suricata
detect-flow.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * FLOW part of the detection engine.
24  */
25 
26 #include "suricata-common.h"
27 #include "decode.h"
28 
29 #include "detect.h"
30 #include "detect-parse.h"
31 #include "detect-engine.h"
33 #include "detect-engine-build.h"
34 
35 #include "flow.h"
36 #include "flow-var.h"
37 
38 #include "detect-flow.h"
39 
40 #include "util-unittest.h"
41 #include "util-unittest-helper.h"
42 #include "util-debug.h"
43 
44 /**
45  * \brief Regex for parsing our flow options
46  */
47 #define PARSE_REGEX "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$"
48 
49 static DetectParseRegex parse_regex;
50 
52  const Signature *, const SigMatchCtx *);
53 static int DetectFlowSetup (DetectEngineCtx *, Signature *, const char *);
54 #ifdef UNITTESTS
55 static void DetectFlowRegisterTests(void);
56 #endif
57 void DetectFlowFree(DetectEngineCtx *, void *);
58 
59 static int PrefilterSetupFlow(DetectEngineCtx *de_ctx, SigGroupHead *sgh);
60 static bool PrefilterFlowIsPrefilterable(const Signature *s);
61 
62 /**
63  * \brief Registration function for flow: keyword
64  */
65 void DetectFlowRegister (void)
66 {
68  sigmatch_table[DETECT_FLOW].desc = "match on direction and state of the flow";
69  sigmatch_table[DETECT_FLOW].url = "/rules/flow-keywords.html#flow";
71  sigmatch_table[DETECT_FLOW].Setup = DetectFlowSetup;
74 #ifdef UNITTESTS
75  sigmatch_table[DETECT_FLOW].RegisterTests = DetectFlowRegisterTests;
76 #endif
77  sigmatch_table[DETECT_FLOW].SupportsPrefilter = PrefilterFlowIsPrefilterable;
78  sigmatch_table[DETECT_FLOW].SetupPrefilter = PrefilterSetupFlow;
79 
80  DetectSetupParseRegexes(PARSE_REGEX, &parse_regex);
81 }
82 
83 /**
84  * \param pflags packet flags (p->flags)
85  * \param pflowflags packet flow flags (p->flowflags)
86  * \param dflags detect flow flags
87  * \param match_cnt number of matches to trigger
88  */
89 static inline int FlowMatch(const uint32_t pflags, const uint8_t pflowflags, const uint16_t dflags,
90  const uint16_t match_cnt)
91 {
92  uint8_t cnt = 0;
93 
94  if ((dflags & DETECT_FLOW_FLAG_NO_FRAG) &&
95  (!(pflags & PKT_REBUILT_FRAGMENT))) {
96  cnt++;
97  } else if ((dflags & DETECT_FLOW_FLAG_ONLY_FRAG) &&
98  (pflags & PKT_REBUILT_FRAGMENT)) {
99  cnt++;
100  }
101 
102  if ((dflags & DETECT_FLOW_FLAG_TOSERVER) && (pflowflags & FLOW_PKT_TOSERVER)) {
103  cnt++;
104  } else if ((dflags & DETECT_FLOW_FLAG_TOCLIENT) && (pflowflags & FLOW_PKT_TOCLIENT)) {
105  cnt++;
106  }
107 
108  if ((dflags & DETECT_FLOW_FLAG_ESTABLISHED) && (pflowflags & FLOW_PKT_ESTABLISHED)) {
109  cnt++;
110  } else if (dflags & DETECT_FLOW_FLAG_NOT_ESTABLISHED && (!(pflowflags & FLOW_PKT_ESTABLISHED))) {
111  cnt++;
112  } else if (dflags & DETECT_FLOW_FLAG_STATELESS) {
113  cnt++;
114  }
115 
116  return (match_cnt == cnt) ? 1 : 0;
117 }
118 
119 /**
120  * \brief This function is used to match flow flags set on a packet with those passed via flow:
121  *
122  * \param t pointer to thread vars
123  * \param det_ctx pointer to the pattern matcher thread
124  * \param p pointer to the current packet
125  * \param m pointer to the sigmatch that we will cast into DetectFlowData
126  *
127  * \retval 0 no match
128  * \retval 1 match
129  */
131  const Signature *s, const SigMatchCtx *ctx)
132 {
133  SCEnter();
134 
135  SCLogDebug("pkt %p", p);
136 
137  if (p->flowflags & FLOW_PKT_TOSERVER) {
138  SCLogDebug("FLOW_PKT_TOSERVER");
139  } else if (p->flowflags & FLOW_PKT_TOCLIENT) {
140  SCLogDebug("FLOW_PKT_TOCLIENT");
141  }
142 
143  if (p->flowflags & FLOW_PKT_ESTABLISHED) {
144  SCLogDebug("FLOW_PKT_ESTABLISHED");
145  }
146 
147  const DetectFlowData *fd = (const DetectFlowData *)ctx;
148 
149  const int ret = FlowMatch(p->flags, p->flowflags, fd->flags, fd->match_cnt);
150  SCLogDebug("returning %" PRId32 " fd->match_cnt %" PRId32 " fd->flags 0x%02X p->flowflags 0x%02X",
151  ret, fd->match_cnt, fd->flags, p->flowflags);
152  SCReturnInt(ret);
153 }
154 
155 /**
156  * \brief This function is used to parse flow options passed via flow: keyword
157  *
158  * \param de_ctx Pointer to the detection engine context
159  * \param flowstr Pointer to the user provided flow options
160  * \param[out] parse_flags keyword flags only used during parsing
161  *
162  * \retval fd pointer to DetectFlowData on success
163  * \retval NULL on failure
164  */
165 static DetectFlowData *DetectFlowParse(
166  DetectEngineCtx *de_ctx, const char *flowstr, uint16_t *parse_flags)
167 {
168  DetectFlowData *fd = NULL;
169  char *args[3] = {NULL,NULL,NULL};
170  int res = 0;
171  size_t pcre2len;
172  char str1[16] = "", str2[16] = "", str3[16] = "";
173  pcre2_match_data *match = NULL;
174 
175  int ret = DetectParsePcreExec(&parse_regex, &match, flowstr, 0, 0);
176  if (ret < 1 || ret > 4) {
177  SCLogError("parse error, ret %" PRId32 ", string %s", ret, flowstr);
178  goto error;
179  }
180 
181  if (ret > 1) {
182  pcre2len = sizeof(str1);
