26 #include "../suricata-common.h"
27 #include "../decode.h"
29 #include "../detect.h"
33 memset(&tv, 0, sizeof(tv)); \
35 memset(&f, 0, sizeof(f));
37 #define TEST_RUN(buf, buflen, sig, match, steps) \
39 DetectEngineCtx *de_ctx = DetectEngineCtxInit(); \
40 FAIL_IF_NULL(de_ctx); \
41 DetectEngineThreadCtx *det_ctx = NULL; \
43 snprintf(rule, sizeof(rule), "alert tcp any any -> any any (%s sid:1; rev:1;)", (sig)); \
44 Signature *s = DetectEngineAppendSig(de_ctx, rule); \
46 SigGroupBuild(de_ctx); \
47 DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); \
48 FAIL_IF_NULL(det_ctx); \
49 int r = DetectEngineContentInspection(de_ctx, det_ctx, \
50 s, s->sm_arrays[DETECT_SM_LIST_PMATCH], NULL, &f, \
51 (uint8_t *)(buf), (buflen), 0, DETECT_CI_FLAGS_SINGLE, \
52 DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD); \
53 FAIL_IF_NOT(r == (match)); \
54 FAIL_IF_NOT(det_ctx->inspection_recursion_counter == (steps)); \
55 DetectEngineThreadCtxDeinit(&tv, det_ctx); \
56 DetectEngineCtxFree(de_ctx); \
62 static int DetectEngineContentInspectionTest01(
void) {
64 TEST_RUN(
"ab", 2,
"content:\"a\"; content:\"b\";",
true, 2);
65 TEST_RUN(
"ab", 2,
"content:\"a\"; content:\"b\"; distance:0; ",
true, 2);
66 TEST_RUN(
"ba", 2,
"content:\"a\"; content:\"b\"; distance:0; ",
false, 2);
71 static int DetectEngineContentInspectionTest02(
void) {
73 TEST_RUN(
"ab", 2,
"content:\"a\"; pcre:\"/b/\";",
true, 2);
74 TEST_RUN(
"ab", 2,
"content:\"a\"; pcre:\"/b/R\";",
true, 2);
75 TEST_RUN(
"ba", 2,
"content:\"a\"; pcre:\"/b/R\";",
false, 2);
80 static int DetectEngineContentInspectionTest03(
void) {
82 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; content:\"c\";",
true, 3);
83 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; content:\"d\";",
false, 3);
85 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0;",
true, 3);
86 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; content:\"d\"; distance:0;",
false, 3);
88 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; within:1; content:\"d\"; distance:0; within:1;",
false, 5);
91 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1;",
true, 5);
93 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; content:\"bab\";",
true, 6);
95 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; content:\"no\";",
false, 6);
98 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; within:1; pcre:\"/^c$/R\";",
true, 5);
100 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; within:1; pcre:\"/^c$/R\"; content:\"bab\";",
true, 6);
102 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; within:1; pcre:\"/^c$/R\"; content:\"no\";",
false, 6);
108 static int DetectEngineContentInspectionTest04(
void) {
110 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; content:\"c\";",
true, 3);
111 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; content:\"d\";",
false, 3);
114 TEST_RUN(
"ababc", 5,
"pcre:\"/^a/\"; pcre:\"/^b/R\"; pcre:\"/c/R\"; ",
true, 3);
115 TEST_RUN(
"ababc", 5,
"pcre:\"/a/\"; pcre:\"/^b/R\"; pcre:\"/^c/R\"; ",
true, 5);
116 TEST_RUN(
"ababc", 5,
"pcre:\"/^a/\"; pcre:\"/^b/R\"; pcre:\"/d/R\"; ",
false, 3);
117 TEST_RUN(
"ababc", 5,
"pcre:\"/^a/\"; pcre:\"/^b/R\"; pcre:\"/c/R\"; pcre:\"/d/\"; ",
false, 4);
123 static int DetectEngineContentInspectionTest05(
void) {
125 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; content:\"c\";",
true, 3);
126 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; content:\"d\";",
false, 3);
130 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; within:1; content:\"b\"; content:\"c\"; distance:0; within:1;",
true, 5);
136 static int DetectEngineContentInspectionTest06(
void) {
138 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; content:\"c\";",
true, 3);
139 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; content:\"d\";",
false, 3);
142 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; isdataat:!1,relative;",
true, 5);
143 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; isdataat:1,relative;",
false, 6);
145 TEST_RUN(
"ababcabc", 8,
"content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; isdataat:!1,relative;",
