suricata
detect-uricontent.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>
23  *
24  * Simple uricontent match part of the detection engine.
25  */
26 
27 #include "suricata-common.h"
28 #include "decode.h"
29 #include "detect.h"
30 #include "detect-content.h"
31 #include "detect-http-uri.h"
32 #include "detect-uricontent.h"
33 #include "detect-engine-mpm.h"
34 #include "detect-parse.h"
35 #include "detect-engine.h"
36 #include "detect-engine-state.h"
37 #include "flow.h"
38 #include "detect-flow.h"
39 #include "flow-var.h"
40 #include "flow-util.h"
41 #include "threads.h"
42 
43 #include "stream-tcp.h"
44 #include "stream.h"
45 #include "app-layer.h"
46 #include "app-layer-parser.h"
47 #include "app-layer-protos.h"
48 #include "app-layer-htp.h"
49 
50 #include "util-mpm.h"
51 #include "util-print.h"
52 #include "util-debug.h"
53 #include "util-unittest.h"
54 #include "util-unittest-helper.h"
55 #include "util-spm.h"
56 #include "conf.h"
57 
58 /* prototypes */
59 static int DetectUricontentSetup (DetectEngineCtx *, Signature *, const char *);
60 static void DetectUricontentRegisterTests(void);
61 static void DetectUricontentFree(void *);
62 
63 static int g_http_uri_buffer_id = 0;
64 
65 /**
66  * \brief Registration function for uricontent: keyword
67  */
69 {
70  sigmatch_table[DETECT_URICONTENT].name = "uricontent";
72  sigmatch_table[DETECT_URICONTENT].Setup = DetectUricontentSetup;
73  sigmatch_table[DETECT_URICONTENT].Free = DetectUricontentFree;
74  sigmatch_table[DETECT_URICONTENT].RegisterTests = DetectUricontentRegisterTests;
76 
77  g_http_uri_buffer_id = DetectBufferTypeRegister("http_uri");
78 }
79 
80 /**
81  * \brief this function will Free memory associated with DetectContentData
82  *
83  * \param cd pointer to DetectUricotentData
84  */
85 void DetectUricontentFree(void *ptr)
86 {
87  SCEnter();
89 
90  if (cd == NULL)
91  SCReturn;
92 
94  SCFree(cd);
95 
96  SCReturn;
97 }
98 
99 /**
100  * \brief Creates a SigMatch for the uricontent keyword being sent as argument,
101  * and appends it to the Signature(s).
102  *
103  * \param de_ctx Pointer to the detection engine context
104  * \param s Pointer to signature for the current Signature being parsed
105  * from the rules
106  * \param contentstr Pointer to the string holding the keyword value
107  *
108  * \retval 0 on success, -1 on failure
109  */
110 int DetectUricontentSetup(DetectEngineCtx *de_ctx, Signature *s, const char *contentstr)
111 {
112  SCEnter();
113 
114  const char *legacy = NULL;
115  if (ConfGet("legacy.uricontent", &legacy) == 1) {
116  if (strcasecmp("disabled", legacy) == 0) {
117  SCLogError(SC_ERR_INVALID_SIGNATURE, "uriconent deprecated. To "
118  "use a rule with \"uricontent\", either set the "
119  "option - \"legacy.uricontent\" in the conf to "
120  "\"enabled\" OR replace uricontent with "
121  "\'content:%s; http_uri;\'.", contentstr);
122  goto error;
123  } else if (strcasecmp("enabled", legacy) == 0) {
124  ;
125  } else {
126  SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid value found "
127  "for legacy.uriconent - \"%s\". Valid values are "
128  "\"enabled\" OR \"disabled\".", legacy);
129  goto error;
130  }
131  }
132 
133  if (DetectContentSetup(de_ctx, s, contentstr) < 0)
134  goto error;
135 
136  if (DetectHttpUriSetup(de_ctx, s, NULL) < 0)
137  goto error;
138 
139  SCReturnInt(0);
140 error:
141  SCReturnInt(-1);
142 }
143 
144 /*
145  * UNITTTESTS
146  */
147 
148 #ifdef UNITTESTS
149 
150 #include "detect-isdataat.h"
151 #include "stream-tcp-reassemble.h"
152 
153 /**
154  * \brief Helper function to print a DetectContentData
155  */
156 static void DetectUricontentPrint(DetectContentData *cd)
157 {
158  int i = 0;
159  if (cd == NULL) {
160  SCLogDebug("Detect UricontentData \"cd\" is NULL");
161  return;
162  }
163  char *tmpstr = SCMalloc(sizeof(char) * cd->content_len + 1);
164  if (unlikely(tmpstr == NULL))
165  return;
166 
167  if (tmpstr != NULL) {
168  for (i = 0; i < cd->content_len; i++) {
169  if (isprint(cd->content[i]))
170  tmpstr[i] = cd->content[i];
171  else
172  tmpstr[i] = '.';
173  }
174  tmpstr[i] = '\0';
175  SCLogDebug("Uricontent: \"%s\"", tmpstr);
176  SCFree(tmpstr);
177  } else {
178  SCLogDebug("Uricontent: ");
179  for (i = 0; i < cd->content_len; i++)
180  SCLogDebug("%c", cd->content[i]);
181  }
182 
183  SCLogDebug("Uricontent_id: %"PRIu32, cd->id);
184  SCLogDebug("Uricontent_len: %"PRIu16, cd->content_len);
185  SCLogDebug("Depth: %"PRIu16, cd->depth);
186  SCLogDebug("Offset: %"PRIu16, cd->offset);
187  SCLogDebug("Within: %"PRIi32, cd->within);
188  SCLogDebug("Distance: %"PRIi32, cd->distance);
189  SCLogDebug("flags: %u ", cd->flags);
190  SCLogDebug("negated: %s ",
191  cd->flags & DETECT_CONTENT_NEGATED ? "true" : "false");
192  SCLogDebug("relative match next: %s ",
193  cd->flags & DETECT_CONTENT_RELATIVE_NEXT ? "true" : "false");
194  SCLogDebug("-----------");
195 }
196 
197 /** \test Test case where path traversal has been sent as a path string in the
198  * HTTP URL and normalized path string is checked */
199 static int HTTPUriTest01(void)
200 {
201  int result = 0;
202  Flow f;
203  uint8_t httpbuf1[] = "GET /../../images.gif HTTP/1.1\r\nHost: www.ExA"
204  "mPlE.cOM\r\n\r\n";
205  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
206  TcpSession ssn;
207  int r = 0;
209  memset(&f, 0, sizeof(f));
210  memset(&ssn, 0, sizeof(ssn));
211 
212  FLOW_INITIALIZE(&f);
213  f.protoctx = (void *)&ssn;
214  f.proto = IPPROTO_TCP;
215  f.alproto = ALPROTO_HTTP;
216  f.flags |= FLOW_IPV4;
217 
219 
220  FLOWLOCK_WRLOCK(&f);
221  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
223  httpbuf1,
224  httplen1);
225  if (r != 0) {
226  printf("AppLayerParse failed: r(%d) != 0: ", r);
227  goto end;
228  }
229 
230  HtpState *htp_state = f.alstate;
231  if (htp_state == NULL) {
232  printf("no http state: ");
233  goto end;
234  }
235 
236  htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0);
237 
238  if (tx->request_method_number != HTP_M_GET ||
239  tx->request_protocol_number != HTP_PROTOCOL_1_1)
240  {
241  goto end;
242  }
243 
244  if ((tx->request_hostname == NULL) ||
245  (bstr_cmp_c(tx->request_hostname, "www.example.com") != 0))
246  {
247  goto end;
248  }
249 
250  if ((tx->parsed_uri->path == NULL) ||
251  (bstr_cmp_c(tx->parsed_uri->path, "/images.gif") != 0))
252  {
253  goto end;
254  }
255 
256  result = 1;
257 end:
258  if (alp_tctx != NULL)
259  AppLayerParserThreadCtxFree(alp_tctx);
261  FLOWLOCK_UNLOCK(&f);
262  FLOW_DESTROY(&f);
263  return result;
264 }
265 
266 /** \test Test case where path traversal has been sent in special characters in
267  * HEX encoding in the HTTP URL and normalized path string is checked */
268 static int HTTPUriTest02(void)
269 {
270  int result = 0;
271  Flow f;
272  HtpState *htp_state = NULL;
273  uint8_t httpbuf1[] = "GET /%2e%2e/images.gif HTTP/1.1\r\nHost: www.ExA"
