47 #define PARSE_REGEX "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$"
55 static void DetectFlowRegisterTests(
void);
60 static bool PrefilterFlowIsPrefilterable(
const Signature *s);
88 static inline int FlowMatch(
const uint32_t pflags,
const uint8_t pflowflags,
const uint16_t dflags,
89 const uint16_t match_cnt)
115 return (match_cnt ==
cnt) ? 1 : 0;
149 SCLogDebug(
"returning %" PRId32
" fd->match_cnt %" PRId32
" fd->flags 0x%02X p->flowflags 0x%02X",
168 char *args[3] = {NULL,NULL,NULL};
171 char str1[16] =
"", str2[16] =
"", str3[16] =
"";
172 pcre2_match_data *match = NULL;
175 if (ret < 1 || ret > 4) {
176 SCLogError(
"parse error, ret %" PRId32
", string %s", ret, flowstr);
181 pcre2len =
sizeof(str1);
184 SCLogError(
"pcre2_substring_copy_bynumber failed");
187 args[0] = (
char *)str1;
190 pcre2len =
sizeof(str2);
191 res = pcre2_substring_copy_bynumber(match, 2, (PCRE2_UCHAR8 *)str2, &pcre2len);
193 SCLogError(
"pcre2_substring_copy_bynumber failed");
196 args[1] = (
char *)str2;
199 pcre2len =
sizeof(str3);
200 res = pcre2_substring_copy_bynumber(match, 3, (PCRE2_UCHAR8 *)str3, &pcre2len);
202 SCLogError(
"pcre2_substring_copy_bynumber failed");
205 args[2] = (
char *)str3;
215 for (
int i = 0; i < (ret - 1); i++) {
218 if (strcasecmp(args[i],
"established") == 0) {
220 SCLogError(
"DETECT_FLOW_FLAG_ESTABLISHED flag is already set");
223 SCLogError(
"cannot set DETECT_FLOW_FLAG_ESTABLISHED, "
224 "DETECT_FLOW_FLAG_NOT_ESTABLISHED already set");
227 SCLogError(
"DETECT_FLOW_FLAG_STATELESS already set");
232 }
else if (strcasecmp(args[i],
"not_established") == 0) {
234 SCLogError(
"DETECT_FLOW_FLAG_NOT_ESTABLISHED flag is already set");
237 SCLogError(
"cannot set DETECT_FLOW_FLAG_NOT_ESTABLISHED, "
238 "DETECT_FLOW_FLAG_ESTABLISHED already set");
243 }
else if (strcasecmp(args[i],
"stateless") == 0) {
245 SCLogError(
"DETECT_FLOW_FLAG_STATELESS flag is already set");
248 SCLogError(
"cannot set DETECT_FLOW_FLAG_STATELESS, "
249 "DETECT_FLOW_FLAG_ESTABLISHED already set");
254 }
else if (strcasecmp(args[i],
"to_client") == 0 || strcasecmp(args[i],
"from_server") == 0) {
256 SCLogError(
"cannot set DETECT_FLOW_FLAG_TOCLIENT flag is already set");
259 SCLogError(
"cannot set to_client, DETECT_FLOW_FLAG_TOSERVER already set");
264 }
else if (strcasecmp(args[i],
"to_server") == 0 || strcasecmp(args[i],
"from_client") == 0){
266 SCLogError(
"cannot set DETECT_FLOW_FLAG_TOSERVER flag is already set");
269 SCLogError(
"cannot set to_server, DETECT_FLOW_FLAG_TO_CLIENT flag already set");
274 }
else if (strcasecmp(args[i],
"no_frag") == 0) {
276 SCLogError(
"cannot set no_frag flag is already set");
279 SCLogError(
"cannot set no_frag flag, only_frag already set");
284 }
else if (strcasecmp(args[i],
"only_frag") == 0) {
286 SCLogError(
"cannot set only_frag flag is already set");
289 SCLogError(
"cannot set only_frag flag, no_frag already set");
297 }
else if (strcasecmp(args[i],
"only_stream") == 0) {
299 SCLogError(
"cannot set only_stream flag is already set");
303 "cannot set only_stream flag, DETECT_FLOW_FLAG_NOSTREAM already set");
