suricata
detect-http-raw-header.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup httplayer
20  *
21  * @{
22  */
23 
24 /** \file
25  *
26  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
27  * \author Victor Julien <victor@inliniac.net>
28  *
29  * \brief Handle HTTP raw header match.
30  *
31  */
32 
33 #include "../suricata-common.h"
34 #include "../suricata.h"
35 #include "../decode.h"
36 
37 #include "../detect.h"
38 #include "../detect-engine.h"
39 #include "../detect-isdataat.h"
40 #include "../detect-pcre.h"
41 #include "../detect-engine-build.h"
42 #include "../detect-engine-alert.h"
43 
44 #include "../stream-tcp.h"
45 #include "../app-layer.h"
46 #include "../app-layer-htp.h"
47 #include "../app-layer-protos.h"
48 #include "../app-layer-parser.h"
49 
50 #include "../util-unittest.h"
51 #include "../util-unittest-helper.h"
52 #include "../util-validate.h"
53 
54 /***********************************Unittests**********************************/
55 
56 #ifdef UNITTESTS
57 
58 /**
59  * \test Test parser accepting valid rules and rejecting invalid rules
60  */
61 static int DetectHttpRawHeaderParserTest01(void)
62 {
63  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; content:\"abc\"; "
64  "http_raw_header; sid:1;)",
65  true));
66  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; content:\"abc\"; "
67  "nocase; http_raw_header; sid:1;)",
68  true));
69  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; content:\"abc\"; "
70  "endswith; http_raw_header; sid:1;)",
71  true));
72  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; content:\"abc\"; "
73  "startswith; http_raw_header; sid:1;)",
74  true));
75  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; content:\"abc\"; "
76  "startswith; endswith; http_raw_header; sid:1;)",
77  true));
78 
79  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; content:\"abc\"; "
80  "rawbytes; http_raw_header; sid:1;)",
81  false));
82  FAIL_IF_NOT(UTHParseSignature(
83  "alert tcp any any -> any any (flow:to_server; http_raw_header; sid:1;)", false));
84  FAIL_IF_NOT(UTHParseSignature("alert tls any any -> any any (flow:to_server; content:\"abc\"; "
85  "http_raw_header; sid:1;)",
86  false));
87  PASS;
88 }
89 
90 /**
91  * \test Test parser accepting valid rules and rejecting invalid rules
92  */
93 static int DetectHttpRawHeaderParserTest02(void)
94 {
95  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; http.header.raw; "
96  "content:\"abc\"; sid:1;)",
97  true));
98  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; http.header.raw; "
99  "content:\"abc\"; nocase; sid:1;)",
100  true));
101  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; http.header.raw; "
102  "content:\"abc\"; endswith; sid:1;)",
103  true));
104  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; http.header.raw; "
105  "content:\"abc\"; startswith; sid:1;)",
106  true));
107  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; http.header.raw; "
108  "content:\"abc\"; startswith; endswith; sid:1;)",
109  true));
110  FAIL_IF_NOT(UTHParseSignature(
111  "alert http any any -> any any (flow:to_server; http.header.raw; bsize:10; sid:1;)",
112  true));
113 
114  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; http.header.raw; "
115  "content:\"abc\"; rawbytes; sid:1;)",
116  false));
117  FAIL_IF_NOT(UTHParseSignature(
118  "alert tcp any any -> any any (flow:to_server; http.header.raw; sid:1;)", false));
119  FAIL_IF_NOT(UTHParseSignature("alert tls any any -> any any (flow:to_server; http.header.raw; "
120  "content:\"abc\"; sid:1;)",
121  false));
122  PASS;
123 }
124 
125 /**
126  *\test Test that the http_header content matches against a http request
127  * which holds the content.