274  "mPlE.cOM\r\n\r\n";
275  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
276  TcpSession ssn;
277  int r = 0;
279 
280  memset(&f, 0, sizeof(f));
281  memset(&ssn, 0, sizeof(ssn));
282 
283  FLOW_INITIALIZE(&f);
284  f.protoctx = (void *)&ssn;
285  f.proto = IPPROTO_TCP;
286  f.alproto = ALPROTO_HTTP;
287  f.flags |= FLOW_IPV4;
288 
290 
291  FLOWLOCK_WRLOCK(&f);
292  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
294  httpbuf1,
295  httplen1);
296  if (r != 0) {
297  printf("AppLayerParse failed: r(%d) != 0: ", r);
298  goto end;
299  }
300 
301  htp_state = f.alstate;
302  if (htp_state == NULL) {
303  printf("no http state: ");
304  goto end;
305  }
306 
307  htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0);
308 
309  if (tx->request_method_number != HTP_M_GET ||
310  tx->request_protocol_number != HTP_PROTOCOL_1_1)
311  {
312  goto end;
313  }
314 
315  if ((tx->request_hostname == NULL) ||
316  (bstr_cmp_c(tx->request_hostname, "www.example.com") != 0))
317  {
318  goto end;
319  }
320 
321  if ((tx->parsed_uri->path == NULL) ||
322  (bstr_cmp_c(tx->parsed_uri->path, "/images.gif") != 0))
323  {
324  goto end;
325  }
326 
327  result = 1;
328 end:
329  if (alp_tctx != NULL)
330  AppLayerParserThreadCtxFree(alp_tctx);
332  FLOWLOCK_UNLOCK(&f);
333  FLOW_DESTROY(&f);
334  return result;
335 }
336 
337 /** \test Test case where NULL character has been sent in HEX encoding in the
338  * HTTP URL and normalized path string is checked */
339 static int HTTPUriTest03(void)
340 {
341  int result = 0;
342  Flow f;
343  HtpState *htp_state = NULL;
344  uint8_t httpbuf1[] = "GET%00 /images.gif HTTP/1.1\r\nHost: www.ExA"
345  "mPlE.cOM\r\n\r\n";
346  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
347  TcpSession ssn;
348  int r = 0;
350 
351  memset(&f, 0, sizeof(f));
352  memset(&ssn, 0, sizeof(ssn));
353 
354  FLOW_INITIALIZE(&f);
355  f.protoctx = (void *)&ssn;
356  f.proto = IPPROTO_TCP;
357  f.alproto = ALPROTO_HTTP;
358  f.flags |= FLOW_IPV4;
359 
361 
362  FLOWLOCK_WRLOCK(&f);
363  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
365  httpbuf1,
366  httplen1);
367  if (r != 0) {
368  printf("AppLayerParse failed: r(%d) != 0: ", r);
369  goto end;
370  }
371 
372  htp_state = f.alstate;
373  if (htp_state == NULL) {
374  printf("no http state: ");
375  goto end;
376  }
377 
378  htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0);
379 
380  if (tx->request_method_number != HTP_M_UNKNOWN ||
381  tx->request_protocol_number != HTP_PROTOCOL_1_1)
382  {
383  goto end;
384  }
385 
386  if ((tx->request_hostname == NULL) ||
387  (bstr_cmp_c(tx->request_hostname, "www.example.com") != 0))
388  {
389  goto end;
390  }
391 
392  if ((tx->parsed_uri->path == NULL) ||
393  (bstr_cmp_c(tx->parsed_uri->path, "/images.gif") != 0))
394  {
395  goto end;
396  }
397 
398  result = 1;
399 end:
400  if (alp_tctx != NULL)
401  AppLayerParserThreadCtxFree(alp_tctx);
403  FLOWLOCK_UNLOCK(&f);
404  FLOW_DESTROY(&f);
405  return result;
406 }
407 
408 
409 /** \test Test case where self referencing directories request has been sent
410  * in the HTTP URL and normalized path string is checked */
411 static int HTTPUriTest04(void)
412 {
413  int result = 0;
414  Flow f;
415  HtpState *htp_state = NULL;
416  uint8_t httpbuf1[] = "GET /./././images.gif HTTP/1.1\r\nHost: www.ExA"
417  "mPlE.cOM\r\n\r\n";
418  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
419  TcpSession ssn;
420  int r = 0;
422 
423  memset(&f, 0, sizeof(f));
424  memset(&ssn, 0, sizeof(ssn));
425 
426  FLOW_INITIALIZE(&f);
427  f.protoctx = (void *)&ssn;
428  f.proto = IPPROTO_TCP;
429  f.alproto = ALPROTO_HTTP;
430  f.flags |= FLOW_IPV4;
431 
433 
434  FLOWLOCK_WRLOCK(&f);
435  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
437  httpbuf1,
438  httplen1);
439  if (r != 0) {
440  printf("AppLayerParse failed: r(%d) != 0: ", r);
441  goto end;
442  }
443 
444  htp_state = f.alstate;
445  if (htp_state == NULL) {
446  printf("no http state: ");
447  goto end;
448  }
449 
450  htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0);
451 
452  if (tx->request_method_number != HTP_M_GET ||
453  tx->request_protocol_number != HTP_PROTOCOL_1_1)
454  {
455  goto end;
456  }
457 
458  if ((tx->request_hostname == NULL) ||
459  (bstr_cmp_c(tx->request_hostname, "www.example.com") != 0))
460  {
461  goto end;
462  }
463 
464  if ((tx->parsed_uri->path == NULL) ||
465  (bstr_cmp_c(tx->parsed_uri->path, "/images.gif") != 0))
466  {
467  goto end;
468  }
469 
470  result = 1;
471 end:
472  if (alp_tctx != NULL)
473  AppLayerParserThreadCtxFree(alp_tctx);
475  FLOWLOCK_UNLOCK(&f);
476  FLOW_DESTROY(&f);
477  return result;
478 }
479 
480 /**
481  * \test Checks if a uricontent is registered in a Signature
482  */
483 static int DetectUriSigTest01(void)
484 {
485  ThreadVars th_v;
486  Signature *s = NULL;
487 
488  memset(&th_v, 0, sizeof(th_v));
489 
491  FAIL_IF_NULL(de_ctx);
492  de_ctx->flags |= DE_QUIET;
493 
494  s = DetectEngineAppendSig(de_ctx,"alert http any any -> any any (msg:"
495  "\" Test uricontent\"; content:\"me\"; uricontent:\"me\"; sid:1;)");
496  FAIL_IF_NULL(s);
497 
498  BUG_ON(s->sm_lists[g_http_uri_buffer_id] == NULL);
499  FAIL_IF_NOT(de_ctx->sig_list->sm_lists[g_http_uri_buffer_id]->type == DETECT_CONTENT);
500 
501  DetectEngineCtxFree(de_ctx);
502  PASS;
503 }
504 
505 /** \test Check the signature working to alert when http_cookie is matched . */
506 static int DetectUriSigTest02(void)
507 {
508  int result = 0;
509  Flow f;
510  uint8_t httpbuf1[] = "POST /one HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:"
511  " hellocatch\r\n\r\n";
512  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
513  TcpSession ssn;
514  Packet *p = NULL;
515  Signature *s = NULL;
516  ThreadVars th_v;
517  DetectEngineThreadCtx *det_ctx = NULL;
518  HtpState *http_state = NULL;
520 
521  memset(&th_v, 0, sizeof(th_v));
522  memset(&f, 0, sizeof(f));
523  memset(&ssn, 0, sizeof(ssn));
524 
525  p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP);
526 
527  FLOW_INITIALIZE(&f);
528  f.protoctx = (void *)&ssn;
529  f.proto = IPPROTO_TCP;
530  f.flags |= FLOW_IPV4;
531 
532  p->flow = &f;
536  f.alproto = ALPROTO_HTTP;
537 
539 
541  if (de_ctx == NULL) {
542  goto end;
543  }
544  de_ctx->flags |= DE_QUIET;
545 
546  s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
547  "\" Test uricontent\"; "
548  "uricontent:\"foo\"; sid:1;)");
549  if (s == NULL) {
550  goto end;
551  }
552 
553  s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
554  "\" Test uricontent\"; "
555  "uricontent:\"one\"; sid:2;)");
556  if (s == NULL) {
557  goto end;
558  }
559 
560  s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
561  "\" Test uricontent\"; "
562  "uricontent:\"oisf\"; sid:3;)");
563  if (s == NULL) {
564  goto end;
565  }
566 
567 
568  SigGroupBuild(de_ctx);
569  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
