47 #define PARSE_REGEX "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$"
55 static void DetectFlowRegisterTests(
void);
60 static bool PrefilterFlowIsPrefilterable(
const Signature *s);
89 static inline int FlowMatch(
const uint32_t pflags,
const uint8_t pflowflags,
const uint16_t dflags,
90 const uint16_t match_cnt)
116 return (match_cnt ==
cnt) ? 1 : 0;
150 SCLogDebug(
"returning %" PRId32
" fd->match_cnt %" PRId32
" fd->flags 0x%02X p->flowflags 0x%02X",
169 char *args[3] = {NULL,NULL,NULL};
172 char str1[16] =
"", str2[16] =
"", str3[16] =
"";
173 pcre2_match_data *match = NULL;
176 if (ret < 1 || ret > 4) {
177 SCLogError(
"parse error, ret %" PRId32
", string %s", ret, flowstr);
182 pcre2len =
sizeof(str1);
185 SCLogError(
"pcre2_substring_copy_bynumber failed");
188 args[0] = (
char *)str1;
191 pcre2len =
sizeof(str2);
192 res = pcre2_substring_copy_bynumber(match, 2, (PCRE2_UCHAR8 *)str2, &pcre2len);
194 SCLogError(
"pcre2_substring_copy_bynumber failed");
197 args[1] = (
char *)str2;
200 pcre2len =
sizeof(str3);
201 res = pcre2_substring_copy_bynumber(match, 3, (PCRE2_UCHAR8 *)str3, &pcre2len);
203 SCLogError(
"pcre2_substring_copy_bynumber failed");
206 args[2] = (
char *)str3;
216 for (
int i = 0; i < (ret - 1); i++) {
219 if (strcasecmp(args[i],
"established") == 0) {
221 SCLogError(
"DETECT_FLOW_FLAG_ESTABLISHED flag is already set");
224 SCLogError(
"cannot set DETECT_FLOW_FLAG_ESTABLISHED, "
225 "DETECT_FLOW_FLAG_NOT_ESTABLISHED already set");
228 SCLogError(
"DETECT_FLOW_FLAG_STATELESS already set");
233 }
else if (strcasecmp(args[i],
"not_established") == 0) {
235 SCLogError(
"DETECT_FLOW_FLAG_NOT_ESTABLISHED flag is already set");
238 SCLogError(
"cannot set DETECT_FLOW_FLAG_NOT_ESTABLISHED, "
239 "DETECT_FLOW_FLAG_ESTABLISHED already set");
244 }
else if (strcasecmp(args[i],
"stateless") == 0) {
246 SCLogError(
"DETECT_FLOW_FLAG_STATELESS flag is already set");
249 SCLogError(
"cannot set DETECT_FLOW_FLAG_STATELESS, "
250 "DETECT_FLOW_FLAG_ESTABLISHED already set");
255 }
else if (strcasecmp(args[i],
"to_client") == 0 || strcasecmp(args[i],
"from_server") == 0) {
257 SCLogError(
"cannot set DETECT_FLOW_FLAG_TOCLIENT flag is already set");
260 SCLogError(
"cannot set to_client, DETECT_FLOW_FLAG_TOSERVER already set");
265 }
else if (strcasecmp(args[i],
"to_server") == 0 || strcasecmp(args[i],
"from_client") == 0){
267 SCLogError(
"cannot set DETECT_FLOW_FLAG_TOSERVER flag is already set");
270 SCLogError(
"cannot set to_server, DETECT_FLOW_FLAG_TO_CLIENT flag already set");
275 }
else if (strcasecmp(args[i],
"no_frag") == 0) {
277 SCLogError(
"cannot set no_frag flag is already set");
280 SCLogError(
"cannot set no_frag flag, only_frag already set");
285 }
else if (strcasecmp(args[i],
"only_frag") == 0) {
287 SCLogError(
"cannot set only_frag flag is already set");
290 SCLogError(
"cannot set only_frag flag, no_frag already set");
298 }
else if (strcasecmp(args[i],
"only_stream") == 0) {
300 SCLogError(
"cannot set only_stream flag is already set");
304 "cannot set only_stream flag, DETECT_FLOW_FLAG_NOSTREAM already set");
308 }
else if (strcasecmp(args[i],
"no_stream") == 0) {