true, 7);
146 TEST_RUN(
"ababcabc", 8,
"content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; isdataat:1,relative;",
true, 6);
148 TEST_RUN(
"abcXYZ", 6,
"content:\"abc\"; content:\"XYZ\"; distance:0; within:3; isdataat:!1,relative;",
true, 2);
149 TEST_RUN(
"abcXYZ", 6,
"content:\"XYZ\"; distance:3; within:3; isdataat:!1,relative;",
true, 1);
150 TEST_RUN(
"abcXYZ", 6,
"content:\"cXY\"; distance:2; within:3; isdataat:!1,relative;",
false, 1);
152 TEST_RUN(
"xxxxxxxxxxxxxxxxxyYYYYYYYYYYYYYYYY", 34,
"content:\"yYYYYYYYYYYYYYYYY\"; distance:9; within:29; isdataat:!1,relative;",
true, 1);
157 static int DetectEngineContentInspectionTest07(
void) {
159 TEST_RUN(
"abcabcabcabcabcabcabcabcabcabcd", 31,
"content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; content:\"d\";",
true, 4);
160 TEST_RUN(
"abcabcabcabcabcabcabcabcabcabcd", 31,
"content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; content:\"d\"; within:1; distance:0; ",
true, 31);
161 TEST_RUN(
"abcabcabcabcabcabcabcabcabcabcx", 31,
"content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; content:\"d\"; within:1; distance:0; ",
false, 31);
163 TEST_RUN(
"abcabcabcabcabcabcabcabcabcabcx", 31,
"content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; content:\"d\"; distance:0; ",
false, 4);
164 TEST_RUN(
"abcabcabcabcabcabcabcabcabcabcx", 31,
"content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; pcre:\"/^d/R\"; ",
false, 13);
165 TEST_RUN(
"abcabcabcabcabcabcabcabcabcabcx", 31,
"content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; isdataat:!1,relative; ",
false, 3);
166 TEST_RUN(
"abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdx", 41,
167 "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; content:\"d\"; distance:0; content:\"e\"; distance:0; ",
false, 5);
168 TEST_RUN(
"abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdx", 41,
169 "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; content:\"d\"; distance:0; pcre:\"/^e/R\"; ",
false, 14);
170 TEST_RUN(
"abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdx", 41,
171 "content:\"a\"; content:\"b\"; distance:0; content:\"c\"; distance:0; content:\"d\"; distance:0; isdataat:!1,relative; ",
false, 4);
173 TEST_RUN(
"abcabcabcabcabcabcabcabcabcabcd", 31,
"content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/d/\";",
true, 4);
174 TEST_RUN(
"abcabcabcabcabcabcabcabcabcabcd", 31,
"content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/d/R\";",
true, 4);
175 TEST_RUN(
"abcabcabcabcabcabcabcabcabcabcd", 31,
"content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/^d/R\";",
true, 31);
177 TEST_RUN(
"abcabcabcabcabcabcabcabcabcabcx", 31,
"content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/d/\";",
false, 4);
178 TEST_RUN(
"abcabcabcabcabcabcabcabcabcabcx", 31,
"content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/d/R\";",
false, 31);
179 TEST_RUN(
"abcabcabcabcabcabcabcabcabcabcx", 31,
"content:\"a\"; content:\"b\"; within:1; distance:0; content:\"c\"; distance:0; within:1; pcre:\"/^d/R\";",
false, 31);
184 static int DetectEngineContentInspectionTest08(
void) {
186 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; content:!\"d\";",
true, 3);
187 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; content:!\"c\";",
false, 3);
189 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; within:1; content:!\"a\"; distance:0; within:1;",
true, 5);
190 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; within:1; content:!\"a\"; distance:0; ",
true, 5);
192 TEST_RUN(
"abcdefghy", 9,
"content:\"a\"; content:!\"x\"; content:\"c\"; distance:0; within:2; ",
194 TEST_RUN(
"abcdefghx", 9,
"content:\"a\"; content:!\"x\"; content:\"c\"; distance:0; within:2; ",
197 "content:\"a\"; content:!\"x\"; content:!\"c\"; distance:2; within:1; ",
true, 3);
203 static int DetectEngineContentInspectionTest09(
void) {
205 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; content:!\"d\";",
true, 3);
206 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; content:!\"c\";",
false, 3);
208 TEST_RUN(
"abc03abcxyz", 11,
