33 #include "../suricata-common.h"
34 #include "../suricata.h"
35 #include "../flow-util.h"
37 #include "../app-layer-parser.h"
39 #include "../util-unittest.h"
40 #include "../util-unittest-helper.h"
41 #include "../app-layer.h"
42 #include "../app-layer-htp.h"
43 #include "../app-layer-protos.h"
44 #include "../detect-isdataat.h"
45 #include "../detect-engine-build.h"
46 #include "../detect-engine-alert.h"
52 static int DetectEngineHttpMethodTest01(
void)
62 "GET /index.html HTTP/1.0\r\n"
63 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
64 uint32_t http_len =
sizeof(http_buf) - 1;
68 memset(&th_v, 0,
sizeof(th_v));
69 memset(&f, 0,
sizeof(f));
70 memset(&ssn, 0,
sizeof(ssn));
76 f.
proto = IPPROTO_TCP;
93 "(msg:\"http header test\"; "
94 "content:\"GET\"; http_method; "
105 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
111 if (http_state == NULL) {
112 printf(
"no http state: ");
121 printf(
"sid 1 didn't match but should have: ");
143 static int DetectEngineHttpMethodTest02(
void)
153 "CONNECT /index.html HTTP/1.0\r\n"
154 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
155 uint32_t http_len =
sizeof(http_buf) - 1;
159 memset(&th_v, 0,
sizeof(th_v));
160 memset(&f, 0,
sizeof(f));
161 memset(&ssn, 0,
sizeof(ssn));
167 f.
proto = IPPROTO_TCP;
184 "(msg:\"http header test\"; "
185 "content:\"CO\"; depth:4; http_method; "
196 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
202 if (http_state == NULL) {
203 printf(
"no http state: ");
212 printf(
"sid 1 didn't match but should have: ");
234 static int DetectEngineHttpMethodTest03(
void)
244 "CONNECT /index.html HTTP/1.0\r\n"
245 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
246 uint32_t http_len =
sizeof(http_buf) - 1;
250 memset(&th_v, 0,
sizeof(th_v));
251 memset(&f, 0,
sizeof(f));
252 memset(&ssn, 0,
sizeof(ssn));
258 f.
proto = IPPROTO_TCP;
275 "(msg:\"http header test\"; "
276 "content:!\"ECT\"; depth:4; http_method; "
287 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
293 if (http_state == NULL) {
294 printf(
"no http state: ");
303 printf(
"sid 1 didn't match but should have: ");
325 static int DetectEngineHttpMethodTest04(
void)
335 "CONNECT /index.html HTTP/1.0\r\n"
336 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
337 uint32_t http_len =
sizeof(http_buf) - 1;
341 memset(&th_v, 0,
sizeof(th_v));
342 memset(&f, 0,
sizeof(f));
343 memset(&ssn, 0,
sizeof(ssn));
349 f.
proto = IPPROTO_TCP;
366 "(msg:\"http header test\"; "
367 "content:\"ECT\"; depth:4; http_method; "
378 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
384 if (http_state == NULL) {
385 printf(
"no http state: ");
394 printf(
"sid 1 matched but shouldn't have: ");
416 static int DetectEngineHttpMethodTest05(
void)
426 "CONNECT /index.html HTTP/1.0\r\n"
427 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
428 uint32_t http_len =
sizeof(http_buf) - 1;
432 memset(&th_v, 0,
sizeof(th_v));
433 memset(&f, 0,
sizeof(f));
434 memset(&ssn, 0,
sizeof(ssn));
440 f.
proto = IPPROTO_TCP;
457 "(msg:\"http header test\"; "
458 "content:!\"CON\"; depth:4; http_method; "
469 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
475 if (http_state == NULL) {
476 printf(
"no http state: ");
485 printf(
"sid 1 matched but shouldn't have: ");
507 static int DetectEngineHttpMethodTest06(
void)
517 "CONNECT /index.html HTTP/1.0\r\n"
518 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
519 uint32_t http_len =
sizeof(http_buf) - 1;
523 memset(&th_v, 0,
sizeof(th_v));
524 memset(&f, 0,
sizeof(f));
525 memset(&ssn, 0,
sizeof(ssn));
531 f.
