suricata
detect-uricontent.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>
23  *
24  * Simple uricontent match part of the detection engine.
25  */
26 
27 #include "suricata-common.h"
28 #include "decode.h"
29 #include "detect.h"
30 #include "detect-content.h"
31 #include "detect-http-uri.h"
32 #include "detect-uricontent.h"
33 #include "detect-engine-mpm.h"
34 #include "detect-parse.h"
35 #include "detect-engine.h"
36 #include "detect-engine-state.h"
37 #include "flow.h"
38 #include "detect-flow.h"
39 #include "flow-var.h"
40 #include "flow-util.h"
41 #include "threads.h"
42 
43 #include "stream-tcp.h"
44 #include "stream.h"
45 #include "app-layer.h"
46 #include "app-layer-parser.h"
47 #include "app-layer-protos.h"
48 #include "app-layer-htp.h"
49 
50 #include "util-mpm.h"
51 #include "util-print.h"
52 #include "util-debug.h"
53 #include "util-unittest.h"
54 #include "util-unittest-helper.h"
55 #include "util-spm.h"
56 #include "conf.h"
57 
58 /* prototypes */
59 static int DetectUricontentSetup (DetectEngineCtx *, Signature *, const char *);
60 #ifdef UNITTESTS
61 static void DetectUricontentRegisterTests(void);
62 #endif
63 static void DetectUricontentFree(DetectEngineCtx *de_ctx, void *);
64 
65 static int g_http_uri_buffer_id = 0;
66 
67 /**
68  * \brief Registration function for uricontent: keyword
69  */
71 {
72  sigmatch_table[DETECT_URICONTENT].name = "uricontent";
73  sigmatch_table[DETECT_URICONTENT].desc = "legacy keyword to match on the request URI buffer";
74  sigmatch_table[DETECT_URICONTENT].url = "/rules/http-keywords.html#uricontent";
76  sigmatch_table[DETECT_URICONTENT].Setup = DetectUricontentSetup;
77  sigmatch_table[DETECT_URICONTENT].Free = DetectUricontentFree;
78 #ifdef UNITTESTS
79  sigmatch_table[DETECT_URICONTENT].RegisterTests = DetectUricontentRegisterTests;
80 #endif
83 
84  g_http_uri_buffer_id = DetectBufferTypeRegister("http_uri");
85 }
86 
87 /**
88  * \brief this function will Free memory associated with DetectContentData
89  *
90  * \param cd pointer to DetectUricotentData
91  */
92 void DetectUricontentFree(DetectEngineCtx *de_ctx, void *ptr)
93 {
94  SCEnter();
96 
97  if (cd == NULL)
98  SCReturn;
99 
100  SpmDestroyCtx(cd->spm_ctx);
101  SCFree(cd);
102 
103  SCReturn;
104 }
105 
106 /**
107  * \brief Creates a SigMatch for the uricontent keyword being sent as argument,
108  * and appends it to the Signature(s).
109  *
110  * \param de_ctx Pointer to the detection engine context
111  * \param s Pointer to signature for the current Signature being parsed
112  * from the rules
113  * \param contentstr Pointer to the string holding the keyword value
114  *
115  * \retval 0 on success, -1 on failure
116  */
117 int DetectUricontentSetup(DetectEngineCtx *de_ctx, Signature *s, const char *contentstr)
118 {
119  SCEnter();
120 
121  const char *legacy = NULL;
122  if (ConfGet("legacy.uricontent", &legacy) == 1) {
123  if (strcasecmp("disabled", legacy) == 0) {
124  SCLogError(SC_ERR_INVALID_SIGNATURE, "uriconent deprecated. To "
125  "use a rule with \"uricontent\", either set the "
126  "option - \"legacy.uricontent\" in the conf to "
127  "\"enabled\" OR replace uricontent with "
128  "\'content:%s; http_uri;\'.", contentstr);
129  goto error;
130  } else if (strcasecmp("enabled", legacy) == 0) {
131  ;
132  } else {
133  SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid value found "
134  "for legacy.uriconent - \"%s\". Valid values are "
135  "\"enabled\" OR \"disabled\".", legacy);
136  goto error;
137  }
138  }
139 
140  if (DetectContentSetup(de_ctx, s, contentstr) < 0)
141  goto error;
142 
143  if (DetectHttpUriSetup(de_ctx, s, NULL) < 0)
144  goto error;
145 
146  SCReturnInt(0);
147 error:
148  SCReturnInt(-1);
149 }
150 
151 /*
152  * UNITTTESTS
153  */
154 
155 #ifdef UNITTESTS
156 
157 #include "detect-isdataat.h"
158 #include "stream-tcp-reassemble.h"
159 
160 /**
161  * \brief Helper function to print a DetectContentData
162  */
163 static void DetectUricontentPrint(DetectContentData *cd)
164 {
165  int i = 0;
166  if (cd == NULL) {
167  SCLogDebug("Detect UricontentData \"cd\" is NULL");
168  return;
169  }
170  char *tmpstr = SCMalloc(sizeof(char) * cd->content_len + 1);
171  if (unlikely(tmpstr == NULL))
172  return;
173 
174  if (tmpstr != NULL) {
175  for (i = 0; i < cd->content_len; i++) {
176  if (isprint(cd->content[i]))
177  tmpstr[i] = cd->content[i];
178  else
179  tmpstr[i] = '.';
180  }
181  tmpstr[i] = '\0';
182  SCLogDebug("Uricontent: \"%s\"", tmpstr);
183  SCFree(tmpstr);
184  } else {
185  SCLogDebug("Uricontent: ");
186  for (i = 0; i < cd->content_len; i++)
187  SCLogDebug("%c", cd->content[i]);
188  }
189 
190  SCLogDebug("Uricontent_id: %"PRIu32, cd->id);
191  SCLogDebug("Uricontent_len: %"PRIu16, cd->content_len);
192  SCLogDebug("Depth: %"PRIu16, cd->depth);
193  SCLogDebug("Offset: %"PRIu16, cd->offset);
194  SCLogDebug("Within: %"PRIi32, cd->within);
195  SCLogDebug("Distance: %"PRIi32, cd->distance);
196  SCLogDebug("flags: %u ", cd->flags);
197  SCLogDebug("negated: %s ",
198  cd->flags & DETECT_CONTENT_NEGATED ? "true" : "false");
199  SCLogDebug("relative match next: %s ",
200  cd->flags & DETECT_CONTENT_RELATIVE_NEXT ? "true" : "false");
201  SCLogDebug("-----------");
202 }
203 
204 /** \test Test case where path traversal has been sent as a path string in the
205  * HTTP URL and normalized path string is checked */
206 static int HTTPUriTest01(void)
207 {
208  int result = 0;
209  Flow f;
210  uint8_t httpbuf1[] = "GET /../../images.gif HTTP/1.1\r\nHost: www.ExA"
211  "mPlE.cOM\r\n\r\n";
212  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
213  TcpSession ssn;
214  int r = 0;
216  memset(&f, 0, sizeof(f));
217  memset(&ssn, 0, sizeof(ssn));
218 
219  FLOW_INITIALIZE(&f);
220  f.protoctx = (void *)&ssn;
221  f.proto = IPPROTO_TCP;
222  f.alproto = ALPROTO_HTTP;
223  f.flags |= FLOW_IPV4;
224 
226 
227  FLOWLOCK_WRLOCK(&f);
230  httpbuf1,
231  httplen1);
232  if (r != 0) {
233  printf("AppLayerParse failed: r(%d) != 0: ", r);
234  goto end;
235  }
236 
237  HtpState *htp_state = f.alstate;
238  if (htp_state == NULL) {
239  printf("no http state: ");
240  goto end;
241  }
242 
243  htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0);
244 
245  if (tx->request_method_number != HTP_M_GET ||
246  tx->request_protocol_number != HTP_PROTOCOL_1_1)
247  {
248  goto end;
249  }
250 
251  if ((tx->request_hostname == NULL) ||
252  (bstr_cmp_c(tx->request_hostname, "www.example.com") != 0))
253  {
254  goto end;
255  }
256 
257  if ((tx->parsed_uri->path == NULL) ||
258  (bstr_cmp_c(tx->parsed_uri->path, "/images.gif") != 0))
259  {
260  goto end;
261  }
262 
263  result = 1;
264 end:
265  if (alp_tctx != NULL)
268  FLOWLOCK_UNLOCK(&f);