570 
571  FLOWLOCK_WRLOCK(&f);
572  int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
573  STREAM_TOSERVER, httpbuf1, httplen1);
574  if (r != 0) {
575  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
576  FLOWLOCK_UNLOCK(&f);
577  goto end;
578  }
579  FLOWLOCK_UNLOCK(&f);
580 
581  http_state = f.alstate;
582  if (http_state == NULL) {
583  printf("no http state: ");
584  goto end;
585  }
586 
587  /* do detect */
588  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
589 
590  if ((PacketAlertCheck(p, 1))) {
591  printf("sig: 1 alerted, but it should not\n");
592  goto end;
593  } else if (!PacketAlertCheck(p, 2)) {
594  printf("sig: 2 did not alerted, but it should\n");
595  goto end;
596  } else if ((PacketAlertCheck(p, 3))) {
597  printf("sig: 3 alerted, but it should not\n");
598  goto end;
599  }
600 
601  result = 1;
602 end:
603  if (alp_tctx != NULL)
604  AppLayerParserThreadCtxFree(alp_tctx);
605  //if (http_state != NULL) HTPStateFree(http_state);
606  if (de_ctx != NULL) SigCleanSignatures(de_ctx);
607  if (de_ctx != NULL) SigGroupCleanup(de_ctx);
608  if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, det_ctx);
609  if (de_ctx != NULL) DetectEngineCtxFree(de_ctx);
610 
612  FLOW_DESTROY(&f);
613  UTHFreePackets(&p, 1);
614  return result;
615 }
616 
617 /** \test Check the working of search once per packet only in applayer
618  * match */
619 static int DetectUriSigTest03(void)
620 {
621  int result = 0;
622  Flow f;
623  HtpState *http_state = NULL;
624  uint8_t httpbuf1[] = "POST /one HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:"
625  " hellocatch\r\n\r\n";
626  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
627  uint8_t httpbuf2[] = "POST /oneself HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:"
628  " hellocatch\r\n\r\n";
629  uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
630  TcpSession ssn;
631  Packet *p = NULL;
632  Signature *s = NULL;
633  ThreadVars th_v;
634  DetectEngineThreadCtx *det_ctx = NULL;
636 
637  memset(&th_v, 0, sizeof(th_v));
638  memset(&f, 0, sizeof(f));
639  memset(&ssn, 0, sizeof(ssn));
640 
641  p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP);
642 
643  FLOW_INITIALIZE(&f);
644  f.protoctx = (void *)&ssn;
645  f.proto = IPPROTO_TCP;
646  f.flags |= FLOW_IPV4;
647 
648  p->flow = &f;
652  f.alproto = ALPROTO_HTTP;
653 
655 
657  if (de_ctx == NULL) {
658  goto end;
659  }
660  de_ctx->flags |= DE_QUIET;
661 
662  s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
663  "\" Test uricontent\"; "
664  "uricontent:\"foo\"; sid:1;)");
665  if (s == NULL) {
666  goto end;
667  }
668 
669  s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
670  "\" Test uricontent\"; "
671  "uricontent:\"one\"; sid:2;)");
672  if (s == NULL) {
673  goto end;
674  }
675 
676  s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
677  "\" Test uricontent\"; "
678  "uricontent:\"self\"; sid:3;)");
679  if (s == NULL) {
680  goto end;
681  }
682 
683 
684  SigGroupBuild(de_ctx);
685  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
686 
687  FLOWLOCK_WRLOCK(&f);
688  int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
689  STREAM_TOSERVER, httpbuf1, httplen1);
690  if (r != 0) {
691  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
692  FLOWLOCK_UNLOCK(&f);
693  goto end;
694  }
695  FLOWLOCK_UNLOCK(&f);
696 
697  /* do detect */
698  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
699 
700  if ((PacketAlertCheck(p, 1))) {
701  printf("sig 1 alerted, but it should not: ");
702  goto end;
703  } else if (!PacketAlertCheck(p, 2)) {
704  printf("sig 2 did not alert, but it should: ");
705  goto end;
706  } else if ((PacketAlertCheck(p, 3))) {
707  printf("sig 3 alerted, but it should not: ");
708  goto end;
709  }
710 
711 
712  FLOWLOCK_WRLOCK(&f);
713  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
714  STREAM_TOSERVER, httpbuf2, httplen2);
715  if (r != 0) {
716  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
717  FLOWLOCK_UNLOCK(&f);
718  goto end;
719  }
720  FLOWLOCK_UNLOCK(&f);
721 
722  http_state = f.alstate;
723  if (http_state == NULL) {
724  printf("no http state: ");
725  goto end;
726  }
727 
728  /* do detect */
729  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
730 
731  if ((PacketAlertCheck(p, 1))) {
732  printf("sig 1 alerted, but it should not (chunk 2): ");
733  goto end;
734  } else if (!PacketAlertCheck(p, 2)) {
735  printf("sig 2 alerted, but it should not (chunk 2): ");
736  goto end;
737  } else if (!(PacketAlertCheck(p, 3))) {
738  printf("sig 3 did not alert, but it should (chunk 2): ");
739  goto end;
740  }
741 
742  result = 1;
743 
744 end:
745  if (alp_tctx != NULL)
746  AppLayerParserThreadCtxFree(alp_tctx);
747  if (de_ctx != NULL) SigGroupCleanup(de_ctx);
748  if (de_ctx != NULL) SigCleanSignatures(de_ctx);
749  if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, det_ctx);
750  if (de_ctx != NULL) DetectEngineCtxFree(de_ctx);
751 
753  FLOW_DESTROY(&f);
754  UTHFreePackets(&p, 1);
755  return result;
756 }
757 
758 /**
759  * \test Check that modifiers of content apply only to content keywords
760  * and the same for uricontent modifiers
761  */
762 static int DetectUriSigTest04(void)
763 {
764  int result = 0;
765  Signature *s = NULL;
766 
768  if (de_ctx == NULL) {
769  goto end;
770  }
771 
772  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
773  "\" Test uricontent\"; "
774  "uricontent:\"foo\"; sid:1;)");
775  if (s == NULL ||
776  s->sm_lists[g_http_uri_buffer_id] == NULL ||
777  s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL ||
778  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
779  {
780  printf("sig 1 failed to parse: ");
781  goto end;
782  }
783 
784  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
785  "\" Test uricontent and content\"; "
786  "uricontent:\"foo\"; content:\"bar\";sid:1;)");
787  if (s == NULL ||
788  s->sm_lists[g_http_uri_buffer_id] == NULL ||
789  s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
790  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
791  {
792  printf("sig 2 failed to parse: ");
793  goto end;
794  }
795 
796  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
797  "\" Test uricontent and content\"; "
798  "uricontent:\"foo\"; content:\"bar\";"
799  " depth:10; offset: 5; sid:1;)");
800  if (s == NULL ||
801  s->sm_lists[g_http_uri_buffer_id] == NULL ||
802  s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
803  ((DetectContentData *)s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
804  ((DetectContentData *)s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
805  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
806  {
807  printf("sig 3 failed to parse: ");
808  goto end;
809  }
810 
811  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
812  "\" Test uricontent and content\"; "
813  "content:\"foo\"; uricontent:\"bar\";"
