47 #define PARSE_REGEX "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$"
55 static void DetectFlowRegisterTests(
void);
60 static bool PrefilterFlowIsPrefilterable(
const Signature *s);
89 static inline int FlowMatch(
const uint32_t pflags,
const uint8_t pflowflags,
90 const uint16_t tflags,
const uint16_t dflags,
const uint8_t match_cnt)
124 return (match_cnt == cnt) ? 1 : 0;
158 SCLogDebug(
"returning %" PRId32
" fd->match_cnt %" PRId32
" fd->flags 0x%02X p->flowflags 0x%02X",
175 char *args[3] = {NULL,NULL,NULL};
176 int ret = 0,
res = 0;
178 char str1[16] =
"", str2[16] =
"", str3[16] =
"";
181 if (ret < 1 || ret > 4) {
187 pcre2len =
sizeof(str1);
193 args[0] = (
char *)str1;
196 pcre2len =
sizeof(str2);
197 res = pcre2_substring_copy_bynumber(
198 parse_regex.
match, 2, (PCRE2_UCHAR8 *)str2, &pcre2len);
203 args[1] = (
char *)str2;
206 pcre2len =
sizeof(str3);
207 res = pcre2_substring_copy_bynumber(
208 parse_regex.
match, 3, (PCRE2_UCHAR8 *)str3, &pcre2len);
213 args[2] = (
char *)str3;
224 for (i = 0; i < (ret - 1); i++) {
227 if (strcasecmp(args[i],
"established") == 0) {
236 }
else if (strcasecmp(args[i],
"not_established") == 0) {
245 }
else if (strcasecmp(args[i],
"stateless") == 0) {
254 }
else if (strcasecmp(args[i],
"to_client") == 0 || strcasecmp(args[i],
"from_server") == 0) {
263 }
else if (strcasecmp(args[i],
"to_server") == 0 || strcasecmp(args[i],
"from_client") == 0){
272 }
else if (strcasecmp(args[i],
"only_stream") == 0) {
281 }
else if (strcasecmp(args[i],
"no_stream") == 0) {
290 }
else if (strcasecmp(args[i],
"no_frag") == 0) {
299 }
else if (strcasecmp(args[i],
"only_frag") == 0) {
328 #define SIG_FLAG_BOTH (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)
439 if (!PrefilterPacketHeaderExtraMatch(ctx, p))
471 PrefilterPacketFlowSet,
472 PrefilterPacketFlowCompare,
473 PrefilterPacketFlowMatch);
476 static bool PrefilterFlowIsPrefilterable(
const Signature *s)
494 static int DetectFlowTestParse01 (
void)
497 fd = DetectFlowParse(NULL,
"established");
506 static int DetectFlowTestParse02 (
void)
509 fd = DetectFlowParse(NULL,
"established");
519 static int DetectFlowTestParse03 (
void)
522 fd = DetectFlowParse(NULL,
"stateless");
532 static int DetectFlowTestParse04 (
void)
535 fd = DetectFlowParse(NULL,
"to_client");
545 static int DetectFlowTestParse05 (
void)
548 fd = DetectFlowParse(NULL,
"to_server");
558 static int DetectFlowTestParse06 (
void)
561 fd = DetectFlowParse(NULL,
"from_server");
571 static int DetectFlowTestParse07 (
void)
574 fd = DetectFlowParse(NULL,
"from_client");
584 static int DetectFlowTestParse08 (
void)
587 fd = DetectFlowParse(NULL,
"established,to_client");
597 static int DetectFlowTestParse09 (
void)
600 fd = DetectFlowParse(NULL,
"to_client,stateless");
612 static int DetectFlowTestParse10 (
void)
615 fd = DetectFlowParse(NULL,
"from_server,stateless");
627 static int DetectFlowTestParse11 (
void)
630 fd = DetectFlowParse(NULL,
" from_server , stateless ");
643 static int DetectFlowTestParseNocase01 (
void)
646 fd = DetectFlowParse(NULL,
"ESTABLISHED");
655 static int DetectFlowTestParseNocase02 (
void)
658 fd = DetectFlowParse(NULL,
"ESTABLISHED");
669 static int DetectFlowTestParseNocase03 (
void)
672 fd = DetectFlowParse(NULL,
"STATELESS");
681 static int DetectFlowTestParseNocase04 (
void)
684 fd = DetectFlowParse(NULL,
"TO_CLIENT");
694 static int DetectFlowTestParseNocase05 (
void)
697 fd = DetectFlowParse(NULL,
"TO_SERVER");
707 static int DetectFlowTestParseNocase06 (
void)
710 fd = DetectFlowParse(NULL,
"FROM_SERVER");
720 static int DetectFlowTestParseNocase07 (
void)
723 fd = DetectFlowParse(NULL,
"FROM_CLIENT");
733 static int DetectFlowTestParseNocase08 (
void)
736 fd = DetectFlowParse(NULL,
"ESTABLISHED,TO_CLIENT");
748 static int DetectFlowTestParseNocase09 (
void)
751 fd = DetectFlowParse(NULL,
