suricata
detect-iprep.c
Go to the documentation of this file.
1 /* Copyright (C) 2012-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Implements the iprep keyword
24  */
25 
26 #include "suricata-common.h"
27 #include "decode.h"
28 #include "detect.h"
29 #include "threads.h"
30 #include "flow.h"
31 #include "flow-bit.h"
32 #include "flow-util.h"
33 #include "detect-iprep.h"
34 #include "util-spm.h"
35 
36 #include "app-layer-parser.h"
37 
38 #include "detect-parse.h"
39 #include "detect-engine.h"
40 #include "detect-engine-mpm.h"
41 #include "detect-engine-state.h"
42 #include "detect-engine-uint.h"
43 #include "detect-engine-build.h"
44 
45 #include "util-debug.h"
46 #include "util-byte.h"
47 #include "util-unittest.h"
48 #include "util-unittest-helper.h"
49 #include "util-fmemopen.h"
50 #include "util-validate.h"
51 
52 #include "reputation.h"
53 #include "host.h"
54 
55 static int DetectIPRepMatch (DetectEngineThreadCtx *, Packet *,
56  const Signature *, const SigMatchCtx *);
57 static int DetectIPRepSetup (DetectEngineCtx *, Signature *, const char *);
58 void DetectIPRepFree (DetectEngineCtx *, void *);
59 #ifdef UNITTESTS
60 static void IPRepRegisterTests(void);
61 #endif
62 
63 void DetectIPRepRegister (void)
64 {
65  sigmatch_table[DETECT_IPREP].name = "iprep";
66  sigmatch_table[DETECT_IPREP].desc = "match on the IP reputation information for a host";
67  sigmatch_table[DETECT_IPREP].url = "/rules/ip-reputation-rules.html#iprep";
68  sigmatch_table[DETECT_IPREP].Match = DetectIPRepMatch;
69  sigmatch_table[DETECT_IPREP].Setup = DetectIPRepSetup;
70  sigmatch_table[DETECT_IPREP].Free = DetectIPRepFree;
71 #ifdef UNITTESTS
72  sigmatch_table[DETECT_IPREP].RegisterTests = IPRepRegisterTests;
73 #endif
74  /* this is compatible to ip-only signatures */
75  sigmatch_table[DETECT_IPREP].flags |= SIGMATCH_IPONLY_COMPAT | SIGMATCH_SUPPORT_FIREWALL;
76 }
77 
78 static inline int8_t GetRep(const SReputation *r, const uint8_t cat, const uint32_t version)
79 {
80  /* allow higher versions as this happens during
81  * rule reload */
82  if (r != NULL && r->version >= version) {
83  return r->rep[cat];
84  }
85  return -1;
86 }
87 
88 /** \returns: -2 no host, -1 no rep entry, 0-127 rep values */
89 static int8_t GetHostRepSrc(Packet *p, uint8_t cat, uint32_t version)
90 {
91  if (p->flags & PKT_HOST_SRC_LOOKED_UP && p->host_src == NULL) {
92  return -2;
93  } else if (p->host_src != NULL) {
94  Host *h = (Host *)p->host_src;
95  HostLock(h);
96  /* use_cnt: 1 for having iprep, 1 for packet ref */
97  DEBUG_VALIDATE_BUG_ON(h->iprep != NULL && SC_ATOMIC_GET(h->use_cnt) < 2);
98  int8_t val = GetRep(h->iprep, cat, version);
99  HostUnlock(h);
100  return val;
101  } else {
102  Host *h = HostLookupHostFromHash(&(p->src));
103  p->flags |= PKT_HOST_SRC_LOOKED_UP;
104  if (h == NULL)
105  return -2;
106  HostReference(&p->host_src, h);
107  /* use_cnt: 1 for having iprep, 1 for HostLookupHostFromHash,
108  * 1 for HostReference to packet */
109  DEBUG_VALIDATE_BUG_ON(h->iprep != NULL && SC_ATOMIC_GET(h->use_cnt) < 3);
110  int8_t val = GetRep(h->iprep, cat, version);
111  HostRelease(h); /* use_cnt >= 2: 1 for iprep, 1 for packet ref */
112  return val;
113  }
114 }
115 
116 static int8_t GetHostRepDst(Packet *p, uint8_t cat, uint32_t version)
117 {
118  if (p->flags & PKT_HOST_DST_LOOKED_UP && p->host_dst == NULL) {
119  return -2;
120  } else if (p->host_dst != NULL) {
121  Host *h = (Host *)p->host_dst;
122  HostLock(h);
123  /* use_cnt: 1 for having iprep, 1 for packet ref */
124  DEBUG_VALIDATE_BUG_ON(h->iprep != NULL && SC_ATOMIC_GET(h->use_cnt) < 2);
125  int8_t val = GetRep(h->iprep, cat, version);
126  HostUnlock(h);
127  return val;
128  } else {
129  Host *h = HostLookupHostFromHash(&(p->dst));
130  p->flags |= PKT_HOST_DST_LOOKED_UP;
131  if (h == NULL)
132  return -2;
133  HostReference(&p->host_dst, h);
134  /* use_cnt: 1 for having iprep, 1 for HostLookupHostFromHash,
135  * 1 for HostReference to packet */
136  DEBUG_VALIDATE_BUG_ON(h->iprep != NULL && SC_ATOMIC_GET(h->use_cnt) < 3);
137  int8_t val = GetRep(h->iprep, cat, version);
138  HostRelease(h); /* use_cnt >= 2: 1 for iprep, 1 for packet ref */