183  res = SC_Pcre2SubstringCopy(match, 1, (PCRE2_UCHAR8 *)str1, &pcre2len);
184  if (res < 0) {
185  SCLogError("pcre2_substring_copy_bynumber failed");
186  goto error;
187  }
188  args[0] = (char *)str1;
189 
190  if (ret > 2) {
191  pcre2len = sizeof(str2);
192  res = pcre2_substring_copy_bynumber(match, 2, (PCRE2_UCHAR8 *)str2, &pcre2len);
193  if (res < 0) {
194  SCLogError("pcre2_substring_copy_bynumber failed");
195  goto error;
196  }
197  args[1] = (char *)str2;
198  }
199  if (ret > 3) {
200  pcre2len = sizeof(str3);
201  res = pcre2_substring_copy_bynumber(match, 3, (PCRE2_UCHAR8 *)str3, &pcre2len);
202  if (res < 0) {
203  SCLogError("pcre2_substring_copy_bynumber failed");
204  goto error;
205  }
206  args[2] = (char *)str3;
207  }
208  }
209 
210  fd = SCMalloc(sizeof(DetectFlowData));
211  if (unlikely(fd == NULL))
212  goto error;
213  fd->flags = 0;
214  fd->match_cnt = 0;
215 
216  for (int i = 0; i < (ret - 1); i++) {
217  if (args[i]) {
218  /* inspect our options and set the flags */
219  if (strcasecmp(args[i], "established") == 0) {
221  SCLogError("DETECT_FLOW_FLAG_ESTABLISHED flag is already set");
222  goto error;
223  } else if (fd->flags & DETECT_FLOW_FLAG_NOT_ESTABLISHED) {
224  SCLogError("cannot set DETECT_FLOW_FLAG_ESTABLISHED, "
225  "DETECT_FLOW_FLAG_NOT_ESTABLISHED already set");
226  goto error;
227  } else if (fd->flags & DETECT_FLOW_FLAG_STATELESS) {
228  SCLogError("DETECT_FLOW_FLAG_STATELESS already set");
229  goto error;
230  }
232  fd->match_cnt++;
233  } else if (strcasecmp(args[i], "not_established") == 0) {
235  SCLogError("DETECT_FLOW_FLAG_NOT_ESTABLISHED flag is already set");
236  goto error;
237  } else if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED) {
238  SCLogError("cannot set DETECT_FLOW_FLAG_NOT_ESTABLISHED, "
239  "DETECT_FLOW_FLAG_ESTABLISHED already set");
240  goto error;
241  }
243  fd->match_cnt++;
244  } else if (strcasecmp(args[i], "stateless") == 0) {
245  if (fd->flags & DETECT_FLOW_FLAG_STATELESS) {
246  SCLogError("DETECT_FLOW_FLAG_STATELESS flag is already set");
247  goto error;
248  } else if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED) {
249  SCLogError("cannot set DETECT_FLOW_FLAG_STATELESS, "
250  "DETECT_FLOW_FLAG_ESTABLISHED already set");
251  goto error;
252  }
254  fd->match_cnt++;
255  } else if (strcasecmp(args[i], "to_client") == 0 || strcasecmp(args[i], "from_server") == 0) {
256  if (fd->flags & DETECT_FLOW_FLAG_TOCLIENT) {
257  SCLogError("cannot set DETECT_FLOW_FLAG_TOCLIENT flag is already set");
258  goto error;
259  } else if (fd->flags & DETECT_FLOW_FLAG_TOSERVER) {
260  SCLogError("cannot set to_client, DETECT_FLOW_FLAG_TOSERVER already set");
261  goto error;
262  }
264  fd->match_cnt++;
265  } else if (strcasecmp(args[i], "to_server") == 0 || strcasecmp(args[i], "from_client") == 0){
266  if (fd->flags & DETECT_FLOW_FLAG_TOSERVER) {
267  SCLogError("cannot set DETECT_FLOW_FLAG_TOSERVER flag is already set");
268  goto error;
269  } else if (fd->flags & DETECT_FLOW_FLAG_TOCLIENT) {
270  SCLogError("cannot set to_server, DETECT_FLOW_FLAG_TO_CLIENT flag already set");
271  goto error;
272  }
274  fd->match_cnt++;
275  } else if (strcasecmp(args[i], "no_frag") == 0) {
276  if (fd->flags & DETECT_FLOW_FLAG_NO_FRAG) {
277  SCLogError("cannot set no_frag flag is already set");
278  goto error;
279  } else if (fd->flags & DETECT_FLOW_FLAG_ONLY_FRAG) {
280  SCLogError("cannot set no_frag flag, only_frag already set");
281  goto error;
282  }
284  fd->match_cnt++;
285  } else if (strcasecmp(args[i], "only_frag") == 0) {
286  if (fd->flags & DETECT_FLOW_FLAG_ONLY_FRAG) {
287  SCLogError("cannot set only_frag flag is already set");
288  goto error;
289  } else if (fd->flags & DETECT_FLOW_FLAG_NO_FRAG) {
290  SCLogError("cannot set only_frag flag, no_frag already set");
291  goto error;
292  }
294  fd->match_cnt++;
295 
296  /* special case: these only affect parsing, not matching */
297 
298  } else if (strcasecmp(args[i], "only_stream") == 0) {
299  if (*parse_flags & DETECT_FLOW_FLAG_ONLYSTREAM) {
300  SCLogError("cannot set only_stream flag is already set");
301  goto error;
302  } else if (*parse_flags & DETECT_FLOW_FLAG_NOSTREAM) {
303  SCLogError(
304  "cannot set only_stream flag, DETECT_FLOW_FLAG_NOSTREAM already set");
305  goto error;
306  }
307  *parse_flags |= DETECT_FLOW_FLAG_ONLYSTREAM;
308  } else if (strcasecmp(args[i], "no_stream") == 0) {
309  if (*parse_flags & DETECT_FLOW_FLAG_NOSTREAM) {
310  SCLogError("cannot set no_stream flag is already set");
311  goto error;
312  } else if (*parse_flags & DETECT_FLOW_FLAG_ONLYSTREAM) {
313  SCLogError(
314  "cannot set no_stream flag, DETECT_FLOW_FLAG_ONLYSTREAM already set");
315  goto error;
316  }
317  *parse_flags |= DETECT_FLOW_FLAG_NOSTREAM;
318  } else {
319  SCLogError("invalid flow option \"%s\"", args[i]);
320  goto error;
321  }
322  }
323  }
324  pcre2_match_data_free(match);
325  return fd;
326 
327 error:
328  if (match) {
329  pcre2_match_data_free(match);
