47 #define PARSE_REGEX "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$"
55 static void DetectFlowRegisterTests(
void);
60 static bool PrefilterFlowIsPrefilterable(
const Signature *s);
89 static inline int FlowMatch(
const uint32_t pflags,
const uint8_t pflowflags,
const uint16_t tflags,
90 const uint16_t dflags,
const uint16_t match_cnt)
124 return (match_cnt == cnt) ? 1 : 0;
158 SCLogDebug(
"returning %" PRId32
" fd->match_cnt %" PRId32
" fd->flags 0x%02X p->flowflags 0x%02X",
175 char *args[3] = {NULL,NULL,NULL};
178 char str1[16] =
"", str2[16] =
"", str3[16] =
"";
179 pcre2_match_data *match = NULL;
182 if (ret < 1 || ret > 4) {
183 SCLogError(
"parse error, ret %" PRId32
", string %s", ret, flowstr);
188 pcre2len =
sizeof(str1);
191 SCLogError(
"pcre2_substring_copy_bynumber failed");
194 args[0] = (
char *)str1;
197 pcre2len =
sizeof(str2);
198 res = pcre2_substring_copy_bynumber(match, 2, (PCRE2_UCHAR8 *)str2, &pcre2len);
200 SCLogError(
"pcre2_substring_copy_bynumber failed");
203 args[1] = (
char *)str2;
206 pcre2len =
sizeof(str3);
207 res = pcre2_substring_copy_bynumber(match, 3, (PCRE2_UCHAR8 *)str3, &pcre2len);
209 SCLogError(
"pcre2_substring_copy_bynumber failed");
212 args[2] = (
char *)str3;
223 for (i = 0; i < (ret - 1); i++) {
226 if (strcasecmp(args[i],
"established") == 0) {
228 SCLogError(
"DETECT_FLOW_FLAG_ESTABLISHED flag is already set");
231 SCLogError(
"DETECT_FLOW_FLAG_STATELESS already set");
235 }
else if (strcasecmp(args[i],
"not_established") == 0) {
237 SCLogError(
"DETECT_FLOW_FLAG_NOT_ESTABLISHED flag is already set");
240 SCLogError(
"cannot set DETECT_FLOW_FLAG_NOT_ESTABLISHED, "
241 "DETECT_FLOW_FLAG_ESTABLISHED already set");
245 }
else if (strcasecmp(args[i],
"stateless") == 0) {
247 SCLogError(
"DETECT_FLOW_FLAG_STATELESS flag is already set");
250 SCLogError(
"cannot set DETECT_FLOW_FLAG_STATELESS, "
251 "DETECT_FLOW_FLAG_ESTABLISHED already set");
255 }
else if (strcasecmp(args[i],
"to_client") == 0 || strcasecmp(args[i],
"from_server") == 0) {
257 SCLogError(
"cannot set DETECT_FLOW_FLAG_TOCLIENT flag is already set");
260 SCLogError(
"cannot set to_client, DETECT_FLOW_FLAG_TOSERVER already set");
264 }
else if (strcasecmp(args[i],
"to_server") == 0 || strcasecmp(args[i],
"from_client") == 0){
266 SCLogError(
"cannot set DETECT_FLOW_FLAG_TOSERVER flag is already set");
269 SCLogError(
"cannot set to_server, DETECT_FLOW_FLAG_TO_CLIENT flag already set");
273 }
else if (strcasecmp(args[i],
"only_stream") == 0) {
275 SCLogError(
"cannot set only_stream flag is already set");
279 "cannot set only_stream flag, DETECT_FLOW_FLAG_NOSTREAM already set");
283 }
else if (strcasecmp(args[i],
"no_stream") == 0) {
285 SCLogError(
"cannot set no_stream flag is already set");
289 "cannot set no_stream flag, DETECT_FLOW_FLAG_ONLYSTREAM already set");
293 }
else if (strcasecmp(args[i],
"no_frag") == 0) {
295 SCLogError(
"cannot set no_frag flag is already set");
298 SCLogError(
"cannot set no_frag flag, only_frag already set");
302 }
else if (strcasecmp(args[i],
"only_frag") == 0) {
304 SCLogError(
"cannot set only_frag flag is already set");
307 SCLogError(