139  return val;
140  }
141 }
142 
143 /*
144  * returns 0: no match
145  * 1: match
146  * -1: error
147  */
148 static int DetectIPRepMatch (DetectEngineThreadCtx *det_ctx, Packet *p,
149  const Signature *s, const SigMatchCtx *ctx)
150 {
151  const DetectIPRepData *rd = (const DetectIPRepData *)ctx;
152  if (rd == NULL)
153  return 0;
154 
155  uint32_t version = det_ctx->de_ctx->srep_version;
156  int8_t val = 0;
157 
158  SCLogDebug("rd->cmd %u", rd->cmd);
159  switch (rd->cmd) {
160  case IPRepCmdAny:
161  if (!rd->isnotset) {
162  val = GetHostRepSrc(p, rd->cat, version);
163  if (val < 0)
164  val = SRepCIDRGetIPRepSrc(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version);
165  if (val >= 0) {
166  if (DetectU8Match((uint8_t)val, &rd->du8))
167  return 1;
168  }
169  val = GetHostRepDst(p, rd->cat, version);
170  if (val < 0)
171  val = SRepCIDRGetIPRepDst(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version);
172  if (val >= 0) {
173  return DetectU8Match((uint8_t)val, &rd->du8);
174  }
175  } else {
176  /* isnotset for any */
177 
178  val = GetHostRepSrc(p, rd->cat, version);
179  if (val < 0)
180  val = SRepCIDRGetIPRepSrc(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version);
181  if (val < 0) {
182  return 1;
183  }
184  val = GetHostRepDst(p, rd->cat, version);
185  if (val < 0)
186  val = SRepCIDRGetIPRepDst(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version);
187  if (val < 0) {
188  return 1;
189  }
190  /* both have a value, so none 'isnotset' */
191  return 0;
192  }
193  break;
194 
195  case IPRepCmdSrc:
196  val = GetHostRepSrc(p, rd->cat, version);
197  SCLogDebug("checking src -- val %d (looking for cat %u, val %u)", val, rd->cat,
198  rd->du8.arg1);
199  if (val < 0)
200  val = SRepCIDRGetIPRepSrc(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version);
201  if (val >= 0) {
202  return DetectU8Match((uint8_t)val, &rd->du8);
203  }
204  /* implied: no value found */
205  if (rd->isnotset) {
206  return 1;
207  }
208  break;
209 
210  case IPRepCmdDst:
211  SCLogDebug("checking dst");
212  val = GetHostRepDst(p, rd->cat, version);
213  if (val < 0)
214  val = SRepCIDRGetIPRepDst(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version);
215  if (val >= 0) {
216  return DetectU8Match((uint8_t)val, &rd->du8);
217  }
218  /* implied: no value found */
219  if (rd->isnotset) {
220  return 1;
221  }
222  break;
223 
224  case IPRepCmdBoth:
225  if (!rd->isnotset) {
226  val = GetHostRepSrc(p, rd->cat, version);
227  if (val < 0)
228  val = SRepCIDRGetIPRepSrc(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version);
229  if (val < 0 || DetectU8Match((uint8_t)val, &rd->du8) == 0)
230  return 0;
231  val = GetHostRepDst(p, rd->cat, version);
232  if (val < 0)
233  val = SRepCIDRGetIPRepDst(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version);
234  if (val >= 0) {
235  return DetectU8Match((uint8_t)val, &rd->du8);
236  }
237  } else {
238  val = GetHostRepSrc(p, rd->cat, version);
239  if (val >= 0)
240  return 0;
241  val = SRepCIDRGetIPRepSrc(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version);
242  if (val >= 0)
243  return 0;
244  val = GetHostRepDst(p, rd->cat, version);
245  if (val >= 0)
246  return 0;
247  val = SRepCIDRGetIPRepDst(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version);
248  if (val >= 0)
249  return 0;
250  return 1;
251  }
252  break;
253  }
254 
255  return 0;
256 }
257 
258 int DetectIPRepSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
259 {
260  DetectIPRepData *cd = SCDetectIPRepParse(rawstr);
261  if (cd == NULL) {
262  SCLogError("\"%s\" is not a valid setting for iprep", rawstr);
263  goto error;
264  }
265 
266  SCLogDebug("cmd %u, cat %u, op %u, val %u", cd->cmd, cd->cat, cd->du8.mode, cd->du8.arg1);
267 
268  /* Okay so far so good, lets get this into a SigMatch
269  * and put it in the Signature. */
270 
271  if (SCSigMatchAppendSMToList(
272  de_ctx, s, DETECT_IPREP, (SigMatchCtx *)cd, DETECT_SM_LIST_MATCH) == NULL) {
273  goto error;
274  }
275 
276  return 0;
277 
278 error:
279  if (cd != NULL)
280  DetectIPRepFree(de_ctx, cd);