814  " depth:10; offset: 5; sid:1;)");
815  if (s == NULL ||
816  s->sm_lists[g_http_uri_buffer_id] == NULL ||
817  s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
818  ((DetectContentData *)s->sm_lists[g_http_uri_buffer_id]->ctx)->depth != 15 ||
819  ((DetectContentData *)s->sm_lists[g_http_uri_buffer_id]->ctx)->offset != 5 ||
820  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
821  {
822  printf("sig 4 failed to parse: ");
823  goto end;
824  }
825 
826  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
827  "\" Test uricontent and content\"; "
828  "uricontent:\"foo\"; content:\"bar\";"
829  " depth:10; offset: 5; within:3; sid:1;)");
830  if (s != NULL) {
831  printf("sig 5 failed to parse: ");
832  goto end;
833  }
834 
835  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
836  "\" Test uricontent and content\"; "
837  "uricontent:\"foo\"; content:\"bar\";"
838  " depth:10; offset: 5; distance:3; sid:1;)");
839  if (s != NULL) {
840  printf("sig 6 failed to parse: ");
841  goto end;
842  }
843 
844  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
845  "\" Test uricontent and content\"; "
846  "uricontent:\"foo\"; content:\"bar\";"
847  " depth:10; offset: 5; content:"
848  "\"two_contents\"; within:30; sid:1;)");
849  if (s == NULL) {
850  goto end;
851  } else if (s->sm_lists[g_http_uri_buffer_id] == NULL ||
852  s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
853  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
854  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
855  ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->within != 30 ||
856  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
857  {
858  printf("sig 7 failed to parse: ");
860  goto end;
861  }
862 
863  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
864  "\" Test uricontent and content\"; "
865  "uricontent:\"foo\"; content:\"bar\";"
866  " depth:10; offset: 5; uricontent:"
867  "\"two_uricontents\"; within:30; sid:1;)");
868  if (s == NULL) {
869  goto end;
870  } else if (s->sm_lists[g_http_uri_buffer_id] == NULL ||
871  s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
872  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
873  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
874  ((DetectContentData*) s->sm_lists_tail[g_http_uri_buffer_id]->ctx)->within != 30 ||
875  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
876  {
877  printf("sig 8 failed to parse: ");
878  DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[g_http_uri_buffer_id]->ctx);
879  goto end;
880  }
881 
882  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
883  "\" Test uricontent and content\"; "
884  "uricontent:\"foo\"; content:\"bar\";"
885  " depth:10; offset: 5; content:"
886  "\"two_contents\"; distance:30; sid:1;)");
887  if (s == NULL) {
888  goto end;
889  } else if (
890  s->sm_lists[g_http_uri_buffer_id] == NULL ||
891  s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
892  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
893  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
894  ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->distance != 30 ||
895  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
896  {
897  printf("sig 9 failed to parse: ");
899  goto end;
900  }
901 
902  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
903  "\" Test uricontent and content\"; "
904  "uricontent:\"foo\"; content:\"bar\";"
905  " depth:10; offset: 5; uricontent:"
906  "\"two_uricontents\"; distance:30; sid:1;)");
907  if (s == NULL) {
908  goto end;
909  } else if (
910  s->sm_lists[g_http_uri_buffer_id] == NULL ||
911  s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
912  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
913  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
914  ((DetectContentData*) s->sm_lists_tail[g_http_uri_buffer_id]->ctx)->distance != 30 ||
915  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
916  {
917  printf("sig 10 failed to parse: ");
918  DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[g_http_uri_buffer_id]->ctx);
919  goto end;
920  }
921 
922  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
923  "\" Test uricontent and content\"; "
924  "uricontent:\"foo\"; content:\"bar\";"
925  " depth:10; offset: 5; uricontent:"
926  "\"two_uricontents\"; distance:30; "
927  "within:60; content:\"two_contents\";"
928  " within:70; distance:45; sid:1;)");
929  if (s == NULL) {
930  printf("sig 10 failed to parse: ");
931  goto end;
932  }
933 
934  if (s->sm_lists[g_http_uri_buffer_id] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
935  printf("umatch %p or pmatch %p: ", s->sm_lists[g_http_uri_buffer_id], s->sm_lists[DETECT_SM_LIST_PMATCH]);
936  goto end;
937  }
938 
939  if ( ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
940  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
941  ((DetectContentData*) s->sm_lists_tail[g_http_uri_buffer_id]->ctx)->distance != 30 ||
942  ((DetectContentData*) s->sm_lists_tail[g_http_uri_buffer_id]->ctx)->within != 60 ||
943  ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->distance != 45 ||
944  ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->within != 70 ||
945  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) {
946  printf("sig 10 failed to parse, content not setup properly: ");
948  DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[g_http_uri_buffer_id]->ctx);
950  goto end;
951  }
952 
953  result = 1;
954 end:
955  if (de_ctx != NULL)
956  DetectEngineCtxFree(de_ctx);
957  return result;
958 }
959 
960 /** \test Check the modifiers for uricontent and content
961  * match
962  */
963 static int DetectUriSigTest05(void)
964 {
965  HtpState *http_state = NULL;
966  uint8_t httpbuf1[] = "POST /one/two/three HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:"
967  " hellocatch\r\n\r\n";
968  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
969  Packet *p = NULL;
970  Signature *s = NULL;
971  ThreadVars th_v;
972  DetectEngineThreadCtx *det_ctx = NULL;
974 
975  memset(&th_v, 0, sizeof(th_v));
977 
978  p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP);
979  FAIL_IF_NULL(p);
980  p->tcph->th_seq = htonl(1000);
981  Flow *f = UTHBuildFlow(AF_INET, "192.168.1.5", "192.168.1.1", 41424, 80);
982  FAIL_IF_NULL(f);
983  f->proto = IPPROTO_TCP;
984 
985  UTHAddSessionToFlow(f, 1000, 1000);
986  UTHAddStreamToFlow(f, 0, httpbuf1, httplen1);
987 
988  p->flow = f;
992  f->alproto = ALPROTO_HTTP;
993 
995  FAIL_IF_NULL(de_ctx);
996  de_ctx->flags |= DE_QUIET;
997 
998  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
999  "\" Test uricontent\"; uricontent:\"foo\"; sid:1;)");
1000  FAIL_IF_NULL(s);
1001 
1002  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1003  "\" Test uricontent\"; uricontent:\"one\"; content:\"two\"; sid:2;)");
1004  FAIL_IF_NULL(s);
1005 
