42 #define PARSE_REGEX "^(\\s*only\\s*)|\\s*([0-9]+)\\s*,\\s*([0-9]+)\\s*$"
48 static void DetectFastPatternRegisterTests(
void);
82 if (list_id == tmp->list_id) {
91 if (priority < tmp->priority)
101 new->list_id = list_id;
102 new->priority = priority;
111 new->list_id = list_id;
112 new->priority = priority;
132 Add(&g_fp_support_smlist_list, list_id, priority);
156 FatalError(
"out of memory: %s", strerror(errno));
216 char arg_substr[128] =
"";
218 pcre2_match_data *match = NULL;
222 if (pm1 == NULL && pm2 == NULL) {
224 "the rule, without a content context. Please use a "
225 "content based keyword before using fast_pattern");
235 }
else if (pm1 && !pm2) {
250 "used with negated content, along with relative modifiers");
254 if (arg == NULL|| strcmp(arg,
"") == 0) {
257 "options for the same content");
268 "can be used on only one content in a rule");
291 "used with negated content or with any of the relative "
292 "modifiers like distance, within, offset, depth");
298 }
else if (ret == 4) {
299 pcre2len =
sizeof(arg_substr);
300 res = pcre2_substring_copy_bynumber(match, 2, (PCRE2_UCHAR8 *)arg_substr, &pcre2len);
302 SCLogError(
"pcre2_substring_copy_bynumber failed "
303 "for fast_pattern offset");
308 (
const char *)arg_substr) < 0) {
315 pcre2len =
sizeof(arg_substr);
316 res = pcre2_substring_copy_bynumber(match, 3, (PCRE2_UCHAR8 *)arg_substr, &pcre2len);
318 SCLogError(
"pcre2_substring_copy_bynumber failed "
319 "for fast_pattern offset");
324 (
const char *)arg_substr) < 0) {
332 if (
offset > (65535 - length)) {
334 "exceeds limit pattern length limit");
340 "offset (%u)) exceeds pattern length (%u)",
350 SCLogError(
"parse error, ret %" PRId32
", string %s", ret, arg);
356 pcre2_match_data_free(match);
361 pcre2_match_data_free(match);
379 static int DetectFastPatternStickySingle(
const char *sticky,
const int list)
384 snprintf(
string,
sizeof(
string),
385 "alert tcp any any -> any any "
386 "(%s%scontent:\"one\"; fast_pattern; sid:1;)",
387 sticky ? sticky :
"", sticky ?
"; " :
" ");
400 static int DetectFastPatternModifierSingle(
const char *sticky,
const int list)
405 snprintf(
string,
sizeof(
string),
406 "alert tcp any any -> any any "
407 "(content:\"one\"; %s%sfast_pattern; sid:1;)",
408 sticky ? sticky :
"", sticky ?
"; " :
" ");
421 static int DetectFastPatternStickySingleNoFP(
const char *sticky,
const int list)
426 snprintf(
string,
sizeof(
string),
427 "alert tcp any any -> any any "
428 "(%s%scontent:\"one\"; sid:1;)",
429 sticky ? sticky :
"", sticky ?
"; " :
" ");
442 static int DetectFastPatternModifierSingleNoFP(
const char *sticky,
const int list)
447 snprintf(
string,
sizeof(
string),
448 "alert tcp any any -> any any "
449 "(content:\"one\"; %s%ssid:1;)",
450 sticky ? sticky :
"", sticky ?
"; " :
" ");
463 static int DetectFastPatternStickySingleBadArg(
const char *sticky)
469 snprintf(
string,
sizeof(
string),
470 "alert tcp any any -> any any "
471 "(%s%scontent:\"one\"; fast_pattern:boo; sid:1;)",
472 sticky ? sticky :
"", sticky ?
"; " :
" ");
476 snprintf(
string,
sizeof(
string),
477 "alert tcp any any -> any any "
478 "(%s%scontent:\"one\"; fast_pattern:only; content:\"two\"; distance:10; sid:1;)",
479 sticky ? sticky :
"", sticky ?
"; " :
" ");
483 snprintf(
string,
sizeof(
string),
484 "alert tcp any any -> any any "
485 "(%s%scontent:\"one\"; content:\"two\"; fast_pattern:only; distance:10; sid:1;)",
486 sticky ? sticky :
"", sticky ?
"; " :
" ");
490 snprintf(
string,
sizeof(
string),
491 "alert tcp any any -> any any "
492 "(%s%scontent:\"one\"; content:\"two\"; distance:10; fast_pattern:only; sid:1;)",
493 sticky ? sticky :
"", sticky ?