"cannot set only_frag flag, no_frag already set");
312 SCLogError(
"invalid flow option \"%s\"", args[i]);
320 pcre2_match_data_free(match);
325 pcre2_match_data_free(match);
335 #define SIG_FLAG_BOTH (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)
378 SCLogError(
"A signature may have only one flow option.");
446 if (!PrefilterPacketHeaderExtraMatch(ctx, p))
475 PrefilterPacketFlowSet,
476 PrefilterPacketFlowCompare,
477 PrefilterPacketFlowMatch);
480 static bool PrefilterFlowIsPrefilterable(
const Signature *s)
499 static int DetectFlowTestParse01 (
void)
502 fd = DetectFlowParse(NULL,
"established");
511 static int DetectFlowTestParse02 (
void)
514 fd = DetectFlowParse(NULL,
"established");
524 static int DetectFlowTestParse03 (
void)
527 fd = DetectFlowParse(NULL,
"stateless");
537 static int DetectFlowTestParse04 (
void)
540 fd = DetectFlowParse(NULL,
"to_client");
550 static int DetectFlowTestParse05 (
void)
553 fd = DetectFlowParse(NULL,
"to_server");
563 static int DetectFlowTestParse06 (
void)
566 fd = DetectFlowParse(NULL,
"from_server");
576 static int DetectFlowTestParse07 (
void)
579 fd = DetectFlowParse(NULL,
"from_client");
589 static int DetectFlowTestParse08 (
void)
592 fd = DetectFlowParse(NULL,
"established,to_client");
602 static int DetectFlowTestParse09 (
void)
605 fd = DetectFlowParse(NULL,
"to_client,stateless");
617 static int DetectFlowTestParse10 (
void)
620 fd = DetectFlowParse(NULL,
"from_server,stateless");
632 static int DetectFlowTestParse11 (
void)
635 fd = DetectFlowParse(NULL,
" from_server , stateless ");
648 static int DetectFlowTestParseNocase01 (
void)
651 fd = DetectFlowParse(NULL,
"ESTABLISHED");
660 static int DetectFlowTestParseNocase02 (
void)
663 fd = DetectFlowParse(NULL,
"ESTABLISHED");
674 static int DetectFlowTestParseNocase03 (
void)
677 fd = DetectFlowParse(NULL,
"STATELESS");
686 static int DetectFlowTestParseNocase04 (
void)
689 fd = DetectFlowParse(NULL,
"TO_CLIENT");
699 static int DetectFlowTestParseNocase05 (
void)
702 fd = DetectFlowParse(NULL,
"TO_SERVER");
712 static int DetectFlowTestParseNocase06 (
void)
715 fd = DetectFlowParse(NULL,
"FROM_SERVER");
725 static int DetectFlowTestParseNocase07 (
void)
728 fd = DetectFlowParse(NULL,
"FROM_CLIENT");
738 static int DetectFlowTestParseNocase08 (
void)
741 fd = DetectFlowParse(NULL,
"ESTABLISHED,TO_CLIENT");
753 static int DetectFlowTestParseNocase09 (
void)
756 fd = DetectFlowParse(NULL,
"TO_CLIENT,STATELESS");
768 static int DetectFlowTestParseNocase10 (
void)
771 fd = DetectFlowParse(NULL,
"FROM_SERVER,STATELESS");
783 static int DetectFlowTestParseNocase11 (
void)
786 fd = DetectFlowParse(NULL,
" FROM_SERVER , STATELESS ");
798 static int DetectFlowTestParse12 (
void)
801 fd = DetectFlowParse(NULL,
"from_server:stateless");
809 static int DetectFlowTestParse13 (
void)
812 fd = DetectFlowParse(NULL,
"invalidoptiontest");
820 static int DetectFlowTestParse14 (
void)
823 fd = DetectFlowParse(NULL,
"");
831 static int DetectFlowTestParse15 (
void)
834 fd = DetectFlowParse(NULL,
"established,stateless");
842 static int DetectFlowTestParse16 (
void)
845 fd = DetectFlowParse(NULL,