1006  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1007  "\" Test uricontent\"; uricontent:\"one\"; offset:1; depth:10; "
1008  "uricontent:\"two\"; distance:1; within: 4; uricontent:\"three\"; "
1009  "distance:1; within: 6; sid:3;)");
1010  FAIL_IF_NULL(s);
1011 
1012  SigGroupBuild(de_ctx);
1013  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1014 
1015  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP,
1016  STREAM_TOSERVER, httpbuf1, httplen1);
1017  FAIL_IF(r != 0);
1018  http_state = f->alstate;
1019  FAIL_IF_NULL(http_state);
1020 
1021  /* do detect */
1022  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1023 
1024  FAIL_IF((PacketAlertCheck(p, 1)));
1025  FAIL_IF(!PacketAlertCheck(p, 2));
1026  FAIL_IF(!(PacketAlertCheck(p, 3)));
1027 
1028  AppLayerParserThreadCtxFree(alp_tctx);
1029  DetectEngineThreadCtxDeinit(&th_v, det_ctx);
1030  DetectEngineCtxFree(de_ctx);
1031 
1033  UTHFreeFlow(f);
1034  UTHFreePackets(&p, 1);
1036  PASS;
1037 }
1038 
1039 /** \test Check the modifiers for uricontent and content
1040  * match
1041  */
1042 static int DetectUriSigTest06(void)
1043 {
1044  HtpState *http_state = NULL;
1045  uint8_t httpbuf1[] = "POST /one/two/three HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:"
1046  " hellocatch\r\n\r\n";
1047  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
1048  Packet *p = NULL;
1049  Signature *s = NULL;
1050  ThreadVars th_v;
1051  DetectEngineThreadCtx *det_ctx = NULL;
1053 
1054  memset(&th_v, 0, sizeof(th_v));
1056 
1057  p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP);
1058  FAIL_IF_NULL(p);
1059  p->tcph->th_seq = htonl(1000);
1060  Flow *f = UTHBuildFlow(AF_INET, "192.168.1.5", "192.168.1.1", 41424, 80);
1061  FAIL_IF_NULL(f);
1062  f->proto = IPPROTO_TCP;
1063 
1064  UTHAddSessionToFlow(f, 1000, 1000);
1065  UTHAddStreamToFlow(f, 0, httpbuf1, httplen1);
1066 
1067  p->flow = f;
1071  f->alproto = ALPROTO_HTTP;
1072 
1074  FAIL_IF_NULL(de_ctx);
1075  de_ctx->flags |= DE_QUIET;
1076 
1077  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1078  "\" Test uricontent\"; "
1079  "uricontent:\"foo\"; content:\"bar\"; sid:1;)");
1080  FAIL_IF_NULL(s);
1081 
1082  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1083  "\" Test uricontent\"; "
1084  "uricontent:\"one\"; offset:1; depth:10; "
1085  "content:\"one\"; offset:1; depth:10; "
1086  "uricontent:\"two\"; distance:1; within: 4; "
1087  "content:\"two\"; distance:1; within: 4; "
1088  "uricontent:\"three\"; distance:1; within: 6; "
1089  "content:\"/three\"; distance:0; within: 7; "
1090  "sid:2;)");
1091  FAIL_IF_NULL(s);
1092 
1093  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1094  "\" Test uricontent\"; "
1095  "uricontent:\"one\"; offset:1; depth:10; "
1096  "uricontent:\"two\"; distance:1; within: 4; "
1097  "uricontent:\"three\"; distance:1; within: 6; "
1098  "sid:3;)");
1099  FAIL_IF_NULL(s);
1100 
1101  SigGroupBuild(de_ctx);
1102  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1103 
1104  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP,
1105  STREAM_TOSERVER, httpbuf1, httplen1);
1106  FAIL_IF(r != 0);
1107  http_state = f->alstate;
1108  FAIL_IF_NULL(http_state);
1109 
1110  /* do detect */
1111  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1112 
1113  FAIL_IF((PacketAlertCheck(p, 1)));
1114  FAIL_IF(!PacketAlertCheck(p, 2));
1115  FAIL_IF(!(PacketAlertCheck(p, 3)));
1116 
1117  AppLayerParserThreadCtxFree(alp_tctx);
1118  DetectEngineThreadCtxDeinit(&th_v, det_ctx);
1119  DetectEngineCtxFree(de_ctx);
1120 
1122  UTHFreeFlow(f);
1123  UTHFreePackets(&p, 1);
1125  PASS;
1126 }
1127 
1128 /** \test Check the modifiers for uricontent and content
1129  * match
1130  */
1131 static int DetectUriSigTest07(void)
1132 {
1133  HtpState *http_state = NULL;
1134  uint8_t httpbuf1[] = "POST /one/two/three HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:"
1135  " hellocatch\r\n\r\n";
1136  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
1137  Packet *p = NULL;
1138  Signature *s = NULL;
1139  ThreadVars th_v;
1140  DetectEngineThreadCtx *det_ctx = NULL;
1142 
1143  memset(&th_v, 0, sizeof(th_v));
1145 
1146  p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP);
1147  FAIL_IF_NULL(p);
1148  p->tcph->th_seq = htonl(1000);
1149  Flow *f = UTHBuildFlow(AF_INET, "192.168.1.5", "192.168.1.1", 41424, 80);
1150  FAIL_IF_NULL(f);
1151  f->proto = IPPROTO_TCP;
1152 
1153  UTHAddSessionToFlow(f, 1000, 1000);
1154  UTHAddStreamToFlow(f, 0, httpbuf1, httplen1);
1155 
1156  p->flow = f;
1160  f->alproto = ALPROTO_HTTP;
1161 
1163  FAIL_IF_NULL(de_ctx);
1164  de_ctx->flags |= DE_QUIET;
1165 
1166  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1167  "\" Test uricontent\"; "
1168  "uricontent:\"foo\"; content:\"bar\"; sid:1;)");
1169  FAIL_IF_NULL(s);
1170 
1171  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1172  "\" Test uricontent\"; "
1173  "uricontent:\"one\"; offset:1; depth:10; "
1174  "content:\"one\"; offset:1; depth:10; "
1175  "uricontent:\"two\"; distance:3; within: 4; "
1176  "content:\"two\"; distance:1; within: 4; "
1177  "uricontent:\"three\"; distance:1; within: 6; "
1178  "content:\"/three\"; distance:0; within: 7; "
1179  "sid:2;)");
1180  FAIL_IF_NULL(s);
1181 
1182  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1183  "\" Test uricontent\"; "
1184  "uricontent:\"one\"; offset:1; depth:10; "
1185  "uricontent:\"two\"; distance:1; within: 4; "
1186  "uricontent:\"six\"; distance:1; within: 6; "
1187  "sid:3;)");
1188  FAIL_IF_NULL(s);
1189 
1190  SigGroupBuild(de_ctx);
1191  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1192 
1193  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP,
1194  STREAM_TOSERVER, httpbuf1, httplen1);
1195  FAIL_IF(r != 0);
1196  http_state = f->alstate;
1197  FAIL_IF_NULL(http_state);
1198 
1199  /* do detect */
1200  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1201 
1202  FAIL_IF((PacketAlertCheck(p, 1)));
1203  FAIL_IF((PacketAlertCheck(p, 2)));
1204  FAIL_IF((PacketAlertCheck(p, 3)));
1205 
1206  AppLayerParserThreadCtxFree(alp_tctx);
1207  DetectEngineThreadCtxDeinit(&th_v, det_ctx);
1208  DetectEngineCtxFree(de_ctx);
1209 
1211  UTHFreeFlow(f);
1212  UTHFreePackets(&p, 1);
1214  PASS;
1215 }
1216 
1217 /**
1218  * \test Test content for dce sig.
1219  */
1220 static int DetectUriSigTest08(void)
1221 {
1222  DetectEngineCtx *de_ctx = NULL;
1223  int result = 1;
1224 
1225  de_ctx = DetectEngineCtxInit();
1226  if (de_ctx == NULL)
1227  goto end;
1228 
1229  de_ctx->flags |= DE_QUIET;
1230  de_ctx->sig_list = SigInit(de_ctx,
1231  "alert udp any any -> any any "
1232  "(msg:\"test\"; uricontent:\"\"; sid:238012;)");
1233  if (de_ctx->sig_list != NULL) {
1234  result = 0;
1235  goto end;
1236  }
1237 
1238  end:
1239  SigGroupCleanup(de_ctx);
1240  SigCleanSignatures(de_ctx);
1241  DetectEngineCtxFree(de_ctx);
1242 
1243  return result;
1244 }
1245 
1246 /**
1247  * \test Test content for dce sig.