269  FLOW_DESTROY(&f);
270  return result;
271 }
272 
273 /** \test Test case where path traversal has been sent in special characters in
274  * HEX encoding in the HTTP URL and normalized path string is checked */
275 static int HTTPUriTest02(void)
276 {
277  int result = 0;
278  Flow f;
279  HtpState *htp_state = NULL;
280  uint8_t httpbuf1[] = "GET /%2e%2e/images.gif HTTP/1.1\r\nHost: www.ExA"
281  "mPlE.cOM\r\n\r\n";
282  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
283  TcpSession ssn;
284  int r = 0;
286 
287  memset(&f, 0, sizeof(f));
288  memset(&ssn, 0, sizeof(ssn));
289 
290  FLOW_INITIALIZE(&f);
291  f.protoctx = (void *)&ssn;
292  f.proto = IPPROTO_TCP;
293  f.alproto = ALPROTO_HTTP;
294  f.flags |= FLOW_IPV4;
295 
297 
298  FLOWLOCK_WRLOCK(&f);
301  httpbuf1,
302  httplen1);
303  if (r != 0) {
304  printf("AppLayerParse failed: r(%d) != 0: ", r);
305  goto end;
306  }
307 
308  htp_state = f.alstate;
309  if (htp_state == NULL) {
310  printf("no http state: ");
311  goto end;
312  }
313 
314  htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0);
315 
316  if (tx->request_method_number != HTP_M_GET ||
317  tx->request_protocol_number != HTP_PROTOCOL_1_1)
318  {
319  goto end;
320  }
321 
322  if ((tx->request_hostname == NULL) ||
323  (bstr_cmp_c(tx->request_hostname, "www.example.com") != 0))
324  {
325  goto end;
326  }
327 
328  if ((tx->parsed_uri->path == NULL) ||
329  (bstr_cmp_c(tx->parsed_uri->path, "/images.gif") != 0))
330  {
331  goto end;
332  }
333 
334  result = 1;
335 end:
336  if (alp_tctx != NULL)
339  FLOWLOCK_UNLOCK(&f);
340  FLOW_DESTROY(&f);
341  return result;
342 }
343 
344 /** \test Test case where NULL character has been sent in HEX encoding in the
345  * HTTP URL and normalized path string is checked */
346 static int HTTPUriTest03(void)
347 {
348  int result = 0;
349  Flow f;
350  HtpState *htp_state = NULL;
351  uint8_t httpbuf1[] = "GET%00 /images.gif HTTP/1.1\r\nHost: www.ExA"
352  "mPlE.cOM\r\n\r\n";
353  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
354  TcpSession ssn;
355  int r = 0;
357 
358  memset(&f, 0, sizeof(f));
359  memset(&ssn, 0, sizeof(ssn));
360 
361  FLOW_INITIALIZE(&f);
362  f.protoctx = (void *)&ssn;
363  f.proto = IPPROTO_TCP;
364  f.alproto = ALPROTO_HTTP;
365  f.flags |= FLOW_IPV4;
366 
368 
369  FLOWLOCK_WRLOCK(&f);
372  httpbuf1,
373  httplen1);
374  if (r != 0) {
375  printf("AppLayerParse failed: r(%d) != 0: ", r);
376  goto end;
377  }
378 
379  htp_state = f.alstate;
380  if (htp_state == NULL) {
381  printf("no http state: ");
382  goto end;
383  }
384 
385  htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0);
386 
387  if (tx->request_method_number != HTP_M_UNKNOWN ||
388  tx->request_protocol_number != HTP_PROTOCOL_1_1)
389  {
390  goto end;
391  }
392 
393  if ((tx->request_hostname == NULL) ||
394  (bstr_cmp_c(tx->request_hostname, "www.example.com") != 0))
395  {
396  goto end;
397  }
398 
399  if ((tx->parsed_uri->path == NULL) ||
400  (bstr_cmp_c(tx->parsed_uri->path, "/images.gif") != 0))
401  {
402  goto end;
403  }
404 
405  result = 1;
406 end:
407  if (alp_tctx != NULL)
410  FLOWLOCK_UNLOCK(&f);
411  FLOW_DESTROY(&f);
412  return result;
413 }
414 
415 
416 /** \test Test case where self referencing directories request has been sent
417  * in the HTTP URL and normalized path string is checked */
418 static int HTTPUriTest04(void)
419 {
420  int result = 0;
421  Flow f;
422  HtpState *htp_state = NULL;
423  uint8_t httpbuf1[] = "GET /./././images.gif HTTP/1.1\r\nHost: www.ExA"
424  "mPlE.cOM\r\n\r\n";
425  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
426  TcpSession ssn;
427  int r = 0;
429 
430  memset(&f, 0, sizeof(f));
431  memset(&ssn, 0, sizeof(ssn));
432 
433  FLOW_INITIALIZE(&f);
434  f.protoctx = (void *)&ssn;
435  f.proto = IPPROTO_TCP;
436  f.alproto = ALPROTO_HTTP;
437  f.flags |= FLOW_IPV4;
438 
440 
441  FLOWLOCK_WRLOCK(&f);
444  httpbuf1,
445  httplen1);
446  if (r != 0) {
447  printf("AppLayerParse failed: r(%d) != 0: ", r);
448  goto end;
449  }
450 
451  htp_state = f.alstate;
452  if (htp_state == NULL) {
453  printf("no http state: ");
454  goto end;
455  }
456 
457  htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0);
458 
459  if (tx->request_method_number != HTP_M_GET ||
460  tx->request_protocol_number != HTP_PROTOCOL_1_1)
461  {
462  goto end;
463  }
464 
465  if ((tx->request_hostname == NULL) ||
466  (bstr_cmp_c(tx->request_hostname, "www.example.com") != 0))
467  {
468  goto end;
469  }
470 
471  if ((tx->parsed_uri->path == NULL) ||
472  (bstr_cmp_c(tx->parsed_uri->path, "/images.gif") != 0))
473  {
474  goto end;
475  }
476 
477  result = 1;
478 end:
479  if (alp_tctx != NULL)
482  FLOWLOCK_UNLOCK(&f);
483  FLOW_DESTROY(&f);
484  return result;
485 }
486 
487 /**
488  * \test Checks if a uricontent is registered in a Signature
489  */
490 static int DetectUriSigTest01(void)
491 {
492  ThreadVars th_v;
493  Signature *s = NULL;
494 
495  memset(&th_v, 0, sizeof(th_v));
496 
499  de_ctx->flags |= DE_QUIET;
500 
501  s = DetectEngineAppendSig(de_ctx,"alert http any any -> any any (msg:"
502  "\" Test uricontent\"; content:\"me\"; uricontent:\"me\"; sid:1;)");
503  FAIL_IF_NULL(s);
504 
505  BUG_ON(s->sm_lists[g_http_uri_buffer_id] == NULL);
506  FAIL_IF_NOT(de_ctx->sig_list->sm_lists[g_http_uri_buffer_id]->type == DETECT_CONTENT);
507 
509  PASS;
510 }
511 
512 /** \test Check the signature working to alert when http_cookie is matched . */
513 static int DetectUriSigTest02(void)
514 {
515  int result = 0;
516  Flow f;
517  uint8_t httpbuf1[] = "POST /one HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:"
518  " hellocatch\r\n\r\n";
519  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
520  TcpSession ssn;
521  Packet *p = NULL;
522  Signature *s = NULL;
523  ThreadVars th_v;
524  DetectEngineThreadCtx *det_ctx = NULL;
525  HtpState *http_state = NULL;
527 
528  memset(&th_v, 0, sizeof(th_v));
529  memset(&f, 0, sizeof(f));
530  memset(&ssn, 0, sizeof(ssn));
531 
532  p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP);
533 
534  FLOW_INITIALIZE(&f);
535  f.protoctx = (void *)&ssn;
536  f.proto = IPPROTO_TCP;
537  f.flags |= FLOW_IPV4;
538 
539  p->flow = &f;
543  f.alproto = ALPROTO_HTTP;
544 
546 
548  if (de_ctx == NULL) {
549  goto end;
550  }
551  de_ctx->flags |= DE_QUIET;
552 
553  s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
554  "\" Test uricontent\"; "
555  "uricontent:\"foo\"; sid:1;)");
556  if (s == NULL) {
557  goto end;
558  }
559 
560  s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
561  "\" Test uricontent\"; "
562  "uricontent:\"one\"; sid:2;)");
563  if (s == NULL) {
564  goto end;
565  }
566 