330  }
331  if (fd != NULL)
332  DetectFlowFree(de_ctx, fd);
333  return NULL;
334 
335 }
336 
338 {
339 #define SIG_FLAG_BOTH (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)
340  BUG_ON(flags == 0);
343 
344  SCLogDebug("want %08x", flags & SIG_FLAG_BOTH);
345  SCLogDebug("have %08x", s->flags & SIG_FLAG_BOTH);
346 
347  if (flags & SIG_FLAG_TOSERVER) {
348  if ((s->flags & SIG_FLAG_BOTH) == SIG_FLAG_BOTH) {
349  /* both is set if we just have 'flow:established' */
350  s->flags &= ~SIG_FLAG_TOCLIENT;
351  } else if (s->flags & SIG_FLAG_TOCLIENT) {
352  return -1;
353  }
354  s->flags |= SIG_FLAG_TOSERVER;
355  } else {
356  if ((s->flags & SIG_FLAG_BOTH) == SIG_FLAG_BOTH) {
357  /* both is set if we just have 'flow:established' */
358  s->flags &= ~SIG_FLAG_TOSERVER;
359  } else if (s->flags & SIG_FLAG_TOSERVER) {
360  return -1;
361  }
362  s->flags |= SIG_FLAG_TOCLIENT;
363  }
364  return 0;
365 #undef SIG_FLAG_BOTH
366 }
367 
368 /**
369  * \brief this function is used to add the parsed flowdata into the current signature
370  *
371  * \param de_ctx pointer to the Detection Engine Context
372  * \param s pointer to the Current Signature
373  * \param flowstr pointer to the user provided flow options
374  *
375  * \retval 0 on Success
376  * \retval -1 on Failure
377  */
378 int DetectFlowSetup (DetectEngineCtx *de_ctx, Signature *s, const char *flowstr)
379 {
380  uint16_t parse_flags = 0;
381 
382  /* ensure only one flow option */
384  SCLogError("A signature may have only one flow option.");
385  return -1;
386  }
387 
388  DetectFlowData *fd = DetectFlowParse(de_ctx, flowstr, &parse_flags);
389  if (fd == NULL)
390  return -1;
391 
392  bool appendsm = true;
393  /* set the signature direction flags */
394  if (fd->flags & DETECT_FLOW_FLAG_TOSERVER) {
395  if (s->flags & SIG_FLAG_TXBOTHDIR) {
396  SCLogError(
397  "rule %u means to use both directions, cannot specify a flow direction", s->id);
398  goto error;
399  }
400  if (s->flags & SIG_FLAG_TOCLIENT) {
401  SCLogError("rule %u has flow to_server but a hook to_client", s->id);
402  goto error;
403  }
404  s->flags |= SIG_FLAG_TOSERVER;
405  } else if (fd->flags & DETECT_FLOW_FLAG_TOCLIENT) {
406  if (s->flags & SIG_FLAG_TXBOTHDIR) {
407  SCLogError(
408  "rule %u means to use both directions, cannot specify a flow direction", s->id);
409  goto error;
410  }
411  if (s->flags & SIG_FLAG_TOSERVER) {
412  SCLogError("rule %u has flow to_client but a hook to_server", s->id);
413  goto error;
414  }
415  s->flags |= SIG_FLAG_TOCLIENT;
416  } else {
417  /* if direction wasn't already set, e.g. by rule hook, assume both */
418  if ((s->flags & (SIG_FLAG_TOSERVER | SIG_FLAG_TOCLIENT)) == 0) {
419  s->flags |= SIG_FLAG_TOSERVER;
420  s->flags |= SIG_FLAG_TOCLIENT;
421  }
422  }
423  if (fd->flags == 0 || fd->flags == DETECT_FLOW_FLAG_TOSERVER ||
425  /* no direct flow is needed for just direction,
426  * no sigmatch is needed either. */
427  appendsm = false;
428  } else {
430  }
431 
432  if (appendsm) {
434  de_ctx, s, DETECT_FLOW, (SigMatchCtx *)fd, DETECT_SM_LIST_MATCH) == NULL) {
435  goto error;
436  }
437  } else {
438  DetectFlowFree(de_ctx, fd);
439  }
440 
441  if (parse_flags & DETECT_FLOW_FLAG_ONLYSTREAM) {
443  }
444  if (parse_flags & DETECT_FLOW_FLAG_NOSTREAM) {
446  }
447  return 0;
448 
449 error:
450  if (fd != NULL)
451  DetectFlowFree(de_ctx, fd);
452  return -1;
453 
454 }
455 
456 /**
457  * \brief this function will free memory associated with DetectFlowData
458  *
459  * \param fd pointer to DetectFlowData
460  */
462 {
463  DetectFlowData *fd = (DetectFlowData *)ptr;
464  SCFree(fd);
465 }
466 
467 static void
468 PrefilterPacketFlowMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
469 {
470  SCEnter();
471 
472  const PrefilterPacketHeaderCtx *ctx = pectx;
473 
474  if (!PrefilterPacketHeaderExtraMatch(ctx, p))
475  return;
476 
477  if (FlowMatch(p->flags, p->flowflags, ctx->v1.u16[0], ctx->v1.u16[1])) {
478  SCLogDebug("match: adding sids");
479  PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
480  }
481  SCReturn;
482 }
483 
484 static void
485 PrefilterPacketFlowSet(PrefilterPacketHeaderValue *v, void *smctx)
486 {
487  const DetectFlowData *fb = smctx;
488  v->u16[0] = fb->flags;
489  v->u16[1] = fb->match_cnt;
490 }
491 
492 static bool
493 PrefilterPacketFlowCompare(PrefilterPacketHeaderValue v, void *smctx)
494 {
495  const DetectFlowData *fb = smctx;
496  if (v.u16[0] == fb->flags && v.u16[1] == fb->match_cnt) {
497  return true;
498  }
499  return false;
500 }
501 
502 static int PrefilterSetupFlow(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
503 {
504  return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_FLOW, 0, PrefilterPacketFlowSet,
505  PrefilterPacketFlowCompare, PrefilterPacketFlowMatch);
506 }
507 
508 static bool PrefilterFlowIsPrefilterable(const Signature *s)
509 {
510  const SigMatch *sm;
511  for (sm = s->init_data->smlists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) {