1248  */
1249 static int DetectUriSigTest09(void)
1250 {
1251  DetectEngineCtx *de_ctx = NULL;
1252  int result = 1;
1253 
1254  de_ctx = DetectEngineCtxInit();
1255  if (de_ctx == NULL)
1256  goto end;
1257 
1258  de_ctx->flags |= DE_QUIET;
1259  de_ctx->sig_list = SigInit(de_ctx,
1260  "alert udp any any -> any any "
1261  "(msg:\"test\"; uricontent:\"; sid:238012;)");
1262  if (de_ctx->sig_list != NULL) {
1263  result = 0;
1264  goto end;
1265  }
1266 
1267  end:
1268  SigGroupCleanup(de_ctx);
1269  SigCleanSignatures(de_ctx);
1270  DetectEngineCtxFree(de_ctx);
1271 
1272  return result;
1273 }
1274 
1275 /**
1276  * \test Test content for dce sig.
1277  */
1278 static int DetectUriSigTest10(void)
1279 {
1280  DetectEngineCtx *de_ctx = NULL;
1281  int result = 1;
1282 
1283  de_ctx = DetectEngineCtxInit();
1284  if (de_ctx == NULL)
1285  goto end;
1286 
1287  de_ctx->flags |= DE_QUIET;
1288  de_ctx->sig_list = SigInit(de_ctx,
1289  "alert udp any any -> any any "
1290  "(msg:\"test\"; uricontent:\"boo; sid:238012;)");
1291  if (de_ctx->sig_list != NULL) {
1292  result = 0;
1293  goto end;
1294  }
1295 
1296  end:
1297  SigGroupCleanup(de_ctx);
1298  SigCleanSignatures(de_ctx);
1299  DetectEngineCtxFree(de_ctx);
1300 
1301  return result;
1302 }
1303 
1304 /**
1305  * \test Test content for dce sig.
1306  */
1307 static int DetectUriSigTest11(void)
1308 {
1309  DetectEngineCtx *de_ctx = NULL;
1310  int result = 1;
1311 
1312  de_ctx = DetectEngineCtxInit();
1313  if (de_ctx == NULL)
1314  goto end;
1315 
1316  de_ctx->flags |= DE_QUIET;
1317  de_ctx->sig_list = SigInit(de_ctx,
1318  "alert udp any any -> any any "
1319  "(msg:\"test\"; uricontent:boo\"; sid:238012;)");
1320  if (de_ctx->sig_list != NULL) {
1321  result = 0;
1322  goto end;
1323  }
1324 
1325  end:
1326  SigGroupCleanup(de_ctx);
1327  SigCleanSignatures(de_ctx);
1328  DetectEngineCtxFree(de_ctx);
1329 
1330  return result;
1331 }
1332 
1333 /**
1334  * \test Parsing test
1335  */
1336 static int DetectUriSigTest12(void)
1337 {
1338  DetectEngineCtx *de_ctx = NULL;
1339  DetectContentData *ud = 0;
1340  Signature *s = NULL;
1341  int result = 0;
1342 
1343  de_ctx = DetectEngineCtxInit();
1344  if (de_ctx == NULL)
1345  goto end;
1346 
1347  de_ctx->flags |= DE_QUIET;
1348  s = de_ctx->sig_list = SigInit(de_ctx,
1349  "alert udp any any -> any any "
1350  "(msg:\"test\"; uricontent: !\"boo\"; sid:238012;)");
1351  if (de_ctx->sig_list == NULL) {
1352  printf("de_ctx->sig_list == NULL: ");
1353  goto end;
1354  }
1355 
1356  if (s->sm_lists_tail[g_http_uri_buffer_id] == NULL || s->sm_lists_tail[g_http_uri_buffer_id]->ctx == NULL) {
1357  printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx == NULL: ");
1358  goto end;
1359  }
1360 
1361  ud = (DetectContentData *)s->sm_lists_tail[g_http_uri_buffer_id]->ctx;
1362  result = (strncmp("boo", (char *)ud->content, ud->content_len) == 0);
1363 
1364 end:
1365  SigGroupCleanup(de_ctx);
1366  SigCleanSignatures(de_ctx);
1367  DetectEngineCtxFree(de_ctx);
1368 
1369  return result;
1370 }
1371 
1372 
1373 /**
1374  * \test Parsing test
1375  */
1376 static int DetectUriContentParseTest13(void)
1377 {
1378  DetectEngineCtx *de_ctx = NULL;
1379  int result = 1;
1380 
1381  de_ctx = DetectEngineCtxInit();
1382  if (de_ctx == NULL)
1383  goto end;
1384 
1385  de_ctx->flags |= DE_QUIET;
1386  de_ctx->sig_list = SigInit(de_ctx,
1387  "alert udp any any -> any any "
1388  "(msg:\"test\"; uricontent:\"|\"; sid:1;)");
1389  if (de_ctx->sig_list != NULL) {
1390  result = 0;
1391  goto end;
1392  }
1393 
1394  end:
1395  SigGroupCleanup(de_ctx);
1396  SigCleanSignatures(de_ctx);
1397  DetectEngineCtxFree(de_ctx);
1398 
1399  return result;
1400 }
1401 
1402 /**
1403  * \test Parsing test
1404  */
1405 static int DetectUriContentParseTest14(void)
1406 {
1407  DetectEngineCtx *de_ctx = NULL;
1408  int result = 1;
1409 
1410  de_ctx = DetectEngineCtxInit();
1411  if (de_ctx == NULL)
1412  goto end;
1413 
1414  de_ctx->flags |= DE_QUIET;
1415  de_ctx->sig_list = SigInit(de_ctx,
1416  "alert udp any any -> any any "
1417  "(msg:\"test\"; uricontent:\"|af\"; sid:1;)");
1418  if (de_ctx->sig_list != NULL) {
1419  result = 0;
1420  goto end;
1421  }
1422 
1423  end:
1424  SigGroupCleanup(de_ctx);
1425  SigCleanSignatures(de_ctx);
1426  DetectEngineCtxFree(de_ctx);
1427 
1428  return result;
1429 }
1430 
1431 /**
1432  * \test Parsing test
1433  */
1434 static int DetectUriContentParseTest15(void)
1435 {
1436  DetectEngineCtx *de_ctx = NULL;
1437  int result = 1;
1438 
1439  de_ctx = DetectEngineCtxInit();
1440  if (de_ctx == NULL)
1441  goto end;
1442 
1443  de_ctx->flags |= DE_QUIET;
1444  de_ctx->sig_list = SigInit(de_ctx,
1445  "alert udp any any -> any any "
1446  "(msg:\"test\"; uricontent:\"af|\"; sid:1;)");
1447  if (de_ctx->sig_list != NULL) {
1448  result = 0;
1449  goto end;
1450  }
1451 
1452  end:
1453  SigGroupCleanup(de_ctx);
1454  SigCleanSignatures(de_ctx);
1455  DetectEngineCtxFree(de_ctx);
1456 
1457  return result;
1458 }
1459 
1460 /**
1461  * \test Parsing test
1462  */
1463 static int DetectUriContentParseTest16(void)
1464 {
1465  DetectEngineCtx *de_ctx = NULL;
1466  int result = 1;
1467 
1468  de_ctx = DetectEngineCtxInit();
1469  if (de_ctx == NULL)
1470  goto end;
1471 
1472  de_ctx->flags |= DE_QUIET;
1473  de_ctx->sig_list = SigInit(de_ctx,
1474  "alert udp any any -> any any "
1475  "(msg:\"test\"; uricontent:\"|af|\"; sid:1;)");
1476  if (de_ctx->sig_list == NULL) {
1477  result = 0;
1478  goto end;
1479  }
1480 
1481  end:
1482  SigGroupCleanup(de_ctx);
1483  SigCleanSignatures(de_ctx);
1484  DetectEngineCtxFree(de_ctx);
1485 
1486  return result;
1487 }
1488 
1489 /**
1490  * \test Parsing test
1491  */
1492 static int DetectUriContentParseTest17(void)
1493 {
1494  DetectEngineCtx *de_ctx = NULL;
1495  int result = 1;
1496 
1497  de_ctx = DetectEngineCtxInit();
1498  if (de_ctx == NULL)
1499  goto end;
1500 
1501  de_ctx->flags |= DE_QUIET;
1502  de_ctx->sig_list = SigInit(de_ctx,
1503  "alert udp any any -> any any "
1504  "(msg:\"test\"; uricontent:\"aast|\"; sid:1;)");
1505  if (de_ctx->sig_list != NULL) {
1506  result = 0;
1507  goto end;
1508  }
1509 
1510  end:
1511  SigGroupCleanup(de_ctx);