310 SCLogError(
"cannot set no_stream flag is already set");
314 "cannot set no_stream flag, DETECT_FLOW_FLAG_ONLYSTREAM already set");
319 SCLogError(
"invalid flow option \"%s\"", args[i]);
324 pcre2_match_data_free(match);
329 pcre2_match_data_free(match);
339 #define SIG_FLAG_BOTH (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)
380 uint16_t parse_flags = 0;
384 SCLogError(
"A signature may have only one flow option.");
392 bool appendsm =
true;
397 "rule %u means to use both directions, cannot specify a flow direction", s->
id);
401 SCLogError(
"rule %u has flow to_server but a hook to_client", s->
id);
408 "rule %u means to use both directions, cannot specify a flow direction", s->
id);
412 SCLogError(
"rule %u has flow to_client but a hook to_server", s->
id);
471 if (!PrefilterPacketHeaderExtraMatch(
ctx, p))
476 PrefilterAddSids(&det_ctx->
pmq,
ctx->sigs_array,
ctx->sigs_cnt);
502 PrefilterPacketFlowCompare, PrefilterPacketFlowMatch);
505 static bool PrefilterFlowIsPrefilterable(
const Signature *s)
524 static int DetectFlowTestParse01 (
void)
526 uint16_t parsed_flags = 0;
527 DetectFlowData *fd = DetectFlowParse(NULL,
"established", &parsed_flags);
537 static int DetectFlowTestParse02 (
void)
539 uint16_t parsed_flags = 0;
540 DetectFlowData *fd = DetectFlowParse(NULL,
"established", &parsed_flags);
550 static int DetectFlowTestParse03 (
void)
552 uint16_t parsed_flags = 0;
553 DetectFlowData *fd = DetectFlowParse(NULL,
"stateless", &parsed_flags);
563 static int DetectFlowTestParse04 (
void)
565 uint16_t parsed_flags = 0;
566 DetectFlowData *fd = DetectFlowParse(NULL,
"to_client", &parsed_flags);
576 static int DetectFlowTestParse05 (
void)
578 uint16_t parsed_flags = 0;
579 DetectFlowData *fd = DetectFlowParse(NULL,
"to_server", &parsed_flags);
589 static int DetectFlowTestParse06 (
void)
591 uint16_t parsed_flags = 0;
592 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server", &parsed_flags);
602 static int DetectFlowTestParse07 (
void)
604 uint16_t parsed_flags = 0;
605 DetectFlowData *fd = DetectFlowParse(NULL,
"from_client", &parsed_flags);
615 static int DetectFlowTestParse08 (
void)
617 uint16_t parsed_flags = 0;
618 DetectFlowData *fd = DetectFlowParse(NULL,
"established,to_client", &parsed_flags);
628 static int DetectFlowTestParse09 (
void)
630 uint16_t parsed_flags = 0;
631 DetectFlowData *fd = DetectFlowParse(NULL,
"to_client,stateless", &parsed_flags);
643 static int DetectFlowTestParse10 (
void)
645 uint16_t parsed_flags = 0;
646 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server,stateless", &parsed_flags);
658 static int DetectFlowTestParse11 (
void)
660 uint16_t parsed_flags = 0;
661 DetectFlowData *fd = DetectFlowParse(NULL,
" from_server , stateless ", &parsed_flags);
674 static int DetectFlowTestParseNocase01 (
void)
676 uint16_t parsed_flags = 0;
677 DetectFlowData *fd = DetectFlowParse(NULL,
"ESTABLISHED", &parsed_flags);
686 static int DetectFlowTestParseNocase02 (
void)
688 uint16_t parsed_flags = 0;
689 DetectFlowData *fd = DetectFlowParse(NULL,
"ESTABLISHED", &parsed_flags);
700 static int DetectFlowTestParseNocase03 (
void)
702 uint16_t parsed_flags = 0;