proto = IPPROTO_TCP;
548 "(msg:\"http header test\"; "
549 "content:\"ECT\"; offset:3; http_method; "
560 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
566 if (http_state == NULL) {
567 printf(
"no http state: ");
576 printf(
"sid 1 didn't match but should have: ");
598 static int DetectEngineHttpMethodTest07(
void)
608 "CONNECT /index.html HTTP/1.0\r\n"
609 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
610 uint32_t http_len =
sizeof(http_buf) - 1;
614 memset(&th_v, 0,
sizeof(th_v));
615 memset(&f, 0,
sizeof(f));
616 memset(&ssn, 0,
sizeof(ssn));
622 f.
proto = IPPROTO_TCP;
639 "(msg:\"http header test\"; "
640 "content:!\"CO\"; offset:3; http_method; "
651 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
657 if (http_state == NULL) {
658 printf(
"no http state: ");
667 printf(
"sid 1 didn't match but should have: ");
689 static int DetectEngineHttpMethodTest08(
void)
699 "CONNECT /index.html HTTP/1.0\r\n"
700 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
701 uint32_t http_len =
sizeof(http_buf) - 1;
705 memset(&th_v, 0,
sizeof(th_v));
706 memset(&f, 0,
sizeof(f));
707 memset(&ssn, 0,
sizeof(ssn));
713 f.
proto = IPPROTO_TCP;
730 "(msg:\"http header test\"; "
731 "content:!\"ECT\"; offset:3; http_method; "
742 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
748 if (http_state == NULL) {
749 printf(
"no http state: ");
758 printf(
"sid 1 matched but shouldn't have: ");
780 static int DetectEngineHttpMethodTest09(
void)
790 "CONNECT /index.html HTTP/1.0\r\n"
791 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
792 uint32_t http_len =
sizeof(http_buf) - 1;
796 memset(&th_v, 0,
sizeof(th_v));
797 memset(&f, 0,
sizeof(f));
798 memset(&ssn, 0,
sizeof(ssn));
804 f.
proto = IPPROTO_TCP;
821 "(msg:\"http header test\"; "
822 "content:\"CON\"; offset:3; http_method; "
833 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
839 if (http_state == NULL) {
840 printf(
"no http state: ");
849 printf(
"sid 1 matched but shouldn't have: ");
871 static int DetectEngineHttpMethodTest10(
void)
881 "CONNECT /index.html HTTP/1.0\r\n"
882 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
883 uint32_t http_len =
sizeof(http_buf) - 1;
887 memset(&th_v, 0,
sizeof(th_v));
888 memset(&f, 0,
sizeof(f));
889 memset(&ssn, 0,
sizeof(ssn));
895 f.
proto = IPPROTO_TCP;
912 "(msg:\"http header test\"; "
913 "content:\"CO\"; http_method; "
914 "content:\"EC\"; within:4; http_method; "
925 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
931 if (http_state == NULL) {
932 printf(
"no http state: ");
941 printf(
"sid 1 didn't match but should have: ");
963 static int DetectEngineHttpMethodTest11(
void)
973 "CONNECT /index.html HTTP/1.0\r\n"
974 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
975 uint32_t http_len =
sizeof(http_buf) - 1;
979 memset(&th_v, 0,
sizeof(th_v));
980 memset(&f, 0,
sizeof(f));
981 memset(&ssn, 0,
sizeof(ssn));
987 f.
proto = IPPROTO_TCP;
1004 "(msg:\"http header test\"; "
1005 "content:\"CO\"; http_method; "
1006 "content:!\"EC\"; within:3; http_method; "
1017 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
1023 if (http_state == NULL) {
1024 printf(
"no http state: ");
1033 printf(
"sid 1 didn't match but should have: ");
1055 static int DetectEngineHttpMethodTest12(
void)
1064 uint8_t http_buf[] =
1065 "CONNECT /index.html HTTP/1.0\r\n"
1066 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
1067 uint32_t http_len =
sizeof(http_buf) - 1;
1071 memset(&th_v, 0,
sizeof(th_v));
1072 memset(&f, 0,
sizeof(f));
1073 memset(&ssn, 0,
sizeof(ssn));
1079 f.
