47 #define PARSE_REGEX "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$"
55 static void DetectFlowRegisterTests(
void);
60 static bool PrefilterFlowIsPrefilterable(
const Signature *s);
89 static inline int FlowMatch(
const uint32_t pflags,
const uint8_t pflowflags,
const uint16_t tflags,
90 const uint16_t dflags,
const uint16_t match_cnt)
124 return (match_cnt == cnt) ? 1 : 0;
158 SCLogDebug(
"returning %" PRId32
" fd->match_cnt %" PRId32
" fd->flags 0x%02X p->flowflags 0x%02X",
175 char *args[3] = {NULL,NULL,NULL};
176 int ret = 0, res = 0;
178 char str1[16] =
"", str2[16] =
"", str3[16] =
"";
181 if (ret < 1 || ret > 4) {
182 SCLogError(
"parse error, ret %" PRId32
", string %s", ret, flowstr);
187 pcre2len =
sizeof(str1);
190 SCLogError(
"pcre2_substring_copy_bynumber failed");
193 args[0] = (
char *)str1;
196 pcre2len =
sizeof(str2);
197 res = pcre2_substring_copy_bynumber(
198 parse_regex.
match, 2, (PCRE2_UCHAR8 *)str2, &pcre2len);
200 SCLogError(
"pcre2_substring_copy_bynumber failed");
203 args[1] = (
char *)str2;
206 pcre2len =
sizeof(str3);
207 res = pcre2_substring_copy_bynumber(
208 parse_regex.
match, 3, (PCRE2_UCHAR8 *)str3, &pcre2len);
210 SCLogError(
"pcre2_substring_copy_bynumber failed");
213 args[2] = (
char *)str3;
224 for (i = 0; i < (ret - 1); i++) {
227 if (strcasecmp(args[i],
"established") == 0) {
229 SCLogError(
"DETECT_FLOW_FLAG_ESTABLISHED flag is already set");
232 SCLogError(
"DETECT_FLOW_FLAG_STATELESS already set");
236 }
else if (strcasecmp(args[i],
"not_established") == 0) {
238 SCLogError(
"DETECT_FLOW_FLAG_NOT_ESTABLISHED flag is already set");
241 SCLogError(
"cannot set DETECT_FLOW_FLAG_NOT_ESTABLISHED, "
242 "DETECT_FLOW_FLAG_ESTABLISHED already set");
246 }
else if (strcasecmp(args[i],
"stateless") == 0) {
248 SCLogError(
"DETECT_FLOW_FLAG_STATELESS flag is already set");
251 SCLogError(
"cannot set DETECT_FLOW_FLAG_STATELESS, "
252 "DETECT_FLOW_FLAG_ESTABLISHED already set");
256 }
else if (strcasecmp(args[i],
"to_client") == 0 || strcasecmp(args[i],
"from_server") == 0) {
258 SCLogError(
"cannot set DETECT_FLOW_FLAG_TOCLIENT flag is already set");
261 SCLogError(
"cannot set to_client, DETECT_FLOW_FLAG_TOSERVER already set");
265 }
else if (strcasecmp(args[i],
"to_server") == 0 || strcasecmp(args[i],
"from_client") == 0){
267 SCLogError(
"cannot set DETECT_FLOW_FLAG_TOSERVER flag is already set");
270 SCLogError(
"cannot set to_server, DETECT_FLOW_FLAG_TO_CLIENT flag already set");
274 }
else if (strcasecmp(args[i],
"only_stream") == 0) {
276 SCLogError(
"cannot set only_stream flag is already set");
280 "cannot set only_stream flag, DETECT_FLOW_FLAG_NOSTREAM already set");
284 }
else if (strcasecmp(args[i],
"no_stream") == 0) {
286 SCLogError(
"cannot set no_stream flag is already set");
290 "cannot set no_stream flag, DETECT_FLOW_FLAG_ONLYSTREAM already set");
294 }
else if (strcasecmp(args[i],
"no_frag") == 0) {
296 SCLogError(
"cannot set no_frag flag is already set");
299 SCLogError(
"cannot set no_frag flag, only_frag already set");
303 }
else if (strcasecmp(args[i],
"only_frag") == 0) {
305 SCLogError(