703 DetectFlowData *fd = DetectFlowParse(NULL,
"STATELESS", &parsed_flags);
713 static int DetectFlowTestParseNocase04 (
void)
715 uint16_t parsed_flags = 0;
716 DetectFlowData *fd = DetectFlowParse(NULL,
"TO_CLIENT", &parsed_flags);
726 static int DetectFlowTestParseNocase05 (
void)
728 uint16_t parsed_flags = 0;
729 DetectFlowData *fd = DetectFlowParse(NULL,
"TO_SERVER", &parsed_flags);
739 static int DetectFlowTestParseNocase06 (
void)
741 uint16_t parsed_flags = 0;
742 DetectFlowData *fd = DetectFlowParse(NULL,
"FROM_SERVER", &parsed_flags);
752 static int DetectFlowTestParseNocase07 (
void)
754 uint16_t parsed_flags = 0;
755 DetectFlowData *fd = DetectFlowParse(NULL,
"FROM_CLIENT", &parsed_flags);
765 static int DetectFlowTestParseNocase08 (
void)
767 uint16_t parsed_flags = 0;
768 DetectFlowData *fd = DetectFlowParse(NULL,
"ESTABLISHED,TO_CLIENT", &parsed_flags);
780 static int DetectFlowTestParseNocase09 (
void)
782 uint16_t parsed_flags = 0;
783 DetectFlowData *fd = DetectFlowParse(NULL,
"TO_CLIENT,STATELESS", &parsed_flags);
795 static int DetectFlowTestParseNocase10 (
void)
797 uint16_t parsed_flags = 0;
798 DetectFlowData *fd = DetectFlowParse(NULL,
"FROM_SERVER,STATELESS", &parsed_flags);
810 static int DetectFlowTestParseNocase11 (
void)
812 uint16_t parsed_flags = 0;
813 DetectFlowData *fd = DetectFlowParse(NULL,
" FROM_SERVER , STATELESS ", &parsed_flags);
825 static int DetectFlowTestParse12 (
void)
827 uint16_t parsed_flags = 0;
828 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server:stateless", &parsed_flags);
836 static int DetectFlowTestParse13 (
void)
838 uint16_t parsed_flags = 0;
839 DetectFlowData *fd = DetectFlowParse(NULL,
"invalidoptiontest", &parsed_flags);
847 static int DetectFlowTestParse14 (
void)
849 uint16_t parsed_flags = 0;
858 static int DetectFlowTestParse15 (
void)
860 uint16_t parsed_flags = 0;
861 DetectFlowData *fd = DetectFlowParse(NULL,
"established,stateless", &parsed_flags);
869 static int DetectFlowTestParse16 (
void)
871 uint16_t parsed_flags = 0;
872 DetectFlowData *fd = DetectFlowParse(NULL,
"to_client,to_server", &parsed_flags);
881 static int DetectFlowTestParse17 (
void)
883 uint16_t parsed_flags = 0;
884 DetectFlowData *fd = DetectFlowParse(NULL,
"to_client,from_server", &parsed_flags);
892 static int DetectFlowTestParse18 (
void)
894 uint16_t parsed_flags = 0;
896 DetectFlowParse(NULL,
"from_server,established,only_stream", &parsed_flags);
908 static int DetectFlowTestParseNocase18 (
void)
910 uint16_t parsed_flags = 0;
912 DetectFlowParse(NULL,
"FROM_SERVER,ESTABLISHED,ONLY_STREAM", &parsed_flags);
925 static int DetectFlowTestParse19 (
void)
927 uint16_t parsed_flags = 0;
929 DetectFlowParse(NULL,
"from_server,established,only_stream,a", &parsed_flags);
937 static int DetectFlowTestParse20 (
void)
939 uint16_t parsed_flags = 0;
940 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server,established,no_stream", &parsed_flags);
952 static int DetectFlowTestParseNocase20 (
void)
954 uint16_t parsed_flags = 0;
955 DetectFlowData *fd = DetectFlowParse(NULL,
"FROM_SERVER,ESTABLISHED,NO_STREAM", &parsed_flags);
967 static int DetectFlowTestParse21 (