567  s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
568  "\" Test uricontent\"; "
569  "uricontent:\"oisf\"; sid:3;)");
570  if (s == NULL) {
571  goto end;
572  }
573 
574 
576  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
577 
578  FLOWLOCK_WRLOCK(&f);
579  int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
580  STREAM_TOSERVER, httpbuf1, httplen1);
581  if (r != 0) {
582  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
583  FLOWLOCK_UNLOCK(&f);
584  goto end;
585  }
586  FLOWLOCK_UNLOCK(&f);
587 
588  http_state = f.alstate;
589  if (http_state == NULL) {
590  printf("no http state: ");
591  goto end;
592  }
593 
594  /* do detect */
595  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
596 
597  if ((PacketAlertCheck(p, 1))) {
598  printf("sig: 1 alerted, but it should not\n");
599  goto end;
600  } else if (!PacketAlertCheck(p, 2)) {
601  printf("sig: 2 did not alerted, but it should\n");
602  goto end;
603  } else if ((PacketAlertCheck(p, 3))) {
604  printf("sig: 3 alerted, but it should not\n");
605  goto end;
606  }
607 
608  result = 1;
609 end:
610  if (alp_tctx != NULL)
612  //if (http_state != NULL) HTPStateFree(http_state);
613  if (de_ctx != NULL) SigCleanSignatures(de_ctx);
614  if (de_ctx != NULL) SigGroupCleanup(de_ctx);
615  if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, det_ctx);
616  if (de_ctx != NULL) DetectEngineCtxFree(de_ctx);
617 
619  FLOW_DESTROY(&f);
620  UTHFreePackets(&p, 1);
621  return result;
622 }
623 
624 /** \test Check the working of search once per packet only in applayer
625  * match */
626 static int DetectUriSigTest03(void)
627 {
628  int result = 0;
629  Flow f;
630  HtpState *http_state = NULL;
631  uint8_t httpbuf1[] = "POST /one HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:"
632  " hellocatch\r\n\r\n";
633  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
634  uint8_t httpbuf2[] = "POST /oneself HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:"
635  " hellocatch\r\n\r\n";
636  uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
637  TcpSession ssn;
638  Packet *p = NULL;
639  Signature *s = NULL;
640  ThreadVars th_v;
641  DetectEngineThreadCtx *det_ctx = NULL;
643 
644  memset(&th_v, 0, sizeof(th_v));
645  memset(&f, 0, sizeof(f));
646  memset(&ssn, 0, sizeof(ssn));
647 
648  p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP);
649 
650  FLOW_INITIALIZE(&f);
651  f.protoctx = (void *)&ssn;
652  f.proto = IPPROTO_TCP;
653  f.flags |= FLOW_IPV4;
654 
655  p->flow = &f;
659  f.alproto = ALPROTO_HTTP;
660 
662 
664  if (de_ctx == NULL) {
665  goto end;
666  }
667  de_ctx->flags |= DE_QUIET;
668 
669  s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
670  "\" Test uricontent\"; "
671  "uricontent:\"foo\"; sid:1;)");
672  if (s == NULL) {
673  goto end;
674  }
675 
676  s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
677  "\" Test uricontent\"; "
678  "uricontent:\"one\"; sid:2;)");
679  if (s == NULL) {
680  goto end;
681  }
682 
683  s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
684  "\" Test uricontent\"; "
685  "uricontent:\"self\"; sid:3;)");
686  if (s == NULL) {
687  goto end;
688  }
689 
690 
692  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
693 
694  FLOWLOCK_WRLOCK(&f);
695  int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP,
696  STREAM_TOSERVER, httpbuf1, httplen1);
697  if (r != 0) {
698  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
699  FLOWLOCK_UNLOCK(&f);
700  goto end;
701  }
702  FLOWLOCK_UNLOCK(&f);
703 
704  /* do detect */
705  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
706 
707  if ((PacketAlertCheck(p, 1))) {
708  printf("sig 1 alerted, but it should not: ");
709  goto end;
710  } else if (!PacketAlertCheck(p, 2)) {
711  printf("sig 2 did not alert, but it should: ");
712  goto end;
713  } else if ((PacketAlertCheck(p, 3))) {
714  printf("sig 3 alerted, but it should not: ");
715  goto end;
716  }
717 
718 
719  FLOWLOCK_WRLOCK(&f);
721  STREAM_TOSERVER, httpbuf2, httplen2);
722  if (r != 0) {
723  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
724  FLOWLOCK_UNLOCK(&f);
725  goto end;
726  }
727  FLOWLOCK_UNLOCK(&f);
728 
729  http_state = f.alstate;
730  if (http_state == NULL) {
731  printf("no http state: ");
732  goto end;
733  }
734 
735  /* do detect */
736  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
737 
738  if ((PacketAlertCheck(p, 1))) {
739  printf("sig 1 alerted, but it should not (chunk 2): ");
740  goto end;
741  } else if (!PacketAlertCheck(p, 2)) {
742  printf("sig 2 alerted, but it should not (chunk 2): ");
743  goto end;
744  } else if (!(PacketAlertCheck(p, 3))) {
745  printf("sig 3 did not alert, but it should (chunk 2): ");
746  goto end;
747  }
748 
749  result = 1;
750 
751 end:
752  if (alp_tctx != NULL)
754  if (de_ctx != NULL) SigGroupCleanup(de_ctx);
755  if (de_ctx != NULL) SigCleanSignatures(de_ctx);
756  if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, det_ctx);
757  if (de_ctx != NULL) DetectEngineCtxFree(de_ctx);
758 
760  FLOW_DESTROY(&f);
761  UTHFreePackets(&p, 1);
762  return result;
763 }
764 
765 /**
766  * \test Check that modifiers of content apply only to content keywords
767  * and the same for uricontent modifiers
768  */
769 static int DetectUriSigTest04(void)
770 {
771  int result = 0;
772  Signature *s = NULL;
773 
775  if (de_ctx == NULL) {
776  goto end;
777  }
778 
779  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
780  "\" Test uricontent\"; "
781  "uricontent:\"foo\"; sid:1;)");
782  if (s == NULL ||
783  s->sm_lists[g_http_uri_buffer_id] == NULL ||
784  s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL ||
785  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
786  {
787  printf("sig 1 failed to parse: ");
788  goto end;
789  }
790 
791  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
792  "\" Test uricontent and content\"; "
793  "uricontent:\"foo\"; content:\"bar\";sid:1;)");
794  if (s == NULL ||
795  s->sm_lists[g_http_uri_buffer_id] == NULL ||
796  s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
797  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
798  {
799  printf("sig 2 failed to parse: ");
800  goto end;
801  }
802 
803  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
804  "\" Test uricontent and content\"; "
805  "uricontent:\"foo\"; content:\"bar\";"
806  " depth:10; offset: 5; sid:1;)");
807  if (s == NULL ||
808  s->sm_lists[g_http_uri_buffer_id] == NULL ||
809  s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
810  ((DetectContentData *)s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
811  ((DetectContentData *)s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
812  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