281  return -1;
282 }
283 
284 void DetectIPRepFree (DetectEngineCtx *de_ctx, void *ptr)
285 {
286  DetectIPRepData *fd = (DetectIPRepData *)ptr;
287  if (fd == NULL)
288  return;
289 
290  SCDetectIPRepFree(fd);
291 }
292 
293 #ifdef UNITTESTS
294 #include "packet.h"
295 #include "action-globals.h"
296 
297 static FILE *DetectIPRepGenerateCategoriesDummy(void)
298 {
299  FILE *fd = NULL;
300  const char *buffer = "1,BadHosts,Know bad hosts";
301 
302  fd = SCFmemopen((void *)buffer, strlen(buffer), "r");
303  if (fd == NULL)
304  SCLogDebug("Error with SCFmemopen()");
305 
306  return fd;
307 }
308 
309 static FILE *DetectIPRepGenerateCategoriesDummy2(void)
310 {
311  FILE *fd = NULL;
312  const char *buffer =
313  "1,BadHosts,Know bad hosts\n"
314  "2,GoodHosts,Know good hosts\n";
315 
316  fd = SCFmemopen((void *)buffer, strlen(buffer), "r");
317  if (fd == NULL)
318  SCLogDebug("Error with SCFmemopen()");
319 
320  return fd;
321 }
322 
323 static FILE *DetectIPRepGenerateNetworksDummy(void)
324 {
325  FILE *fd = NULL;
326  const char *buffer = "10.0.0.0/24,1,20";
327 
328  fd = SCFmemopen((void *)buffer, strlen(buffer), "r");
329  if (fd == NULL)
330  SCLogDebug("Error with SCFmemopen()");
331 
332  return fd;
333 }
334 
335 static FILE *DetectIPRepGenerateNetworksDummy2(void)
336 {
337  FILE *fd = NULL;
338  const char *buffer =
339  "0.0.0.0/0,1,10\n"
340  "192.168.0.0/16,2,127";
341 
342  fd = SCFmemopen((void *)buffer, strlen(buffer), "r");
343  if (fd == NULL)
344  SCLogDebug("Error with SCFmemopen()");
345 
346  return fd;
347 }
348 
349 static int DetectIPRepTest01(void)
350 {
351  ThreadVars th_v;
352  DetectEngineThreadCtx *det_ctx = NULL;
353  Signature *sig = NULL;
354  FILE *fd = NULL;
355  int r = 0;
356  Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP);
357  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
358 
359  HostInitConfig(HOST_QUIET);
360  memset(&th_v, 0, sizeof(th_v));
361  StatsThreadInit(&th_v.stats);
362 
363  FAIL_IF_NULL(de_ctx);
364  FAIL_IF_NULL(p);
365 
366  p->src.addr_data32[0] = UTHSetIPv4Address("10.0.0.1");
367  de_ctx->flags |= DE_QUIET;
368  SRepResetVersion();
369 
370  fd = DetectIPRepGenerateCategoriesDummy();
371  r = SRepLoadCatFileFromFD(fd);
372  FAIL_IF(r < 0);
373 
374  fd = DetectIPRepGenerateNetworksDummy();
375  r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd);
376  FAIL_IF(r < 0);
377 
378  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value "
379  "badhost\"; iprep:any,BadHosts,>,1; sid:1;rev:1;)");
380  FAIL_IF_NULL(sig);
381 
382  SigGroupBuild(de_ctx);
383  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
384 
385  p->alerts.cnt = 0;
386  p->action = 0;
387  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
388 
389  FAIL_IF(p->alerts.cnt != 1);
390  FAIL_IF(PacketTestAction(p, ACTION_DROP));
391 
392  UTHFreePacket(p);
393 
394  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
395  DetectEngineCtxFree(de_ctx);
396  HostShutdown();
397  StatsThreadCleanup(&th_v.stats);
398  PASS;
399 }
400 
401 static int DetectIPRepTest02(void)
402 {
403  ThreadVars th_v;
404  DetectEngineThreadCtx *det_ctx = NULL;
405  Signature *sig = NULL;
406  FILE *fd = NULL;
407  int r = 0;
408  Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP);
409  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
410 
411  HostInitConfig(HOST_QUIET);
412  memset(&th_v, 0, sizeof(th_v));
413  StatsThreadInit(&th_v.stats);
414 
415  FAIL_IF_NULL(de_ctx);
416  FAIL_IF_NULL(p);
417 
418  p->src.addr_data32[0] = UTHSetIPv4Address("10.0.0.1");
419  de_ctx->flags |= DE_QUIET;
420  SRepResetVersion();
421 
422  fd = DetectIPRepGenerateCategoriesDummy();
423  r = SRepLoadCatFileFromFD(fd);
424  FAIL_IF(r < 0);
425 
426  fd = DetectIPRepGenerateNetworksDummy();
427  r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd);
428  FAIL_IF(r < 0);
429 
430  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value "
431  "badhost\"; iprep:src,BadHosts,>,1; sid:1; rev:1;)");
432  FAIL_IF_NULL(sig);
433 
434  SigGroupBuild(de_ctx);
435  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
436 
437  p->alerts.cnt = 0;