"; " :
" ");
497 snprintf(
string,
sizeof(
string),
498 "alert tcp any any -> any any "
499 "(%s%scontent:\"one\"; fast_pattern:5,6; sid:1;)",
500 sticky ? sticky :
"", sticky ?
"; " :
" ");
507 static int DetectFastPatternModifierBadRules(
const char *sticky)
513 snprintf(
string,
sizeof(
string),
514 "alert tcp any any -> any any "
515 "(content:\"one\"; %s%sfast_pattern:boo; sid:1;)",
516 sticky ? sticky :
"", sticky ?
"; " :
" ");
520 snprintf(
string,
sizeof(
string),
521 "alert tcp any any -> any any "
522 "(content:\"one\"; %s%sfast_pattern:only; content:\"two\"; %s%sdistance:10; sid:1;)",
523 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ");
528 snprintf(
string,
sizeof(
string),
"alert tcp any any -> any any "
529 "(content:\"one\"; %s%s content:\"two\"; %s%sdistance:10; fast_pattern:only; sid:1;)",
530 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ");
535 snprintf(
string,
sizeof(
string),
536 "alert tcp any any -> any any "
537 "(content:\"one\"; %s%sfast_pattern:only; content:\"two\"; %s%swithin:10; sid:1;)",
538 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ");
542 snprintf(
string,
sizeof(
string),
543 "alert tcp any any -> any any "
544 "(content:\"one\"; %s%s content:\"two\"; %s%swithin:10; fast_pattern:only; sid:1;)",
545 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ");
549 snprintf(
string,
sizeof(
string),
550 "alert tcp any any -> any any "
551 "(content:\"one\"; %s%sfast_pattern:only; offset:10; sid:1;)",
552 sticky ? sticky :
"", sticky ?
"; " :
" ");
556 snprintf(
string,
sizeof(
string),
557 "alert tcp any any -> any any "
558 "(content:\"one\"; %s%s offset:10; fast_pattern:only; sid:1;)",
559 sticky ? sticky :
"", sticky ?
"; " :
" ");
563 snprintf(
string,
sizeof(
string),
564 "alert tcp any any -> any any "
565 "(content:\"one\"; %s%sfast_pattern:only; depth:10; sid:1;)",
566 sticky ? sticky :
"", sticky ?
"; " :
" ");
570 snprintf(
string,
sizeof(
string),
571 "alert tcp any any -> any any "
572 "(content:\"one\"; %s%s depth:10; fast_pattern:only; sid:1;)",
573 sticky ? sticky :
"", sticky ?
"; " :
" ");
577 snprintf(
string,
sizeof(
string),
578 "alert tcp any any -> any any "
579 "(content:\"one\"; %s%s content:!\"two\"; %s%sfast_pattern:only; sid:1;)",
580 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ");
584 snprintf(
string,
sizeof(
string),
585 "alert tcp any any -> any any "
586 "(content:\"one\"; %s%sfast_pattern:5,6; sid:1;)",
587 sticky ? sticky :
"", sticky ?
"; " :
" ");
591 snprintf(
string,
sizeof(
string),
592 "alert tcp any any -> any any "
593 "(content:\"one\"; %s%sfast_pattern:65977,2; sid:1;)",
594 sticky ? sticky :
"", sticky ?
"; " :
" ");
598 snprintf(
string,
sizeof(
string),
599 "alert tcp any any -> any any "
600 "(content:\"one\"; %s%sfast_pattern:2,65977; sid:1;)",
601 sticky ? sticky :
"", sticky ?
"; " :
" ");
605 snprintf(
string,
sizeof(
string),
606 "alert tcp any any -> any any "
607 "(content:\"one\"; %s%sfast_pattern:2,65534; sid:1;)",
608 sticky ? sticky :
"", sticky ?
"; " :
" ");
612 snprintf(
string,
sizeof(
string),
613 "alert tcp any any -> any any "
614 "(content:\"one\"; %s%sfast_pattern:65534,2; sid:1;)",
615 sticky ? sticky :
"", sticky ?
