42 static void DetectTransformFromBase64DecodeFree(
DetectEngineCtx *,
void *);
44 static void DetectTransformFromBase64DecodeRegisterTests(
void);
46 static void TransformFromBase64Decode(
InspectionBuffer *buffer,
void *options);
48 #define DETECT_TRANSFORM_FROM_BASE64_MODE_DEFAULT (uint8_t) Base64ModeRFC4648
60 DetectTransformFromBase64DecodeRegisterTests;
67 SCTransformBase64Free(ptr);
70 static SCDetectTransformFromBase64Data *DetectTransformFromBase64DecodeParse(
const char *
str)
72 SCDetectTransformFromBase64Data *tbd = SCTransformBase64Parse(
str);
88 static int DetectTransformFromBase64DecodeSetup(
95 SCDetectTransformFromBase64Data *b64d = DetectTransformFromBase64DecodeParse(opts_str);
99 if (b64d->flags & DETECT_TRANSFORM_BASE64_FLAG_OFFSET_VAR) {
100 SCLogError(
"offset value must be a value, not a variable name");
104 if (b64d->flags & DETECT_TRANSFORM_BASE64_FLAG_NBYTES_VAR) {
105 SCLogError(
"byte value must be a value, not a variable name");
113 DetectTransformFromBase64DecodeFree(
de_ctx, b64d);
117 static void TransformFromBase64Decode(
InspectionBuffer *buffer,
void *options)
119 SCDetectTransformFromBase64Data *b64d = options;
120 const uint8_t *input = buffer->
inspect;
127 uint8_t output[input_len];
128 uint32_t decode_length = input_len;
130 DetectBase64Mode mode = b64d->mode;
131 uint32_t
offset = b64d->offset;
132 uint32_t nbytes = b64d->nbytes;
144 if (nbytes > decode_length) {
145 SCLogDebug(
"byte count %d plus offset %d exceeds length %d; returning", nbytes,
offset,
149 decode_length = nbytes;
153 uint32_t decoded_length = 0;
154 uint32_t consumed = 0;
156 DecodeBase64(output, input_len, input, decode_length, &consumed, &decoded_length, mode);
159 if (decoded_length) {
167 static int DetectTransformFromBase64DecodeTest01(
void)
169 const uint8_t *input = (
const uint8_t *)
"VGhpcyBpcyBTdXJpY2F0YQ==";
170 uint32_t input_len = strlen((
char *)input);
171 const char *result =
"This is Suricata";
172 uint32_t result_len = strlen((
char *)result);
173 SCDetectTransformFromBase64Data b64d = {
182 TransformFromBase64Decode(&buffer, &b64d);
191 static int DetectTransformFromBase64DecodeTest01a(
void)
193 const uint8_t *input = (
const uint8_t *)
"Zm 9v Ym Fy";
194 uint32_t input_len = strlen((
char *)input);
195 const char *result =
"foobar";
196 uint32_t result_len = strlen((
char *)result);
197 SCDetectTransformFromBase64Data b64d = { .nbytes = input_len, .mode = Base64ModeRFC2045 };
203 TransformFromBase64Decode(&buffer, &b64d);
212 static int DetectTransformFromBase64DecodeTest02(
void)
214 const uint8_t *input = (
const uint8_t *)
"This is Suricata\n";
215 uint32_t input_len = strlen((
char *)input);
216 SCDetectTransformFromBase64Data b64d = {
223 buffer_orig = buffer;
225 TransformFromBase64Decode(&buffer, &b64d);
234 static int DetectTransformFromBase64DecodeTest03(
void)
236 const uint8_t *input = (
const uint8_t *)
"VGhpcyBpcyBTdXJpY2F0YQ==";
237 uint32_t input_len = strlen((
char *)input);
239 SCDetectTransformFromBase64Data b64d = {
240 .nbytes = input_len + 1,
247 TransformFromBase64Decode(&buffer, &b64d);
248 FAIL_IF_NOT(strncmp((
const char *)input, (
const char *)buffer.
inspect, input_len) == 0);
255 static int DetectTransformFromBase64DecodeTest04(
void)
257 const uint8_t *input = (
const uint8_t *)
"VGhpcyBpcyBTdXJpY2F0YQ==";
258 uint32_t input_len = strlen((
char *)input);
260 SCDetectTransformFromBase64Data b64d = {
261 .offset = input_len + 1,
268 TransformFromBase64Decode(&buffer, &b64d);
269 FAIL_IF_NOT(strncmp((
const char *)input, (
const char *)buffer.
inspect, input_len) == 0);
276 static int DetectTransformFromBase64DecodeTest05(
void)
278 const uint8_t *input = (
const uint8_t *)
"VGhpcyBpcyBTdXJpY2F0YQ==";
279 uint32_t input_len = strlen((
char *)input);
280 const char *result =
"This is S";
281 uint32_t result_len = strlen((
char *)result);
283 SCDetectTransformFromBase64Data b64d = {
292 TransformFromBase64Decode(&buffer, &b64d);
301 static int DetectTransformFromBase64DecodeTest06(
void)
303 const uint8_t *input = (
const uint8_t *)
"VGhpcyBpcyBTdXJpY2F0YQ==";
304 uint32_t input_len = strlen((
char *)input);
305 const char *result =
"s is Suricata";
306 uint32_t result_len = strlen((
char *)result);
308 SCDetectTransformFromBase64Data b64d = {
317 TransformFromBase64Decode(&buffer, &b64d);
326 static int DetectTransformFromBase64DecodeTest07(
void)
329 const uint8_t *input = (
const uint8_t *)
"SGVs bG8 gV29y bGQ=";
330 uint32_t input_len = strlen((
char *)input);
331 const char *result =
"Hello Wor";
332 uint32_t result_len = strlen((
char *)result);
334 SCDetectTransformFromBase64Data b64d = { .nbytes = input_len - 4,
335 .mode = Base64ModeRFC2045 };
341 TransformFromBase64Decode(&buffer, &b64d);
350 static int DetectTransformFromBase64DecodeTest08(
void)
353 const uint8_t *input = (
const uint8_t *)
"This is not base64-encoded";
354 uint32_t input_len = strlen((
char *)input);
356 SCDetectTransformFromBase64Data b64d = { .nbytes = input_len, .mode = Base64ModeRFC2045 };
362 TransformFromBase64Decode(&buffer, &b64d);
368 static void DetectTransformFromBase64DecodeRegisterTests(
void)
370 UtRegisterTest(
"DetectTransformFromBase64DecodeTest01", DetectTransformFromBase64DecodeTest01);
372 "DetectTransformFromBase64DecodeTest01a", DetectTransformFromBase64DecodeTest01a);
373 UtRegisterTest(
"DetectTransformFromBase64DecodeTest02", DetectTransformFromBase64DecodeTest02);
374 UtRegisterTest(
"DetectTransformFromBase64DecodeTest03", DetectTransformFromBase64DecodeTest03);
375 UtRegisterTest(
"DetectTransformFromBase64DecodeTest04", DetectTransformFromBase64DecodeTest04);
376 UtRegisterTest(
"DetectTransformFromBase64DecodeTest05", DetectTransformFromBase64DecodeTest05);
377 UtRegisterTest(
"DetectTransformFromBase64DecodeTest06", DetectTransformFromBase64DecodeTest06);
378 UtRegisterTest(
"DetectTransformFromBase64DecodeTest07", DetectTransformFromBase64DecodeTest07);
379 UtRegisterTest(
"DetectTransformFromBase64DecodeTest08", DetectTransformFromBase64DecodeTest08);