"cannot set only_frag flag is already set");
308 SCLogError(
"cannot set only_frag flag, no_frag already set");
313 SCLogError(
"invalid flow option \"%s\"", args[i]);
332 #define SIG_FLAG_BOTH (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)
375 SCLogError(
"A signature may have only one flow option.");
443 if (!PrefilterPacketHeaderExtraMatch(ctx, p))
472 PrefilterPacketFlowSet,
473 PrefilterPacketFlowCompare,
474 PrefilterPacketFlowMatch);
477 static bool PrefilterFlowIsPrefilterable(
const Signature *s)
496 static int DetectFlowTestParse01 (
void)
499 fd = DetectFlowParse(NULL,
"established");
508 static int DetectFlowTestParse02 (
void)
511 fd = DetectFlowParse(NULL,
"established");
521 static int DetectFlowTestParse03 (
void)
524 fd = DetectFlowParse(NULL,
"stateless");
534 static int DetectFlowTestParse04 (
void)
537 fd = DetectFlowParse(NULL,
"to_client");
547 static int DetectFlowTestParse05 (
void)
550 fd = DetectFlowParse(NULL,
"to_server");
560 static int DetectFlowTestParse06 (
void)
563 fd = DetectFlowParse(NULL,
"from_server");
573 static int DetectFlowTestParse07 (
void)
576 fd = DetectFlowParse(NULL,
"from_client");
586 static int DetectFlowTestParse08 (
void)
589 fd = DetectFlowParse(NULL,
"established,to_client");
599 static int DetectFlowTestParse09 (
void)
602 fd = DetectFlowParse(NULL,
"to_client,stateless");
614 static int DetectFlowTestParse10 (
void)
617 fd = DetectFlowParse(NULL,
"from_server,stateless");
629 static int DetectFlowTestParse11 (
void)
632 fd = DetectFlowParse(NULL,
" from_server , stateless ");
645 static int DetectFlowTestParseNocase01 (
void)
648 fd = DetectFlowParse(NULL,
"ESTABLISHED");
657 static int DetectFlowTestParseNocase02 (
void)
660 fd = DetectFlowParse(NULL,
"ESTABLISHED");
671 static int DetectFlowTestParseNocase03 (
void)
674 fd = DetectFlowParse(NULL,
"STATELESS");
683 static int DetectFlowTestParseNocase04 (
void)
686 fd = DetectFlowParse(NULL,
"TO_CLIENT");
696 static int DetectFlowTestParseNocase05 (
void)
699 fd = DetectFlowParse(NULL,
"TO_SERVER");
709 static int DetectFlowTestParseNocase06 (
void)
712 fd = DetectFlowParse(NULL,
"FROM_SERVER");
722 static int DetectFlowTestParseNocase07 (
void)
725 fd = DetectFlowParse(NULL,
"FROM_CLIENT");
735 static int DetectFlowTestParseNocase08 (
void)
738 fd = DetectFlowParse(NULL,
"ESTABLISHED,TO_CLIENT");
750 static int DetectFlowTestParseNocase09 (
void)
753 fd = DetectFlowParse(NULL,
"TO_CLIENT,STATELESS");
765 static int DetectFlowTestParseNocase10 (
void)
768 fd = DetectFlowParse(NULL,
"FROM_SERVER,STATELESS");
780 static int DetectFlowTestParseNocase11 (
void)
783 fd = DetectFlowParse(NULL,
" FROM_SERVER , STATELESS ");
795 static int DetectFlowTestParse12 (
void)
798 fd = DetectFlowParse(NULL,
"from_server:stateless");
806 static int DetectFlowTestParse13 (
void)
809 fd = DetectFlowParse(NULL,
"invalidoptiontest");
817 static int DetectFlowTestParse14 (
void)
820 fd = DetectFlowParse(NULL,
"");
828 static int DetectFlowTestParse15 (
void)
831 fd = DetectFlowParse(NULL,
"established,stateless");
839 static int DetectFlowTestParse16 (
void)
842 fd = DetectFlowParse(NULL,