512  switch (sm->type) {
513  case DETECT_FLOW:
514  return true;
515  }
516  }
517  return false;
518 }
519 
520 #ifdef UNITTESTS
521 #include "detect-engine-alert.h"
522 
523 /**
524  * \test DetectFlowTestParse01 is a test to make sure that we return "something"
525  * when given valid flow opt
526  */
527 static int DetectFlowTestParse01 (void)
528 {
529  uint16_t parsed_flags = 0;
530  DetectFlowData *fd = DetectFlowParse(NULL, "established", &parsed_flags);
531  FAIL_IF_NULL(fd);
532  FAIL_IF_NOT(parsed_flags == 0);
533  DetectFlowFree(NULL, fd);
534  PASS;
535 }
536 
537 /**
538  * \test DetectFlowTestParse02 is a test for setting the established flow opt
539  */
540 static int DetectFlowTestParse02 (void)
541 {
542  uint16_t parsed_flags = 0;
543  DetectFlowData *fd = DetectFlowParse(NULL, "established", &parsed_flags);
544  FAIL_IF_NULL(fd);
546  fd->match_cnt == 1);
547  PASS;
548 }
549 
550 /**
551  * \test DetectFlowTestParse03 is a test for setting the stateless flow opt
552  */
553 static int DetectFlowTestParse03 (void)
554 {
555  uint16_t parsed_flags = 0;
556  DetectFlowData *fd = DetectFlowParse(NULL, "stateless", &parsed_flags);
557  FAIL_IF_NULL(fd);
559  DetectFlowFree(NULL, fd);
560  PASS;
561 }
562 
563 /**
564  * \test DetectFlowTestParse04 is a test for setting the to_client flow opt
565  */
566 static int DetectFlowTestParse04 (void)
567 {
568  uint16_t parsed_flags = 0;
569  DetectFlowData *fd = DetectFlowParse(NULL, "to_client", &parsed_flags);
570  FAIL_IF_NULL(fd);
572  DetectFlowFree(NULL, fd);
573  PASS;
574 }
575 
576 /**
577  * \test DetectFlowTestParse05 is a test for setting the to_server flow opt
578  */
579 static int DetectFlowTestParse05 (void)
580 {
581  uint16_t parsed_flags = 0;
582  DetectFlowData *fd = DetectFlowParse(NULL, "to_server", &parsed_flags);
583  FAIL_IF_NULL(fd);
585  DetectFlowFree(NULL, fd);
586  PASS;
587 }
588 
589 /**
590  * \test DetectFlowTestParse06 is a test for setting the from_server flow opt
591  */
592 static int DetectFlowTestParse06 (void)
593 {
594  uint16_t parsed_flags = 0;
595  DetectFlowData *fd = DetectFlowParse(NULL, "from_server", &parsed_flags);
596  FAIL_IF_NULL(fd);
598  DetectFlowFree(NULL, fd);
599  PASS;
600 }
601 
602 /**
603  * \test DetectFlowTestParse07 is a test for setting the from_client flow opt
604  */
605 static int DetectFlowTestParse07 (void)
606 {
607  uint16_t parsed_flags = 0;
608  DetectFlowData *fd = DetectFlowParse(NULL, "from_client", &parsed_flags);
609  FAIL_IF_NULL(fd);
611  DetectFlowFree(NULL, fd);
612  PASS;
613 }
614 
615 /**
616  * \test DetectFlowTestParse08 is a test for setting the established,to_client flow opts
617  */
618 static int DetectFlowTestParse08 (void)
619 {
620  uint16_t parsed_flags = 0;
621  DetectFlowData *fd = DetectFlowParse(NULL, "established,to_client", &parsed_flags);
622  FAIL_IF_NULL(fd);
624  DetectFlowFree(NULL, fd);
625  PASS;
626 }
627 
628 /**
629  * \test DetectFlowTestParse09 is a test for setting the to_client,stateless flow opts (order of state,dir reversed)
630  */
631 static int DetectFlowTestParse09 (void)
632 {
633  uint16_t parsed_flags = 0;
634  DetectFlowData *fd = DetectFlowParse(NULL, "to_client,stateless", &parsed_flags);
635  FAIL_IF_NULL(fd);
638  fd->match_cnt == 2);
639  DetectFlowFree(NULL, fd);
640  PASS;
641 }
642 
643 /**
644  * \test DetectFlowTestParse10 is a test for setting the from_server,stateless flow opts (order of state,dir reversed)
645  */
646 static int DetectFlowTestParse10 (void)
647 {
648  uint16_t parsed_flags = 0;
649  DetectFlowData *fd = DetectFlowParse(NULL, "from_server,stateless", &parsed_flags);
650  FAIL_IF_NULL(fd);
653  fd->match_cnt == 2);
654  DetectFlowFree(NULL, fd);
655  PASS;
656 }
657 
658 /**
659  * \test DetectFlowTestParse11 is a test for setting the from_server,stateless flow opts with spaces all around
660  */
661 static int DetectFlowTestParse11 (void)
662 {
663  uint16_t parsed_flags = 0;
664  DetectFlowData *fd = DetectFlowParse(NULL, " from_server , stateless ", &parsed_flags);
665  FAIL_IF_NULL(fd);
668  fd->match_cnt == 2);
669  DetectFlowFree(NULL, fd);
670  PASS;
671 }
672 
673 /**
674  * \test DetectFlowTestParseNocase01 is a test to make sure that we return "something"
675  * when given valid flow opt
676  */
677 static int DetectFlowTestParseNocase01 (void)
678 {
679  uint16_t parsed_flags = 0;
680  DetectFlowData *fd = DetectFlowParse(NULL, "ESTABLISHED", &parsed_flags);
681  FAIL_IF_NULL(fd);
682  DetectFlowFree(NULL, fd);
683  PASS;
684 }
685 
686 /**
687  * \test DetectFlowTestParseNocase02 is a test for setting the established flow opt
688  */
689 static int DetectFlowTestParseNocase02 (void)
690 {
691  uint16_t parsed_flags = 0;
692  DetectFlowData *fd = DetectFlowParse(NULL, "ESTABLISHED", &parsed_flags);
693  FAIL_IF_NULL(fd);
695  fd->match_cnt == 1);
696  DetectFlowFree(NULL, fd);
697  PASS;
698 }
699 
700 /**
701  * \test DetectFlowTestParseNocase03 is a test for setting the stateless flow opt
