {
284  void *inspect_tx = AppLayerParserGetTx(f->proto, f->alproto, alstate, inspect_tx_id);
285  if (inspect_tx != NULL) {
286  AppLayerTxData *txd = AppLayerParserGetTxData(f->proto, f->alproto, inspect_tx);
287  BUG_ON(txd == NULL);
288  if (txd) {
289  ResetTxState(txd->de_state);
290  }
291  }
292  }
293 }
294 
295 /*********Unittests*********/
296 
297 #ifdef UNITTESTS
298 #include "detect-engine-alert.h"
299 
300 static int DeStateTest01(void)
301 {
302  SCLogDebug("sizeof(DetectEngineState)\t\t%"PRIuMAX,
303  (uintmax_t)sizeof(DetectEngineState));
304  SCLogDebug("sizeof(DeStateStore)\t\t\t%"PRIuMAX,
305  (uintmax_t)sizeof(DeStateStore));
306  SCLogDebug("sizeof(DeStateStoreItem)\t\t%"PRIuMAX"",
307  (uintmax_t)sizeof(DeStateStoreItem));
308 
309  return 1;
310 }
311 
312 static int DeStateTest02(void)
313 {
314  uint8_t direction = STREAM_TOSERVER;
315  DetectEngineState *state = DetectEngineStateAlloc();
316  FAIL_IF_NULL(state);
317  FAIL_IF_NOT_NULL(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head);
318 
319  Signature s;
320  memset(&s, 0x00, sizeof(s));
321 
322  s.num = 0;
323  DeStateSignatureAppend(state, &s, 0, direction);
324  s.num = 11;
325  DeStateSignatureAppend(state, &s, 0, direction);
326  s.num = 22;
327  DeStateSignatureAppend(state, &s, 0, direction);
328  s.num = 33;
329  DeStateSignatureAppend(state, &s, 0, direction);
330  s.num = 44;
331  DeStateSignatureAppend(state, &s, 0, direction);
332  s.num = 55;
333  DeStateSignatureAppend(state, &s, 0, direction);
334  s.num = 66;
335  DeStateSignatureAppend(state, &s, 0, direction);
336  s.num = 77;
337  DeStateSignatureAppend(state, &s, 0, direction);
338  s.num = 88;
339  DeStateSignatureAppend(state, &s, 0, direction);
340  s.num = 99;
341  DeStateSignatureAppend(state, &s, 0, direction);
342  s.num = 100;
343  DeStateSignatureAppend(state, &s, 0, direction);
344  s.num = 111;
345  DeStateSignatureAppend(state, &s, 0, direction);
346  s.num = 122;
347  DeStateSignatureAppend(state, &s, 0, direction);
348  s.num = 133;
349  DeStateSignatureAppend(state, &s, 0, direction);
350  FAIL_IF_NOT(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head ==
351  state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur);
352 
353  s.num = 144;
354  DeStateSignatureAppend(state, &s, 0, direction);
355 
356  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[14].sid != 144);
357  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head ==
358  state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur);
359  FAIL_IF_NOT(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur == NULL);
360 
361  s.num = 155;
362  DeStateSignatureAppend(state, &s, 0, direction);
363 
364  FAIL_IF_NOT(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].tail ==
365  state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur);
366 
367  s.num = 166;
368  DeStateSignatureAppend(state, &s, 0, direction);
369 
370  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head == NULL);
371  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[1].sid != 11);
372  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next == NULL);
373  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[14].sid != 144);
374  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next->store[0].sid != 155);
375  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next->store[1].sid != 166);
376 
377  ResetTxState(state);
378 
379  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head == NULL);
380  FAIL_IF_NOT(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head ==
381  state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur);
382 
383  s.num = 0;
384  DeStateSignatureAppend(state, &s, 0, direction);
385  s.num = 11;
386  DeStateSignatureAppend(state, &s, 0, direction);
387  s.num = 22;
388  DeStateSignatureAppend(state, &s, 0, direction);
389  s.num = 33;
390  DeStateSignatureAppend(state, &s, 0, direction);
391  s.num = 44;
392  DeStateSignatureAppend(state, &s, 0, direction);
393  s.num = 55;
394  DeStateSignatureAppend(state, &s, 0, direction);
395  s.num = 66;
396  DeStateSignatureAppend(state, &s, 0, direction);
397  s.num = 77;
398  DeStateSignatureAppend(state, &s, 0, direction);
399  s.num = 88;
400  DeStateSignatureAppend(state, &s, 0, direction);
401  s.num = 99;
402  DeStateSignatureAppend(state, &s, 0, direction);
403  s.num = 100;
404  DeStateSignatureAppend(state, &s, 0, direction);
405  s.num = 111;
406  DeStateSignatureAppend(state, &s, 0, direction);
407  s.num = 122;
408  DeStateSignatureAppend(state, &s, 0, direction);
409  s.num = 133;
410  DeStateSignatureAppend(state, &s, 0, direction);
411  FAIL_IF_NOT(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head ==
412  state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur);
413  s.num = 144;
414  DeStateSignatureAppend(state, &s, 0, direction);
415  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[14].sid != 144);
416  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head ==
417  state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur);
418  FAIL_IF_NOT(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].tail ==
419  state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur);
420  s.num = 155;
421  DeStateSignatureAppend(state, &s, 0, direction);
422  s.num = 166;
423  DeStateSignatureAppend(state, &s, 0, direction);
424 
425  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head == NULL);
426  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[1].sid != 11);
427  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next == NULL);
428  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[14].sid != 144);
429  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next->store[0].sid != 155);
430  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next->store[1].sid != 166);
431 
432  DetectEngineStateFree(state);
433 
434  PASS;
435 }
436 
437 static int DeStateTest03(void)
438 {
439  DetectEngineState *state = DetectEngineStateAlloc();
440  FAIL_IF_NULL(state);
441 
442  Signature s;
443  memset(&s, 0x00, sizeof(s));
444 
445  uint8_t direction = STREAM_TOSERVER;
446 
447  s.num = 11;
448  DeStateSignatureAppend(state, &s, 0, direction);