307 }
else if (strcasecmp(args[i],
"no_stream") == 0) {
309 SCLogError(
"cannot set no_stream flag is already set");
313 "cannot set no_stream flag, DETECT_FLOW_FLAG_ONLYSTREAM already set");
318 SCLogError(
"invalid flow option \"%s\"", args[i]);
323 pcre2_match_data_free(match);
328 pcre2_match_data_free(match);
338 #define SIG_FLAG_BOTH (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)
379 uint16_t parse_flags = 0;
383 SCLogError(
"A signature may have only one flow option.");
391 bool appendsm =
true;
415 }
else if (fd != NULL) {
450 if (!PrefilterPacketHeaderExtraMatch(ctx, p))
479 PrefilterPacketFlowSet,
480 PrefilterPacketFlowCompare,
481 PrefilterPacketFlowMatch);
484 static bool PrefilterFlowIsPrefilterable(
const Signature *s)
503 static int DetectFlowTestParse01 (
void)
505 uint16_t parsed_flags = 0;
506 DetectFlowData *fd = DetectFlowParse(NULL,
"established", &parsed_flags);
516 static int DetectFlowTestParse02 (
void)
518 uint16_t parsed_flags = 0;
519 DetectFlowData *fd = DetectFlowParse(NULL,
"established", &parsed_flags);
529 static int DetectFlowTestParse03 (
void)
531 uint16_t parsed_flags = 0;
532 DetectFlowData *fd = DetectFlowParse(NULL,
"stateless", &parsed_flags);
542 static int DetectFlowTestParse04 (
void)
544 uint16_t parsed_flags = 0;
545 DetectFlowData *fd = DetectFlowParse(NULL,
"to_client", &parsed_flags);
555 static int DetectFlowTestParse05 (
void)
557 uint16_t parsed_flags = 0;
558 DetectFlowData *fd = DetectFlowParse(NULL,
"to_server", &parsed_flags);
568 static int DetectFlowTestParse06 (
void)
570 uint16_t parsed_flags = 0;
571 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server", &parsed_flags);
581 static int DetectFlowTestParse07 (
void)
583 uint16_t parsed_flags = 0;
584 DetectFlowData *fd = DetectFlowParse(NULL,
"from_client", &parsed_flags);
594 static int DetectFlowTestParse08 (
void)
596 uint16_t parsed_flags = 0;
597 DetectFlowData *fd = DetectFlowParse(NULL,
"established,to_client", &parsed_flags);
607 static int DetectFlowTestParse09 (
void)
609 uint16_t parsed_flags = 0;
610 DetectFlowData *fd = DetectFlowParse(NULL,
"to_client,stateless", &parsed_flags);
622 static int DetectFlowTestParse10 (
void)
624 uint16_t parsed_flags = 0;
625 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server,stateless", &parsed_flags);
637 static int DetectFlowTestParse11 (
void)
639 uint16_t parsed_flags = 0;
640 DetectFlowData *fd = DetectFlowParse(NULL,
" from_server , stateless ", &parsed_flags);
653 static int DetectFlowTestParseNocase01 (
void)
655 uint16_t parsed_flags = 0;
656 DetectFlowData *fd = DetectFlowParse(NULL,
"ESTABLISHED", &parsed_flags);
665 static int DetectFlowTestParseNocase02 (
void)
667 uint16_t parsed_flags = 0;
668 DetectFlowData *fd = DetectFlowParse(NULL,
"ESTABLISHED", &parsed_flags);
679 static int DetectFlowTestParseNocase03 (
void)
681 uint16_t parsed_flags = 0;
682 DetectFlowData *fd = DetectFlowParse(NULL,
"STATELESS", &parsed_flags);
692 static int DetectFlowTestParseNocase04 (
void)
694 uint16_t parsed_flags = 0;
