Go to the documentation of this file.
53 #define PARSE_REGEX "\\s*(any|src|dst|both)\\s*,\\s*([A-Za-z0-9\\-\\_]+)\\s*,\\s*(\\<|\\>|\\=)\\s*,\\s*([0-9]+)\\s*"
61 static void IPRepRegisterTests(
void);
81 static inline uint8_t GetRep(
const SReputation *r,
const uint8_t cat,
const uint32_t
version)
91 static uint8_t GetHostRepSrc(
Packet *p, uint8_t cat, uint32_t
version)
118 static uint8_t GetHostRepDst(
Packet *p, uint8_t cat, uint32_t
version)
145 static inline int RepMatch(uint8_t op, uint8_t val1, uint8_t val2)
179 if (RepMatch(rd->
op, val, rd->
val) == 1)
186 return RepMatch(rd->
op, val, rd->
val);
192 SCLogDebug(
"checking src -- val %u (looking for cat %u, val %u)", val, rd->
cat, rd->
val);
196 return RepMatch(rd->
op, val, rd->
val);
206 return RepMatch(rd->
op, val, rd->
val);
214 if (val == 0 || RepMatch(rd->
op, val, rd->
val) == 0)
220 return RepMatch(rd->
op, val, rd->
val);
232 char *cmd_str = NULL, *name = NULL, *op_str = NULL, *value = NULL;
234 int ret = 0,
res = 0;
244 res = pcre2_substring_get_bynumber(parse_regex.
match, 1, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len);
249 cmd_str = (
char *)str_ptr;
251 res = pcre2_substring_get_bynumber(parse_regex.
match, 2, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len);
256 name = (
char *)str_ptr;
258 res = pcre2_substring_get_bynumber(parse_regex.
match, 3, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len);
263 op_str = (
char *)str_ptr;
265 res = pcre2_substring_get_bynumber(parse_regex.
match, 4, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len);
270 value = (
char *)str_ptr;
272 if (strcmp(cmd_str,
"any") == 0) {
274 }
else if (strcmp(cmd_str,
"both") == 0) {
276 }
else if (strcmp(cmd_str,
"src") == 0) {
278 }
else if (strcmp(cmd_str,
"dst") == 0) {
295 if (op_str == NULL || strlen(op_str) != 1) {
314 if (value != NULL && strlen(value) > 0) {
329 pcre2_substring_free((PCRE2_UCHAR *)name);
331 pcre2_substring_free((PCRE2_UCHAR *)cmd_str);
333 pcre2_substring_free((PCRE2_UCHAR *)op_str);
335 pcre2_substring_free((PCRE2_UCHAR *)value);
353 pcre2_substring_free((PCRE2_UCHAR *)name);
355 pcre2_substring_free((PCRE2_UCHAR *)cmd_str);
357 pcre2_substring_free((PCRE2_UCHAR *)op_str);
359 pcre2_substring_free((PCRE2_UCHAR *)value);
378 static FILE *DetectIPRepGenerateCategoriesDummy(
void)
381 const char *buffer =
"1,BadHosts,Know bad hosts";
383 fd =
SCFmemopen((
void *)buffer, strlen(buffer),
"r");
390 static FILE *DetectIPRepGenerateCategoriesDummy2(
void)
394 "1,BadHosts,Know bad hosts\n"
395 "2,GoodHosts,Know good hosts\n";
397 fd =
SCFmemopen((
void *)buffer, strlen(buffer),
"r");
404 static FILE *DetectIPRepGenerateNetworksDummy(
void)
407 const char *buffer =
"10.0.0.0/24,1,20";
409 fd =
SCFmemopen((
void *)buffer, strlen(buffer),
"r");
416 static FILE *DetectIPRepGenerateNetworksDummy2(
void)
421 "192.168.0.0/16,2,127";
423 fd =
SCFmemopen((
void *)buffer, strlen(buffer),
"r");
430 static int DetectIPRepTest01(
void)
441 memset(&th_v, 0,
sizeof(th_v));
452 fd = DetectIPRepGenerateCategoriesDummy();
456 fd = DetectIPRepGenerateNetworksDummy();
461 "badhost\"; iprep:any,BadHosts,>,1; sid:1;rev:1;)");
483 static int DetectIPRepTest02(
void)
494 memset(&th_v, 0,
sizeof(th_v));
505 fd = DetectIPRepGenerateCategoriesDummy();
509 fd = DetectIPRepGenerateNetworksDummy();
514 "badhost\"; iprep:src,BadHosts,>,1; sid:1; rev:1;)");
535 static int DetectIPRepTest03(
void)
546 memset(&th_v, 0,
sizeof(th_v));
557 fd = DetectIPRepGenerateCategoriesDummy();
561 fd = DetectIPRepGenerateNetworksDummy();
566 "badhost\"; iprep:dst,BadHosts,>,1; sid:1; rev:1;)");
587 static int DetectIPRepTest04(
void)
598 memset(&th_v, 0,
sizeof(th_v));
610 fd = DetectIPRepGenerateCategoriesDummy();