702  */
703 static int DetectFlowTestParseNocase03 (void)
704 {
705  uint16_t parsed_flags = 0;
706  DetectFlowData *fd = DetectFlowParse(NULL, "STATELESS", &parsed_flags);
707  FAIL_IF_NULL(fd);
709  DetectFlowFree(NULL, fd);
710  PASS;
711 }
712 
713 /**
714  * \test DetectFlowTestParseNocase04 is a test for setting the to_client flow opt
715  */
716 static int DetectFlowTestParseNocase04 (void)
717 {
718  uint16_t parsed_flags = 0;
719  DetectFlowData *fd = DetectFlowParse(NULL, "TO_CLIENT", &parsed_flags);
720  FAIL_IF_NULL(fd);
722  DetectFlowFree(NULL, fd);
723  PASS;
724 }
725 
726 /**
727  * \test DetectFlowTestParseNocase05 is a test for setting the to_server flow opt
728  */
729 static int DetectFlowTestParseNocase05 (void)
730 {
731  uint16_t parsed_flags = 0;
732  DetectFlowData *fd = DetectFlowParse(NULL, "TO_SERVER", &parsed_flags);
733  FAIL_IF_NULL(fd);
735  DetectFlowFree(NULL, fd);
736  PASS;
737 }
738 
739 /**
740  * \test DetectFlowTestParseNocase06 is a test for setting the from_server flow opt
741  */
742 static int DetectFlowTestParseNocase06 (void)
743 {
744  uint16_t parsed_flags = 0;
745  DetectFlowData *fd = DetectFlowParse(NULL, "FROM_SERVER", &parsed_flags);
746  FAIL_IF_NULL(fd);
748  DetectFlowFree(NULL, fd);
749  PASS;
750 }
751 
752 /**
753  * \test DetectFlowTestParseNocase07 is a test for setting the from_client flow opt
754  */
755 static int DetectFlowTestParseNocase07 (void)
756 {
757  uint16_t parsed_flags = 0;
758  DetectFlowData *fd = DetectFlowParse(NULL, "FROM_CLIENT", &parsed_flags);
759  FAIL_IF_NULL(fd);
761  DetectFlowFree(NULL, fd);
762  PASS;
763 }
764 
765 /**
766  * \test DetectFlowTestParseNocase08 is a test for setting the established,to_client flow opts
767  */
768 static int DetectFlowTestParseNocase08 (void)
769 {
770  uint16_t parsed_flags = 0;
771  DetectFlowData *fd = DetectFlowParse(NULL, "ESTABLISHED,TO_CLIENT", &parsed_flags);
772  FAIL_IF_NULL(fd);
775  fd->match_cnt == 2);
776  DetectFlowFree(NULL, fd);
777  PASS;
778 }
779 
780 /**
781  * \test DetectFlowTestParseNocase09 is a test for setting the to_client,stateless flow opts (order of state,dir reversed)
782  */
783 static int DetectFlowTestParseNocase09 (void)
784 {
785  uint16_t parsed_flags = 0;
786  DetectFlowData *fd = DetectFlowParse(NULL, "TO_CLIENT,STATELESS", &parsed_flags);
787  FAIL_IF_NULL(fd);
790  fd->match_cnt == 2);
791  DetectFlowFree(NULL, fd);
792  PASS;
793 }
794 
795 /**
796  * \test DetectFlowTestParseNocase10 is a test for setting the from_server,stateless flow opts (order of state,dir reversed)
797  */
798 static int DetectFlowTestParseNocase10 (void)
799 {
800  uint16_t parsed_flags = 0;
801  DetectFlowData *fd = DetectFlowParse(NULL, "FROM_SERVER,STATELESS", &parsed_flags);
802  FAIL_IF_NULL(fd);
805  fd->match_cnt == 2);
806  DetectFlowFree(NULL, fd);
807  PASS;
808 }
809 
810 /**
811  * \test DetectFlowTestParseNocase11 is a test for setting the from_server,stateless flow opts with spaces all around
812  */
813 static int DetectFlowTestParseNocase11 (void)
814 {
815  uint16_t parsed_flags = 0;
816  DetectFlowData *fd = DetectFlowParse(NULL, " FROM_SERVER , STATELESS ", &parsed_flags);
817  FAIL_IF_NULL(fd);
820  fd->match_cnt == 2);
821  DetectFlowFree(NULL, fd);
822  PASS;
823 }
824 
825 /**
826  * \test DetectFlowTestParse12 is a test for setting an invalid separator :
827  */
828 static int DetectFlowTestParse12 (void)
829 {
830  uint16_t parsed_flags = 0;
831  DetectFlowData *fd = DetectFlowParse(NULL, "from_server:stateless", &parsed_flags);
832  FAIL_IF_NOT_NULL(fd);
833  PASS;
834 }
835 
836 /**
837  * \test DetectFlowTestParse13 is a test for an invalid option
838  */
839 static int DetectFlowTestParse13 (void)
840 {
841  uint16_t parsed_flags = 0;
842  DetectFlowData *fd = DetectFlowParse(NULL, "invalidoptiontest", &parsed_flags);
843  FAIL_IF_NOT_NULL(fd);
844  PASS;
845 }
846 
847 /**
848  * \test DetectFlowTestParse14 is a test for a empty option
849  */
850 static int DetectFlowTestParse14 (void)
851 {
852  uint16_t parsed_flags = 0;
853  DetectFlowData *fd = DetectFlowParse(NULL, "", &parsed_flags);
854  FAIL_IF_NOT_NULL(fd);
855  PASS;
856 }
857 
858 /**
859  * \test DetectFlowTestParse15 is a test for an invalid combo of options established,stateless
860  */
861 static int DetectFlowTestParse15 (void)
862 {
863  uint16_t parsed_flags = 0;
864  DetectFlowData *fd = DetectFlowParse(NULL, "established,stateless", &parsed_flags);
865  FAIL_IF_NOT_NULL(fd);
866  PASS;
867 }
868 
869 /**
870  * \test DetectFlowTestParse16 is a test for an invalid combo of options to_client,to_server
871  */
872 static int DetectFlowTestParse16 (void)
873 {
874  uint16_t parsed_flags = 0;
875  DetectFlowData *fd = DetectFlowParse(NULL, "to_client,to_server", &parsed_flags);
876  FAIL_IF_NOT_NULL(fd);
877  PASS;
878 }
879 
880 /**
881  * \test DetectFlowTestParse16 is a test for an invalid combo of options to_client,from_server
882  * flowbit flags are the same