695 DetectFlowData *fd = DetectFlowParse(NULL,
"TO_CLIENT", &parsed_flags);
705 static int DetectFlowTestParseNocase05 (
void)
707 uint16_t parsed_flags = 0;
708 DetectFlowData *fd = DetectFlowParse(NULL,
"TO_SERVER", &parsed_flags);
718 static int DetectFlowTestParseNocase06 (
void)
720 uint16_t parsed_flags = 0;
721 DetectFlowData *fd = DetectFlowParse(NULL,
"FROM_SERVER", &parsed_flags);
731 static int DetectFlowTestParseNocase07 (
void)
733 uint16_t parsed_flags = 0;
734 DetectFlowData *fd = DetectFlowParse(NULL,
"FROM_CLIENT", &parsed_flags);
744 static int DetectFlowTestParseNocase08 (
void)
746 uint16_t parsed_flags = 0;
747 DetectFlowData *fd = DetectFlowParse(NULL,
"ESTABLISHED,TO_CLIENT", &parsed_flags);
759 static int DetectFlowTestParseNocase09 (
void)
761 uint16_t parsed_flags = 0;
762 DetectFlowData *fd = DetectFlowParse(NULL,
"TO_CLIENT,STATELESS", &parsed_flags);
774 static int DetectFlowTestParseNocase10 (
void)
776 uint16_t parsed_flags = 0;
777 DetectFlowData *fd = DetectFlowParse(NULL,
"FROM_SERVER,STATELESS", &parsed_flags);
789 static int DetectFlowTestParseNocase11 (
void)
791 uint16_t parsed_flags = 0;
792 DetectFlowData *fd = DetectFlowParse(NULL,
" FROM_SERVER , STATELESS ", &parsed_flags);
804 static int DetectFlowTestParse12 (
void)
806 uint16_t parsed_flags = 0;
807 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server:stateless", &parsed_flags);
815 static int DetectFlowTestParse13 (
void)
817 uint16_t parsed_flags = 0;
818 DetectFlowData *fd = DetectFlowParse(NULL,
"invalidoptiontest", &parsed_flags);
826 static int DetectFlowTestParse14 (
void)
828 uint16_t parsed_flags = 0;
837 static int DetectFlowTestParse15 (
void)
839 uint16_t parsed_flags = 0;
840 DetectFlowData *fd = DetectFlowParse(NULL,
"established,stateless", &parsed_flags);
848 static int DetectFlowTestParse16 (
void)
850 uint16_t parsed_flags = 0;
851 DetectFlowData *fd = DetectFlowParse(NULL,
"to_client,to_server", &parsed_flags);
860 static int DetectFlowTestParse17 (
void)
862 uint16_t parsed_flags = 0;
863 DetectFlowData *fd = DetectFlowParse(NULL,
"to_client,from_server", &parsed_flags);
871 static int DetectFlowTestParse18 (
void)
873 uint16_t parsed_flags = 0;
875 DetectFlowParse(NULL,
"from_server,established,only_stream", &parsed_flags);
887 static int DetectFlowTestParseNocase18 (
void)
889 uint16_t parsed_flags = 0;
891 DetectFlowParse(NULL,
"FROM_SERVER,ESTABLISHED,ONLY_STREAM", &parsed_flags);
904 static int DetectFlowTestParse19 (
void)
906 uint16_t parsed_flags = 0;
908 DetectFlowParse(NULL,
"from_server,established,only_stream,a", &parsed_flags);
916 static int DetectFlowTestParse20 (
void)
918 uint16_t parsed_flags = 0;
919 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server,established,no_stream", &parsed_flags);
931 static int DetectFlowTestParseNocase20 (
void)
933 uint16_t parsed_flags = 0;
934 DetectFlowData *fd = DetectFlowParse(NULL,
"FROM_SERVER,ESTABLISHED,NO_STREAM", &parsed_flags);
946 static int DetectFlowTestParse21 (
void)
948 uint16_t parsed_flags = 0;