813  {
814  printf("sig 3 failed to parse: ");
815  goto end;
816  }
817 
818  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
819  "\" Test uricontent and content\"; "
820  "content:\"foo\"; uricontent:\"bar\";"
821  " depth:10; offset: 5; sid:1;)");
822  if (s == NULL ||
823  s->sm_lists[g_http_uri_buffer_id] == NULL ||
824  s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
825  ((DetectContentData *)s->sm_lists[g_http_uri_buffer_id]->ctx)->depth != 15 ||
826  ((DetectContentData *)s->sm_lists[g_http_uri_buffer_id]->ctx)->offset != 5 ||
827  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
828  {
829  printf("sig 4 failed to parse: ");
830  goto end;
831  }
832 
833  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
834  "\" Test uricontent and content\"; "
835  "uricontent:\"foo\"; content:\"bar\";"
836  " depth:10; offset: 5; within:3; sid:1;)");
837  if (s != NULL) {
838  printf("sig 5 failed to parse: ");
839  goto end;
840  }
841 
842  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
843  "\" Test uricontent and content\"; "
844  "uricontent:\"foo\"; content:\"bar\";"
845  " depth:10; offset: 5; distance:3; sid:1;)");
846  if (s != NULL) {
847  printf("sig 6 failed to parse: ");
848  goto end;
849  }
850 
851  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
852  "\" Test uricontent and content\"; "
853  "uricontent:\"foo\"; content:\"bar\";"
854  " depth:10; offset: 5; content:"
855  "\"two_contents\"; within:30; sid:1;)");
856  if (s == NULL) {
857  goto end;
858  } else if (s->sm_lists[g_http_uri_buffer_id] == NULL ||
859  s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
860  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
861  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
862  ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->within != 30 ||
863  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
864  {
865  printf("sig 7 failed to parse: ");
867  goto end;
868  }
869 
870  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
871  "\" Test uricontent and content\"; "
872  "uricontent:\"foo\"; content:\"bar\";"
873  " depth:10; offset: 5; uricontent:"
874  "\"two_uricontents\"; within:30; sid:1;)");
875  if (s == NULL) {
876  goto end;
877  } else if (s->sm_lists[g_http_uri_buffer_id] == NULL ||
878  s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
879  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
880  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
881  ((DetectContentData*) s->sm_lists_tail[g_http_uri_buffer_id]->ctx)->within != 30 ||
882  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
883  {
884  printf("sig 8 failed to parse: ");
885  DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[g_http_uri_buffer_id]->ctx);
886  goto end;
887  }
888 
889  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
890  "\" Test uricontent and content\"; "
891  "uricontent:\"foo\"; content:\"bar\";"
892  " depth:10; offset: 5; content:"
893  "\"two_contents\"; distance:30; sid:1;)");
894  if (s == NULL) {
895  goto end;
896  } else if (
897  s->sm_lists[g_http_uri_buffer_id] == NULL ||
898  s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
899  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
900  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
901  ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->distance != 30 ||
902  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
903  {
904  printf("sig 9 failed to parse: ");
906  goto end;
907  }
908 
909  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
910  "\" Test uricontent and content\"; "
911  "uricontent:\"foo\"; content:\"bar\";"
912  " depth:10; offset: 5; uricontent:"
913  "\"two_uricontents\"; distance:30; sid:1;)");
914  if (s == NULL) {
915  goto end;
916  } else if (
917  s->sm_lists[g_http_uri_buffer_id] == NULL ||
918  s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
919  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
920  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
921  ((DetectContentData*) s->sm_lists_tail[g_http_uri_buffer_id]->ctx)->distance != 30 ||
922  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
923  {
924  printf("sig 10 failed to parse: ");
925  DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[g_http_uri_buffer_id]->ctx);
926  goto end;
927  }
928 
929  s = SigInit(de_ctx,"alert tcp any any -> any any (msg:"
930  "\" Test uricontent and content\"; "
931  "uricontent:\"foo\"; content:\"bar\";"
932  " depth:10; offset: 5; uricontent:"
933  "\"two_uricontents\"; distance:30; "
934  "within:60; content:\"two_contents\";"
935  " within:70; distance:45; sid:1;)");
936  if (s == NULL) {
937  printf("sig 10 failed to parse: ");
938  goto end;
939  }
940 
941  if (s->sm_lists[g_http_uri_buffer_id] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
942  printf("umatch %p or pmatch %p: ", s->sm_lists[g_http_uri_buffer_id], s->sm_lists[DETECT_SM_LIST_PMATCH]);
943  goto end;
944  }
945 
946  if ( ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
947  ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
948  ((DetectContentData*) s->sm_lists_tail[g_http_uri_buffer_id]->ctx)->distance != 30 ||
949  ((DetectContentData*) s->sm_lists_tail[g_http_uri_buffer_id]->ctx)->within != 60 ||
950  ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->distance != 45 ||
951  ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->within != 70 ||
952  s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) {
953  printf("sig 10 failed to parse, content not setup properly: ");
955  DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[g_http_uri_buffer_id]->ctx);
957  goto end;
958  }
959 
960  result = 1;
961 end:
962  if (de_ctx != NULL)
964  return result;
965 }
966 
967 /** \test Check the modifiers for uricontent and content
968  * match
969  */
970 static int DetectUriSigTest05(void)
971 {
972  HtpState *http_state = NULL;
973  uint8_t httpbuf1[] = "POST /one/two/three HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:"
974  " hellocatch\r\n\r\n";
975  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
976  Packet *p = NULL;
977  Signature *s = NULL;
978  ThreadVars th_v;
979  DetectEngineThreadCtx *det_ctx = NULL;
981 
982  memset(&th_v, 0, sizeof(th_v));
984 
985  p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP);
986  FAIL_IF_NULL(p);
987  p->tcph->th_seq = htonl(1000);
988  Flow *f = UTHBuildFlow(AF_INET, "192.168.1.5", "192.168.1.1", 41424, 80);
989  FAIL_IF_NULL(f);
990  f->proto = IPPROTO_TCP;
991 
992  UTHAddSessionToFlow(f, 1000, 1000);
993  UTHAddStreamToFlow(f, 0, httpbuf1, httplen1);
994 
995  p->flow = f;
999  f->alproto = ALPROTO_HTTP;
1000 
1003  de_ctx->flags |= DE_QUIET;
1004 