449  s.num = 22;
450  DeStateSignatureAppend(state, &s, BIT_U32(DE_STATE_FLAG_BASE), direction);
451 
452  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head == NULL);
453  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[0].sid != 11);
454  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[0].flags & BIT_U32(DE_STATE_FLAG_BASE));
455  FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[1].sid != 22);
456  FAIL_IF(!(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[1].flags & BIT_U32(DE_STATE_FLAG_BASE)));
457 
458  DetectEngineStateFree(state);
459  PASS;
460 }
461 
462 static int DeStateSigTest01(void)
463 {
464  DetectEngineThreadCtx *det_ctx = NULL;
465  ThreadVars th_v;
466  Flow f;
467  TcpSession ssn;
468  Packet *p = NULL;
469  uint8_t httpbuf1[] = "POST / HTTP/1.0\r\n";
470  uint8_t httpbuf2[] = "User-Agent: Mozilla/1.0\r\n";
471  uint8_t httpbuf3[] = "Cookie: dummy\r\nContent-Length: 10\r\n\r\n";
472  uint8_t httpbuf4[] = "Http Body!";
473  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
474  uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
475  uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */
476  uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */
477 
478  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
479  FAIL_IF_NULL(alp_tctx);
480 
481  memset(&th_v, 0, sizeof(th_v));
482  memset(&f, 0, sizeof(f));
483  memset(&ssn, 0, sizeof(ssn));
484 
485  p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
486  FAIL_IF_NULL(p);
487 
488  FLOW_INITIALIZE(&f);
489  f.protoctx = (void *)&ssn;
490  f.proto = IPPROTO_TCP;
491  f.flags |= FLOW_IPV4;
492  f.alproto = ALPROTO_HTTP1;
493 
494  p->flow = &f;
495  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
496  p->flowflags |= FLOW_PKT_TOSERVER;
497  p->flowflags |= FLOW_PKT_ESTABLISHED;
498 
499  StreamTcpInitConfig(true);
500 
501  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
502  FAIL_IF_NULL(de_ctx);
503  de_ctx->flags |= DE_QUIET;
504 
505  Signature *s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (content:\"POST\"; http_method; content:\"dummy\"; http_cookie; sid:1; rev:1;)");
506  FAIL_IF_NULL(s);
507 
508  SigGroupBuild(de_ctx);
509  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
510  FAIL_IF_NULL(det_ctx);
511 
512  int r = AppLayerParserParse(
513  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf1, httplen1);
514  FAIL_IF_NOT(r == 0);
515  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
516  FAIL_IF(PacketAlertCheck(p, 1));
517 
518  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf2, httplen2);
519  FAIL_IF_NOT(r == 0);
520  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
521  FAIL_IF(PacketAlertCheck(p, 1));
522 
523  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf3, httplen3);
524  FAIL_IF_NOT(r == 0);
525  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
526  FAIL_IF_NOT(PacketAlertCheck(p, 1));
527 
528  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf4, httplen4);
529  FAIL_IF_NOT(r == 0);
530  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
531  FAIL_IF(PacketAlertCheck(p, 1));
532 
533  AppLayerParserThreadCtxFree(alp_tctx);
534  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
535  DetectEngineCtxFree(de_ctx);
536  StreamTcpFreeConfig(true);
537  FLOW_DESTROY(&f);
538  UTHFreePacket(p);
539  PASS;
540 }
541 
542 /** \test multiple pipelined http transactions */
543 static int DeStateSigTest02(void)
544 {
545  DetectEngineThreadCtx *det_ctx = NULL;
546  ThreadVars th_v;
547  Flow f;
548  TcpSession ssn;
549  Packet *p = NULL;
550  uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n";
551  uint8_t httpbuf2[] = "User-Agent: Mozilla/1.0\r\nContent-Length: 10\r\n";
552  uint8_t httpbuf3[] = "Cookie: dummy\r\n\r\n";
553  uint8_t httpbuf4[] = "Http Body!";
554  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
555  uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
556  uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */
557  uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */
558  uint8_t httpbuf5[] = "GET /?var=val HTTP/1.1\r\n";
559  uint8_t httpbuf6[] = "User-Agent: Firefox/1.0\r\n";
560  uint8_t httpbuf7[] = "Cookie: dummy2\r\nContent-Length: 10\r\n\r\nHttp Body!";
561  uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */
562  uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */
563  uint32_t httplen7 = sizeof(httpbuf7) - 1; /* minus the \0 */
564  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
565  FAIL_IF_NULL(alp_tctx);
566 
567  memset(&th_v, 0, sizeof(th_v));
568  memset(&f, 0, sizeof(f));
569  memset(&ssn, 0, sizeof(ssn));
570 
571  p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
572 
573  FLOW_INITIALIZE(&f);
574  f.protoctx = (void *)&ssn;
575  f.proto = IPPROTO_TCP;
576  f.flags |= FLOW_IPV4;
577 
578  p->flow = &f;
579  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
580  p->flowflags |= FLOW_PKT_TOSERVER;
581  p->flowflags |= FLOW_PKT_ESTABLISHED;
582  f.alproto = ALPROTO_HTTP1;
583 
584  StreamTcpInitConfig(true);
585 
586  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
587  FAIL_IF_NULL(de_ctx);
588 
589  de_ctx->flags |= DE_QUIET;
590 
591  Signature *s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:to_server; content:\"POST\"; http_method; content:\"/\"; http_uri; content:\"Mozilla\"; http_header; content:\"dummy\"; http_cookie; content:\"body\"; nocase; http_client_body; sid:1; rev:1;)");
592  FAIL_IF_NULL(s);
593  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:to_server; content:\"GET\"; http_method; content:\"Firefox\"; http_header; content:\"dummy2\"; http_cookie; sid:2; rev:1;)");
594  FAIL_IF_NULL(s);
595 
596  SigGroupBuild(de_ctx);
597  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
598  FAIL_IF_NULL(det_ctx);
599 
600  int r = AppLayerParserParse(
601  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf1, httplen1);
602  FAIL_IF(r != 0);
603  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
604  FAIL_IF(PacketAlertCheck(p, 1));
605 
606  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf2, httplen2);
607  FAIL_IF(r != 0);