883  */
884 static int DetectFlowTestParse17 (void)
885 {
886  uint16_t parsed_flags = 0;
887  DetectFlowData *fd = DetectFlowParse(NULL, "to_client,from_server", &parsed_flags);
888  FAIL_IF_NOT_NULL(fd);
889  PASS;
890 }
891 
892 /**
893  * \test DetectFlowTestParse18 is a test for setting the from_server,stateless,only_stream flow opts (order of state,dir reversed)
894  */
895 static int DetectFlowTestParse18 (void)
896 {
897  uint16_t parsed_flags = 0;
898  DetectFlowData *fd =
899  DetectFlowParse(NULL, "from_server,established,only_stream", &parsed_flags);
900  FAIL_IF_NULL(fd);
902  FAIL_IF_NOT(parsed_flags == DETECT_FLOW_FLAG_ONLYSTREAM);
903  FAIL_IF_NOT(fd->match_cnt == 2);
904  DetectFlowFree(NULL, fd);
905  PASS;
906 }
907 
908 /**
909  * \test DetectFlowTestParseNocase18 is a test for setting the from_server,stateless,only_stream flow opts (order of state,dir reversed)
910  */
911 static int DetectFlowTestParseNocase18 (void)
912 {
913  uint16_t parsed_flags = 0;
914  DetectFlowData *fd =
915  DetectFlowParse(NULL, "FROM_SERVER,ESTABLISHED,ONLY_STREAM", &parsed_flags);
916  FAIL_IF_NULL(fd);
918  FAIL_IF_NOT(parsed_flags == DETECT_FLOW_FLAG_ONLYSTREAM);
919  FAIL_IF_NOT(fd->match_cnt == 2);
920  DetectFlowFree(NULL, fd);
921  PASS;
922 }
923 
924 
925 /**
926  * \test DetectFlowTestParse19 is a test for one to many options passed to DetectFlowParse
927  */
928 static int DetectFlowTestParse19 (void)
929 {
930  uint16_t parsed_flags = 0;
931  DetectFlowData *fd =
932  DetectFlowParse(NULL, "from_server,established,only_stream,a", &parsed_flags);
933  FAIL_IF_NOT_NULL(fd);
934  PASS;
935 }
936 
937 /**
938  * \test DetectFlowTestParse20 is a test for setting from_server, established, no_stream
939  */
940 static int DetectFlowTestParse20 (void)
941 {
942  uint16_t parsed_flags = 0;
943  DetectFlowData *fd = DetectFlowParse(NULL, "from_server,established,no_stream", &parsed_flags);
944  FAIL_IF_NULL(fd);
946  FAIL_IF_NOT(parsed_flags == DETECT_FLOW_FLAG_NOSTREAM);
947  FAIL_IF_NOT(fd->match_cnt == 2);
948  DetectFlowFree(NULL, fd);
949  PASS;
950 }
951 
952 /**
953  * \test DetectFlowTestParse20 is a test for setting from_server, established, no_stream
954  */
955 static int DetectFlowTestParseNocase20 (void)
956 {
957  uint16_t parsed_flags = 0;
958  DetectFlowData *fd = DetectFlowParse(NULL, "FROM_SERVER,ESTABLISHED,NO_STREAM", &parsed_flags);
959  FAIL_IF_NULL(fd);
961  FAIL_IF_NOT(parsed_flags == DETECT_FLOW_FLAG_NOSTREAM);
962  FAIL_IF_NOT(fd->match_cnt == 2);
963  DetectFlowFree(NULL, fd);
964  PASS;
965 }
966 
967 /**
968  * \test DetectFlowTestParse21 is a test for an invalid opt between to valid opts
969  */
970 static int DetectFlowTestParse21 (void)
971 {
972  uint16_t parsed_flags = 0;
973  DetectFlowData *fd = DetectFlowParse(NULL, "from_server,a,no_stream", &parsed_flags);
974  FAIL_IF_NOT_NULL(fd);
975  PASS;
976 }
977 
978 /**
979  * \test DetectFlowTestParse22 is a test for setting the established,not_established flow opts both
980  */
981 static int DetectFlowTestParse22(void)
982 {
983  uint16_t parsed_flags = 0;
984  DetectFlowData *fd = DetectFlowParse(NULL, "established,not_established", &parsed_flags);
985  FAIL_IF_NOT_NULL(fd);
986  fd = DetectFlowParse(NULL, "not_established,established", &parsed_flags);
987  FAIL_IF_NOT_NULL(fd);
988  PASS;
989 }
990 
991 static int DetectFlowSigTest01(void)
992 {
993  uint8_t *buf = (uint8_t *)"supernovaduper";
994  uint16_t buflen = strlen((char *)buf);
995  ThreadVars th_v;
997  memset(&dtv, 0, sizeof(DecodeThreadVars));
998  memset(&th_v, 0, sizeof(th_v));
999 
1000  Packet *p = UTHBuildPacket(buf, buflen, IPPROTO_TCP);
1001  FAIL_IF_NULL(p);
1002 
1003  const char *sig1 = "alert tcp any any -> any any (msg:\"dummy\"; "
1004  "content:\"nova\"; flow:no_stream; sid:1;)";
1005 
1008  de_ctx->flags |= DE_QUIET;
1009 
1010  de_ctx->sig_list = SigInit(de_ctx, sig1);
1012 
1014  DetectEngineThreadCtx *det_ctx = NULL;
1015  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1016  FAIL_IF_NULL(det_ctx);
1017 
1018  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1019  FAIL_IF(PacketAlertCheck(p, 1) != 1);
1020 
1021  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1023  UTHFreePacket(p);
1024 
1025  PASS;
1026 }
1027 
1028 /**
1029  * \test Test parsing of the not_established keyword.
1030  */
1031 static int DetectFlowTestParseNotEstablished(void)
1032 {
1033  uint16_t parsed_flags = 0;
1034  DetectFlowData *fd = DetectFlowParse(NULL, "not_established", &parsed_flags);
1035  FAIL_IF_NULL(fd);
1037  DetectFlowFree(NULL, fd);
1038  PASS;
1039 }
1040 
1041 /**
1042  * \test Test parsing of the "no_frag" flow argument.
1043  */
1044 static int DetectFlowTestParseNoFrag(void)
1045 {
1046  uint16_t parsed_flags = 0;
1047  DetectFlowData *fd = DetectFlowParse(NULL, "no_frag", &parsed_flags);
1048  FAIL_IF_NULL(fd);
1050  DetectFlowFree(NULL, fd);
1051  PASS;
1052 }
1053 
1054 /**
1055  * \test Test parsing of the "only_frag" flow argument.