128  */
129 static int DetectEngineHttpRawHeaderTest01(void)
130 {
131  TcpSession ssn;
132  ThreadVars th_v;
133  DetectEngineThreadCtx *det_ctx = NULL;
134  Flow f;
135  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
136  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
137  uint32_t http_len = sizeof(http_buf) - 1;
138  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
139 
140  memset(&th_v, 0, sizeof(th_v));
141  StatsThreadInit(&th_v.stats);
142  memset(&f, 0, sizeof(f));
143  memset(&ssn, 0, sizeof(ssn));
144 
145  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
146 
147  FLOW_INITIALIZE(&f);
148  f.protoctx = (void *)&ssn;
149  f.proto = IPPROTO_TCP;
150  f.flags |= FLOW_IPV4;
151  p->flow = &f;
152  p->flowflags |= FLOW_PKT_TOSERVER;
153  p->flowflags |= FLOW_PKT_ESTABLISHED;
154  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
155  f.alproto = ALPROTO_HTTP1;
156 
157  StreamTcpInitConfig(true);
158 
159  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
160  FAIL_IF_NULL(de_ctx);
161 
162  de_ctx->flags |= DE_QUIET;
163 
164  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
165  "(msg:\"http header test\"; flow:to_server; "
166  "content:\"one\"; http_raw_header; "
167  "sid:1;)");
168  FAIL_IF_NULL(s);
169 
170  SigGroupBuild(de_ctx);
171  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
172 
173  int r = AppLayerParserParse(
174  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
175  FAIL_IF_NOT(r == 0);
176 
177  HtpState *http_state = f.alstate;
178  FAIL_IF_NULL(http_state);
179 
180  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
181  FAIL_IF(!(PacketAlertCheck(p, 1)));
182 
183  UTHFreePackets(&p, 1);
184  FLOW_DESTROY(&f);
185 
186  AppLayerParserThreadCtxFree(alp_tctx);
187  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
188  DetectEngineCtxFree(de_ctx);
189  StreamTcpFreeConfig(true);
190  StatsThreadCleanup(&th_v.stats);
191  PASS;
192 }
193 
194 /**
195  *\test Test that the http_header content matches against a http request
196  * which holds the content.
197  */
198 static int DetectEngineHttpRawHeaderTest02(void)
199 {
200  TcpSession ssn;
201  ThreadVars th_v;
202  DetectEngineThreadCtx *det_ctx = NULL;
203  Flow f;
204  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
205  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
206  uint32_t http_len = sizeof(http_buf) - 1;
207  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
208 
209  memset(&th_v, 0, sizeof(th_v));
210  StatsThreadInit(&th_v.stats);
211  memset(&f, 0, sizeof(f));
212  memset(&ssn, 0, sizeof(ssn));
213 
214  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
215 
216  FLOW_INITIALIZE(&f);
217  f.protoctx = (void *)&ssn;
218  f.proto = IPPROTO_TCP;
219  f.flags |= FLOW_IPV4;
220  p->flow = &f;
221  p->flowflags |= FLOW_PKT_TOSERVER;
222  p->flowflags |= FLOW_PKT_ESTABLISHED;
223  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
224  f.alproto = ALPROTO_HTTP1;
225 
226  StreamTcpInitConfig(true);
227 
228  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
229  FAIL_IF_NULL(de_ctx);
230  de_ctx->flags |= DE_QUIET;
231 
232  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
233  "(msg:\"http header test\"; flow:to_server; "
234  "content:\"one\"; depth:15; http_raw_header; "
235  "sid:1;)");
236  FAIL_IF_NULL(s);
237 
238  SigGroupBuild(de_ctx);
239  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
240 
241  int r = AppLayerParserParse(
242  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
243  FAIL_IF_NOT(r == 0);
244 
245  HtpState *http_state = f.alstate;
246  FAIL_IF_NULL(http_state);
247 
248  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
249  FAIL_IF(!(PacketAlertCheck(p, 1)));
250 
251  UTHFreePackets(&p, 1);
252  FLOW_DESTROY(&f);
253 
254  AppLayerParserThreadCtxFree(alp_tctx);
255  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
256  DetectEngineCtxFree(de_ctx);
257  StreamTcpFreeConfig(true);
258  StatsThreadCleanup(&th_v.stats);
259  PASS;
260 }
261 
262 /**
263  *\test Test that the http_header content matches against a http request
264  * which holds the content.