608  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
609  FAIL_IF(PacketAlertCheck(p, 1));
610 
611  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf3, httplen3);
612  FAIL_IF(r != 0);
613  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
614  FAIL_IF(PacketAlertCheck(p, 1));
615 
616  void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f.alstate, 0);
617  FAIL_IF_NULL(tx);
618 
619  AppLayerTxData *tx_data = AppLayerParserGetTxData(IPPROTO_TCP, ALPROTO_HTTP1, tx);
620  FAIL_IF_NULL(tx_data);
621  DetectEngineState *tx_de_state = tx_data->de_state;
622  FAIL_IF_NULL(tx_de_state);
623  FAIL_IF(tx_de_state->dir_state[0].cnt != 1);
624  /* http_header(mpm): 5, uri: 3, method: 6, cookie: 7 */
625  uint32_t expected_flags = (BIT_U32(5) | BIT_U32(3) | BIT_U32(6) |BIT_U32(7));
626  FAIL_IF(tx_de_state->dir_state[0].head->store[0].flags != expected_flags);
627 
628  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf4, httplen4);
629  FAIL_IF(r != 0);
630  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
631  FAIL_IF(!(PacketAlertCheck(p, 1)));
632 
633  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf5, httplen5);
634  FAIL_IF(r != 0);
635  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
636  FAIL_IF(PacketAlertCheck(p, 1));
637 
638  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf6, httplen6);
639  FAIL_IF(r != 0);
640  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
641  FAIL_IF((PacketAlertCheck(p, 1)) || (PacketAlertCheck(p, 2)));
642 
643  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf7, httplen7);
644  FAIL_IF(r != 0);
645  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
646  FAIL_IF(!(PacketAlertCheck(p, 2)));
647 
648  AppLayerParserThreadCtxFree(alp_tctx);
649  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
650  DetectEngineCtxFree(de_ctx);
651  StreamTcpFreeConfig(true);
652  FLOW_DESTROY(&f);
653  UTHFreePacket(p);
654  PASS;
655 }
656 
657 static int DeStateSigTest03(void)
658 {
659  uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"
660  "Host: www.server.lan\r\n"
661  "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"
662  "Content-Length: 215\r\n"
663  "\r\n"
664  "-----------------------------277531038314945\r\n"
665  "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n"
666  "Content-Type: image/jpeg\r\n"
667  "\r\n"
668  "filecontent\r\n"
669  "-----------------------------277531038314945--";
670  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
671  ThreadVars th_v;
672  TcpSession ssn;
673  Flow *f = NULL;
674  Packet *p = NULL;
675  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
676  FAIL_IF_NULL(alp_tctx);
677 
678  memset(&th_v, 0, sizeof(th_v));
679  memset(&ssn, 0, sizeof(ssn));
680 
681  DetectEngineThreadCtx *det_ctx = NULL;
682  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
683  FAIL_IF_NULL(de_ctx);
684 
685  de_ctx->flags |= DE_QUIET;
686 
687  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (flow:to_server; content:\"POST\"; http_method; content:\"upload.cgi\"; http_uri; filestore; sid:1; rev:1;)");
688  FAIL_IF_NULL(s);
689 
690  SigGroupBuild(de_ctx);
691  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
692 
693  f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);
694  FAIL_IF_NULL(f);
695  f->protoctx = &ssn;
696  f->proto = IPPROTO_TCP;
697  f->alproto = ALPROTO_HTTP1;
698 
699  p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
700  FAIL_IF_NULL(p);
701 
702  p->flow = f;
703  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
704  p->flowflags |= FLOW_PKT_TOSERVER;
705  p->flowflags |= FLOW_PKT_ESTABLISHED;
706 
707  StreamTcpInitConfig(true);
708 
709  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1,
710  STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1);
711  FAIL_IF(r != 0);
712 
713  HtpState *http_state = f->alstate;
714  FAIL_IF_NULL(http_state);
715  void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);
716  FAIL_IF_NULL(tx);
717  HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);
718  FAIL_IF_NULL(tx_ud);
719 
720  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
721  FAIL_IF(!(PacketAlertCheck(p, 1)));
722 
723  FileContainer *files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);
724  FAIL_IF_NULL(files);
725 
726  File *file = files->head;
727  FAIL_IF_NULL(file);
728 
729  FAIL_IF(!(file->flags & FILE_STORE));
730 
731  AppLayerParserThreadCtxFree(alp_tctx);
732  UTHFreeFlow(f);
733 
734  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
735  DetectEngineCtxFree(de_ctx);
736  StreamTcpFreeConfig(true);
737  PASS;
738 }
739 
740 static int DeStateSigTest04(void)
741 {
742  uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"
743  "Host: www.server.lan\r\n"
744  "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"
745  "Content-Length: 215\r\n"
746  "\r\n"
747  "-----------------------------277531038314945\r\n"
748  "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n"
749  "Content-Type: image/jpeg\r\n"
750  "\r\n"
751  "filecontent\r\n"
752  "-----------------------------277531038314945--";
753  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
754  ThreadVars th_v;
755  TcpSession ssn;
756  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
757  FAIL_IF_NULL(alp_tctx);
758 
759  memset(&th_v, 0, sizeof(th_v));
760  memset(&ssn, 0, sizeof(ssn));
761 
762  DetectEngineThreadCtx *det_ctx = NULL;
763  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
764  FAIL_IF_NULL(de_ctx);
765  de_ctx->flags |= DE_QUIET;
766 
767  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"GET\"; http_method; content:\"upload.cgi\"; http_uri; filestore; sid:1; rev:1;)");
768  FAIL_IF_NULL(s);
769 
770  SigGroupBuild(de_ctx);
771  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
772  FAIL_IF_NULL(det_ctx);
773 
774  Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);
775  FAIL_IF_NULL(f);
776  f->protoctx = &ssn;
777  f->proto = IPPROTO_TCP;
778  f->alproto = ALPROTO_HTTP1;
779 
780  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
781  FAIL_IF_NULL(p);
782  p->flow = f;
783  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
784  p->flowflags |= FLOW_PKT_TOSERVER;
