47 #define PARSE_REGEX "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$"
55 static void DetectFlowRegisterTests(
void);
60 static bool PrefilterFlowIsPrefilterable(
const Signature *s);
89 static inline int FlowMatch(
const uint32_t pflags,
const uint8_t pflowflags,
const uint16_t dflags,
90 const uint16_t match_cnt)
116 return (match_cnt ==
cnt) ? 1 : 0;
150 SCLogDebug(
"returning %" PRId32
" fd->match_cnt %" PRId32
" fd->flags 0x%02X p->flowflags 0x%02X",
169 char *args[3] = {NULL,NULL,NULL};
172 char str1[16] =
"", str2[16] =
"", str3[16] =
"";
173 pcre2_match_data *match = NULL;
176 if (ret < 1 || ret > 4) {
177 SCLogError(
"parse error, ret %" PRId32
", string %s", ret, flowstr);
182 pcre2len =
sizeof(str1);
185 SCLogError(
"pcre2_substring_copy_bynumber failed");
188 args[0] = (
char *)str1;
191 pcre2len =
sizeof(str2);
192 res = pcre2_substring_copy_bynumber(match, 2, (PCRE2_UCHAR8 *)str2, &pcre2len);
194 SCLogError(
"pcre2_substring_copy_bynumber failed");
197 args[1] = (
char *)str2;
200 pcre2len =
sizeof(str3);
201 res = pcre2_substring_copy_bynumber(match, 3, (PCRE2_UCHAR8 *)str3, &pcre2len);
203 SCLogError(
"pcre2_substring_copy_bynumber failed");
206 args[2] = (
char *)str3;
216 for (
int i = 0; i < (ret - 1); i++) {
219 if (strcasecmp(args[i],
"established") == 0) {
221 SCLogError(
"DETECT_FLOW_FLAG_ESTABLISHED flag is already set");
224 SCLogError(
"cannot set DETECT_FLOW_FLAG_ESTABLISHED, "
225 "DETECT_FLOW_FLAG_NOT_ESTABLISHED already set");
228 SCLogError(
"DETECT_FLOW_FLAG_STATELESS already set");
233 }
else if (strcasecmp(args[i],
"not_established") == 0) {
235 SCLogError(
"DETECT_FLOW_FLAG_NOT_ESTABLISHED flag is already set");
238 SCLogError(
"cannot set DETECT_FLOW_FLAG_NOT_ESTABLISHED, "
239 "DETECT_FLOW_FLAG_ESTABLISHED already set");
244 }
else if (strcasecmp(args[i],
"stateless") == 0) {
246 SCLogError(
"DETECT_FLOW_FLAG_STATELESS flag is already set");
249 SCLogError(
"cannot set DETECT_FLOW_FLAG_STATELESS, "
250 "DETECT_FLOW_FLAG_ESTABLISHED already set");
255 }
else if (strcasecmp(args[i],
"to_client") == 0 || strcasecmp(args[i],
"from_server") == 0) {
257 SCLogError(
"cannot set DETECT_FLOW_FLAG_TOCLIENT flag is already set");
260 SCLogError(
"cannot set to_client, DETECT_FLOW_FLAG_TOSERVER already set");
265 }
else if (strcasecmp(args[i],
"to_server") == 0 || strcasecmp(args[i],
"from_client") == 0){
267 SCLogError(
"cannot set DETECT_FLOW_FLAG_TOSERVER flag is already set");
270 SCLogError(
"cannot set to_server, DETECT_FLOW_FLAG_TO_CLIENT flag already set");
275 }
else if (strcasecmp(args[i],
"no_frag") == 0) {
277 SCLogError(
"cannot set no_frag flag is already set");
280 SCLogError(
"cannot set no_frag flag, only_frag already set");
285 }
else if (strcasecmp(args[i],
"only_frag") == 0) {
287 SCLogError(
"cannot set only_frag flag is already set");
290 SCLogError(
"cannot set only_frag flag, no_frag already set");
298 }
else if (strcasecmp(args[i],
"only_stream") == 0) {
300 SCLogError(
"cannot set only_stream flag is already set");
304 "cannot set only_stream flag, DETECT_FLOW_FLAG_NOSTREAM already set");
308 }
else if (strcasecmp(args[i],