438  p->action = 0;
439  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
440  FAIL_IF(p->alerts.cnt != 1);
441  FAIL_IF(PacketTestAction(p, ACTION_DROP));
442 
443  UTHFreePacket(p);
444 
445  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
446  DetectEngineCtxFree(de_ctx);
447 
448  HostShutdown();
449  StatsThreadCleanup(&th_v.stats);
450  PASS;
451 }
452 
453 static int DetectIPRepTest03(void)
454 {
455  ThreadVars th_v;
456  DetectEngineThreadCtx *det_ctx = NULL;
457  Signature *sig = NULL;
458  FILE *fd = NULL;
459  int r = 0;
460  Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP);
461  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
462 
463  HostInitConfig(HOST_QUIET);
464  memset(&th_v, 0, sizeof(th_v));
465  StatsThreadInit(&th_v.stats);
466 
467  FAIL_IF_NULL(de_ctx);
468  FAIL_IF_NULL(p);
469 
470  p->dst.addr_data32[0] = UTHSetIPv4Address("10.0.0.2");
471  de_ctx->flags |= DE_QUIET;
472  SRepResetVersion();
473 
474  fd = DetectIPRepGenerateCategoriesDummy();
475  r = SRepLoadCatFileFromFD(fd);
476  FAIL_IF(r < 0);
477 
478  fd = DetectIPRepGenerateNetworksDummy();
479  r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd);
480  FAIL_IF(r < 0);
481 
482  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value "
483  "badhost\"; iprep:dst,BadHosts,>,1; sid:1; rev:1;)");
484  FAIL_IF_NULL(sig);
485 
486  SigGroupBuild(de_ctx);
487  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
488 
489  p->alerts.cnt = 0;
490  p->action = 0;
491  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
492  FAIL_IF(p->alerts.cnt != 1);
493  FAIL_IF(PacketTestAction(p, ACTION_DROP));
494 
495  UTHFreePacket(p);
496 
497  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
498  DetectEngineCtxFree(de_ctx);
499 
500  HostShutdown();
501  StatsThreadCleanup(&th_v.stats);
502  PASS;
503 }
504 
505 static int DetectIPRepTest04(void)
506 {
507  ThreadVars th_v;
508  DetectEngineThreadCtx *det_ctx = NULL;
509  Signature *sig = NULL;
510  FILE *fd = NULL;
511  int r = 0;
512  Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP);
513  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
514 
515  HostInitConfig(HOST_QUIET);
516  memset(&th_v, 0, sizeof(th_v));
517  StatsThreadInit(&th_v.stats);
518 
519  FAIL_IF_NULL(de_ctx);
520  FAIL_IF_NULL(p);
521 
522  p->src.addr_data32[0] = UTHSetIPv4Address("10.0.0.1");
523  p->dst.addr_data32[0] = UTHSetIPv4Address("10.0.0.2");
524  de_ctx->flags |= DE_QUIET;
525  SRepResetVersion();
526 
527  fd = DetectIPRepGenerateCategoriesDummy();
528  r = SRepLoadCatFileFromFD(fd);
529  FAIL_IF(r < 0);
530 
531  fd = DetectIPRepGenerateNetworksDummy();
532  r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd);
533  FAIL_IF(r < 0);
534 
535  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value "
536  "badhost\"; iprep:both,BadHosts,>,1; sid:1; rev:1;)");
537  FAIL_IF_NULL(sig);
538 
539  SigGroupBuild(de_ctx);
540  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
541 
542  p->alerts.cnt = 0;
543  p->action = 0;
544  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
545  FAIL_IF(p->alerts.cnt != 1);
546  FAIL_IF(PacketTestAction(p, ACTION_DROP));
547 
548  UTHFreePacket(p);
549 
550  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
551  DetectEngineCtxFree(de_ctx);
552 
553  HostShutdown();
554  StatsThreadCleanup(&th_v.stats);
555  PASS;
556 }
557 
558 static int DetectIPRepTest05(void)
559 {
560  ThreadVars th_v;
561  DetectEngineThreadCtx *det_ctx = NULL;
562  Signature *sig = NULL;
563  FILE *fd = NULL;
564  int r = 0;
565  Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP);
566  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
567 
568  HostInitConfig(HOST_QUIET);
569  memset(&th_v, 0, sizeof(th_v));
570  StatsThreadInit(&th_v.stats);
571 
572  FAIL_IF_NULL(de_ctx);
573  FAIL_IF_NULL(p);
574 
575  p->src.addr_data32[0] = UTHSetIPv4Address("1.0.0.1");
576  de_ctx->flags |= DE_QUIET;
577  SRepResetVersion();
578 
579  fd = DetectIPRepGenerateCategoriesDummy();
580  r = SRepLoadCatFileFromFD(fd);
581  FAIL_IF(r < 0);
582 
583  fd = DetectIPRepGenerateNetworksDummy();