"to_client,to_server");
854 static int DetectFlowTestParse17 (
void)
857 fd = DetectFlowParse(NULL,
"to_client,from_server");
865 static int DetectFlowTestParse18 (
void)
868 fd = DetectFlowParse(NULL,
"from_server,established,only_stream");
881 static int DetectFlowTestParseNocase18 (
void)
884 fd = DetectFlowParse(NULL,
"FROM_SERVER,ESTABLISHED,ONLY_STREAM");
898 static int DetectFlowTestParse19 (
void)
901 fd = DetectFlowParse(NULL,
"from_server,established,only_stream,a");
909 static int DetectFlowTestParse20 (
void)
912 fd = DetectFlowParse(NULL,
"from_server,established,no_stream");
925 static int DetectFlowTestParseNocase20 (
void)
928 fd = DetectFlowParse(NULL,
"FROM_SERVER,ESTABLISHED,NO_STREAM");
941 static int DetectFlowTestParse21 (
void)
944 fd = DetectFlowParse(NULL,
"from_server,a,no_stream");
949 static int DetectFlowSigTest01(
void)
951 uint8_t *buf = (uint8_t *)
"supernovaduper";
952 uint16_t buflen = strlen((
char *)buf);
956 memset(&th_v, 0,
sizeof(th_v));
961 const char *sig1 =
"alert tcp any any -> any any (msg:\"dummy\"; "
962 "content:\"nova\"; flow:no_stream; sid:1;)";
989 static int DetectFlowTestParseNotEstablished(
void)
992 fd = DetectFlowParse(NULL,
"not_established");
1002 static int DetectFlowTestParseNoFrag(
void)
1005 fd = DetectFlowParse(NULL,
"no_frag");
1015 static int DetectFlowTestParseOnlyFrag(
void)
1018 fd = DetectFlowParse(NULL,
"only_frag");
1028 static int DetectFlowTestParseNoFragOnlyFrag(
void)
1031 fd = DetectFlowParse(NULL,
"no_frag,only_frag");
1039 static int DetectFlowTestNoFragMatch(
void)
1041 uint32_t pflags = 0;
1055 static int DetectFlowTestOnlyFragMatch(
void)
1057 uint32_t pflags = 0;
1071 static void DetectFlowRegisterTests(
void)
1084 UtRegisterTest(
"DetectFlowTestParseNocase01", DetectFlowTestParseNocase01);
1085 UtRegisterTest(
"DetectFlowTestParseNocase02", DetectFlowTestParseNocase02);
1086 UtRegisterTest(
"DetectFlowTestParseNocase03", DetectFlowTestParseNocase03);
1087 UtRegisterTest(
"DetectFlowTestParseNocase04", DetectFlowTestParseNocase04);
1088 UtRegisterTest(
"DetectFlowTestParseNocase05", DetectFlowTestParseNocase05);
1089 UtRegisterTest(
"DetectFlowTestParseNocase06", DetectFlowTestParseNocase06);
1090 UtRegisterTest(
"DetectFlowTestParseNocase07", DetectFlowTestParseNocase07);
1091 UtRegisterTest(
"DetectFlowTestParseNocase08", DetectFlowTestParseNocase08);
1092 UtRegisterTest(
"DetectFlowTestParseNocase09", DetectFlowTestParseNocase09);
1093 UtRegisterTest(
"DetectFlowTestParseNocase10", DetectFlowTestParseNocase10);
1094 UtRegisterTest(
"DetectFlowTestParseNocase11", DetectFlowTestParseNocase11);
1102 UtRegisterTest(
"DetectFlowTestParseNocase18", DetectFlowTestParseNocase18);
1105 UtRegisterTest(
"DetectFlowTestParseNocase20", DetectFlowTestParseNocase20);
1108 DetectFlowTestParseNotEstablished);
1109 UtRegisterTest(
"DetectFlowTestParseNoFrag", DetectFlowTestParseNoFrag);
1111 DetectFlowTestParseOnlyFrag);
1113 DetectFlowTestParseNoFragOnlyFrag);
1114 UtRegisterTest(
"DetectFlowTestNoFragMatch", DetectFlowTestNoFragMatch);
1115 UtRegisterTest(
"DetectFlowTestOnlyFragMatch", DetectFlowTestOnlyFragMatch);