785  p->flowflags |= FLOW_PKT_ESTABLISHED;
786 
787  StreamTcpInitConfig(true);
788 
789  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1,
790  STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1);
791  FAIL_IF(r != 0);
792  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
793  FAIL_IF(PacketAlertCheck(p, 1));
794 
795  HtpState *http_state = f->alstate;
796  FAIL_IF_NULL(http_state);
797  void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);
798  FAIL_IF_NULL(tx);
799  HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);
800  FAIL_IF_NULL(tx_ud);
801 
802  FileContainer *files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);
803  FAIL_IF_NULL(files);
804  File *file = files->head;
805  FAIL_IF_NULL(file);
806 
807  FAIL_IF(file->flags & FILE_STORE);
808 
809  AppLayerParserThreadCtxFree(alp_tctx);
810  UTHFreeFlow(f);
811  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
812  DetectEngineCtxFree(de_ctx);
813  StreamTcpFreeConfig(true);
814  PASS;
815 }
816 
817 static int DeStateSigTest05(void)
818 {
819  uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"
820  "Host: www.server.lan\r\n"
821  "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"
822  "Content-Length: 215\r\n"
823  "\r\n"
824  "-----------------------------277531038314945\r\n"
825  "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n"
826  "Content-Type: image/jpeg\r\n"
827  "\r\n"
828  "filecontent\r\n"
829  "-----------------------------277531038314945--";
830  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
831  ThreadVars th_v;
832  TcpSession ssn;
833 
834  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
835  FAIL_IF_NULL(alp_tctx);
836 
837  memset(&th_v, 0, sizeof(th_v));
838  memset(&ssn, 0, sizeof(ssn));
839 
840  DetectEngineThreadCtx *det_ctx = NULL;
841  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
842  FAIL_IF_NULL(de_ctx);
843  de_ctx->flags |= DE_QUIET;
844 
845  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"GET\"; http_method; content:\"upload.cgi\"; http_uri; filename:\"nomatch\"; sid:1; rev:1;)");
846  FAIL_IF_NULL(s);
847 
848  SigGroupBuild(de_ctx);
849  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
850 
851  Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);
852  FAIL_IF_NULL(f);
853  f->protoctx = &ssn;
854  f->proto = IPPROTO_TCP;
855  f->alproto = ALPROTO_HTTP1;
856 
857  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
858  FAIL_IF_NULL(p);
859  p->flow = f;
860  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
861  p->flowflags |= FLOW_PKT_TOSERVER;
862  p->flowflags |= FLOW_PKT_ESTABLISHED;
863 
864  StreamTcpInitConfig(true);
865 
866  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1,
867  STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1);
868  FAIL_IF_NOT(r == 0);
869  HtpState *http_state = f->alstate;
870  FAIL_IF_NULL(http_state);
871  void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);
872  FAIL_IF_NULL(tx);
873  HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);
874  FAIL_IF_NULL(tx_ud);
875 
876  FileContainer *files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);
877  FAIL_IF_NULL(files);
878  File *file = files->head;
879  FAIL_IF_NULL(file);
880  FAIL_IF(http_state->state_data.file_flags & FLOWFILE_NO_STORE_TS);
881 
882  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
883  FAIL_IF(PacketAlertCheck(p, 1));
884 
885  /* detect will have set FLOWFILE_NO_STORE_TS, but it won't have had
886  * an opportunity to be applied to the file itself yet */
887  FAIL_IF_NOT(http_state->state_data.file_flags & FLOWFILE_NO_STORE_TS);
888  FAIL_IF(file->flags & FILE_NOSTORE);
889 
890  AppLayerParserThreadCtxFree(alp_tctx);
891  UTHFreeFlow(f);
892  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
893  DetectEngineCtxFree(de_ctx);
894  StreamTcpFreeConfig(true);
895  PASS;
896 }
897 
898 static int DeStateSigTest06(void)
899 {
900  uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"
901  "Host: www.server.lan\r\n"
902  "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"
903  "Content-Length: 215\r\n"
904  "\r\n"
905  "-----------------------------277531038314945\r\n"
906  "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n"
907  "Content-Type: image/jpeg\r\n"
908  "\r\n"
909  "filecontent\r\n"
910  "-----------------------------277531038314945--";
911  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
912  ThreadVars th_v;
913  TcpSession ssn;
914 
915  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
916  FAIL_IF_NULL(alp_tctx);
917 
918  memset(&th_v, 0, sizeof(th_v));
919  memset(&ssn, 0, sizeof(ssn));
920 
921  DetectEngineThreadCtx *det_ctx = NULL;
922  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
923  FAIL_IF_NULL(de_ctx);
924  de_ctx->flags |= DE_QUIET;
925 
926  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"POST\"; http_method; content:\"upload.cgi\"; http_uri; filename:\"nomatch\"; filestore; sid:1; rev:1;)");
927  FAIL_IF_NULL(s);
928 
929  SigGroupBuild(de_ctx);
930  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
931  FAIL_IF_NULL(det_ctx);
932 
933  Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);
934  FAIL_IF_NULL(f);
935  f->protoctx = &ssn;
936  f->proto = IPPROTO_TCP;
937  f->alproto = ALPROTO_HTTP1;
938 
939  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
940  FAIL_IF_NULL(p);
941  p->flow = f;
942  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
943  p->flowflags |= FLOW_PKT_TOSERVER;
944  p->flowflags |= FLOW_PKT_ESTABLISHED;
945 
946  StreamTcpInitConfig(true);
947 
948  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1,
949  STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1);
950  FAIL_IF(r != 0);
951  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
952  FAIL_IF(PacketAlertCheck(p, 1));
953 
954  HtpState *http_state = f->alstate;
955  FAIL_IF_NULL(http_state);
956  void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);
957  FAIL_IF_NULL(tx);
958  HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);
959  FAIL_IF_NULL(tx_ud);
960 
961  FileContainer *files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);
962  FAIL_IF_NULL(files);