1005  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1006  "\" Test uricontent\"; uricontent:\"foo\"; sid:1;)");
1007  FAIL_IF_NULL(s);
1008 
1009  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1010  "\" Test uricontent\"; uricontent:\"one\"; content:\"two\"; sid:2;)");
1011  FAIL_IF_NULL(s);
1012 
1013  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1014  "\" Test uricontent\"; uricontent:\"one\"; offset:1; depth:10; "
1015  "uricontent:\"two\"; distance:1; within: 4; uricontent:\"three\"; "
1016  "distance:1; within: 6; sid:3;)");
1017  FAIL_IF_NULL(s);
1018 
1020  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1021 
1022  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP,
1023  STREAM_TOSERVER, httpbuf1, httplen1);
1024  FAIL_IF(r != 0);
1025  http_state = f->alstate;
1026  FAIL_IF_NULL(http_state);
1027 
1028  /* do detect */
1029  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1030 
1031  FAIL_IF((PacketAlertCheck(p, 1)));
1032  FAIL_IF(!PacketAlertCheck(p, 2));
1033  FAIL_IF(!(PacketAlertCheck(p, 3)));
1034 
1036  DetectEngineThreadCtxDeinit(&th_v, det_ctx);
1038 
1040  UTHFreeFlow(f);
1041  UTHFreePackets(&p, 1);
1043  PASS;
1044 }
1045 
1046 /** \test Check the modifiers for uricontent and content
1047  * match
1048  */
1049 static int DetectUriSigTest06(void)
1050 {
1051  HtpState *http_state = NULL;
1052  uint8_t httpbuf1[] = "POST /one/two/three HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:"
1053  " hellocatch\r\n\r\n";
1054  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
1055  Packet *p = NULL;
1056  Signature *s = NULL;
1057  ThreadVars th_v;
1058  DetectEngineThreadCtx *det_ctx = NULL;
1060 
1061  memset(&th_v, 0, sizeof(th_v));
1063 
1064  p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP);
1065  FAIL_IF_NULL(p);
1066  p->tcph->th_seq = htonl(1000);
1067  Flow *f = UTHBuildFlow(AF_INET, "192.168.1.5", "192.168.1.1", 41424, 80);
1068  FAIL_IF_NULL(f);
1069  f->proto = IPPROTO_TCP;
1070 
1071  UTHAddSessionToFlow(f, 1000, 1000);
1072  UTHAddStreamToFlow(f, 0, httpbuf1, httplen1);
1073 
1074  p->flow = f;
1078  f->alproto = ALPROTO_HTTP;
1079 
1082  de_ctx->flags |= DE_QUIET;
1083 
1084  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1085  "\" Test uricontent\"; "
1086  "uricontent:\"foo\"; content:\"bar\"; sid:1;)");
1087  FAIL_IF_NULL(s);
1088 
1089  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1090  "\" Test uricontent\"; "
1091  "uricontent:\"one\"; offset:1; depth:10; "
1092  "content:\"one\"; offset:1; depth:10; "
1093  "uricontent:\"two\"; distance:1; within: 4; "
1094  "content:\"two\"; distance:1; within: 4; "
1095  "uricontent:\"three\"; distance:1; within: 6; "
1096  "content:\"/three\"; distance:0; within: 7; "
1097  "sid:2;)");
1098  FAIL_IF_NULL(s);
1099 
1100  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1101  "\" Test uricontent\"; "
1102  "uricontent:\"one\"; offset:1; depth:10; "
1103  "uricontent:\"two\"; distance:1; within: 4; "
1104  "uricontent:\"three\"; distance:1; within: 6; "
1105  "sid:3;)");
1106  FAIL_IF_NULL(s);
1107 
1109  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1110 
1111  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP,
1112  STREAM_TOSERVER, httpbuf1, httplen1);
1113  FAIL_IF(r != 0);
1114  http_state = f->alstate;
1115  FAIL_IF_NULL(http_state);
1116 
1117  /* do detect */
1118  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1119 
1120  FAIL_IF((PacketAlertCheck(p, 1)));
1121  FAIL_IF(!PacketAlertCheck(p, 2));
1122  FAIL_IF(!(PacketAlertCheck(p, 3)));
1123 
1125  DetectEngineThreadCtxDeinit(&th_v, det_ctx);
1127 
1129  UTHFreeFlow(f);
1130  UTHFreePackets(&p, 1);
1132  PASS;
1133 }
1134 
1135 /** \test Check the modifiers for uricontent and content
1136  * match
1137  */
1138 static int DetectUriSigTest07(void)
1139 {
1140  HtpState *http_state = NULL;
1141  uint8_t httpbuf1[] = "POST /one/two/three HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:"
1142  " hellocatch\r\n\r\n";
1143  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
1144  Packet *p = NULL;
1145  Signature *s = NULL;
1146  ThreadVars th_v;
1147  DetectEngineThreadCtx *det_ctx = NULL;
1149 
1150  memset(&th_v, 0, sizeof(th_v));
1152 
1153  p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP);
1154  FAIL_IF_NULL(p);
1155  p->tcph->th_seq = htonl(1000);
1156  Flow *f = UTHBuildFlow(AF_INET, "192.168.1.5", "192.168.1.1", 41424, 80);
1157  FAIL_IF_NULL(f);
1158  f->proto = IPPROTO_TCP;
1159 
1160  UTHAddSessionToFlow(f, 1000, 1000);
1161  UTHAddStreamToFlow(f, 0, httpbuf1, httplen1);
1162 
1163  p->flow = f;
1167  f->alproto = ALPROTO_HTTP;
1168 
1171  de_ctx->flags |= DE_QUIET;
1172 
1173  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1174  "\" Test uricontent\"; "
1175  "uricontent:\"foo\"; content:\"bar\"; sid:1;)");
1176  FAIL_IF_NULL(s);
1177 
1178  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1179  "\" Test uricontent\"; "
1180  "uricontent:\"one\"; offset:1; depth:10; "
1181  "content:\"one\"; offset:1; depth:10; "
1182  "uricontent:\"two\"; distance:3; within: 4; "
1183  "content:\"two\"; distance:1; within: 4; "
1184  "uricontent:\"three\"; distance:1; within: 6; "
1185  "content:\"/three\"; distance:0; within: 7; "
1186  "sid:2;)");
1187  FAIL_IF_NULL(s);
1188 
1189  s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any (msg:"
1190  "\" Test uricontent\"; "
1191  "uricontent:\"one\"; offset:1; depth:10; "
1192  "uricontent:\"two\"; distance:1; within: 4; "
1193  "uricontent:\"six\"; distance:1; within: 6; "
1194  "sid:3;)");
1195  FAIL_IF_NULL(s);
1196 
1198  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1199 
1200  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP,
1201  STREAM_TOSERVER, httpbuf1, httplen1);
1202  FAIL_IF(r != 0);
1203  http_state = f->alstate;
1204  FAIL_IF_NULL(http_state);
1205 
1206  /* do detect */
1207  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1208 
1209  FAIL_IF((PacketAlertCheck(p, 1)));
1210  FAIL_IF((PacketAlertCheck(p, 2)));
1211  FAIL_IF((PacketAlertCheck(p, 3)));
1212 
1214  DetectEngineThreadCtxDeinit(&th_v, det_ctx);
1216 
1218  UTHFreeFlow(f);
1219  UTHFreePackets(&p, 1);
1221  PASS;
1222 }
1223 
1224 /**
1225  * \test Test content for dce sig.
1226  */
1227 static int DetectUriSigTest08(void)
1228 {
1229  DetectEngineCtx *de_ctx = NULL;
1230  int result = 1;
1231 
1233  if (de_ctx == NULL)
1234  goto end;
1235 
1236  de_ctx->flags |= DE_QUIET;
1238  "alert udp any any -> any any "
1239  "(msg:\"test\"; uricontent:\"\"; sid:238012;)");
1240  if (de_ctx->sig_list != NULL) {
1241  result = 0;
1242  goto end;
1243  }
1244 
1245  end:
1249 
1250  return result;
1251 }
1252 
1253 /**
1254  * \test Test content for dce sig.