1056  */
1057 static int DetectFlowTestParseOnlyFrag(void)
1058 {
1059  uint16_t parsed_flags = 0;
1060  DetectFlowData *fd = DetectFlowParse(NULL, "only_frag", &parsed_flags);
1061  FAIL_IF_NULL(fd);
1063  DetectFlowFree(NULL, fd);
1064  PASS;
1065 }
1066 
1067 /**
1068  * \test Test that parsing of only_frag and no_frag together fails.
1069  */
1070 static int DetectFlowTestParseNoFragOnlyFrag(void)
1071 {
1072  uint16_t parsed_flags = 0;
1073  DetectFlowData *fd = DetectFlowParse(NULL, "no_frag,only_frag", &parsed_flags);
1074  FAIL_IF_NOT_NULL(fd);
1075  PASS;
1076 }
1077 
1078 /**
1079  * \test Test no_frag matching.
1080  */
1081 static int DetectFlowTestNoFragMatch(void)
1082 {
1083  uint16_t parsed_flags = 0;
1084  uint32_t pflags = 0;
1085  DetectFlowData *fd = DetectFlowParse(NULL, "no_frag", &parsed_flags);
1086  FAIL_IF_NULL(fd);
1088  FAIL_IF_NOT(fd->match_cnt == 1);
1089  FAIL_IF_NOT(FlowMatch(pflags, 0, fd->flags, fd->match_cnt));
1090  pflags |= PKT_REBUILT_FRAGMENT;
1091  FAIL_IF(FlowMatch(pflags, 0, fd->flags, fd->match_cnt));
1092  PASS;
1093 }
1094 
1095 /**
1096  * \test Test only_frag matching.
1097  */
1098 static int DetectFlowTestOnlyFragMatch(void)
1099 {
1100  uint16_t parsed_flags = 0;
1101  uint32_t pflags = 0;
1102  DetectFlowData *fd = DetectFlowParse(NULL, "only_frag", &parsed_flags);
1103  FAIL_IF_NULL(fd);
1105  FAIL_IF_NOT(fd->match_cnt == 1);
1106  FAIL_IF(FlowMatch(pflags, 0, fd->flags, fd->match_cnt));
1107  pflags |= PKT_REBUILT_FRAGMENT;
1108  FAIL_IF_NOT(FlowMatch(pflags, 0, fd->flags, fd->match_cnt));
1109  PASS;
1110 }
1111 
1112 /**
1113  * \brief this function registers unit tests for DetectFlow
1114  */
1115 static void DetectFlowRegisterTests(void)
1116 {
1117  UtRegisterTest("DetectFlowTestParse01", DetectFlowTestParse01);
1118  UtRegisterTest("DetectFlowTestParse02", DetectFlowTestParse02);
1119  UtRegisterTest("DetectFlowTestParse03", DetectFlowTestParse03);
1120  UtRegisterTest("DetectFlowTestParse04", DetectFlowTestParse04);
1121  UtRegisterTest("DetectFlowTestParse05", DetectFlowTestParse05);
1122  UtRegisterTest("DetectFlowTestParse06", DetectFlowTestParse06);
1123  UtRegisterTest("DetectFlowTestParse07", DetectFlowTestParse07);
1124  UtRegisterTest("DetectFlowTestParse08", DetectFlowTestParse08);
1125  UtRegisterTest("DetectFlowTestParse09", DetectFlowTestParse09);
1126  UtRegisterTest("DetectFlowTestParse10", DetectFlowTestParse10);
1127  UtRegisterTest("DetectFlowTestParse11", DetectFlowTestParse11);
1128  UtRegisterTest("DetectFlowTestParseNocase01", DetectFlowTestParseNocase01);
1129  UtRegisterTest("DetectFlowTestParseNocase02", DetectFlowTestParseNocase02);
1130  UtRegisterTest("DetectFlowTestParseNocase03", DetectFlowTestParseNocase03);
1131  UtRegisterTest("DetectFlowTestParseNocase04", DetectFlowTestParseNocase04);
1132  UtRegisterTest("DetectFlowTestParseNocase05", DetectFlowTestParseNocase05);
1133  UtRegisterTest("DetectFlowTestParseNocase06", DetectFlowTestParseNocase06);
1134  UtRegisterTest("DetectFlowTestParseNocase07", DetectFlowTestParseNocase07);
1135  UtRegisterTest("DetectFlowTestParseNocase08", DetectFlowTestParseNocase08);
1136  UtRegisterTest("DetectFlowTestParseNocase09", DetectFlowTestParseNocase09);
1137  UtRegisterTest("DetectFlowTestParseNocase10", DetectFlowTestParseNocase10);
1138  UtRegisterTest("DetectFlowTestParseNocase11", DetectFlowTestParseNocase11);
1139  UtRegisterTest("DetectFlowTestParse12", DetectFlowTestParse12);
1140  UtRegisterTest("DetectFlowTestParse13", DetectFlowTestParse13);
1141  UtRegisterTest("DetectFlowTestParse14", DetectFlowTestParse14);
1142  UtRegisterTest("DetectFlowTestParse15", DetectFlowTestParse15);
1143  UtRegisterTest("DetectFlowTestParse16", DetectFlowTestParse16);
1144  UtRegisterTest("DetectFlowTestParse17", DetectFlowTestParse17);
1145  UtRegisterTest("DetectFlowTestParse18", DetectFlowTestParse18);
1146  UtRegisterTest("DetectFlowTestParseNocase18", DetectFlowTestParseNocase18);
1147  UtRegisterTest("DetectFlowTestParse19", DetectFlowTestParse19);
1148  UtRegisterTest("DetectFlowTestParse20", DetectFlowTestParse20);
1149  UtRegisterTest("DetectFlowTestParseNocase20", DetectFlowTestParseNocase20);
1150  UtRegisterTest("DetectFlowTestParse21", DetectFlowTestParse21);
1151  UtRegisterTest("DetectFlowTestParse22", DetectFlowTestParse22);
1152  UtRegisterTest("DetectFlowTestParseNotEstablished",
1153  DetectFlowTestParseNotEstablished);
1154  UtRegisterTest("DetectFlowTestParseNoFrag", DetectFlowTestParseNoFrag);
1155  UtRegisterTest("DetectFlowTestParseOnlyFrag",
1156  DetectFlowTestParseOnlyFrag);
1157  UtRegisterTest("DetectFlowTestParseNoFragOnlyFrag",
1158  DetectFlowTestParseNoFragOnlyFrag);
1159  UtRegisterTest("DetectFlowTestNoFragMatch", DetectFlowTestNoFragMatch);
1160  UtRegisterTest("DetectFlowTestOnlyFragMatch", DetectFlowTestOnlyFragMatch);
1161 
1162  UtRegisterTest("DetectFlowSigTest01", DetectFlowSigTest01);
1163 }
1164 #endif /* UNITTESTS */
DETECT_FLOW_FLAG_TOCLIENT
#define DETECT_FLOW_FLAG_TOCLIENT
Definition: detect-flow.h:28
DETECT_FLOW_FLAG_STATELESS
#define DETECT_FLOW_FLAG_STATELESS
Definition: detect-flow.h:31
SigTableElmt_::url
const char * url
Definition: detect.h:1431
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SignatureInitData_::smlists
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
Definition: detect.h:644
SigTableElmt_::desc
const char * desc
Definition: detect.h:1430
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:155
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1418
DetectFlowData_
Definition: detect-flow.h:37
DetectParseRegex
Definition: detect-parse.h:62
DETECT_FLOW_FLAG_NOSTREAM
#define DETECT_FLOW_FLAG_NOSTREAM
Definition: detect-flow.h:33
SigTableElmt_::name
const char * name
Definition: detect.h:1428
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1598
SIG_FLAG_INIT_FLOW
#define SIG_FLAG_INIT_FLOW
Definition: detect.h:291