"; " :
" ");
619 snprintf(
string,
sizeof(
string),
620 "alert tcp any any -> any any "
621 "(content:\"one\"; %s%scontent:!\"two\"; fast_pattern:1,2; %s%sdistance:10; sid:1;)",
622 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ");
626 snprintf(
string,
sizeof(
string),
627 "alert tcp any any -> any any "
628 "(content:\"one\"; %s%scontent:!\"two\"; fast_pattern:1,2; %s%swithin:10; sid:1;)",
629 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ");
633 snprintf(
string,
sizeof(
string),
634 "alert tcp any any -> any any "
635 "(content:\"one\"; %s%scontent:!\"two\"; fast_pattern:1,2; %s%sdepth:10; sid:1;)",
636 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ");
640 snprintf(
string,
sizeof(
string),
641 "alert tcp any any -> any any "
642 "(content:\"one\"; %s%scontent:!\"two\"; fast_pattern:1,2; %s%soffset:10; sid:1;)",
643 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ");
650 static int DetectFastPatternStickySingleFPOnly(
const char *sticky,
const int list)
655 snprintf(
string,
sizeof(
string),
656 "alert tcp any any -> any any "
657 "(%s%scontent:\"one\"; fast_pattern:only; sid:1;)",
658 sticky ? sticky :
"", sticky ?
"; " :
" ");
672 static int DetectFastPatternModifierFPOnly(
const char *sticky,
const int list)
677 snprintf(
string,
sizeof(
string),
678 "alert tcp any any -> any any "
679 "(content:\"one\"; %s%sfast_pattern:only; sid:1;)",
680 sticky ? sticky :
"", sticky ?
"; " :
" ");
691 snprintf(
string,
sizeof(
string),
692 "alert tcp any any -> any any "
693 "(content:\"one\"; %s%scontent:\"two\"; %s%sfast_pattern:only; sid:2;)",
694 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ");
697 sm = GetMatches(s, list);
712 snprintf(
string,
sizeof(
string),
713 "alert tcp any any -> any any "
714 "(content:\"one\"; %s%scontent:\"two\"; distance:10; %s%scontent:\"three\"; "
715 "%s%sfast_pattern:only; sid:3;)",
716 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ",
717 sticky ? sticky :
"", sticky ?
"; " :
" ");
720 sm = GetMatches(s, list);
743 snprintf(
string,
sizeof(
string),
744 "alert tcp any any -> any any "
745 "(content:\"one\"; %s%scontent:\"two\"; within:10; %s%scontent:\"three\"; "
746 "%s%sfast_pattern:only; sid:4;)",
747 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ",
748 sticky ? sticky :
"", sticky ?
"; " :
" ");
751 sm = GetMatches(s, list);
774 snprintf(
string,
sizeof(
string),
775 "alert tcp any any -> any any "
776 "(content:\"one\"; %s%scontent:\"two\"; offset:10; %s%scontent:\"three\"; "
777 "%s%sfast_pattern:only; sid:5;)",
778 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ",
779 sticky ? sticky :
"", sticky ?
"; " :
" ");
782 sm = GetMatches(s, list);
805 snprintf(
string,
sizeof(
string),
806 "alert tcp any any -> any any "
807 "(content:\"one\"; %s%scontent:\"two\"; depth:10; %s%scontent:\"three\"; "
808 "%s%sfast_pattern:only; sid:6;)",
809 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ",
810 sticky ? sticky :
"", sticky ?
"; " :
" ");
813 sm = GetMatches(s, list);
836 snprintf(
string,
sizeof(
string),
837 "alert tcp any any -> any any "
838 "(content:!\"one\"; %s%sfast_pattern; content:\"two\"; depth:10; %s%ssid:7;)",
839 sticky ? sticky :
"", sticky ?
"; " :
" ", sticky ? sticky :
"", sticky ?
"; " :
" ");
842 sm = GetMatches(s, list);
863 static int DetectFastPatternStickyFPChop(
const char *sticky,
const int list)
868 snprintf(
string,
sizeof(
string),
869 "alert tcp any any -> any any "
870 "(%s%scontent:\"onetwothree\"; fast_pattern:3,4; sid:1;)",
871 sticky ? sticky :
"", sticky ?
"; " :
" ");
885 snprintf(
string,
sizeof(
string),
886 "alert tcp any any -> any any "
887 "(%s%scontent:\"onetwothree\"; fast_pattern:3,4; content:\"xyz\"; distance:10; sid:2;)",
888 sticky ? sticky :
"", sticky ?
"; " :
" ");
891 sm = GetMatches(s, list);
906 static int DetectFastPatternModifierFPChop(
const char *sticky,
const int list)
911 snprintf(
string,
sizeof(
string),
912 "alert tcp any any -> any any "
913 "(content:\"onetwothree\"; %s%sfast_pattern:3,4; sid:1;)",
914 sticky ? sticky :
"", sticky ?
"; " :
" ");
928 snprintf(
string,
sizeof(
string),
929 "alert tcp any any -> any any "
930 "(content:!\"onetwothree\"; %s%sfast_pattern:3,4; sid:2;)",
931 sticky ? sticky :
"", sticky ?