proto = IPPROTO_TCP;
1096 "(msg:\"http header test\"; "
1097 "content:\"CO\"; http_method; "
1098 "content:\"EC\"; within:3; http_method; "
1109 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
1115 if (http_state == NULL) {
1116 printf(
"no http state: ");
1125 printf(
"sid 1 matched but shouldn't have: ");
1147 static int DetectEngineHttpMethodTest13(
void)
1156 uint8_t http_buf[] =
1157 "CONNECT /index.html HTTP/1.0\r\n"
1158 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
1159 uint32_t http_len =
sizeof(http_buf) - 1;
1163 memset(&th_v, 0,
sizeof(th_v));
1164 memset(&f, 0,
sizeof(f));
1165 memset(&ssn, 0,
sizeof(ssn));
1171 f.
proto = IPPROTO_TCP;
1188 "(msg:\"http header test\"; "
1189 "content:\"CO\"; http_method; "
1190 "content:!\"EC\"; within:4; http_method; "
1201 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
1207 if (http_state == NULL) {
1208 printf(
"no http state: ");
1217 printf(
"sid 1 matched but shouldn't have: ");
1239 static int DetectEngineHttpMethodTest14(
void)
1248 uint8_t http_buf[] =
1249 "CONNECT /index.html HTTP/1.0\r\n"
1250 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
1251 uint32_t http_len =
sizeof(http_buf) - 1;
1255 memset(&th_v, 0,
sizeof(th_v));
1256 memset(&f, 0,
sizeof(f));
1257 memset(&ssn, 0,
sizeof(ssn));
1263 f.
proto = IPPROTO_TCP;
1280 "(msg:\"http header test\"; "
1281 "content:\"CO\"; http_method; "
1282 "content:\"EC\"; distance:2; http_method; "
1293 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
1299 if (http_state == NULL) {
1300 printf(
"no http state: ");
1309 printf(
"sid 1 didn't match but should have: ");
1331 static int DetectEngineHttpMethodTest15(
void)
1340 uint8_t http_buf[] =
1341 "CONNECT /index.html HTTP/1.0\r\n"
1342 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
1343 uint32_t http_len =
sizeof(http_buf) - 1;
1347 memset(&th_v, 0,
sizeof(th_v));
1348 memset(&f, 0,
sizeof(f));
1349 memset(&ssn, 0,
sizeof(ssn));
1355 f.
proto = IPPROTO_TCP;
1372 "(msg:\"http header test\"; "
1373 "content:\"CO\"; http_method; "
1374 "content:!\"EC\"; distance:3; http_method; "
1385 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
1391 if (http_state == NULL) {
1392 printf(
"no http state: ");
1401 printf(
"sid 1 didn't match but should have: ");
1423 static int DetectEngineHttpMethodTest16(
void)
1432 uint8_t http_buf[] =
1433 "CONNECT /index.html HTTP/1.0\r\n"
1434 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
1435 uint32_t http_len =
sizeof(http_buf) - 1;
1439 memset(&th_v, 0,
sizeof(th_v));
1440 memset(&f, 0,
sizeof(f));
1441 memset(&ssn, 0,
sizeof(ssn));
1447 f.
proto = IPPROTO_TCP;
1464 "(msg:\"http header test\"; "
1465 "content:\"CO\"; http_method; "
1466 "content:\"EC\"; distance:3; http_method; "
1477 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
1483 if (http_state == NULL) {
1484 printf(
"no http state: ");
1493 printf(
"sid 1 matched but shouldn't have: ");
1515 static int DetectEngineHttpMethodTest17(
void)
1524 uint8_t http_buf[] =
1525 "CONNECT /index.html HTTP/1.0\r\n"
1526 "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
1527 uint32_t http_len =
sizeof(http_buf) - 1;
1531 memset(&th_v, 0,
sizeof(th_v));
1532 memset(&f, 0,
sizeof(f));
1533 memset(&ssn, 0,
sizeof(ssn));
1539 f.