614 fd = DetectIPRepGenerateNetworksDummy();
619 "badhost\"; iprep:both,BadHosts,>,1; sid:1; rev:1;)");
640 static int DetectIPRepTest05(
void)
651 memset(&th_v, 0,
sizeof(th_v));
662 fd = DetectIPRepGenerateCategoriesDummy();
666 fd = DetectIPRepGenerateNetworksDummy();
671 "badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)");
692 static int DetectIPRepTest06(
void)
703 memset(&th_v, 0,
sizeof(th_v));
714 fd = DetectIPRepGenerateCategoriesDummy();
718 fd = DetectIPRepGenerateNetworksDummy2();
723 "badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)");
744 static int DetectIPRepTest07(
void)
755 memset(&th_v, 0,
sizeof(th_v));
766 fd = DetectIPRepGenerateCategoriesDummy();
770 fd = DetectIPRepGenerateNetworksDummy2();
775 "badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)");
796 static int DetectIPRepTest08(
void)
807 memset(&th_v, 0,
sizeof(th_v));
819 fd = DetectIPRepGenerateCategoriesDummy();
823 fd = DetectIPRepGenerateNetworksDummy();
828 "badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)");
849 static int DetectIPRepTest09(
void)
860 memset(&th_v, 0,
sizeof(th_v));
872 fd = DetectIPRepGenerateCategoriesDummy2();
876 fd = DetectIPRepGenerateNetworksDummy2();
881 "alert tcp any any -> any any (msg:\"test\"; iprep:src,BadHosts,>,9; sid:1; rev:1;)");
905 void IPRepRegisterTests(
void)
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
#define DETECT_IPREP_CMD_SRC
#define PKT_HOST_DST_LOOKED_UP
int DetectParsePcreExec(DetectParseRegex *parse_regex, const char *str, int start_offset, int options)
void(* Free)(DetectEngineCtx *, void *)
uint8_t rep[SREP_MAX_CATS]
uint8_t SRepCatGetByShortname(char *shortname)
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
void HostRelease(Host *h)
uint32_t UTHSetIPv4Address(const char *str)
return the uint32_t for a ipv4 address string
main detection engine ctx
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
#define DETECT_IPREP_CMD_ANY
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
@ SC_ERR_PCRE_GET_SUBSTRING
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
#define DETECT_IPREP_OP_EQ
#define PASS
Pass the test.
SRepCIDRTree * srepCIDR_ctx
#define DETECT_IPREP_CMD_DST
int SRepLoadCatFileFromFD(FILE *fp)
#define PKT_HOST_SRC_LOOKED_UP
void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *detect_parse)
Per thread variable structure.
#define HostReference(dst_h_ptr, h)
Data structures and function prototypes for keeping state for the detection engine.
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
#define DETECT_IPREP_OP_LT
int SRepLoadFileFromFD(SRepCIDRTree *cidr_ctx, FILE *fp)
void DetectIPRepFree(DetectEngineCtx *, void *)
SigMatch * SigMatchAlloc(void)
int StringParseU8RangeCheck(uint8_t *res, int base, size_t len, const char *str, uint8_t min, uint8_t max)
uint8_t SRepCIDRGetIPRepDst(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version)
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
void HostShutdown(void)
shutdown the flow engine
int SRepInit(DetectEngineCtx *de_ctx)
init reputation
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself.
#define DETECT_IPREP_OP_GT
a single match condition for a signature
void SRepResetVersion(void)
DetectEngineCtx * DetectEngineCtxInit(void)
Host * HostLookupHostFromHash(Address *a)
look up a host in the hash
#define DETECT_IPREP_CMD_BOTH
void HostInitConfig(bool quiet)
initialize the configuration
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
void DetectIPRepRegister(void)
#define SIGMATCH_IPONLY_COMPAT
#define DEBUG_VALIDATE_BUG_ON(exp)
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
uint8_t SRepCIDRGetIPRepSrc(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version)
void(* RegisterTests)(void)