1512  SigCleanSignatures(de_ctx);
1513  DetectEngineCtxFree(de_ctx);
1514 
1515  return result;
1516 }
1517 
1518 /**
1519  * \test Parsing test
1520  */
1521 static int DetectUriContentParseTest18(void)
1522 {
1523  DetectEngineCtx *de_ctx = NULL;
1524  int result = 1;
1525 
1526  de_ctx = DetectEngineCtxInit();
1527  if (de_ctx == NULL)
1528  goto end;
1529 
1530  de_ctx->flags |= DE_QUIET;
1531  de_ctx->sig_list = SigInit(de_ctx,
1532  "alert udp any any -> any any "
1533  "(msg:\"test\"; uricontent:\"aast|af\"; sid:1;)");
1534  if (de_ctx->sig_list != NULL) {
1535  result = 0;
1536  goto end;
1537  }
1538 
1539  end:
1540  SigGroupCleanup(de_ctx);
1541  SigCleanSignatures(de_ctx);
1542  DetectEngineCtxFree(de_ctx);
1543 
1544  return result;
1545 }
1546 
1547 /**
1548  * \test Parsing test
1549  */
1550 static int DetectUriContentParseTest19(void)
1551 {
1552  DetectEngineCtx *de_ctx = NULL;
1553  int result = 1;
1554 
1555  de_ctx = DetectEngineCtxInit();
1556  if (de_ctx == NULL)
1557  goto end;
1558 
1559  de_ctx->flags |= DE_QUIET;
1560  de_ctx->sig_list = SigInit(de_ctx,
1561  "alert udp any any -> any any "
1562  "(msg:\"test\"; uricontent:\"aast|af|\"; sid:1;)");
1563  if (de_ctx->sig_list == NULL) {
1564  result = 0;
1565  goto end;
1566  }
1567 
1568  end:
1569  SigGroupCleanup(de_ctx);
1570  SigCleanSignatures(de_ctx);
1571  DetectEngineCtxFree(de_ctx);
1572 
1573  return result;
1574 }
1575 
1576 /**
1577  * \test Parsing test
1578  */
1579 static int DetectUriContentParseTest20(void)
1580 {
1581  DetectEngineCtx *de_ctx = NULL;
1582  int result = 1;
1583 
1584  de_ctx = DetectEngineCtxInit();
1585  if (de_ctx == NULL)
1586  goto end;
1587 
1588  de_ctx->flags |= DE_QUIET;
1589  de_ctx->sig_list = SigInit(de_ctx,
1590  "alert udp any any -> any any "
1591  "(msg:\"test\"; uricontent:\"|af|asdf\"; sid:1;)");
1592  if (de_ctx->sig_list == NULL) {
1593  result = 0;
1594  goto end;
1595  }
1596 
1597  end:
1598  SigGroupCleanup(de_ctx);
1599  SigCleanSignatures(de_ctx);
1600  DetectEngineCtxFree(de_ctx);
1601 
1602  return result;
1603 }
1604 
1605 /**
1606  * \test Parsing test
1607  */
1608 static int DetectUriContentParseTest21(void)
1609 {
1610  DetectEngineCtx *de_ctx = NULL;
1611  int result = 1;
1612 
1613  de_ctx = DetectEngineCtxInit();
1614  if (de_ctx == NULL)
1615  goto end;
1616 
1617  de_ctx->flags |= DE_QUIET;
1618  de_ctx->sig_list = SigInit(de_ctx,
1619  "alert udp any any -> any any "
1620  "(msg:\"test\"; uricontent:\"|af|af|\"; sid:1;)");
1621  if (de_ctx->sig_list != NULL) {
1622  result = 0;
1623  goto end;
1624  }
1625 
1626  end:
1627  SigGroupCleanup(de_ctx);
1628  SigCleanSignatures(de_ctx);
1629  DetectEngineCtxFree(de_ctx);
1630 
1631  return result;
1632 }
1633 
1634 /**
1635  * \test Parsing test
1636  */
1637 static int DetectUriContentParseTest22(void)
1638 {
1639  DetectEngineCtx *de_ctx = NULL;
1640  int result = 1;
1641 
1642  de_ctx = DetectEngineCtxInit();
1643  if (de_ctx == NULL)
1644  goto end;
1645 
1646  de_ctx->flags |= DE_QUIET;
1647  de_ctx->sig_list = SigInit(de_ctx,
1648  "alert udp any any -> any any "
1649  "(msg:\"test\"; uricontent:\"|af|af|af\"; sid:1;)");
1650  if (de_ctx->sig_list != NULL) {
1651  result = 0;
1652  goto end;
1653  }
1654 
1655  end:
1656  SigGroupCleanup(de_ctx);
1657  SigCleanSignatures(de_ctx);
1658  DetectEngineCtxFree(de_ctx);
1659 
1660  return result;
1661 }
1662 
1663 /**
1664  * \test Parsing test
1665  */
1666 static int DetectUriContentParseTest23(void)
1667 {
1668  DetectEngineCtx *de_ctx = NULL;
1669  int result = 1;
1670 
1671  de_ctx = DetectEngineCtxInit();
1672  if (de_ctx == NULL)
1673  goto end;
1674 
1675  de_ctx->flags |= DE_QUIET;
1676  de_ctx->sig_list = SigInit(de_ctx,
1677  "alert udp any any -> any any "
1678  "(msg:\"test\"; uricontent:\"|af|af|af|\"; sid:1;)");
1679  if (de_ctx->sig_list == NULL) {
1680  result = 0;
1681  goto end;
1682  }
1683 
1684  end:
1685  SigGroupCleanup(de_ctx);
1686  SigCleanSignatures(de_ctx);
1687  DetectEngineCtxFree(de_ctx);
1688 
1689  return result;
1690 }
1691 
1692 /**
1693  * \test Parsing test
1694  */
1695 static int DetectUriContentParseTest24(void)
1696 {
1697  DetectEngineCtx *de_ctx = NULL;
1698  int result = 1;
1699 
1700  de_ctx = DetectEngineCtxInit();
1701  if (de_ctx == NULL)
1702  goto end;
1703 
1704  de_ctx->flags |= DE_QUIET;
1705  de_ctx->sig_list = SigInit(de_ctx,
1706  "alert tcp any any -> any any "
1707  "(msg:\"test\"; uricontent:\"\"; sid:1;)");
1708  if (de_ctx->sig_list != NULL) {
1709  result = 0;
1710  goto end;
1711  }
1712 
1713  end:
1714  SigGroupCleanup(de_ctx);
1715  SigCleanSignatures(de_ctx);
1716  DetectEngineCtxFree(de_ctx);
1717 
1718  return result;
1719 }
1720 
1721 static int DetectUricontentIsdataatParseTest(void)
1722 {
1724  FAIL_IF_NULL(de_ctx);
1725  de_ctx->flags |= DE_QUIET;
1726 
1727  Signature *s = DetectEngineAppendSig(de_ctx,
1728  "alert tcp any any -> any any ("
1729  "uricontent:\"one\"; "
1730  "isdataat:!4,relative; sid:1;)");
1731  FAIL_IF_NULL(s);
1732 
1733  SigMatch *sm = s->init_data->smlists_tail[g_http_uri_buffer_id];
1734  FAIL_IF_NULL(sm);
1736 
1737  DetectIsdataatData *data = (DetectIsdataatData *)sm->ctx;
1740  FAIL_IF(data->flags & ISDATAAT_RAWBYTES);
1741 
1742  DetectEngineCtxFree(de_ctx);
1743  PASS;
1744 }
1745 
1746 #endif /* UNITTESTS */
1747 
1748 static void DetectUricontentRegisterTests(void)
1749 {
1750 #ifdef UNITTESTS
1751  UtRegisterTest("HTTPUriTest01", HTTPUriTest01);
1752  UtRegisterTest("HTTPUriTest02", HTTPUriTest02);
1753  UtRegisterTest("HTTPUriTest03", HTTPUriTest03);
1754  UtRegisterTest("HTTPUriTest04", HTTPUriTest04);
1755 
1756  UtRegisterTest("DetectUriSigTest01", DetectUriSigTest01);
1757  UtRegisterTest("DetectUriSigTest02", DetectUriSigTest02);
1758  UtRegisterTest("DetectUriSigTest03", DetectUriSigTest03);
1759  UtRegisterTest("DetectUriSigTest04 - Modifiers", DetectUriSigTest04);
1760  UtRegisterTest("DetectUriSigTest05 - Inspection", DetectUriSigTest05);
1761  UtRegisterTest("DetectUriSigTest06 - Inspection", DetectUriSigTest06);
1762  UtRegisterTest("DetectUriSigTest07 - Inspection", DetectUriSigTest07);
1763  UtRegisterTest("DetectUriSigTest08", DetectUriSigTest08);