963  File *file = files->head;
964  FAIL_IF_NULL(file);
965  /* detect will have set FLOWFILE_NO_STORE_TS, but it won't have had
966  * an opportunity to be applied to the file itself yet */
967  FAIL_IF_NOT(tx_ud->tx_data.file_flags & FLOWFILE_NO_STORE_TS);
968  FAIL_IF(file->flags & FILE_NOSTORE);
969 
970  AppLayerParserThreadCtxFree(alp_tctx);
971  UTHFreeFlow(f);
972  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
973  DetectEngineCtxFree(de_ctx);
974  StreamTcpFreeConfig(true);
975  PASS;
976 }
977 
978 static int DeStateSigTest07(void)
979 {
980  uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"
981  "Host: www.server.lan\r\n"
982  "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"
983  "Content-Length: 215\r\n"
984  "\r\n"
985  "-----------------------------277531038314945\r\n"
986  "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n"
987  "Content-Type: image/jpeg\r\n"
988  "\r\n";
989 
990  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
991  uint8_t httpbuf2[] = "filecontent\r\n"
992  "-----------------------------277531038314945--";
993  uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
994  ThreadVars th_v;
995  TcpSession ssn;
996 
997  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
998  FAIL_IF_NULL(alp_tctx);
999 
1000  memset(&th_v, 0, sizeof(th_v));
1001  memset(&ssn, 0, sizeof(ssn));
1002 
1003  DetectEngineThreadCtx *det_ctx = NULL;
1004  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1005  FAIL_IF_NULL(de_ctx);
1006  de_ctx->flags |= DE_QUIET;
1007 
1008  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"GET\"; http_method; content:\"upload.cgi\"; http_uri; filestore; sid:1; rev:1;)");
1009  FAIL_IF_NULL(s);
1010 
1011  SigGroupBuild(de_ctx);
1012  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1013 
1014  Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);
1015  FAIL_IF_NULL(f);
1016  f->protoctx = &ssn;
1017  f->proto = IPPROTO_TCP;
1018  f->alproto = ALPROTO_HTTP1;
1019 
1020  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1021  FAIL_IF_NULL(p);
1022  p->flow = f;
1023  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1024  p->flowflags |= FLOW_PKT_TOSERVER;
1025  p->flowflags |= FLOW_PKT_ESTABLISHED;
1026 
1027  StreamTcpInitConfig(true);
1028 
1029  int r = AppLayerParserParse(
1030  NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1);
1031  FAIL_IF(r != 0);
1032  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1033  FAIL_IF(PacketAlertCheck(p, 1));
1034 
1035  r = AppLayerParserParse(
1036  NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_EOF, httpbuf2, httplen2);
1037  FAIL_IF(r != 0);
1038  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1039  FAIL_IF(PacketAlertCheck(p, 1));
1040 
1041  HtpState *http_state = f->alstate;
1042  FAIL_IF_NULL(http_state);
1043  void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);
1044  FAIL_IF_NULL(tx);
1045  HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);
1046  FAIL_IF_NULL(tx_ud);
1047 
1048  FileContainer *files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);
1049  FAIL_IF_NULL(files);
1050  File *file = files->head;
1051  FAIL_IF_NULL(file);
1052  FAIL_IF(file->flags & FILE_STORE);
1053 
1054  AppLayerParserThreadCtxFree(alp_tctx);
1055  UTHFreeFlow(f);
1056  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1057  DetectEngineCtxFree(de_ctx);
1058  StreamTcpFreeConfig(true);
1059  PASS;
1060 }
1061 
1062 /**
1063  * \test multiple files in a tx
1064  */
1065 static int DeStateSigTest08(void)
1066 {
1067  uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"
1068  "Host: www.server.lan\r\n"
1069  "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"
1070  "Content-Length: 440\r\n"
1071  "\r\n"
1072  "-----------------------------277531038314945\r\n"
1073  "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"AAAApicture1.jpg\"\r\n"
1074  "Content-Type: image/jpeg\r\n"
1075  "\r\n";
1076 
1077  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
1078  uint8_t httpbuf2[] = "file";
1079  uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
1080  uint8_t httpbuf3[] = "content\r\n"
1081  "-----------------------------277531038314945\r\n";
1082  uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */
1083 
1084  uint8_t httpbuf4[] = "Content-Disposition: form-data; name=\"uploadfile_1\"; filename=\"BBBBpicture2.jpg\"\r\n"
1085  "Content-Type: image/jpeg\r\n"
1086  "\r\n"
1087  "filecontent2\r\n"
1088  "-----------------------------277531038314945--";
1089  uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */
1090 
1091  ThreadVars th_v;
1092  TcpSession ssn;
1093 
1094  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1095  FAIL_IF_NULL(alp_tctx);
1096 
1097  memset(&th_v, 0, sizeof(th_v));
1098  memset(&ssn, 0, sizeof(ssn));
1099 
1100  DetectEngineThreadCtx *det_ctx = NULL;
1101  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1102  FAIL_IF_NULL(de_ctx);
1103  de_ctx->flags |= DE_QUIET;
1104 
1105  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"POST\"; http_method; content:\"upload.cgi\"; http_uri; filename:\"BBBBpicture\"; filestore; sid:1; rev:1;)");
1106  FAIL_IF_NULL(s);
1107 
1108  SigGroupBuild(de_ctx);
1109  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1110 
1111  Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);
1112  FAIL_IF_NULL(f);
1113  f->protoctx = &ssn;
1114  f->proto = IPPROTO_TCP;
1115  f->alproto = ALPROTO_HTTP1;
1116 
1117  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1118  FAIL_IF_NULL(p);
1119  p->flow = f;
1120  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1121  p->flowflags |= FLOW_PKT_TOSERVER;
1122  p->flowflags |= FLOW_PKT_ESTABLISHED;
1123 
1124  StreamTcpInitConfig(true);
1125 
1126  /* HTTP request with 1st part of the multipart body */
1127 
1128  int r = AppLayerParserParse(
1129  NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1);
1130  FAIL_IF(r != 0);
1131  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1132  FAIL_IF(PacketAlertCheck(p, 1));
1133 
1134  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf2, httplen2);
1135  FAIL_IF(r != 0);
1136  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1137  FAIL_IF(PacketAlertCheck(p, 1));