proto = IPPROTO_TCP;
1556 "(msg:\"http header test\"; "
1557 "content:\"CO\"; http_method; "
1558 "content:!\"EC\"; distance:2; http_method; "
1569 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
1575 if (http_state == NULL) {
1576 printf(
"no http state: ");
1585 printf(
"sid 1 matched but shouldn't have: ");
1604 static int DetectHttpMethodTest01(
void)
1614 "alert tcp any any -> any any "
1615 "(msg:\"Testing http_method\"; "
1617 "http_method; sid:1;)");
1622 printf(
"sig parse failed: ");
1632 static int DetectHttpMethodTest02(
void)
1642 "alert tcp any any -> any any "
1643 "(msg:\"Testing http_method\"; "
1644 "http_method; sid:1;)");
1657 static int DetectHttpMethodTest03(
void)
1667 "alert tcp any any -> any any "
1668 "(msg:\"Testing http_method\"; "
1669 "content:\"foobar\"; "
1670 "http_method:\"GET\"; sid:1;)");
1683 static int DetectHttpMethodTest04(
void)
1693 "alert tcp any any -> any any "
1694 "(msg:\"Testing http_method\"; "
1697 "http_method; sid:1;)");
1710 static int DetectHttpMethodTest05(
void)
1720 "alert tcp any any -> any any "
1721 "(msg:\"Testing http_method\"; "
1724 "http_method; sid:1;)");
1737 static int DetectHttpMethodTest12(
void)
1748 "(content:\"one\"; http_method; nocase; sid:1;)") == NULL) {
1749 printf(
"DetectEngineAppend == NULL: ");
1753 "(content:\"one\"; nocase; http_method; sid:2;)") == NULL) {
1754 printf(
"DetectEngineAppend == NULL: ");
1758 if (
de_ctx->
sig_list->sm_lists[g_http_method_buffer_id] == NULL) {
1759 printf(
"de_ctx->sig_list->sm_lists[g_http_method_buffer_id] == NULL: ");
1767 printf(
"nocase flag not set on sig 1: ");
1772 printf(
"nocase flag not set on sig 2: ");
1783 static int DetectHttpMethodTest13(
void)
1793 "alert tcp any any -> any any "
1794 "(msg:\"Testing http_method\"; "
1797 "within:2; http_method; sid:1;)");
1810 static int DetectHttpMethodTest14(
void)
1820 "alert tcp any any -> any any "
1821 "(msg:\"Testing http_method\"; "
1824 "http_method; within:2; sid:1;)");
1837 static int DetectHttpMethodTest15(
void)
1847 "alert tcp any any -> any any "
1848 "(msg:\"Testing http_method\"; "
1851 "http_method; within:2; sid:1;)");
1863 static int DetectHttpMethodSigTest01(
void)
1867 uint8_t httpbuf1[] =
"GET / HTTP/1.0\r\n"
1868 "Host: foo.bar.tld\r\n"
1870 uint32_t httplen1 =
sizeof(httpbuf1) - 1;
1879 memset(&th_v, 0,
sizeof(th_v));
1880 memset(&f, 0,
sizeof(f));
1881 memset(&ssn, 0,
sizeof(ssn));
1887 f.
proto = IPPROTO_TCP;
1906 "alert tcp any any -> any any "
1907 "(msg:\"Testing http_method\"; "
1909 "http_method; sid:1;)");
1915 "alert tcp any any -> any any "
1916 "(msg:\"Testing http_method\"; "
1917 "content:\"POST\"; "
1918 "http_method; sid:2;)");
1929 SCLogDebug(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
1934 if (http_state == NULL) {
1963 static int DetectHttpMethodSigTest02(
void)
1967 uint8_t httpbuf1[] =
"FOO / HTTP/1.0\r\n"
1968 "Host: foo.bar.tld\r\n"
1970 uint32_t httplen1 =
sizeof(httpbuf1) - 1;
1979 memset(&th_v, 0,
sizeof(th_v));
1980 memset(&f, 0,
sizeof(f));
1981 memset(&ssn, 0,
sizeof(ssn));
1987 f.