"no_stream") == 0) {
310 SCLogError(
"cannot set no_stream flag is already set");
314 "cannot set no_stream flag, DETECT_FLOW_FLAG_ONLYSTREAM already set");
319 SCLogError(
"invalid flow option \"%s\"", args[i]);
324 pcre2_match_data_free(match);
329 pcre2_match_data_free(match);
339 #define SIG_FLAG_BOTH (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)
380 uint16_t parse_flags = 0;
384 SCLogError(
"A signature may have only one flow option.");
392 bool appendsm =
true;
397 "rule %u means to use both directions, cannot specify a flow direction", s->
id);
404 "rule %u means to use both directions, cannot specify a flow direction", s->
id);
463 if (!PrefilterPacketHeaderExtraMatch(
ctx, p))
468 PrefilterAddSids(&det_ctx->
pmq,
ctx->sigs_array,
ctx->sigs_cnt);
494 PrefilterPacketFlowCompare, PrefilterPacketFlowMatch);
497 static bool PrefilterFlowIsPrefilterable(
const Signature *s)
516 static int DetectFlowTestParse01 (
void)
518 uint16_t parsed_flags = 0;
519 DetectFlowData *fd = DetectFlowParse(NULL,
"established", &parsed_flags);
529 static int DetectFlowTestParse02 (
void)
531 uint16_t parsed_flags = 0;
532 DetectFlowData *fd = DetectFlowParse(NULL,
"established", &parsed_flags);
542 static int DetectFlowTestParse03 (
void)
544 uint16_t parsed_flags = 0;
545 DetectFlowData *fd = DetectFlowParse(NULL,
"stateless", &parsed_flags);
555 static int DetectFlowTestParse04 (
void)
557 uint16_t parsed_flags = 0;
558 DetectFlowData *fd = DetectFlowParse(NULL,
"to_client", &parsed_flags);
568 static int DetectFlowTestParse05 (
void)
570 uint16_t parsed_flags = 0;
571 DetectFlowData *fd = DetectFlowParse(NULL,
"to_server", &parsed_flags);
581 static int DetectFlowTestParse06 (
void)
583 uint16_t parsed_flags = 0;
584 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server", &parsed_flags);
594 static int DetectFlowTestParse07 (
void)
596 uint16_t parsed_flags = 0;
597 DetectFlowData *fd = DetectFlowParse(NULL,
"from_client", &parsed_flags);
607 static int DetectFlowTestParse08 (
void)
609 uint16_t parsed_flags = 0;
610 DetectFlowData *fd = DetectFlowParse(NULL,
"established,to_client", &parsed_flags);
620 static int DetectFlowTestParse09 (
void)
622 uint16_t parsed_flags = 0;
623 DetectFlowData *fd = DetectFlowParse(NULL,
"to_client,stateless", &parsed_flags);
635 static int DetectFlowTestParse10 (
void)
637 uint16_t parsed_flags = 0;
638 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server,stateless", &parsed_flags);
650 static int DetectFlowTestParse11 (
void)
652 uint16_t parsed_flags = 0;
653 DetectFlowData *fd = DetectFlowParse(NULL,
" from_server , stateless ", &parsed_flags);
666 static int DetectFlowTestParseNocase01 (
void)
668 uint16_t parsed_flags = 0;
669 DetectFlowData *fd = DetectFlowParse(NULL,
"ESTABLISHED", &parsed_flags);
678 static int DetectFlowTestParseNocase02 (
void)
680 uint16_t parsed_flags = 0;
681 DetectFlowData *fd = DetectFlowParse(NULL,
"ESTABLISHED", &parsed_flags);
692 static int DetectFlowTestParseNocase03 (
void)
694 uint16_t parsed_flags = 0;
695 DetectFlowData *fd = DetectFlowParse(NULL,
"STATELESS", &parsed_flags);