"TO_CLIENT,STATELESS");
763 static int DetectFlowTestParseNocase10 (
void)
766 fd = DetectFlowParse(NULL,
"FROM_SERVER,STATELESS");
778 static int DetectFlowTestParseNocase11 (
void)
781 fd = DetectFlowParse(NULL,
" FROM_SERVER , STATELESS ");
793 static int DetectFlowTestParse12 (
void)
796 fd = DetectFlowParse(NULL,
"from_server:stateless");
804 static int DetectFlowTestParse13 (
void)
807 fd = DetectFlowParse(NULL,
"invalidoptiontest");
815 static int DetectFlowTestParse14 (
void)
818 fd = DetectFlowParse(NULL,
"");
826 static int DetectFlowTestParse15 (
void)
829 fd = DetectFlowParse(NULL,
"established,stateless");
837 static int DetectFlowTestParse16 (
void)
840 fd = DetectFlowParse(NULL,
"to_client,to_server");
849 static int DetectFlowTestParse17 (
void)
852 fd = DetectFlowParse(NULL,
"to_client,from_server");
860 static int DetectFlowTestParse18 (
void)
863 fd = DetectFlowParse(NULL,
"from_server,established,only_stream");
876 static int DetectFlowTestParseNocase18 (
void)
879 fd = DetectFlowParse(NULL,
"FROM_SERVER,ESTABLISHED,ONLY_STREAM");
893 static int DetectFlowTestParse19 (
void)
896 fd = DetectFlowParse(NULL,
"from_server,established,only_stream,a");
904 static int DetectFlowTestParse20 (
void)
907 fd = DetectFlowParse(NULL,
"from_server,established,no_stream");
920 static int DetectFlowTestParseNocase20 (
void)
923 fd = DetectFlowParse(NULL,
"FROM_SERVER,ESTABLISHED,NO_STREAM");
936 static int DetectFlowTestParse21 (
void)
939 fd = DetectFlowParse(NULL,
"from_server,a,no_stream");
944 static int DetectFlowSigTest01(
void)
946 uint8_t *buf = (uint8_t *)
"supernovaduper";
947 uint16_t buflen = strlen((
char *)buf);
951 memset(&th_v, 0,
sizeof(th_v));
956 const char *sig1 =
"alert tcp any any -> any any (msg:\"dummy\"; "
957 "content:\"nova\"; flow:no_stream; sid:1;)";
984 static int DetectFlowTestParseNotEstablished(
void)
987 fd = DetectFlowParse(NULL,
"not_established");
997 static int DetectFlowTestParseNoFrag(
void)
1000 fd = DetectFlowParse(NULL,
"no_frag");
1010 static int DetectFlowTestParseOnlyFrag(
void)
1013 fd = DetectFlowParse(NULL,
"only_frag");
1023 static int DetectFlowTestParseNoFragOnlyFrag(
void)
1026 fd = DetectFlowParse(NULL,
"no_frag,only_frag");
1034 static int DetectFlowTestNoFragMatch(
void)
1036 uint32_t pflags = 0;
1050 static int DetectFlowTestOnlyFragMatch(
void)
1052 uint32_t pflags = 0;
1066 static void DetectFlowRegisterTests(
void)
1079 UtRegisterTest(
"DetectFlowTestParseNocase01", DetectFlowTestParseNocase01);
1080 UtRegisterTest(
"DetectFlowTestParseNocase02", DetectFlowTestParseNocase02);
1081 UtRegisterTest(
"DetectFlowTestParseNocase03", DetectFlowTestParseNocase03);
1082 UtRegisterTest(
"DetectFlowTestParseNocase04", DetectFlowTestParseNocase04);
1083 UtRegisterTest(
"DetectFlowTestParseNocase05", DetectFlowTestParseNocase05);
1084 UtRegisterTest(
"DetectFlowTestParseNocase06", DetectFlowTestParseNocase06);
1085 UtRegisterTest(
"DetectFlowTestParseNocase07", DetectFlowTestParseNocase07);
1086 UtRegisterTest(
"DetectFlowTestParseNocase08", DetectFlowTestParseNocase08);
1087 UtRegisterTest(
"DetectFlowTestParseNocase09", DetectFlowTestParseNocase09);
1088 UtRegisterTest(
"DetectFlowTestParseNocase10", DetectFlowTestParseNocase10);
1089 UtRegisterTest(
"DetectFlowTestParseNocase11", DetectFlowTestParseNocase11);
1097 UtRegisterTest(
"DetectFlowTestParseNocase18", DetectFlowTestParseNocase18);
1100 UtRegisterTest(
"DetectFlowTestParseNocase20", DetectFlowTestParseNocase20);
1103 DetectFlowTestParseNotEstablished);
1104 UtRegisterTest(
"DetectFlowTestParseNoFrag", DetectFlowTestParseNoFrag);
1106 DetectFlowTestParseOnlyFrag);
1108 DetectFlowTestParseNoFragOnlyFrag);
1109 UtRegisterTest(
"DetectFlowTestNoFragMatch", DetectFlowTestNoFragMatch);
1110 UtRegisterTest(
"DetectFlowTestOnlyFragMatch", DetectFlowTestOnlyFragMatch);