949 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server,a,no_stream", &parsed_flags);
957 static int DetectFlowTestParse22(
void)
959 uint16_t parsed_flags = 0;
960 DetectFlowData *fd = DetectFlowParse(NULL,
"established,not_established", &parsed_flags);
962 fd = DetectFlowParse(NULL,
"not_established,established", &parsed_flags);
967 static int DetectFlowSigTest01(
void)
969 uint8_t *buf = (uint8_t *)
"supernovaduper";
970 uint16_t buflen = strlen((
char *)buf);
974 memset(&th_v, 0,
sizeof(th_v));
979 const char *sig1 =
"alert tcp any any -> any any (msg:\"dummy\"; "
980 "content:\"nova\"; flow:no_stream; sid:1;)";
1007 static int DetectFlowTestParseNotEstablished(
void)
1009 uint16_t parsed_flags = 0;
1010 DetectFlowData *fd = DetectFlowParse(NULL,
"not_established", &parsed_flags);
1020 static int DetectFlowTestParseNoFrag(
void)
1022 uint16_t parsed_flags = 0;
1023 DetectFlowData *fd = DetectFlowParse(NULL,
"no_frag", &parsed_flags);
1033 static int DetectFlowTestParseOnlyFrag(
void)
1035 uint16_t parsed_flags = 0;
1036 DetectFlowData *fd = DetectFlowParse(NULL,
"only_frag", &parsed_flags);
1046 static int DetectFlowTestParseNoFragOnlyFrag(
void)
1048 uint16_t parsed_flags = 0;
1049 DetectFlowData *fd = DetectFlowParse(NULL,
"no_frag,only_frag", &parsed_flags);
1057 static int DetectFlowTestNoFragMatch(
void)
1059 uint16_t parsed_flags = 0;
1060 uint32_t pflags = 0;
1061 DetectFlowData *fd = DetectFlowParse(NULL,
"no_frag", &parsed_flags);
1074 static int DetectFlowTestOnlyFragMatch(
void)
1076 uint16_t parsed_flags = 0;
1077 uint32_t pflags = 0;
1078 DetectFlowData *fd = DetectFlowParse(NULL,
"only_frag", &parsed_flags);
1091 static void DetectFlowRegisterTests(
void)
1104 UtRegisterTest(
"DetectFlowTestParseNocase01", DetectFlowTestParseNocase01);
1105 UtRegisterTest(
"DetectFlowTestParseNocase02", DetectFlowTestParseNocase02);
1106 UtRegisterTest(
"DetectFlowTestParseNocase03", DetectFlowTestParseNocase03);
1107 UtRegisterTest(
"DetectFlowTestParseNocase04", DetectFlowTestParseNocase04);
1108 UtRegisterTest(
"DetectFlowTestParseNocase05", DetectFlowTestParseNocase05);
1109 UtRegisterTest(
"DetectFlowTestParseNocase06", DetectFlowTestParseNocase06);
1110 UtRegisterTest(
"DetectFlowTestParseNocase07", DetectFlowTestParseNocase07);
1111 UtRegisterTest(
"DetectFlowTestParseNocase08", DetectFlowTestParseNocase08);
1112 UtRegisterTest(
"DetectFlowTestParseNocase09", DetectFlowTestParseNocase09);
1113 UtRegisterTest(
"DetectFlowTestParseNocase10", DetectFlowTestParseNocase10);
1114 UtRegisterTest(
"DetectFlowTestParseNocase11", DetectFlowTestParseNocase11);
1122 UtRegisterTest(
"DetectFlowTestParseNocase18", DetectFlowTestParseNocase18);
1125 UtRegisterTest(
"DetectFlowTestParseNocase20", DetectFlowTestParseNocase20);
1129 DetectFlowTestParseNotEstablished);
1130 UtRegisterTest(
"DetectFlowTestParseNoFrag", DetectFlowTestParseNoFrag);
1132 DetectFlowTestParseOnlyFrag);
1134 DetectFlowTestParseNoFragOnlyFrag);
1135 UtRegisterTest(
"DetectFlowTestNoFragMatch", DetectFlowTestNoFragMatch);
1136 UtRegisterTest(
"DetectFlowTestOnlyFragMatch", DetectFlowTestOnlyFragMatch);