void)
969 uint16_t parsed_flags = 0;
970 DetectFlowData *fd = DetectFlowParse(NULL,
"from_server,a,no_stream", &parsed_flags);
978 static int DetectFlowTestParse22(
void)
980 uint16_t parsed_flags = 0;
981 DetectFlowData *fd = DetectFlowParse(NULL,
"established,not_established", &parsed_flags);
983 fd = DetectFlowParse(NULL,
"not_established,established", &parsed_flags);
988 static int DetectFlowSigTest01(
void)
990 uint8_t *buf = (uint8_t *)
"supernovaduper";
991 uint16_t buflen = strlen((
char *)buf);
995 memset(&th_v, 0,
sizeof(th_v));
1000 const char *sig1 =
"alert tcp any any -> any any (msg:\"dummy\"; "
1001 "content:\"nova\"; flow:no_stream; sid:1;)";
1028 static int DetectFlowTestParseNotEstablished(
void)
1030 uint16_t parsed_flags = 0;
1031 DetectFlowData *fd = DetectFlowParse(NULL,
"not_established", &parsed_flags);
1041 static int DetectFlowTestParseNoFrag(
void)
1043 uint16_t parsed_flags = 0;
1044 DetectFlowData *fd = DetectFlowParse(NULL,
"no_frag", &parsed_flags);
1054 static int DetectFlowTestParseOnlyFrag(
void)
1056 uint16_t parsed_flags = 0;
1057 DetectFlowData *fd = DetectFlowParse(NULL,
"only_frag", &parsed_flags);
1067 static int DetectFlowTestParseNoFragOnlyFrag(
void)
1069 uint16_t parsed_flags = 0;
1070 DetectFlowData *fd = DetectFlowParse(NULL,
"no_frag,only_frag", &parsed_flags);
1078 static int DetectFlowTestNoFragMatch(
void)
1080 uint16_t parsed_flags = 0;
1081 uint32_t pflags = 0;
1082 DetectFlowData *fd = DetectFlowParse(NULL,
"no_frag", &parsed_flags);
1095 static int DetectFlowTestOnlyFragMatch(
void)
1097 uint16_t parsed_flags = 0;
1098 uint32_t pflags = 0;
1099 DetectFlowData *fd = DetectFlowParse(NULL,
"only_frag", &parsed_flags);
1112 static void DetectFlowRegisterTests(
void)
1125 UtRegisterTest(
"DetectFlowTestParseNocase01", DetectFlowTestParseNocase01);
1126 UtRegisterTest(
"DetectFlowTestParseNocase02", DetectFlowTestParseNocase02);
1127 UtRegisterTest(
"DetectFlowTestParseNocase03", DetectFlowTestParseNocase03);
1128 UtRegisterTest(
"DetectFlowTestParseNocase04", DetectFlowTestParseNocase04);
1129 UtRegisterTest(
"DetectFlowTestParseNocase05", DetectFlowTestParseNocase05);
1130 UtRegisterTest(
"DetectFlowTestParseNocase06", DetectFlowTestParseNocase06);
1131 UtRegisterTest(
"DetectFlowTestParseNocase07", DetectFlowTestParseNocase07);
1132 UtRegisterTest(
"DetectFlowTestParseNocase08", DetectFlowTestParseNocase08);
1133 UtRegisterTest(
"DetectFlowTestParseNocase09", DetectFlowTestParseNocase09);
1134 UtRegisterTest(
"DetectFlowTestParseNocase10", DetectFlowTestParseNocase10);
1135 UtRegisterTest(
"DetectFlowTestParseNocase11", DetectFlowTestParseNocase11);
1143 UtRegisterTest(
"DetectFlowTestParseNocase18", DetectFlowTestParseNocase18);
1146 UtRegisterTest(
"DetectFlowTestParseNocase20", DetectFlowTestParseNocase20);
1150 DetectFlowTestParseNotEstablished);
1151 UtRegisterTest(
"DetectFlowTestParseNoFrag", DetectFlowTestParseNoFrag);
1153 DetectFlowTestParseOnlyFrag);
1155 DetectFlowTestParseNoFragOnlyFrag);
1156 UtRegisterTest(
"DetectFlowTestNoFragMatch", DetectFlowTestNoFragMatch);
1157 UtRegisterTest(
"DetectFlowTestOnlyFragMatch", DetectFlowTestOnlyFragMatch);