584  r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd);
585  FAIL_IF(r < 0);
586 
587  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value "
588  "badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)");
589  FAIL_IF_NULL(sig);
590 
591  SigGroupBuild(de_ctx);
592  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
593 
594  p->alerts.cnt = 0;
595  p->action = 0;
596  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
597  FAIL_IF(p->alerts.cnt != 0);
598  FAIL_IF(PacketTestAction(p, ACTION_DROP));
599 
600  UTHFreePacket(p);
601 
602  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
603  DetectEngineCtxFree(de_ctx);
604 
605  HostShutdown();
606  StatsThreadCleanup(&th_v.stats);
607  PASS;
608 }
609 
610 static int DetectIPRepTest06(void)
611 {
612  ThreadVars th_v;
613  DetectEngineThreadCtx *det_ctx = NULL;
614  Signature *sig = NULL;
615  FILE *fd = NULL;
616  int r = 0;
617  Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP);
618  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
619 
620  HostInitConfig(HOST_QUIET);
621  memset(&th_v, 0, sizeof(th_v));
622  StatsThreadInit(&th_v.stats);
623 
624  FAIL_IF_NULL(de_ctx);
625  FAIL_IF_NULL(p);
626 
627  p->src.addr_data32[0] = UTHSetIPv4Address("1.0.0.1");
628  de_ctx->flags |= DE_QUIET;
629  SRepResetVersion();
630 
631  fd = DetectIPRepGenerateCategoriesDummy();
632  r = SRepLoadCatFileFromFD(fd);
633  FAIL_IF(r < 0);
634 
635  fd = DetectIPRepGenerateNetworksDummy2();
636  r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd);
637  FAIL_IF(r < 0);
638 
639  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value "
640  "badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)");
641  FAIL_IF_NULL(sig);
642 
643  SigGroupBuild(de_ctx);
644  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
645 
646  p->alerts.cnt = 0;
647  p->action = 0;
648  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
649  FAIL_IF(p->alerts.cnt != 1);
650  FAIL_IF(PacketTestAction(p, ACTION_DROP));
651 
652  UTHFreePacket(p);
653 
654  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
655  DetectEngineCtxFree(de_ctx);
656 
657  HostShutdown();
658  StatsThreadCleanup(&th_v.stats);
659  PASS;
660 }
661 
662 static int DetectIPRepTest07(void)
663 {
664  ThreadVars th_v;
665  DetectEngineThreadCtx *det_ctx = NULL;
666  Signature *sig = NULL;
667  FILE *fd = NULL;
668  int r = 0;
669  Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP);
670  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
671 
672  HostInitConfig(HOST_QUIET);
673  memset(&th_v, 0, sizeof(th_v));
674  StatsThreadInit(&th_v.stats);
675 
676  FAIL_IF_NULL(de_ctx);
677  FAIL_IF_NULL(p);
678 
679  p->dst.addr_data32[0] = UTHSetIPv4Address("1.0.0.2");
680  de_ctx->flags |= DE_QUIET;
681  SRepResetVersion();
682 
683  fd = DetectIPRepGenerateCategoriesDummy();
684  r = SRepLoadCatFileFromFD(fd);
685  FAIL_IF(r < 0);
686 
687  fd = DetectIPRepGenerateNetworksDummy2();
688  r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd);
689  FAIL_IF(r < 0);
690 
691  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value "
692  "badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)");
693  FAIL_IF_NULL(sig);
694 
695  SigGroupBuild(de_ctx);
696  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
697 
698  p->alerts.cnt = 0;
699  p->action = 0;
700  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
701  FAIL_IF(p->alerts.cnt != 1);
702  FAIL_IF(PacketTestAction(p, ACTION_DROP));
703 
704  UTHFreePacket(p);
705 
706  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
707  DetectEngineCtxFree(de_ctx);
708 
709  HostShutdown();
710  StatsThreadCleanup(&th_v.stats);
711  PASS;
712 }
713 
714 static int DetectIPRepTest08(void)
715 {
716  ThreadVars th_v;
717  DetectEngineThreadCtx *det_ctx = NULL;
718  Signature *sig = NULL;
719  FILE *fd = NULL;
720  int r = 0;
721  Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP);
722  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
723 
724  HostInitConfig(HOST_QUIET);
725  memset(&th_v, 0, sizeof(th_v));
726  StatsThreadInit(&th_v.stats);
727 
728  FAIL_IF_NULL(de_ctx);
729  FAIL_IF_NULL(p);
730 