705 static int DetectFlowTestParseNocase04 (
void)
707 uint16_t parsed_flags = 0;
708 DetectFlowData *fd = DetectFlowParse(NULL,
"TO_CLIENT", &parsed_flags);
718 static int DetectFlowTestParseNocase05 (
void)
720 uint16_t parsed_flags = 0;
721 DetectFlowData *fd = DetectFlowParse(NULL,
"TO_SERVER", &parsed_flags);
731 static int DetectFlowTestParseNocase06 (
void)
733 uint16_t parsed_flags = 0;
734 DetectFlowData *fd = DetectFlowParse(NULL,
"FROM_SERVER", &parsed_flags);
744 static int DetectFlowTestParseNocase07 (
void)
746 uint16_t parsed_flags = 0;
747 DetectFlowData *fd = DetectFlowParse(NULL,
"FROM_CLIENT", &parsed_flags);
757 static int DetectFlowTestParseNocase08 (
void)
759 uint16_t parsed_flags = 0;
760 DetectFlowData *fd = DetectFlowParse(NULL,
"ESTABLISHED,TO_CLIENT", &parsed_flags);
772 static int DetectFlowTestParseNocase09 (
void)
774 uint16_t parsed_flags = 0;
775 DetectFlowData *fd = DetectFlowParse(NULL,
"TO_CLIENT,STATELESS", &parsed_flags);
787 static int DetectFlowTestParseNocase10 (
void)
789 uint16_t parsed_flags = 0;
790 DetectFlowData *fd = DetectFlowParse(NULL,
"FROM_SERVER,STATELESS", &parsed_flags);
802 static int DetectFlowTestParseNocase11 (
void)
804 uint16_t parsed_flags = 0;
805 DetectFlowData *fd = DetectFlowParse(NULL,
" FROM_SERVER , STATELESS ", &parsed_flags);
817 static int DetectFlowTestParse12 (
void)
819 uint16_t parsed_flags = 0;
820 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server:stateless", &parsed_flags);
828 static int DetectFlowTestParse13 (
void)
830 uint16_t parsed_flags = 0;
831 DetectFlowData *fd = DetectFlowParse(NULL,
"invalidoptiontest", &parsed_flags);
839 static int DetectFlowTestParse14 (
void)
841 uint16_t parsed_flags = 0;
850 static int DetectFlowTestParse15 (
void)
852 uint16_t parsed_flags = 0;
853 DetectFlowData *fd = DetectFlowParse(NULL,
"established,stateless", &parsed_flags);
861 static int DetectFlowTestParse16 (
void)
863 uint16_t parsed_flags = 0;
864 DetectFlowData *fd = DetectFlowParse(NULL,
"to_client,to_server", &parsed_flags);
873 static int DetectFlowTestParse17 (
void)
875 uint16_t parsed_flags = 0;
876 DetectFlowData *fd = DetectFlowParse(NULL,
"to_client,from_server", &parsed_flags);
884 static int DetectFlowTestParse18 (
void)
886 uint16_t parsed_flags = 0;
888 DetectFlowParse(NULL,
"from_server,established,only_stream", &parsed_flags);
900 static int DetectFlowTestParseNocase18 (
void)
902 uint16_t parsed_flags = 0;
904 DetectFlowParse(NULL,
"FROM_SERVER,ESTABLISHED,ONLY_STREAM", &parsed_flags);
917 static int DetectFlowTestParse19 (
void)
919 uint16_t parsed_flags = 0;
921 DetectFlowParse(NULL,
"from_server,established,only_stream,a", &parsed_flags);
929 static int DetectFlowTestParse20 (
void)
931 uint16_t parsed_flags = 0;
932 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server,established,no_stream", &parsed_flags);
944 static int DetectFlowTestParseNocase20 (
void)
946 uint16_t parsed_flags = 0;
947 DetectFlowData *fd = DetectFlowParse(NULL,
"FROM_SERVER,ESTABLISHED,NO_STREAM", &parsed_flags);
959 static int DetectFlowTestParse21 (
void)
961 uint16_t parsed_flags = 0;