"; " :
" ");
934 sm = GetMatches(s, list);
954 static int DetectFastPatternTest01(
void)
960 FAIL_IF_NOT(DetectFastPatternStickySingleBadArg(NULL));
961 FAIL_IF_NOT(DetectFastPatternModifierBadRules(NULL));
968 const char *buffer_name;
970 const char *mod_name;
972 {
"file_data",
"file.data", NULL },
973 {
"http_uri",
"http.uri",
"http_uri" },
974 {
"http_raw_uri",
"http.uri.raw",
"http_raw_uri" },
975 {
"http_user_agent",
"http.user_agent",
"http_user_agent" },
976 {
"http_header",
"http.header",
"http_header" },
979 {
"http_method",
"http.method",
"http_method" },
980 {
"http_cookie",
"http.cookie",
"http_cookie" },
981 {
"http_host",
"http.host",
"http_host" },
982 {
"http_raw_host",
"http.host.raw",
"http_raw_host" },
983 {
"http_stat_code",
"http.stat_code",
"http_stat_code" },
984 {
"http_stat_msg",
"http.stat_msg",
"http_stat_msg" },
985 {
"http_client_body",
"http.request_body",
"http_client_body" },
986 { NULL, NULL, NULL },
989 for (
int i = 0; keywords[i].buffer_name != NULL; i++) {
993 const char *k = keywords[i].sb_name;
995 FAIL_IF_NOT(DetectFastPatternStickySingle(k, list_id));
996 FAIL_IF_NOT(DetectFastPatternStickySingleNoFP(k, list_id));
997 FAIL_IF_NOT(DetectFastPatternStickySingleBadArg(k));
998 FAIL_IF_NOT(DetectFastPatternStickySingleFPOnly(k, list_id));
999 FAIL_IF_NOT(DetectFastPatternStickyFPChop(k, list_id));
1001 k = keywords[i].mod_name;
1003 FAIL_IF_NOT(DetectFastPatternModifierSingle(k, list_id));
1004 FAIL_IF_NOT(DetectFastPatternModifierSingleNoFP(k, list_id));
1005 FAIL_IF_NOT(DetectFastPatternModifierBadRules(k));
1006 FAIL_IF_NOT(DetectFastPatternModifierFPOnly(k, list_id));
1007 FAIL_IF_NOT(DetectFastPatternModifierFPChop(k, list_id));
1019 static int DetectFastPatternTest14(
void)
1021 uint8_t *buf = (uint8_t *)
"Dummy is our name. Oh yes. From right here "
1022 "right now, all the way to hangover. right. strings5_imp now here "
1023 "comes our dark knight strings_string5. Yes here is our dark knight";
1024 uint16_t buflen = strlen((
char *)buf);
1028 memset(&th_v, 0,
sizeof(th_v));
1039 "alert tcp any any -> any any "
1040 "(msg:\"fast_pattern test\"; content:\"strings_string5\"; content:\"knight\"; "
1041 "fast_pattern; sid:1;)");
1045 "alert tcp any any -> any any "
1046 "(msg:\"test different content\"; content:\"Dummy is our name\"; sid:2;)");
1070 static int DetectFastPatternTest671(
void)
1078 de_ctx,
"alert tcp any any -> any any (content:\"onetwothreefour\"; sid:1;)");
1081 de_ctx,
"alert tcp any any -> any any (content:\"onetwothreefour\"; sid:2;)");
1084 de_ctx,
"alert tcp any any -> any any (content:\"uniquepattern\"; sid:3;)");
1087 "alert tcp any any -> any any (content:\"onetwothreefour\"; fast_pattern:3,5; sid:4;)");
1090 de_ctx,
"alert tcp any any -> any any (content:\"twoth\"; sid:5;)");
1093 "alert tcp any any -> any any (content:\"onetwothreefour\"; fast_pattern:0,15; "
1127 static int DetectFastPatternPrefilter(
void)
1131 const char *
string =
"alert tcp any any -> any any "
1132 "(content:\"one\"; prefilter; sid:1;)";
1145 static void DetectFastPatternRegisterTests(
void)
1147 UtRegisterTest(
"DetectFastPatternTest01", DetectFastPatternTest01);
1148 UtRegisterTest(
"DetectFastPatternTest14", DetectFastPatternTest14);
1155 UtRegisterTest(
"DetectFastPatternTest671", DetectFastPatternTest671);
1157 UtRegisterTest(
"DetectFastPatternPrefilter", DetectFastPatternPrefilter);