1255  */
1256 static int DetectUriSigTest09(void)
1257 {
1258  DetectEngineCtx *de_ctx = NULL;
1259  int result = 1;
1260 
1262  if (de_ctx == NULL)
1263  goto end;
1264 
1265  de_ctx->flags |= DE_QUIET;
1267  "alert udp any any -> any any "
1268  "(msg:\"test\"; uricontent:\"; sid:238012;)");
1269  if (de_ctx->sig_list != NULL) {
1270  result = 0;
1271  goto end;
1272  }
1273 
1274  end:
1278 
1279  return result;
1280 }
1281 
1282 /**
1283  * \test Test content for dce sig.
1284  */
1285 static int DetectUriSigTest10(void)
1286 {
1287  DetectEngineCtx *de_ctx = NULL;
1288  int result = 1;
1289 
1291  if (de_ctx == NULL)
1292  goto end;
1293 
1294  de_ctx->flags |= DE_QUIET;
1296  "alert udp any any -> any any "
1297  "(msg:\"test\"; uricontent:\"boo; sid:238012;)");
1298  if (de_ctx->sig_list != NULL) {
1299  result = 0;
1300  goto end;
1301  }
1302 
1303  end:
1307 
1308  return result;
1309 }
1310 
1311 /**
1312  * \test Test content for dce sig.
1313  */
1314 static int DetectUriSigTest11(void)
1315 {
1316  DetectEngineCtx *de_ctx = NULL;
1317  int result = 1;
1318 
1320  if (de_ctx == NULL)
1321  goto end;
1322 
1323  de_ctx->flags |= DE_QUIET;
1325  "alert udp any any -> any any "
1326  "(msg:\"test\"; uricontent:boo\"; sid:238012;)");
1327  if (de_ctx->sig_list != NULL) {
1328  result = 0;
1329  goto end;
1330  }
1331 
1332  end:
1336 
1337  return result;
1338 }
1339 
1340 /**
1341  * \test Parsing test
1342  */
1343 static int DetectUriSigTest12(void)
1344 {
1345  DetectEngineCtx *de_ctx = NULL;
1346  DetectContentData *ud = 0;
1347  Signature *s = NULL;
1348  int result = 0;
1349 
1351  if (de_ctx == NULL)
1352  goto end;
1353 
1354  de_ctx->flags |= DE_QUIET;
1355  s = de_ctx->sig_list = SigInit(de_ctx,
1356  "alert udp any any -> any any "
1357  "(msg:\"test\"; uricontent: !\"boo\"; sid:238012;)");
1358  if (de_ctx->sig_list == NULL) {
1359  printf("de_ctx->sig_list == NULL: ");
1360  goto end;
1361  }
1362 
1363  if (s->sm_lists_tail[g_http_uri_buffer_id] == NULL || s->sm_lists_tail[g_http_uri_buffer_id]->ctx == NULL) {
1364  printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx == NULL: ");
1365  goto end;
1366  }
1367 
1368  ud = (DetectContentData *)s->sm_lists_tail[g_http_uri_buffer_id]->ctx;
1369  result = (strncmp("boo", (char *)ud->content, ud->content_len) == 0);
1370 
1371 end:
1375 
1376  return result;
1377 }
1378 
1379 
1380 /**
1381  * \test Parsing test
1382  */
1383 static int DetectUriContentParseTest13(void)
1384 {
1385  DetectEngineCtx *de_ctx = NULL;
1386  int result = 1;
1387 
1389  if (de_ctx == NULL)
1390  goto end;
1391 
1392  de_ctx->flags |= DE_QUIET;
1394  "alert udp any any -> any any "
1395  "(msg:\"test\"; uricontent:\"|\"; sid:1;)");
1396  if (de_ctx->sig_list != NULL) {
1397  result = 0;
1398  goto end;
1399  }
1400 
1401  end:
1405 
1406  return result;
1407 }
1408 
1409 /**
1410  * \test Parsing test
1411  */
1412 static int DetectUriContentParseTest14(void)
1413 {
1414  DetectEngineCtx *de_ctx = NULL;
1415  int result = 1;
1416 
1418  if (de_ctx == NULL)
1419  goto end;
1420 
1421  de_ctx->flags |= DE_QUIET;
1423  "alert udp any any -> any any "
1424  "(msg:\"test\"; uricontent:\"|af\"; sid:1;)");
1425  if (de_ctx->sig_list != NULL) {
1426  result = 0;
1427  goto end;
1428  }
1429 
1430  end:
1434 
1435  return result;
1436 }
1437 
1438 /**
1439  * \test Parsing test
1440  */
1441 static int DetectUriContentParseTest15(void)
1442 {
1443  DetectEngineCtx *de_ctx = NULL;
1444  int result = 1;
1445 
1447  if (de_ctx == NULL)
1448  goto end;
1449 
1450  de_ctx->flags |= DE_QUIET;
1452  "alert udp any any -> any any "
1453  "(msg:\"test\"; uricontent:\"af|\"; sid:1;)");
1454  if (de_ctx->sig_list != NULL) {
1455  result = 0;
1456  goto end;
1457  }
1458 
1459  end:
1463 
1464  return result;
1465 }
1466 
1467 /**
1468  * \test Parsing test
1469  */
1470 static int DetectUriContentParseTest16(void)
1471 {
1472  DetectEngineCtx *de_ctx = NULL;
1473  int result = 1;
1474 
1476  if (de_ctx == NULL)
1477  goto end;
1478 
1479  de_ctx->flags |= DE_QUIET;
1481  "alert udp any any -> any any "
1482  "(msg:\"test\"; uricontent:\"|af|\"; sid:1;)");
1483  if (de_ctx->sig_list == NULL) {
1484  result = 0;
1485  goto end;
1486  }
1487 
1488  end:
1492 
1493  return result;
1494 }
1495 
1496 /**
1497  * \test Parsing test
1498  */
1499 static int DetectUriContentParseTest17(void)
1500 {
1501  DetectEngineCtx *de_ctx = NULL;
1502  int result = 1;
1503 
1505  if (de_ctx == NULL)
1506  goto end;
1507 
1508  de_ctx->flags |= DE_QUIET;
1510  "alert udp any any -> any any "
1511  "(msg:\"test\"; uricontent:\"aast|\"; sid:1;)");
1512  if (de_ctx->sig_list != NULL) {
1513  result = 0;
1514  goto end;
1515  }
1516 
1517  end:
1521 
1522  return result;
1523 }
1524 
1525 /**
1526  * \test Parsing test
1527  */
1528 static int DetectUriContentParseTest18(void)
1529 {
1530  DetectEngineCtx *de_ctx = NULL;
1531  int result = 1;
1532 
1534  if (de_ctx == NULL)
1535  goto end;
1536 
1537  de_ctx->flags |= DE_QUIET;
1539  "alert udp any any -> any any "
1540  "(msg:\"test\"; uricontent:\"aast|af\"; sid:1;)");
1541  if (de_ctx->sig_list != NULL) {
1542  result = 0;
1543  goto end;
1544  }
1545 
1546  end:
1550 
1551  return result;
1552 }
1553 
1554 /**
1555  * \test Parsing test
1556  */
1557 static int DetectUriContentParseTest19(void)
1558 {
1559  DetectEngineCtx *de_ctx = NULL;
1560  int result = 1;
1561 
1563  if (de_ctx == NULL)
1564  goto end;
1565 
1566  de_ctx->flags |= DE_QUIET;
1568  "alert udp any any -> any any "
1569  "(msg:\"test\"; uricontent:\"aast|af|\"; sid:1;)");
1570  if (de_ctx->sig_list == NULL) {
1571  result = 0;
1572  goto end;
1573  }
1574 
1575  end:
1579 
1580  return result;
1581 }
1582 
1583 /**
1584  * \test Parsing test
1585  */
1586 static int DetectUriContentParseTest20(void)
1587 {
1588  DetectEngineCtx *de_ctx = NULL;
1589  int result = 1;
1590 
1592  if (de_ctx == NULL)
1593  goto end;
1594 
1595  de_ctx->flags |= DE_QUIET;
1597  "alert udp any any -> any any "
1598  "(msg:\"test\"; uricontent:\"|af|asdf\"; sid:1;)");
1599  if (de_ctx->sig_list == NULL) {