1138 
1139  HtpState *http_state = f->alstate;
1140  FAIL_IF_NULL(http_state);
1141  void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);
1142  FAIL_IF_NULL(tx);
1143  HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);
1144  FAIL_IF_NULL(tx_ud);
1145 
1146  FileContainer *files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);
1147  FAIL_IF_NULL(files);
1148  File *file = files->head;
1149  FAIL_IF_NULL(file);
1150  FAIL_IF(file->flags & FILE_STORE);
1151 
1152  /* 2nd multipart body file */
1153 
1154  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf3, httplen3);
1155  FAIL_IF(r != 0);
1156  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1157  FAIL_IF(PacketAlertCheck(p, 1));
1158 
1159  r = AppLayerParserParse(
1160  NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_EOF, httpbuf4, httplen4);
1161  FAIL_IF(r != 0);
1162  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1163  FAIL_IF_NOT(PacketAlertCheck(p, 1));
1164 
1165  http_state = f->alstate;
1166  FAIL_IF_NULL(http_state);
1167  tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);
1168  FAIL_IF_NULL(tx);
1169  tx_ud = htp_tx_get_user_data(tx);
1170  FAIL_IF_NULL(tx_ud);
1171 
1172  files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);
1173  FAIL_IF_NULL(files);
1174  file = files->head;
1175  FAIL_IF_NULL(file);
1176  file = file->next;
1177  FAIL_IF_NULL(file);
1178  FAIL_IF_NOT(file->flags & FILE_STORE);
1179 
1180  AppLayerParserThreadCtxFree(alp_tctx);
1181  UTHFreeFlow(f);
1182  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1183  DetectEngineCtxFree(de_ctx);
1184  StreamTcpFreeConfig(true);
1185  PASS;
1186 }
1187 
1188 /**
1189  * \test multiple files in a tx. Both files should match
1190  */
1191 static int DeStateSigTest09(void)
1192 {
1193  uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"
1194  "Host: www.server.lan\r\n"
1195  "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"
1196  "Content-Length: 440\r\n"
1197  "\r\n"
1198  "-----------------------------277531038314945\r\n"
1199  "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n"
1200  "Content-Type: image/jpeg\r\n"
1201  "\r\n";
1202 
1203  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
1204  uint8_t httpbuf2[] = "file";
1205  uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
1206  uint8_t httpbuf3[] = "content\r\n"
1207  "-----------------------------277531038314945\r\n";
1208  uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */
1209 
1210  uint8_t httpbuf4[] = "Content-Disposition: form-data; name=\"uploadfile_1\"; filename=\"somepicture2.jpg\"\r\n"
1211  "Content-Type: image/jpeg\r\n"
1212  "\r\n"
1213  "filecontent2\r\n"
1214  "-----------------------------277531038314945--";
1215  uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */
1216 
1217  ThreadVars th_v;
1218  TcpSession ssn;
1219 
1220  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1221  FAIL_IF_NULL(alp_tctx);
1222 
1223  memset(&th_v, 0, sizeof(th_v));
1224  memset(&ssn, 0, sizeof(ssn));
1225 
1226  DetectEngineThreadCtx *det_ctx = NULL;
1227  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1228  FAIL_IF_NULL(de_ctx);
1229  de_ctx->flags |= DE_QUIET;
1230 
1231  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"POST\"; http_method; content:\"upload.cgi\"; http_uri; filename:\"somepicture\"; filestore; sid:1; rev:1;)");
1232  FAIL_IF_NULL(s);
1233 
1234  SigGroupBuild(de_ctx);
1235  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1236 
1237  Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);
1238  FAIL_IF_NULL(f);
1239  f->protoctx = &ssn;
1240  f->proto = IPPROTO_TCP;
1241  f->alproto = ALPROTO_HTTP1;
1242 
1243  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1244  FAIL_IF_NULL(p);
1245  p->flow = f;
1246  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1247  p->flowflags |= FLOW_PKT_TOSERVER;
1248  p->flowflags |= FLOW_PKT_ESTABLISHED;
1249 
1250  StreamTcpInitConfig(true);
1251 
1252  /* HTTP request with 1st part of the multipart body */
1253 
1254  int r = AppLayerParserParse(
1255  NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1);
1256  FAIL_IF(r != 0);
1257  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1258  FAIL_IF_NOT(PacketAlertCheck(p, 1));
1259 
1260  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf2, httplen2);
1261  FAIL_IF(r != 0);
1262  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1263  FAIL_IF(PacketAlertCheck(p, 1));
1264 
1265  HtpState *http_state = f->alstate;
1266  FAIL_IF_NULL(http_state);
1267  void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);
1268  FAIL_IF_NULL(tx);
1269  HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);
1270  FAIL_IF_NULL(tx_ud);
1271 
1272  FileContainer *files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);
1273  FAIL_IF_NULL(files);
1274  File *file = files->head;
1275  FAIL_IF_NULL(file);
1276  FAIL_IF_NOT(file->flags & FILE_STORE);
1277 
1278  /* 2nd multipart body file */
1279 
1280  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf3, httplen3);
1281  FAIL_IF(r != 0);
1282  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1283  FAIL_IF(PacketAlertCheck(p, 1));
1284 
1285  r = AppLayerParserParse(
1286  NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_EOF, httpbuf4, httplen4);
1287  FAIL_IF(r != 0);
1288  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1289  FAIL_IF_NOT(PacketAlertCheck(p, 1));
1290 
1291  http_state = f->alstate;
1292  FAIL_IF_NULL(http_state);
1293  tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);
1294  FAIL_IF_NULL(tx);
1295  tx_ud = htp_tx_get_user_data(tx);
1296  FAIL_IF_NULL(tx_ud);
1297 
1298  files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);
1299  FAIL_IF_NULL(files);
1300  file = files->head;
1301  FAIL_IF_NULL(file);
1302  FAIL_IF_NOT(file->flags & FILE_STORE);
1303 
1304  AppLayerParserThreadCtxFree(alp_tctx);
1305  UTHFreeFlow(f);
1306  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1307  DetectEngineCtxFree(de_ctx);
1308  StreamTcpFreeConfig(true);
1309  PASS;
1310 }
1311 
1312 /**
1313  * \test multiple files in a tx. Both files should match. No other matches.