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DETECT_FLOW
@ DETECT_FLOW
Definition: detect-engine-register.h:54
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:141
Packet_::flags
uint32_t flags
Definition: decode.h:535
DetectFlowData_::match_cnt
uint8_t match_cnt
Definition: detect-flow.h:39
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1324
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1422
ctx
struct Thresholds ctx
DetectFlowData_::flags
uint16_t flags
Definition: detect-flow.h:38
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:931
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2674
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:233
SIG_FLAG_REQUIRE_STREAM
#define SIG_FLAG_REQUIRE_STREAM
Definition: detect.h:254
SIG_FLAG_TXBOTHDIR
#define SIG_FLAG_TXBOTHDIR
Definition: detect.h:249
DE_QUIET
#define DE_QUIET
Definition: detect.h:329
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:365
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:2347
SignatureInitData_::init_flags
uint32_t init_flags
Definition: detect.h:610
DetectParsePcreExec
int DetectParsePcreExec(DetectParseRegex *parse_regex, pcre2_match_data **match, const char *str, int start_offset, int options)
Definition: detect-parse.c:3493
SIGMATCH_SUPPORT_FIREWALL
#define SIGMATCH_SUPPORT_FIREWALL
Definition: detect.h:1651
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:523
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:271
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1413
DetectFlowSetupImplicit
int DetectFlowSetupImplicit(Signature *s, uint32_t flags)
Definition: detect-flow.c:337
PrefilterPacketHeaderValue::u16
uint16_t u16[8]
Definition: detect-engine-prefilter-common.h:25
util-unittest.h
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1416
DETECT_FLOW_FLAG_ONLYSTREAM
#define DETECT_FLOW_FLAG_ONLYSTREAM
Definition: detect-flow.h:32
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:270
PrefilterPacketHeaderCtx_
Definition: detect-engine-prefilter-common.h:35
decode.h
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
DetectEngineThreadCtx_
Definition: detect.h:1223
PARSE_REGEX
#define PARSE_REGEX
Regex for parsing our flow options.
Definition: detect-flow.c:47
DETECT_FLOW_FLAG_TOSERVER
#define DETECT_FLOW_FLAG_TOSERVER
Definition: detect-flow.h:27
DetectSetupParseRegexes
void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *detect_parse)
Definition: detect-parse.c:3619
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3400
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:360
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:116
SigInit
Signature * SigInit(DetectEngineCtx *de_ctx, const char *sigstr)
Parses a signature and adds it to the Detection Engine Context.
Definition: detect-parse.c:3097
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:317
SCReturn
#define SCReturn
Definition: util-debug.h:273
Signature_::flags
uint32_t flags
Definition: detect.h:671
Packet_
Definition: decode.h:492
detect-engine-build.h
detect-engine-alert.h
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:749
PrefilterSetupPacketHeader
int PrefilterSetupPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, SignatureMask mask, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:406
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1396
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:234
SIG_FLAG_REQUIRE_STREAM_ONLY
#define SIG_FLAG_REQUIRE_STREAM_ONLY
Definition: detect.h:260
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:2129
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:351
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:357
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3626
DetectEngineCtx_::sig_list
Signature * sig_list
Definition: detect.h:940
DetectFlowRegister
void DetectFlowRegister(void)
Registration function for flow: keyword.
Definition: detect-flow.c:65
SIG_FLAG_BOTH
#define SIG_FLAG_BOTH
DETECT_FLOW_FLAG_NOT_ESTABLISHED
#define DETECT_FLOW_FLAG_NOT_ESTABLISHED
Definition: detect-flow.h:30
detect-flow.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
DETECT_FLOW_FLAG_ONLY_FRAG
#define DETECT_FLOW_FLAG_ONLY_FRAG
Definition: detect-flow.h:35
PKT_REBUILT_FRAGMENT
#define PKT_REBUILT_FRAGMENT
Definition: decode.h:1286
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:954
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1415
UTHFreePacket
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:473
Signature_::id
uint32_t id
Definition: detect.h:715
DETECT_FLOW_FLAG_ESTABLISHED
#define DETECT_FLOW_FLAG_ESTABLISHED
Definition: detect-flow.h:29
detect-parse.h
DetectFlowFree
void DetectFlowFree(DetectEngineCtx *, void *)
this function will free memory associated with DetectFlowData
Definition: detect-flow.c:461
Signature_
Signature container.
Definition: detect.h:670
SigMatch_
a single match condition for a signature
Definition: detect.h:356
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:235
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2635
SC_Pcre2SubstringCopy
int SC_Pcre2SubstringCopy(pcre2_match_data *match_data, uint32_t number, PCRE2_UCHAR *buffer, PCRE2_SIZE *bufflen)
Definition: detect-parse.c:3595
DetectFlowMatch
int DetectFlowMatch(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
This function is used to match flow flags set on a packet with those passed via flow:
Definition: detect-flow.c:130
PrefilterPacketHeaderValue
Definition: detect-engine-prefilter-common.h:23
SigMatchAppendSMToList
SigMatch * SigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:464
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:933
detect-engine-prefilter-common.h
flow.h
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
flow-var.h
DETECT_FLOW_FLAG_NO_FRAG
#define DETECT_FLOW_FLAG_NO_FRAG
Definition: detect-flow.h:34
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1420
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:253