proto = IPPROTO_TCP;
2006 "alert tcp any any -> any any "
2007 "(msg:\"Testing http_method\"; "
2009 "http_method; sid:1;)");
2015 "alert tcp any any -> any any "
2016 "(msg:\"Testing http_method\"; "
2018 "http_method; sid:2;)");
2029 SCLogDebug(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
2034 if (http_state == NULL) {
2053 if (det_ctx != NULL)
2065 static int DetectHttpMethodSigTest03(
void)
2069 uint8_t httpbuf1[] =
" ";
2070 uint32_t httplen1 =
sizeof(httpbuf1) - 1;
2079 memset(&th_v, 0,
sizeof(th_v));
2080 memset(&f, 0,
sizeof(f));
2081 memset(&ssn, 0,
sizeof(ssn));
2087 f.
proto = IPPROTO_TCP;
2106 "alert tcp any any -> any any "
2107 "(msg:\"Testing http_method\"; "
2109 "http_method; sid:1;)");
2121 SCLogDebug(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
2126 if (http_state == NULL) {
2152 static int DetectHttpMethodSigTest04(
void)
2156 uint8_t httpbuf1[] =
"GET / HTTP/1.0\r\n"
2157 "Host: foo.bar.tld\r\n"
2159 uint32_t httplen1 =
sizeof(httpbuf1) - 1;
2168 memset(&th_v, 0,
sizeof(th_v));
2169 memset(&f, 0,
sizeof(f));
2170 memset(&ssn, 0,
sizeof(ssn));
2176 f.
proto = IPPROTO_TCP;
2195 "alert tcp any any -> any any (msg:\"Testing http_method\"; "
2196 "content:\"GET\"; http_method; sid:1;)");
2202 "alert tcp any any -> any any (msg:\"Testing http_method\"; "
2203 "content:!\"GET\"; http_method; sid:2;)");
2214 SCLogDebug(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
2219 if (http_state == NULL) {
2227 printf(
"sid 1 didn't match but should have: ");
2231 printf(
"sid 2 matched but shouldn't have: ");
2240 if (det_ctx != NULL) {
2253 static int DetectHttpMethodIsdataatParseTest(
void)
2260 "alert tcp any any -> any any ("
2261 "content:\"one\"; http_method; "
2262 "isdataat:!4,relative; sid:1;)");
2283 UtRegisterTest(
"DetectHttpMethodTest01", DetectHttpMethodTest01);
2284 UtRegisterTest(
"DetectHttpMethodTest02", DetectHttpMethodTest02);
2285 UtRegisterTest(
"DetectHttpMethodTest03", DetectHttpMethodTest03);
2286 UtRegisterTest(
"DetectHttpMethodTest04", DetectHttpMethodTest04);
2287 UtRegisterTest(
"DetectHttpMethodTest05", DetectHttpMethodTest05);
2289 DetectHttpMethodTest12);
2290 UtRegisterTest(
"DetectHttpMethodTest13", DetectHttpMethodTest13);
2291 UtRegisterTest(
"DetectHttpMethodTest14", DetectHttpMethodTest14);
2292 UtRegisterTest(
"DetectHttpMethodTest15", DetectHttpMethodTest15);
2293 UtRegisterTest(
"DetectHttpMethodSigTest01", DetectHttpMethodSigTest01);
2294 UtRegisterTest(
"DetectHttpMethodSigTest02", DetectHttpMethodSigTest02);
2295 UtRegisterTest(
"DetectHttpMethodSigTest03", DetectHttpMethodSigTest03);
2296 UtRegisterTest(
"DetectHttpMethodSigTest04", DetectHttpMethodSigTest04);
2299 DetectHttpMethodIsdataatParseTest);
2301 DetectEngineHttpMethodTest01);
2303 DetectEngineHttpMethodTest02);
2305 DetectEngineHttpMethodTest03);
2307 DetectEngineHttpMethodTest04);
2309 DetectEngineHttpMethodTest05);
2311 DetectEngineHttpMethodTest06);
2313 DetectEngineHttpMethodTest07);
2315 DetectEngineHttpMethodTest08);
2317 DetectEngineHttpMethodTest09);
2319 DetectEngineHttpMethodTest10);
2321 DetectEngineHttpMethodTest11);
2323 DetectEngineHttpMethodTest12);
2325 DetectEngineHttpMethodTest13);
2327 DetectEngineHttpMethodTest14);
2329 DetectEngineHttpMethodTest15);
2331 DetectEngineHttpMethodTest16);
2333 DetectEngineHttpMethodTest17);