1314  */
1315 static int DeStateSigTest10(void)
1316 {
1317  uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"
1318  "Host: www.server.lan\r\n"
1319  "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"
1320  "Content-Length: 440\r\n"
1321  "\r\n"
1322  "-----------------------------277531038314945\r\n"
1323  "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n"
1324  "Content-Type: image/jpeg\r\n"
1325  "\r\n";
1326 
1327  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
1328  uint8_t httpbuf2[] = "file";
1329  uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
1330  uint8_t httpbuf3[] = "content\r\n"
1331  "-----------------------------277531038314945\r\n";
1332  uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */
1333 
1334  uint8_t httpbuf4[] = "Content-Disposition: form-data; name=\"uploadfile_1\"; filename=\"somepicture2.jpg\"\r\n"
1335  "Content-Type: image/jpeg\r\n"
1336  "\r\n"
1337  "filecontent2\r\n"
1338  "-----------------------------277531038314945--";
1339  uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */
1340 
1341  ThreadVars th_v;
1342  TcpSession ssn;
1343 
1344  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1345  FAIL_IF_NULL(alp_tctx);
1346 
1347  memset(&th_v, 0, sizeof(th_v));
1348  memset(&ssn, 0, sizeof(ssn));
1349 
1350  DetectEngineThreadCtx *det_ctx = NULL;
1351  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1352  FAIL_IF_NULL(de_ctx);
1353  de_ctx->flags |= DE_QUIET;
1354 
1355  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (filename:\"somepicture\"; filestore; sid:1; rev:1;)");
1356  FAIL_IF_NULL(s);
1357 
1358  SigGroupBuild(de_ctx);
1359  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1360 
1361  Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);
1362  FAIL_IF_NULL(f);
1363  f->protoctx = &ssn;
1364  f->proto = IPPROTO_TCP;
1365  f->alproto = ALPROTO_HTTP1;
1366 
1367  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1368  FAIL_IF_NULL(p);
1369  p->flow = f;
1370  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1371  p->flowflags |= FLOW_PKT_TOSERVER;
1372  p->flowflags |= FLOW_PKT_ESTABLISHED;
1373 
1374  StreamTcpInitConfig(true);
1375 
1376  /* HTTP request with 1st part of the multipart body */
1377 
1378  int r = AppLayerParserParse(
1379  NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1);
1380  FAIL_IF(r != 0);
1381  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1382  FAIL_IF_NOT(PacketAlertCheck(p, 1));
1383 
1384  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf2, httplen2);
1385  FAIL_IF(r != 0);
1386  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1387  FAIL_IF(PacketAlertCheck(p, 1));
1388 
1389  HtpState *http_state = f->alstate;
1390  FAIL_IF_NULL(http_state);
1391  void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);
1392  FAIL_IF_NULL(tx);
1393  HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);
1394  FAIL_IF_NULL(tx_ud);
1395 
1396  FileContainer *files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);
1397  FAIL_IF_NULL(files);
1398  File *file = files->head;
1399  FAIL_IF_NULL(file);
1400  FAIL_IF_NOT(file->flags & FILE_STORE);
1401 
1402  /* 2nd multipart body file */
1403 
1404  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf3, httplen3);
1405  FAIL_IF(r != 0);
1406  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1407  FAIL_IF(PacketAlertCheck(p, 1));
1408 
1409  r = AppLayerParserParse(
1410  NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_EOF, httpbuf4, httplen4);
1411  FAIL_IF(r != 0);
1412  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1413  FAIL_IF_NOT(PacketAlertCheck(p, 1));
1414 
1415  http_state = f->alstate;
1416  FAIL_IF_NULL(http_state);
1417  tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);
1418  FAIL_IF_NULL(tx);
1419  tx_ud = htp_tx_get_user_data(tx);
1420  FAIL_IF_NULL(tx_ud);
1421 
1422  files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);
1423  FAIL_IF_NULL(files);
1424  file = files->head;
1425  FAIL_IF_NULL(file);
1426  FAIL_IF_NOT(file->flags & FILE_STORE);
1427 
1428  AppLayerParserThreadCtxFree(alp_tctx);
1429  UTHFreeFlow(f);
1430  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1431  DetectEngineCtxFree(de_ctx);
1432  StreamTcpFreeConfig(true);
1433  PASS;
1434 }
1435 
1436 #endif
1437 
1438 void DeStateRegisterTests(void)
1439 {
1440 #ifdef UNITTESTS
1441  UtRegisterTest("DeStateTest01", DeStateTest01);
1442  UtRegisterTest("DeStateTest02", DeStateTest02);
1443  UtRegisterTest("DeStateTest03", DeStateTest03);
1444  UtRegisterTest("DeStateSigTest01", DeStateSigTest01);
1445  UtRegisterTest("DeStateSigTest02", DeStateSigTest02);
1446  UtRegisterTest("DeStateSigTest03", DeStateSigTest03);
1447  UtRegisterTest("DeStateSigTest04", DeStateSigTest04);
1448  UtRegisterTest("DeStateSigTest05", DeStateSigTest05);
1449  UtRegisterTest("DeStateSigTest06", DeStateSigTest06);
1450  UtRegisterTest("DeStateSigTest07", DeStateSigTest07);
1451  UtRegisterTest("DeStateSigTest08", DeStateSigTest08);
1452  UtRegisterTest("DeStateSigTest09", DeStateSigTest09);
1453  UtRegisterTest("DeStateSigTest10", DeStateSigTest10);
1454 #endif
1455 
1456  return;
1457 }
1458 
1459 /**
1460  * @}
1461  */
FileContainer_
Definition: util-file.h:113
DE_STATE_CHUNK_SIZE
#define DE_STATE_CHUNK_SIZE
Definition: detect-engine-state.h:53
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
DetectEngineStateDirection_::flags
uint8_t flags
Definition: detect-engine-state.h:89
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:996
flow-util.h
DetectEngineState_
Definition: detect-engine-state.h:93
Signature_::num
SigIntId num
Definition: detect.h:550
stream-tcp.h
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1393
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:296
DetectEngineStateDirection_::cnt
SigIntId cnt
Definition: detect-engine-state.h:87
Flow_::proto
uint8_t proto
Definition: flow.h:378
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:141
Packet_::flags
uint32_t flags
Definition: decode.h:460
Flow_
Flow data structure.
Definition: flow.h:356
SigInit
Signature * SigInit(DetectEngineCtx *, const char *)
Parses a signature and adds it to the Detection Engine Context.