1600  result = 0;
1601  goto end;
1602  }
1603 
1604  end:
1608 
1609  return result;
1610 }
1611 
1612 /**
1613  * \test Parsing test
1614  */
1615 static int DetectUriContentParseTest21(void)
1616 {
1617  DetectEngineCtx *de_ctx = NULL;
1618  int result = 1;
1619 
1621  if (de_ctx == NULL)
1622  goto end;
1623 
1624  de_ctx->flags |= DE_QUIET;
1626  "alert udp any any -> any any "
1627  "(msg:\"test\"; uricontent:\"|af|af|\"; sid:1;)");
1628  if (de_ctx->sig_list != NULL) {
1629  result = 0;
1630  goto end;
1631  }
1632 
1633  end:
1637 
1638  return result;
1639 }
1640 
1641 /**
1642  * \test Parsing test
1643  */
1644 static int DetectUriContentParseTest22(void)
1645 {
1646  DetectEngineCtx *de_ctx = NULL;
1647  int result = 1;
1648 
1650  if (de_ctx == NULL)
1651  goto end;
1652 
1653  de_ctx->flags |= DE_QUIET;
1655  "alert udp any any -> any any "
1656  "(msg:\"test\"; uricontent:\"|af|af|af\"; sid:1;)");
1657  if (de_ctx->sig_list != NULL) {
1658  result = 0;
1659  goto end;
1660  }
1661 
1662  end:
1666 
1667  return result;
1668 }
1669 
1670 /**
1671  * \test Parsing test
1672  */
1673 static int DetectUriContentParseTest23(void)
1674 {
1675  DetectEngineCtx *de_ctx = NULL;
1676  int result = 1;
1677 
1679  if (de_ctx == NULL)
1680  goto end;
1681 
1682  de_ctx->flags |= DE_QUIET;
1684  "alert udp any any -> any any "
1685  "(msg:\"test\"; uricontent:\"|af|af|af|\"; sid:1;)");
1686  if (de_ctx->sig_list == NULL) {
1687  result = 0;
1688  goto end;
1689  }
1690 
1691  end:
1695 
1696  return result;
1697 }
1698 
1699 /**
1700  * \test Parsing test
1701  */
1702 static int DetectUriContentParseTest24(void)
1703 {
1704  DetectEngineCtx *de_ctx = NULL;
1705  int result = 1;
1706 
1708  if (de_ctx == NULL)
1709  goto end;
1710 
1711  de_ctx->flags |= DE_QUIET;
1713  "alert tcp any any -> any any "
1714  "(msg:\"test\"; uricontent:\"\"; sid:1;)");
1715  if (de_ctx->sig_list != NULL) {
1716  result = 0;
1717  goto end;
1718  }
1719 
1720  end:
1724 
1725  return result;
1726 }
1727 
1728 static int DetectUricontentIsdataatParseTest(void)
1729 {
1732  de_ctx->flags |= DE_QUIET;
1733 
1735  "alert tcp any any -> any any ("
1736  "uricontent:\"one\"; "
1737  "isdataat:!4,relative; sid:1;)");
1738  FAIL_IF_NULL(s);
1739 
1740  SigMatch *sm = s->init_data->smlists_tail[g_http_uri_buffer_id];
1741  FAIL_IF_NULL(sm);
1743 
1744  DetectIsdataatData *data = (DetectIsdataatData *)sm->ctx;
1747  FAIL_IF(data->flags & ISDATAAT_RAWBYTES);
1748 
1750  PASS;
1751 }
1752 
1753 static void DetectUricontentRegisterTests(void)
1754 {
1755  UtRegisterTest("HTTPUriTest01", HTTPUriTest01);
1756  UtRegisterTest("HTTPUriTest02", HTTPUriTest02);
1757  UtRegisterTest("HTTPUriTest03", HTTPUriTest03);
1758  UtRegisterTest("HTTPUriTest04", HTTPUriTest04);
1759 
1760  UtRegisterTest("DetectUriSigTest01", DetectUriSigTest01);
1761  UtRegisterTest("DetectUriSigTest02", DetectUriSigTest02);
1762  UtRegisterTest("DetectUriSigTest03", DetectUriSigTest03);
1763  UtRegisterTest("DetectUriSigTest04 - Modifiers", DetectUriSigTest04);
1764  UtRegisterTest("DetectUriSigTest05 - Inspection", DetectUriSigTest05);
1765  UtRegisterTest("DetectUriSigTest06 - Inspection", DetectUriSigTest06);
1766  UtRegisterTest("DetectUriSigTest07 - Inspection", DetectUriSigTest07);
1767  UtRegisterTest("DetectUriSigTest08", DetectUriSigTest08);
1768  UtRegisterTest("DetectUriSigTest09", DetectUriSigTest09);
1769  UtRegisterTest("DetectUriSigTest10", DetectUriSigTest10);
1770  UtRegisterTest("DetectUriSigTest11", DetectUriSigTest11);
1771  UtRegisterTest("DetectUriSigTest12", DetectUriSigTest12);
1772 
1773  UtRegisterTest("DetectUriContentParseTest13", DetectUriContentParseTest13);
1774  UtRegisterTest("DetectUriContentParseTest14", DetectUriContentParseTest14);
1775  UtRegisterTest("DetectUriContentParseTest15", DetectUriContentParseTest15);
1776  UtRegisterTest("DetectUriContentParseTest16", DetectUriContentParseTest16);
1777  UtRegisterTest("DetectUriContentParseTest17", DetectUriContentParseTest17);
1778  UtRegisterTest("DetectUriContentParseTest18", DetectUriContentParseTest18);
1779  UtRegisterTest("DetectUriContentParseTest19", DetectUriContentParseTest19);
1780  UtRegisterTest("DetectUriContentParseTest20", DetectUriContentParseTest20);
1781  UtRegisterTest("DetectUriContentParseTest21", DetectUriContentParseTest21);
1782  UtRegisterTest("DetectUriContentParseTest22", DetectUriContentParseTest22);
1783  UtRegisterTest("DetectUriContentParseTest23", DetectUriContentParseTest23);
1784  UtRegisterTest("DetectUriContentParseTest24", DetectUriContentParseTest24);
1785 
1786  UtRegisterTest("DetectUricontentIsdataatParseTest",
1787  DetectUricontentIsdataatParseTest);
1788 }
1789 #endif /* UNITTESTS */
DetectContentData_::offset
uint16_t offset
Definition: detect-content.h:100
SigTableElmt_::url
const char * url
Definition: detect.h:1214
DETECT_CONTENT_RELATIVE_NEXT
#define DETECT_CONTENT_RELATIVE_NEXT
Definition: detect-content.h:64
detect-content.h
detect-engine.h
DETECT_SM_LIST_PMATCH
@ DETECT_SM_LIST_PMATCH
Definition: detect.h:90
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SigTableElmt_::desc
const char * desc
Definition: detect.h:1213
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1109
UTHAddStreamToFlow
int UTHAddStreamToFlow(Flow *f, int direction, uint8_t *data, uint32_t data_len)
Definition: util-unittest-helper.c:533
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1201
flow-util.h
SigTableElmt_::name
const char * name
Definition: detect.h:1211
stream-tcp.h
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
DetectContentData_::within
int32_t within
Definition: detect-content.h:102
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DetectIsdataatData_::flags
uint8_t flags
Definition: detect-isdataat.h:37
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:59
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
detect-isdataat.h
Flow_::proto
uint8_t proto
Definition: flow.h:365
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:138
Packet_::flags
uint32_t flags
Definition: decode.h:449
threads.h
Flow_
Flow data structure.