"content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3;",
true, 3);
209 TEST_RUN(
"abc03abc03abcxyz", 16,
"content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3;",
true, 5);
210 TEST_RUN(
"abc03abc03abcxyz", 16,
"content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; isdataat:!1,relative;",
true, 5);
211 TEST_RUN(
"abc03abc03abcxyz", 16,
"content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; pcre:\"/klm$/R\";",
false, 7);
212 TEST_RUN(
"abc03abc03abcxyzklm", 19,
"content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; pcre:\"/klm$/R\";",
true, 6);
213 TEST_RUN(
"abc03abc03abcxyzklx", 19,
"content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; pcre:\"/^klm$/R\";",
false, 7);
214 TEST_RUN(
"abc03abc03abc03abcxyzklm", 24,
"content:\"abc\"; byte_jump:2,0,relative,string,dec; content:\"xyz\"; within:3; pcre:\"/^klm$/R\";",
true, 8);
220 static int DetectEngineContentInspectionTest10(
void) {
223 TEST_RUN(
"9abcdefghi", 10,
"byte_extract:1,0,data_size,string; isdataat:data_size;",
true, 2);
224 TEST_RUN(
"9abcdefgh", 9,
"byte_extract:1,0,data_size,string; isdataat:!data_size;",
true, 2);
226 TEST_RUN(
"x9x9abcdefghi", 13,
"content:\"x\"; byte_extract:1,0,data_size,string,relative; isdataat:data_size,relative;",
true, 3);
227 TEST_RUN(
"x9x9abcdefgh", 12,
"content:\"x\"; byte_extract:1,0,data_size,string,relative; isdataat:!data_size,relative;",
true, 5);
228 TEST_RUN(
"x9x9abcdefgh", 12,
"content:\"x\"; depth:1; byte_extract:1,0,data_size,string,relative; isdataat:!data_size,relative;",
false, 3);
230 TEST_RUN(
"100000000abcdefghi", 18,
"byte_extract:0,0,data_size,string; isdataat:data_size;",
false, 2);
231 TEST_RUN(
"100000000abcdefghi", 18,
"byte_extract:0,0,data_size,string; isdataat:!data_size;",
true, 2);
235 static int DetectEngineContentInspectionTest11(
void) {
237 TEST_RUN(
"ab", 2,
"content:\"a\"; startswith; content:\"b\";",
true, 2);
238 TEST_RUN(
"ab", 2,
"content:\"a\"; startswith; content:\"b\"; within:1; distance:0;",
true, 2);
239 TEST_RUN(
"ab", 2,
"content:\"ab\"; startswith;",
true, 1);
240 TEST_RUN(
"ab", 2,
"content:\"a\"; startswith;",
true, 1);
241 TEST_RUN(
"ab", 2,
"content:\"b\"; startswith;",
false, 1);
247 static int DetectEngineContentInspectionTest12(
void) {
250 TEST_RUN(
"ababc", 5,
"content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; endswith;",
true, 5);
252 TEST_RUN(
"ababcabc", 8,
"content:\"a\"; content:\"b\"; distance:0; within:1; content:\"c\"; distance:0; within:1; endswith;",
true, 7);
254 TEST_RUN(
"abcXYZ", 6,
"content:\"abc\"; content:\"XYZ\"; distance:0; within:3; endswith;",
true, 2);
255 TEST_RUN(
"abcXYZ", 6,
"content:\"XYZ\"; distance:3; within:3; endswith;",
true, 1);
256 TEST_RUN(
"abcXYZ", 6,
"content:\"cXY\"; distance:2; within:3; endswith;",
false, 1);
258 TEST_RUN(
"xxxxxxxxxxxxxxxxxyYYYYYYYYYYYYYYYY", 34,
"content:\"yYYYYYYYYYYYYYYYY\"; distance:9; within:29; endswith;",
true, 1);
262 static int DetectEngineContentInspectionTest13(
void) {
264 TEST_RUN(
"ab", 2,
"content:\"a\"; startswith; content:\"b\"; endswith;",
true, 2);
265 TEST_RUN(
"ab", 2,
"content:\"a\"; startswith; content:\"b\"; within:1; distance:0; endswith;",
true, 2);
266 TEST_RUN(
"ab", 2,
"content:\"ab\"; startswith; endswith;",
true, 1);
267 TEST_RUN(
"ab", 2,
"content:\"a\"; startswith; endswith;",
false, 1);
268 TEST_RUN(
"ab", 2,
"content:\"b\"; startswith;",
false, 1);
269 TEST_RUN(
"ab", 2,
"content:\"b\"; startswith; endswith;",
false, 1);
276 DetectEngineContentInspectionTest01);
278 DetectEngineContentInspectionTest02);
280 DetectEngineContentInspectionTest03);
282 DetectEngineContentInspectionTest04);
284 DetectEngineContentInspectionTest05);
286 DetectEngineContentInspectionTest06);
288 DetectEngineContentInspectionTest07);
290 DetectEngineContentInspectionTest08);
292 DetectEngineContentInspectionTest09);
294 DetectEngineContentInspectionTest10);
296 DetectEngineContentInspectionTest11);
298 DetectEngineContentInspectionTest12);
299 UtRegisterTest(
"DetectEngineContentInspectionTest13 mix startswith/endswith",
300 DetectEngineContentInspectionTest13);