Definition: detect-parse.c:2129
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:784
FILE_STORE
#define FILE_STORE
Definition: util-file.h:55
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2445
DetectEngineState_::dir_state
DetectEngineStateDirection dir_state[2]
Definition: detect-engine-state.h:94
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:316
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:226
MIN
#define MIN(x, y)
Definition: suricata-common.h:380
DE_QUIET
#define DE_QUIET
Definition: detect.h:287
stream-tcp-reassemble.h
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:339
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:1788
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:456
Flow_::protoctx
void * protoctx
Definition: flow.h:454
DeStateStoreItem_::sid
SigIntId sid
Definition: detect-engine-state.h:75
FLOW_IPV4
#define FLOW_IPV4
Definition: flow.h:96
AppLayerParserGetTransactionInspectId
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:731
util-unittest.h
DetectEngineStateDirection_::cur
DeStateStore * cur
Definition: detect-engine-state.h:85
HtpState_
Definition: app-layer-htp.h:245
FlowGetAppState
void * FlowGetAppState(const Flow *f)
Definition: flow.c:1148
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
detect-flowvar.h
DetectRunStoreStateTx
void DetectRunStoreStateTx(const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const Signature *s, uint32_t inspect_flags, uint8_t flow_flags, const uint16_t file_no_match)
Definition: detect-engine-state.c:223
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:488
StreamTcpInitConfig
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
Definition: stream-tcp.c:361
UTHBuildFlow
Flow * UTHBuildFlow(int family, const char *src, const char *dst, Port sp, Port dp)
Definition: util-unittest-helper.c:523
FLOW_INITIALIZE
#define FLOW_INITIALIZE(f)
Definition: flow-util.h:39
app-layer-htp.h
decode.h
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1024
DeStateStoreItem_::flags
uint32_t flags
Definition: detect-engine-state.h:74
FLOWFILE_NO_STORE_TS
#define FLOWFILE_NO_STORE_TS
Definition: flow.h:124
BIT_U32
#define BIT_U32(n)
Definition: suricata-common.h:389
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:22
SCEnter
#define SCEnter(...)
Definition: util-debug.h:298
FileContainer_::head
File * head
Definition: util-file.h:114
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
DeStateStore_::next
struct DeStateStore_ * next
Definition: detect-engine-state.h:80
HtpState_::conn
htp_conn_t * conn
Definition: app-layer-htp.h:249
HtpTxUserData_::tx_data
AppLayerTxData tx_data
Definition: app-layer-htp.h:240
HtpState_::state_data
AppLayerStateData state_data
Definition: app-layer-htp.h:263
app-layer-parser.h
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:289
AppLayerParserGetTxFiles
FileContainer * AppLayerParserGetTxFiles(const Flow *f, void *tx, const uint8_t direction)
Definition: app-layer-parser.c:892
util-profiling.h
DetectEngineStateAlloc
DetectEngineState * DetectEngineStateAlloc(void)
Alloc a DetectEngineState object.
Definition: detect-engine-state.c:164
SCReturn
#define SCReturn
Definition: util-debug.h:300
Packet_
Definition: decode.h:425
DE_STATE_FLAG_BASE
#define DE_STATE_FLAG_BASE
Definition: detect-engine-state.h:64
detect-engine-build.h
stream-tcp-private.h
detect-engine-alert.h
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
AppLayerParserGetTx
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:1148
DetectEngineStateFree
void DetectEngineStateFree(DetectEngineState *state)
Frees a DetectEngineState object.
Definition: detect-engine-state.c:174
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:1954
UTHFreeFlow
void UTHFreeFlow(Flow *flow)
Definition: util-unittest-helper.c:528
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:295
FileDisableStoringForTransaction
void FileDisableStoringForTransaction(Flow *f, const uint8_t direction, void *tx, uint64_t tx_id)
disable file storing for files in a transaction
Definition: util-file.c:1151
File_::flags
uint16_t flags
Definition: util-file.h:80
DetectEngineStateDirection_::head
DeStateStore * head
Definition: detect-engine-state.h:84
File_
Definition: util-file.h:79
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1301
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2434
Packet_::flow
struct Flow_ * flow
Definition: decode.h:462
DetectEngineStateResetTxs
void DetectEngineStateResetTxs(Flow *f)
Reset de state for active tx' To be used on detect engine reload.
Definition: detect-engine-state.c:269
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
Definition: detect-engine.c:3154
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
StreamTcpFreeConfig
void StreamTcpFreeConfig(bool quiet)
Definition: stream-tcp.c:669
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1280
suricata-common.h
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
Definition: detect-engine.c:3368
DeStateStore_
Definition: detect-engine-state.h:78
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:30
File_::next
struct File_ * next
Definition: util-file.h:92
DetectEngineStateDirection_
Definition: detect-engine-state.h:83
AppLayerParserGetTxData
AppLayerTxData * AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:1220
DetectEngineCtx_::sig_list
Signature * sig_list
Definition: detect.h:790
HtpTxUserData_
Definition: app-layer-htp.h:208
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
DetectEngineStateDirection_::filestore_cnt
uint16_t filestore_cnt
Definition: detect-engine-state.h:88
SCFree
#define SCFree(p)
Definition: util-mem.h:61
UTHFreePacket
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:487
Flow_::alstate
void * alstate
Definition: flow.h:489
DeStateStore_::store
DeStateStoreItem store[DE_STATE_CHUNK_SIZE]
Definition: detect-engine-state.h:79
Flow_::flags
uint32_t flags
Definition: flow.h:434
detect-parse.h
Signature_
Signature container.
Definition: detect.h:539
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:228
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2406
app-layer-protos.h
FILE_NOSTORE
#define FILE_NOSTORE
Definition: util-file.h:54
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:785
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:68
TcpSession_
Definition: stream-tcp-private.h:272
SigIntId
#define SigIntId
Definition: suricata-common.h:304
DeStateStoreItem_
Definition: detect-engine-state.h:73
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:463
DeStateRegisterTests
void DeStateRegisterTests(void)
Definition: detect-engine-state.c:1438
detect-engine-dcepayload.h
SigGroupHead_::filestore_cnt
uint16_t filestore_cnt
Definition: detect.h:1406
AppLayerParserGetTxCnt
uint64_t AppLayerParserGetTxCnt(const Flow *f, void *alstate)
Definition: app-layer-parser.c:1141
DetectEngineStateDirection_::tail
DeStateStore * tail
Definition: detect-engine-state.h:86
FLOW_DESTROY
#define FLOW_DESTROY(f)
Definition: flow-util.h:130
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:993
app-layer.h