Definition: flow.h:347
SigInit
Signature * SigInit(DetectEngineCtx *, const char *)
Parses a signature and adds it to the Detection Engine Context.
Definition: detect-parse.c:2056
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1205
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:767
SC_ERR_INVALID_SIGNATURE
@ SC_ERR_INVALID_SIGNATURE
Definition: util-error.h:69
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2093
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:278
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:219
DE_QUIET
#define DE_QUIET
Definition: detect.h:294
stream-tcp-reassemble.h
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:337
DetectIsdataatData_
Definition: detect-isdataat.h:35
DetectContentData_
Definition: detect-content.h:86
SigCleanSignatures
void SigCleanSignatures(DetectEngineCtx *de_ctx)
Definition: detect-engine-build.c:39
DetectUricontentRegister
void DetectUricontentRegister(void)
Registration function for uricontent: keyword.
Definition: detect-uricontent.c:70
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:445
Flow_::protoctx
void * protoctx
Definition: flow.h:441
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1196
FLOW_IPV4
#define FLOW_IPV4
Definition: flow.h:95
util-unittest.h
HtpState_
Definition: app-layer-htp.h:243
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
FLOWLOCK_UNLOCK
#define FLOWLOCK_UNLOCK(fb)
Definition: flow.h:264
STREAM_START
#define STREAM_START
Definition: stream.h:29
Signature_::next
struct Signature_ * next
Definition: detect.h:600
DetectHttpUriSetup
int DetectHttpUriSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)
this function setups the http_uri modifier keyword used in the rule
Definition: detect-http-uri.c:174
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:330
SignatureInitData_::smlists_tail
struct SigMatch_ ** smlists_tail
Definition: detect.h:524
SIGMATCH_QUOTES_MANDATORY
#define SIGMATCH_QUOTES_MANDATORY
Definition: detect.h:1396
UTHBuildFlow
Flow * UTHBuildFlow(int family, const char *src, const char *dst, Port sp, Port dp)
Definition: util-unittest-helper.c:521
FLOW_INITIALIZE
#define FLOW_INITIALIZE(f)
Definition: flow-util.h:39
app-layer-htp.h
DetectContentPrint
void DetectContentPrint(DetectContentData *cd)
Helper function to print a DetectContentData.
Definition: detect-content.c:256
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectContentSetup
int DetectContentSetup(DetectEngineCtx *de_ctx, Signature *s, const char *contentstr)
Function to setup a content pattern.
Definition: detect-content.c:322
DetectEngineThreadCtx_
Definition: detect.h:1010
UTHAddSessionToFlow
int UTHAddSessionToFlow(Flow *f, uint32_t ts_isn, uint32_t tc_isn)
Definition: util-unittest-helper.c:549
DETECT_URICONTENT
@ DETECT_URICONTENT
Definition: detect-engine-register.h:60
STREAM_TOSERVER
#define STREAM_TOSERVER
Definition: stream.h:31
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:19
FLOWLOCK_WRLOCK
#define FLOWLOCK_WRLOCK(fb)
Definition: flow.h:261
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
detect-engine-mpm.h
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
detect-http-uri.h
DETECT_CONTENT_NEGATED
#define DETECT_CONTENT_NEGATED
Definition: detect-content.h:40
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:89
SigTableElmt_::alternative
uint16_t alternative
Definition: detect.h:1209
DetectContentData_::id
PatIntId id
Definition: detect-content.h:98
app-layer-parser.h
TRUE
#define TRUE
Definition: suricata-common.h:33
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:323
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:282
SigMatchSignatures
void SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:1688
SigGroupCleanup
int SigGroupCleanup(DetectEngineCtx *de_ctx)
Definition: detect-engine-build.c:1953
SCReturn
#define SCReturn
Definition: util-debug.h:302
DetectContentData_::depth
uint16_t depth
Definition: detect-content.h:99
stream.h
Packet_
Definition: decode.h:414
ISDATAAT_RELATIVE
#define ISDATAAT_RELATIVE
Definition: detect-isdataat.h:27
StreamTcpFreeConfig
void StreamTcpFreeConfig(char quiet)
Definition: stream-tcp.c:668
conf.h
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:97
SIGMATCH_HANDLE_NEGATION
#define SIGMATCH_HANDLE_NEGATION
Definition: detect.h:1400
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:597
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
ISDATAAT_RAWBYTES
#define ISDATAAT_RAWBYTES
Definition: detect-isdataat.h:28
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1179
SC_ERR_INVALID_YAML_CONF_ENTRY
@ SC_ERR_INVALID_YAML_CONF_ENTRY
Definition: util-error.h:169
AppLayerParserGetTx
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:1057
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:1888
SigMatch_::type
uint8_t type
Definition: detect.h:321
UTHFreeFlow
void UTHFreeFlow(Flow *flow)
Definition: util-unittest-helper.c:526
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:252
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2361
Packet_::flow
struct Flow_ * flow
Definition: decode.h:451
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
Definition: detect-engine.c:2797
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
util-mpm.h
DetectBufferTypeRegister
int DetectBufferTypeRegister(const char *name)
Definition: detect-engine.c:836
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1203
suricata-common.h
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
Definition: detect-engine.c:3005
Packet_::tcph
TCPHdr * tcph
Definition: decode.h:531
DetectContentData_::distance
int32_t distance
Definition: detect-content.h:101
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
util-spm.h
DetectContentData_::content
uint8_t * content
Definition: detect-content.h:87
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
DetectEngineCtx_::sig_list
Signature * sig_list
Definition: detect.h:773
detect-flow.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
ISDATAAT_NEGATED
#define ISDATAAT_NEGATED
Definition: detect-isdataat.h:29
DetectContentData_::spm_ctx
SpmCtx * spm_ctx
Definition: detect-content.h:104
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Flow_::alstate
void * alstate
Definition: flow.h:476
Flow_::flags
uint32_t flags
Definition: flow.h:421
detect-parse.h
Signature_
Signature container.
Definition: detect.h:528
SigMatch_
a single match condition for a signature
Definition: detect.h:320
DETECT_ISDATAAT
@ DETECT_ISDATAAT
Definition: detect-engine-register.h:79
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition: app-layer-protos.h:30
StreamTcpInitConfig
void StreamTcpInitConfig(char)
To initialize the stream global configuration data.
Definition: stream-tcp.c:365
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:221
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2048
STREAM_EOF
#define STREAM_EOF
Definition: stream.h:30
app-layer-protos.h
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:88
detect-uricontent.h
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:768
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:87
UTHRemoveSessionFromFlow
int UTHRemoveSessionFromFlow(Flow *f)
Definition: util-unittest-helper.c:569
TcpSession_
Definition: stream-tcp-private.h:260
flow.h
SpmDestroyCtx
void SpmDestroyCtx(SpmCtx *ctx)
Definition: util-spm.c:184
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:450
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
flow-var.h
FLOW_DESTROY
#define FLOW_DESTROY(f)
Definition: flow-util.h:130
DETECT_HTTP_URI
@ DETECT_HTTP_URI
Definition: detect-engine-register.h:143
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:1107
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1203
app-layer.h
UTHFreePackets
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:468