962 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server,a,no_stream", &parsed_flags);
970 static int DetectFlowTestParse22(
void)
972 uint16_t parsed_flags = 0;
973 DetectFlowData *fd = DetectFlowParse(NULL,
"established,not_established", &parsed_flags);
975 fd = DetectFlowParse(NULL,
"not_established,established", &parsed_flags);
980 static int DetectFlowSigTest01(
void)
982 uint8_t *buf = (uint8_t *)
"supernovaduper";
983 uint16_t buflen = strlen((
char *)buf);
987 memset(&th_v, 0,
sizeof(th_v));
992 const char *sig1 =
"alert tcp any any -> any any (msg:\"dummy\"; "
993 "content:\"nova\"; flow:no_stream; sid:1;)";
1020 static int DetectFlowTestParseNotEstablished(
void)
1022 uint16_t parsed_flags = 0;
1023 DetectFlowData *fd = DetectFlowParse(NULL,
"not_established", &parsed_flags);
1033 static int DetectFlowTestParseNoFrag(
void)
1035 uint16_t parsed_flags = 0;
1036 DetectFlowData *fd = DetectFlowParse(NULL,
"no_frag", &parsed_flags);
1046 static int DetectFlowTestParseOnlyFrag(
void)
1048 uint16_t parsed_flags = 0;
1049 DetectFlowData *fd = DetectFlowParse(NULL,
"only_frag", &parsed_flags);
1059 static int DetectFlowTestParseNoFragOnlyFrag(
void)
1061 uint16_t parsed_flags = 0;
1062 DetectFlowData *fd = DetectFlowParse(NULL,
"no_frag,only_frag", &parsed_flags);
1070 static int DetectFlowTestNoFragMatch(
void)
1072 uint16_t parsed_flags = 0;
1073 uint32_t pflags = 0;
1074 DetectFlowData *fd = DetectFlowParse(NULL,
"no_frag", &parsed_flags);
1087 static int DetectFlowTestOnlyFragMatch(
void)
1089 uint16_t parsed_flags = 0;
1090 uint32_t pflags = 0;
1091 DetectFlowData *fd = DetectFlowParse(NULL,
"only_frag", &parsed_flags);
1104 static void DetectFlowRegisterTests(
void)
1117 UtRegisterTest(
"DetectFlowTestParseNocase01", DetectFlowTestParseNocase01);
1118 UtRegisterTest(
"DetectFlowTestParseNocase02", DetectFlowTestParseNocase02);
1119 UtRegisterTest(
"DetectFlowTestParseNocase03", DetectFlowTestParseNocase03);
1120 UtRegisterTest(
"DetectFlowTestParseNocase04", DetectFlowTestParseNocase04);
1121 UtRegisterTest(
"DetectFlowTestParseNocase05", DetectFlowTestParseNocase05);
1122 UtRegisterTest(
"DetectFlowTestParseNocase06", DetectFlowTestParseNocase06);
1123 UtRegisterTest(
"DetectFlowTestParseNocase07", DetectFlowTestParseNocase07);
1124 UtRegisterTest(
"DetectFlowTestParseNocase08", DetectFlowTestParseNocase08);
1125 UtRegisterTest(
"DetectFlowTestParseNocase09", DetectFlowTestParseNocase09);
1126 UtRegisterTest(
"DetectFlowTestParseNocase10", DetectFlowTestParseNocase10);
1127 UtRegisterTest(
"DetectFlowTestParseNocase11", DetectFlowTestParseNocase11);
1135 UtRegisterTest(
"DetectFlowTestParseNocase18", DetectFlowTestParseNocase18);
1138 UtRegisterTest(
"DetectFlowTestParseNocase20", DetectFlowTestParseNocase20);
1142 DetectFlowTestParseNotEstablished);
1143 UtRegisterTest(
"DetectFlowTestParseNoFrag", DetectFlowTestParseNoFrag);
1145 DetectFlowTestParseOnlyFrag);
1147 DetectFlowTestParseNoFragOnlyFrag);
1148 UtRegisterTest(
"DetectFlowTestNoFragMatch", DetectFlowTestNoFragMatch);
1149 UtRegisterTest(
"DetectFlowTestOnlyFragMatch", DetectFlowTestOnlyFragMatch);