1764  UtRegisterTest("DetectUriSigTest09", DetectUriSigTest09);
1765  UtRegisterTest("DetectUriSigTest10", DetectUriSigTest10);
1766  UtRegisterTest("DetectUriSigTest11", DetectUriSigTest11);
1767  UtRegisterTest("DetectUriSigTest12", DetectUriSigTest12);
1768 
1769  UtRegisterTest("DetectUriContentParseTest13", DetectUriContentParseTest13);
1770  UtRegisterTest("DetectUriContentParseTest14", DetectUriContentParseTest14);
1771  UtRegisterTest("DetectUriContentParseTest15", DetectUriContentParseTest15);
1772  UtRegisterTest("DetectUriContentParseTest16", DetectUriContentParseTest16);
1773  UtRegisterTest("DetectUriContentParseTest17", DetectUriContentParseTest17);
1774  UtRegisterTest("DetectUriContentParseTest18", DetectUriContentParseTest18);
1775  UtRegisterTest("DetectUriContentParseTest19", DetectUriContentParseTest19);
1776  UtRegisterTest("DetectUriContentParseTest20", DetectUriContentParseTest20);
1777  UtRegisterTest("DetectUriContentParseTest21", DetectUriContentParseTest21);
1778  UtRegisterTest("DetectUriContentParseTest22", DetectUriContentParseTest22);
1779  UtRegisterTest("DetectUriContentParseTest23", DetectUriContentParseTest23);
1780  UtRegisterTest("DetectUriContentParseTest24", DetectUriContentParseTest24);
1781 
1782  UtRegisterTest("DetectUricontentIsdataatParseTest",
1783  DetectUricontentIsdataatParseTest);
1784 #endif /* UNITTESTS */
1785 }
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect.h:1403
SignatureInitData * init_data
Definition: detect.h:560
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1146
#define SCLogDebug(...)
Definition: util-debug.h:335
int DetectHttpUriSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)
this function setups the http_uri modifier keyword used in the rule
struct Flow_ * flow
Definition: decode.h:444
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
#define BUG_ON(x)
uint8_t proto
Definition: flow.h:346
#define FLOWLOCK_UNLOCK(fb)
Definition: flow.h:235
#define PASS
Pass the test.
#define unlikely(expr)
Definition: util-optimize.h:35
Signature * SigInit(DetectEngineCtx *, const char *)
Parses a signature and adds it to the Detection Engine Context.
int UTHAddStreamToFlow(Flow *f, int direction, uint8_t *data, uint32_t data_len)
void DetectContentPrint(DetectContentData *cd)
Helper function to print a DetectContentData.
Signature * sig_list
Definition: detect.h:726
int DetectContentSetup(DetectEngineCtx *de_ctx, Signature *s, const char *contentstr)
Function to setup a content pattern.
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:195
void SigCleanSignatures(DetectEngineCtx *de_ctx)
#define ISDATAAT_RELATIVE
void StreamTcpFreeConfig(char quiet)
Definition: stream-tcp.c:669
#define FLOWLOCK_WRLOCK(fb)
Definition: flow.h:232
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
#define ISDATAAT_RAWBYTES
const char * name
Definition: detect.h:1160
TCPHdr * tcph
Definition: decode.h:525
Signature container.
Definition: detect.h:492
#define TRUE
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:331
void * protoctx
Definition: flow.h:398
main detection engine ctx
Definition: detect.h:720
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
void * alstate
Definition: flow.h:436
#define DE_QUIET
Definition: detect.h:298
Flow * UTHBuildFlow(int family, const char *src, const char *dst, Port sp, Port dp)
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
void DetectUricontentRegister(void)
Registration function for uricontent: keyword.
uint8_t flags
Definition: detect.h:721
Data structures and function prototypes for keeping state for the detection engine.
void(* Free)(void *)
Definition: detect.h:1151
#define ISDATAAT_NEGATED
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
#define FLOW_DESTROY(f)
Definition: flow-util.h:115
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
#define STREAM_EOF
Definition: stream.h:30
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
void SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:1752
#define SIGMATCH_QUOTES_MANDATORY
Definition: detect.h:1344
#define SCEnter(...)
Definition: util-debug.h:337
void StreamTcpInitConfig(char)
To initialize the stream global configuration data.
Definition: stream-tcp.c:365
uint8_t flowflags
Definition: decode.h:438
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
#define FLOW_PKT_TOSERVER
Definition: flow.h:193
struct SigMatch_ ** smlists_tail
Definition: detect.h:488
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol&#39;s parser thread context.
int SigGroupCleanup(DetectEngineCtx *de_ctx)
struct Signature_ * next
Definition: detect.h:563
uint8_t type
Definition: detect.h:325
#define SCReturnInt(x)
Definition: util-debug.h:341
int UTHRemoveSessionFromFlow(Flow *f)
int DetectBufferTypeRegister(const char *name)
SigMatchCtx * ctx
Definition: detect.h:327
#define SCMalloc(a)
Definition: util-mem.h:174
#define DETECT_CONTENT_NEGATED
#define SCFree(a)
Definition: util-mem.h:236
int UTHAddSessionToFlow(Flow *f, uint32_t ts_isn, uint32_t tc_isn)
int(* Match)(ThreadVars *, DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1129
#define STREAM_START
Definition: stream.h:29
void SpmDestroyCtx(SpmCtx *ctx)
Definition: util-spm.c:176
#define FLOW_INITIALIZE(f)
Definition: flow-util.h:39
#define STREAM_TOSERVER
Definition: stream.h:31
#define PKT_HAS_FLOW
Definition: decode.h:1101
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
#define DETECT_CONTENT_RELATIVE_NEXT
#define SCReturn
Definition: util-debug.h:339
Per thread variable structure.
Definition: threadvars.h:57
AppProto alproto
application level protocol
Definition: flow.h:407
uint32_t flags
Definition: decode.h:442
#define SIGMATCH_HANDLE_NEGATION
Definition: detect.h:1348
uint16_t flags
Definition: detect.h:1154
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself...
Flow data structure.
Definition: flow.h:327
#define FLOW_IPV4
Definition: flow.h:93
uint32_t flags
Definition: flow.h:377
#define PKT_STREAM_EST
Definition: decode.h:1099
void(* RegisterTests)(void)
Definition: detect.h:1152
a single match condition for a signature
Definition: detect.h:324
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, uint8_t *input, uint32_t input_len)
void UTHFreeFlow(Flow *flow)
DetectEngineCtx * DetectEngineCtxInit(void)