731  p->src.addr_data32[0] = UTHSetIPv4Address("1.0.0.1");
732  p->dst.addr_data32[0] = UTHSetIPv4Address("1.0.0.2");
733  de_ctx->flags |= DE_QUIET;
734  SRepResetVersion();
735 
736  fd = DetectIPRepGenerateCategoriesDummy();
737  r = SRepLoadCatFileFromFD(fd);
738  FAIL_IF(r < 0);
739 
740  fd = DetectIPRepGenerateNetworksDummy();
741  r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd);
742  FAIL_IF(r < 0);
743 
744  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value "
745  "badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)");
746  FAIL_IF_NULL(sig);
747 
748  SigGroupBuild(de_ctx);
749  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
750 
751  p->alerts.cnt = 0;
752  p->action = 0;
753  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
754  FAIL_IF(p->alerts.cnt != 0);
755  FAIL_IF(PacketTestAction(p, ACTION_DROP));
756 
757  UTHFreePacket(p);
758 
759  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
760  DetectEngineCtxFree(de_ctx);
761 
762  HostShutdown();
763  StatsThreadCleanup(&th_v.stats);
764  PASS;
765 }
766 
767 static int DetectIPRepTest09(void)
768 {
769  ThreadVars th_v;
770  DetectEngineThreadCtx *det_ctx = NULL;
771  Signature *sig = NULL;
772  FILE *fd = NULL;
773  int r = 0;
774  Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP);
775  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
776 
777  HostInitConfig(HOST_QUIET);
778  memset(&th_v, 0, sizeof(th_v));
779  StatsThreadInit(&th_v.stats);
780 
781  FAIL_IF_NULL(de_ctx);
782  FAIL_IF_NULL(p);
783 
784  p->src.addr_data32[0] = UTHSetIPv4Address("192.168.0.1");
785  p->dst.addr_data32[0] = UTHSetIPv4Address("192.168.0.2");
786  de_ctx->flags |= DE_QUIET;
787  SRepResetVersion();
788 
789  fd = DetectIPRepGenerateCategoriesDummy2();
790  r = SRepLoadCatFileFromFD(fd);
791  FAIL_IF(r < 0);
792 
793  fd = DetectIPRepGenerateNetworksDummy2();
794  r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd);
795  FAIL_IF(r < 0);
796 
797  sig = DetectEngineAppendSig(de_ctx,
798  "alert tcp any any -> any any (msg:\"test\"; iprep:src,BadHosts,>,9; sid:1; rev:1;)");
799  FAIL_IF_NULL(sig);
800 
801  SigGroupBuild(de_ctx);
802  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
803 
804  p->alerts.cnt = 0;
805  p->action = 0;
806  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
807  FAIL_IF(p->alerts.cnt != 1);
808  FAIL_IF(PacketTestAction(p, ACTION_DROP));
809 
810  UTHFreePacket(p);
811 
812  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
813  DetectEngineCtxFree(de_ctx);
814 
815  HostShutdown();
816  StatsThreadCleanup(&th_v.stats);
817  PASS;
818 }
819 
820 static FILE *DetectIPRepGenerateNetworksDummy3(void)
821 {
822  FILE *fd = NULL;
823  const char *buffer = "192.168.0.0/16,1,127"; // BadHosts
824 
825  fd = SCFmemopen((void *)buffer, strlen(buffer), "r");
826  if (fd == NULL)
827  SCLogDebug("Error with SCFmemopen()");
828 
829  return fd;
830 }
831 
832 static int DetectIPRepTest10(void)
833 {
834  ThreadVars th_v;
835  DetectEngineThreadCtx *det_ctx = NULL;
836  Signature *sig = NULL;
837  FILE *fd = NULL;
838  int r = 0;
839  Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP);
840  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
841 
842  HostInitConfig(HOST_QUIET);
843  memset(&th_v, 0, sizeof(th_v));
844  StatsThreadInit(&th_v.stats);
845 
846  FAIL_IF_NULL(de_ctx);
847  FAIL_IF_NULL(p);
848 
849  p->src.addr_data32[0] = UTHSetIPv4Address("192.168.0.1");
850  p->dst.addr_data32[0] = UTHSetIPv4Address("192.168.0.2");
851  de_ctx->flags |= DE_QUIET;
852  SRepResetVersion();
853 
854  fd = DetectIPRepGenerateCategoriesDummy2();
855  r = SRepLoadCatFileFromFD(fd);
856  FAIL_IF(r < 0);
857 
858  fd = DetectIPRepGenerateNetworksDummy3();
859  r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd);
860  FAIL_IF(r < 0);
861 
862  sig = DetectEngineAppendSig(de_ctx,
863  "alert tcp any any -> any any (msg:\"test\"; iprep:src,BadHosts,isset; sid:1; rev:1;)");
864  FAIL_IF_NULL(sig);
865 
866  SigGroupBuild(de_ctx);
867  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
868 
869  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