"to_client,to_server");
851 static int DetectFlowTestParse17 (
void)
854 fd = DetectFlowParse(NULL,
"to_client,from_server");
862 static int DetectFlowTestParse18 (
void)
865 fd = DetectFlowParse(NULL,
"from_server,established,only_stream");
878 static int DetectFlowTestParseNocase18 (
void)
881 fd = DetectFlowParse(NULL,
"FROM_SERVER,ESTABLISHED,ONLY_STREAM");
895 static int DetectFlowTestParse19 (
void)
898 fd = DetectFlowParse(NULL,
"from_server,established,only_stream,a");
906 static int DetectFlowTestParse20 (
void)
909 fd = DetectFlowParse(NULL,
"from_server,established,no_stream");
922 static int DetectFlowTestParseNocase20 (
void)
925 fd = DetectFlowParse(NULL,
"FROM_SERVER,ESTABLISHED,NO_STREAM");
938 static int DetectFlowTestParse21 (
void)
941 fd = DetectFlowParse(NULL,
"from_server,a,no_stream");
946 static int DetectFlowSigTest01(
void)
948 uint8_t *buf = (uint8_t *)
"supernovaduper";
949 uint16_t buflen = strlen((
char *)buf);
953 memset(&th_v, 0,
sizeof(th_v));
958 const char *sig1 =
"alert tcp any any -> any any (msg:\"dummy\"; "
959 "content:\"nova\"; flow:no_stream; sid:1;)";
986 static int DetectFlowTestParseNotEstablished(
void)
989 fd = DetectFlowParse(NULL,
"not_established");
999 static int DetectFlowTestParseNoFrag(
void)
1002 fd = DetectFlowParse(NULL,
"no_frag");
1012 static int DetectFlowTestParseOnlyFrag(
void)
1015 fd = DetectFlowParse(NULL,
"only_frag");
1025 static int DetectFlowTestParseNoFragOnlyFrag(
void)
1028 fd = DetectFlowParse(NULL,
"no_frag,only_frag");
1036 static int DetectFlowTestNoFragMatch(
void)
1038 uint32_t pflags = 0;
1052 static int DetectFlowTestOnlyFragMatch(
void)
1054 uint32_t pflags = 0;
1068 static void DetectFlowRegisterTests(
void)
1081 UtRegisterTest(
"DetectFlowTestParseNocase01", DetectFlowTestParseNocase01);
1082 UtRegisterTest(
"DetectFlowTestParseNocase02", DetectFlowTestParseNocase02);
1083 UtRegisterTest(
"DetectFlowTestParseNocase03", DetectFlowTestParseNocase03);
1084 UtRegisterTest(
"DetectFlowTestParseNocase04", DetectFlowTestParseNocase04);
1085 UtRegisterTest(
"DetectFlowTestParseNocase05", DetectFlowTestParseNocase05);
1086 UtRegisterTest(
"DetectFlowTestParseNocase06", DetectFlowTestParseNocase06);
1087 UtRegisterTest(
"DetectFlowTestParseNocase07", DetectFlowTestParseNocase07);
1088 UtRegisterTest(
"DetectFlowTestParseNocase08", DetectFlowTestParseNocase08);
1089 UtRegisterTest(
"DetectFlowTestParseNocase09", DetectFlowTestParseNocase09);
1090 UtRegisterTest(
"DetectFlowTestParseNocase10", DetectFlowTestParseNocase10);
1091 UtRegisterTest(
"DetectFlowTestParseNocase11", DetectFlowTestParseNocase11);
1099 UtRegisterTest(
"DetectFlowTestParseNocase18", DetectFlowTestParseNocase18);
1102 UtRegisterTest(
"DetectFlowTestParseNocase20", DetectFlowTestParseNocase20);
1105 DetectFlowTestParseNotEstablished);
1106 UtRegisterTest(
"DetectFlowTestParseNoFrag", DetectFlowTestParseNoFrag);
1108 DetectFlowTestParseOnlyFrag);
1110 DetectFlowTestParseNoFragOnlyFrag);
1111 UtRegisterTest(
"DetectFlowTestNoFragMatch", DetectFlowTestNoFragMatch);
1112 UtRegisterTest(
"DetectFlowTestOnlyFragMatch", DetectFlowTestOnlyFragMatch);