265  */
266 static int DetectEngineHttpRawHeaderTest03(void)
267 {
268  TcpSession ssn;
269  ThreadVars th_v;
270  DetectEngineThreadCtx *det_ctx = NULL;
271  Flow f;
272  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
273  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
274  uint32_t http_len = sizeof(http_buf) - 1;
275  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
276 
277  memset(&th_v, 0, sizeof(th_v));
278  StatsThreadInit(&th_v.stats);
279  memset(&f, 0, sizeof(f));
280  memset(&ssn, 0, sizeof(ssn));
281 
282  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
283 
284  FLOW_INITIALIZE(&f);
285  f.protoctx = (void *)&ssn;
286  f.proto = IPPROTO_TCP;
287  f.flags |= FLOW_IPV4;
288  p->flow = &f;
289  p->flowflags |= FLOW_PKT_TOSERVER;
290  p->flowflags |= FLOW_PKT_ESTABLISHED;
291  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
292  f.alproto = ALPROTO_HTTP1;
293 
294  StreamTcpInitConfig(true);
295 
296  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
297  FAIL_IF_NULL(de_ctx);
298  de_ctx->flags |= DE_QUIET;
299 
300  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
301  "(msg:\"http header test\"; flow:to_server; "
302  "content:!\"one\"; depth:5; http_raw_header; "
303  "sid:1;)");
304  FAIL_IF_NULL(s);
305 
306  SigGroupBuild(de_ctx);
307  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
308 
309  int r = AppLayerParserParse(
310  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
311  FAIL_IF_NOT(r == 0);
312 
313  HtpState *http_state = f.alstate;
314  FAIL_IF_NULL(http_state);
315 
316  /* do detect */
317  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
318 
319  FAIL_IF(!(PacketAlertCheck(p, 1)));
320 
321  UTHFreePackets(&p, 1);
322  FLOW_DESTROY(&f);
323 
324  AppLayerParserThreadCtxFree(alp_tctx);
325  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
326  DetectEngineCtxFree(de_ctx);
327  StreamTcpFreeConfig(true);
328  StatsThreadCleanup(&th_v.stats);
329  PASS;
330 }
331 
332 /**
333  *\test Test that the http_header content matches against a http request
334  * which holds the content.
335  */
336 static int DetectEngineHttpRawHeaderTest04(void)
337 {
338  TcpSession ssn;
339  ThreadVars th_v;
340  DetectEngineThreadCtx *det_ctx = NULL;
341  Flow f;
342  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
343  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
344  uint32_t http_len = sizeof(http_buf) - 1;
345  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
346 
347  memset(&th_v, 0, sizeof(th_v));
348  StatsThreadInit(&th_v.stats);
349  memset(&f, 0, sizeof(f));
350  memset(&ssn, 0, sizeof(ssn));
351 
352  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
353 
354  FLOW_INITIALIZE(&f);
355  f.protoctx = (void *)&ssn;
356  f.proto = IPPROTO_TCP;
357  f.flags |= FLOW_IPV4;
358  p->flow = &f;
359  p->flowflags |= FLOW_PKT_TOSERVER;
360  p->flowflags |= FLOW_PKT_ESTABLISHED;
361  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
362  f.alproto = ALPROTO_HTTP1;
363 
364  StreamTcpInitConfig(true);
365 
366  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
367  FAIL_IF_NULL(de_ctx);
368  de_ctx->flags |= DE_QUIET;
369 
370  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
371  "(msg:\"http header test\"; flow:to_server; "
372  "content:\"one\"; depth:5; http_raw_header; "
373  "sid:1;)");
374  FAIL_IF_NULL(s);
375 
376  SigGroupBuild(de_ctx);
377  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
378 
379  int r = AppLayerParserParse(
380  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
381  FAIL_IF_NOT(r == 0);
382 
383  HtpState *http_state = f.alstate;
384  FAIL_IF_NULL(http_state);
385 
386  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
387 
388  FAIL_IF(PacketAlertCheck(p, 1));
389 
390  UTHFreePackets(&p, 1);
391  FLOW_DESTROY(&f);
392  AppLayerParserThreadCtxFree(alp_tctx);
393  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
394  DetectEngineCtxFree(de_ctx);
395  StreamTcpFreeConfig(true);
396  StatsThreadCleanup(&th_v.stats);
397  PASS;
398 }
399 
400 /**
401  *\test Test that the http_header content matches against a http request
402  * which holds the content.