870  FAIL_IF_NOT(p->alerts.cnt == 1);
871 
872  UTHFreePacket(p);
873 
874  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
875  DetectEngineCtxFree(de_ctx);
876 
877  HostShutdown();
878  StatsThreadCleanup(&th_v.stats);
879  PASS;
880 }
881 
882 static int DetectIPRepTest11(void)
883 {
884  ThreadVars th_v;
885  DetectEngineThreadCtx *det_ctx = NULL;
886  Signature *sig = NULL;
887  FILE *fd = NULL;
888  int r = 0;
889  Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP);
890  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
891 
892  HostInitConfig(HOST_QUIET);
893  memset(&th_v, 0, sizeof(th_v));
894  StatsThreadInit(&th_v.stats);
895 
896  FAIL_IF_NULL(de_ctx);
897  FAIL_IF_NULL(p);
898 
899  p->src.addr_data32[0] = UTHSetIPv4Address("10.0.0.1");
900  p->dst.addr_data32[0] = UTHSetIPv4Address("10.0.0.2");
901  de_ctx->flags |= DE_QUIET;
902  SRepResetVersion();
903 
904  fd = DetectIPRepGenerateCategoriesDummy2();
905  r = SRepLoadCatFileFromFD(fd);
906  FAIL_IF(r < 0);
907 
908  fd = DetectIPRepGenerateNetworksDummy3();
909  r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd);
910  FAIL_IF(r < 0);
911 
912  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"test\"; "
913  "iprep:src,BadHosts,isnotset; sid:1; rev:1;)");
914  FAIL_IF_NULL(sig);
915 
916  SigGroupBuild(de_ctx);
917  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
918 
919  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
920  FAIL_IF_NOT(p->alerts.cnt == 1);
921 
922  UTHFreePacket(p);
923 
924  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
925  DetectEngineCtxFree(de_ctx);
926 
927  HostShutdown();
928  StatsThreadCleanup(&th_v.stats);
929  PASS;
930 }
931 
932 /**
933  * \brief this function registers unit tests for IPRep
934  */
935 void IPRepRegisterTests(void)
936 {
937  UtRegisterTest("DetectIPRepTest01", DetectIPRepTest01);
938  UtRegisterTest("DetectIPRepTest02", DetectIPRepTest02);
939  UtRegisterTest("DetectIPRepTest03", DetectIPRepTest03);
940  UtRegisterTest("DetectIPRepTest04", DetectIPRepTest04);
941  UtRegisterTest("DetectIPRepTest05", DetectIPRepTest05);
942  UtRegisterTest("DetectIPRepTest06", DetectIPRepTest06);
943  UtRegisterTest("DetectIPRepTest07", DetectIPRepTest07);
944  UtRegisterTest("DetectIPRepTest08", DetectIPRepTest08);
945  UtRegisterTest("DetectIPRepTest09", DetectIPRepTest09);
946  UtRegisterTest("DetectIPRepTest10 -- isset", DetectIPRepTest10);
947  UtRegisterTest("DetectIPRepTest11 -- isnotset", DetectIPRepTest11);
948 }
949 #endif /* UNITTESTS */
util-byte.h
detect-engine-uint.h
host.h
SigTableElmt_::url
const char * url
Definition: detect.h:1512
HostUnlock
void HostUnlock(Host *h)
Definition: host.c:472
SReputation_
Definition: reputation.h:45
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
PKT_HOST_DST_LOOKED_UP
#define PKT_HOST_DST_LOOKED_UP
Definition: decode.h:1325
SigTableElmt_::desc
const char * desc
Definition: detect.h:1511
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
util-fmemopen.h
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1496
SReputation_::rep
uint8_t rep[SREP_MAX_CATS]
Definition: reputation.h:47
flow-util.h
SigTableElmt_::name
const char * name
Definition: detect.h:1509
Packet_::host_src
struct Host_ * host_src
Definition: decode.h:637
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
SigTableElmt_::flags
uint32_t flags
Definition: detect.h:1500
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:282
PacketAlerts_::cnt
uint16_t cnt
Definition: decode.h:288
action-globals.h
Packet_::flags
uint32_t flags
Definition: decode.h:560
Packet_::action
uint8_t action
Definition: decode.h:622
threads.h
HostRelease
void HostRelease(Host *h)
Definition: host.c:461
UTHSetIPv4Address
uint32_t UTHSetIPv4Address(const char *str)
return the uint32_t for a ipv4 address string
Definition: util-unittest-helper.c:275
ctx
struct Thresholds ctx
th_v
ThreadVars * th_v
Definition: fuzz_iprep.c:20
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:973
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2715
flow-bit.h
DetectEngineCtx_::srep_version
uint32_t srep_version
Definition: detect.h:986
DE_QUIET
#define DE_QUIET
Definition: detect.h:330
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:243
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:2971
p
Packet * p
Definition: fuzz_iprep.c:21
SCFmemopen
#define SCFmemopen
Definition: util-fmemopen.h:52
Packet_::host_dst
struct Host_ * host_dst
Definition: decode.h:638
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3580
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1491
Packet_::alerts
PacketAlerts alerts
Definition: decode.h:635
util-unittest.h
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:22
detect-iprep.h
DetectEngineThreadCtx_
Definition: detect.h:1291
DetectEngineCtx_::srepCIDR_ctx
SRepCIDRTree * srepCIDR_ctx
Definition: detect.h:989
SRepLoadCatFileFromFD
int SRepLoadCatFileFromFD(FILE *fp)
Definition: reputation.c:368
PKT_HOST_SRC_LOOKED_UP
#define PKT_HOST_SRC_LOOKED_UP
Definition: decode.h:1324
detect-engine-mpm.h
SCSigMatchAppendSMToList
SigMatch * SCSigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:387
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3461
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:117
app-layer-parser.h
HostLock
void HostLock(Host *h)
Definition: host.c:467
Packet_
Definition: decode.h:514
SIGMATCH_IPONLY_COMPAT
#define SIGMATCH_IPONLY_COMPAT
Definition: detect-engine-register.h:308
detect-engine-build.h
HostReference
#define HostReference(dst_h_ptr, h)
Definition: host.h:117
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1471
reputation.h
SRepLoadFileFromFD
int SRepLoadFileFromFD(SRepCIDRTree *cidr_ctx, FILE *fp)
Definition: reputation.c:424
DetectIPRepFree
void DetectIPRepFree(DetectEngineCtx *, void *)
Definition: detect-iprep.c:284
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:2286
StatsThreadInit
void StatsThreadInit(StatsThreadContext *stats)
Definition: counters.c:1333
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:351
Host_::iprep
void * iprep
Definition: host.h:69
DetectU8Match
int DetectU8Match(const uint8_t parg, const DetectUintData_u8 *du8)
Definition: detect-engine-uint.c:71
SRepCIDRGetIPRepSrc
int8_t SRepCIDRGetIPRepSrc(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version)
Definition: reputation.c:135
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
suricata-common.h
packet.h
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3706
util-spm.h
HOST_QUIET
#define HOST_QUIET
Definition: host.h:93
version
uint8_t version
Definition: decode-gre.h:1
HostShutdown
void HostShutdown(void)
shutdown the flow engine
Definition: host.c:296
SReputation_::version
uint32_t version
Definition: reputation.h:46
util-validate.h
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:274
UTHFreePacket
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:472
SRepCIDRGetIPRepDst
int8_t SRepCIDRGetIPRepDst(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version)
Definition: reputation.c:147
detect-parse.h
Signature_
Signature container.
Definition: detect.h:675
SRepResetVersion
void SRepResetVersion(void)
Definition: reputation.c:64
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2676
HostLookupHostFromHash
Host * HostLookupHostFromHash(Address *a)
look up a host in the hash
Definition: host.c:585
SIGMATCH_SUPPORT_FIREWALL
#define SIGMATCH_SUPPORT_FIREWALL
Definition: detect-engine-register.h:334
DetectEngineThreadCtx_::de_ctx
DetectEngineCtx * de_ctx
Definition: detect.h:1414
Packet_::dst
Address dst
Definition: decode.h:519
HostInitConfig
void HostInitConfig(bool quiet)
initialize the configuration
Definition: host.c:168
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:975
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:375
flow.h
DetectIPRepRegister
void DetectIPRepRegister(void)
Definition: detect-iprep.c:63
Host_
Definition: host.h:58
ThreadVars_::stats
StatsThreadContext stats
Definition: threadvars.h:121
StatsThreadCleanup
void StatsThreadCleanup(StatsThreadContext *stats)
Definition: counters.c:1429
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:109
Packet_::src
Address src
Definition: decode.h:518
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1498
DETECT_IPREP
@ DETECT_IPREP
Definition: detect-engine-register.h:230