403  */
404 static int DetectEngineHttpRawHeaderTest05(void)
405 {
406  TcpSession ssn;
407  ThreadVars th_v;
408  DetectEngineThreadCtx *det_ctx = NULL;
409  Flow f;
410  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
411  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
412  uint32_t http_len = sizeof(http_buf) - 1;
413  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
414 
415  memset(&th_v, 0, sizeof(th_v));
416  StatsThreadInit(&th_v.stats);
417  memset(&f, 0, sizeof(f));
418  memset(&ssn, 0, sizeof(ssn));
419 
420  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
421 
422  FLOW_INITIALIZE(&f);
423  f.protoctx = (void *)&ssn;
424  f.proto = IPPROTO_TCP;
425  f.flags |= FLOW_IPV4;
426  p->flow = &f;
427  p->flowflags |= FLOW_PKT_TOSERVER;
428  p->flowflags |= FLOW_PKT_ESTABLISHED;
429  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
430  f.alproto = ALPROTO_HTTP1;
431 
432  StreamTcpInitConfig(true);
433 
434  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
435  FAIL_IF_NULL(de_ctx);
436 
437  de_ctx->flags |= DE_QUIET;
438 
439  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
440  "(msg:\"http header test\"; flow:to_server; "
441  "content:!\"one\"; depth:15; http_raw_header; "
442  "sid:1;)");
443  FAIL_IF_NULL(s);
444 
445  SigGroupBuild(de_ctx);
446  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
447 
448  int r = AppLayerParserParse(
449  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
450  FAIL_IF_NOT(r == 0);
451 
452  HtpState *http_state = f.alstate;
453  FAIL_IF_NULL(http_state);
454 
455  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
456  FAIL_IF(PacketAlertCheck(p, 1));
457 
458  UTHFreePackets(&p, 1);
459  FLOW_DESTROY(&f);
460  AppLayerParserThreadCtxFree(alp_tctx);
461  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
462  DetectEngineCtxFree(de_ctx);
463  StreamTcpFreeConfig(true);
464  StatsThreadCleanup(&th_v.stats);
465  PASS;
466 }
467 
468 /**
469  *\test Test that the http_header content matches against a http request
470  * which holds the content.
471  */
472 static int DetectEngineHttpRawHeaderTest06(void)
473 {
474  TcpSession ssn;
475  ThreadVars th_v;
476  DetectEngineThreadCtx *det_ctx = NULL;
477  Flow f;
478  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
479  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
480  uint32_t http_len = sizeof(http_buf) - 1;
481  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
482 
483  memset(&th_v, 0, sizeof(th_v));
484  StatsThreadInit(&th_v.stats);
485  memset(&f, 0, sizeof(f));
486  memset(&ssn, 0, sizeof(ssn));
487 
488  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
489 
490  FLOW_INITIALIZE(&f);
491  f.protoctx = (void *)&ssn;
492  f.proto = IPPROTO_TCP;
493  f.flags |= FLOW_IPV4;
494  p->flow = &f;
495  p->flowflags |= FLOW_PKT_TOSERVER;
496  p->flowflags |= FLOW_PKT_ESTABLISHED;
497  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
498  f.alproto = ALPROTO_HTTP1;
499 
500  StreamTcpInitConfig(true);
501 
502  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
503  FAIL_IF_NULL(de_ctx);
504  de_ctx->flags |= DE_QUIET;
505 
506  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
507  "(msg:\"http header test\"; flow:to_server; "
508  "content:\"one\"; offset:10; http_raw_header; "
509  "sid:1;)");
510  FAIL_IF_NULL(s);
511 
512  SigGroupBuild(de_ctx);
513  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
514 
515  int r = AppLayerParserParse(
516  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
517  FAIL_IF_NOT(r == 0);
518 
519  HtpState *http_state = f.alstate;
520  FAIL_IF_NULL(http_state);
521 
522  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
523  FAIL_IF(!(PacketAlertCheck(p, 1)));
524 
525  UTHFreePackets(&p, 1);
526  FLOW_DESTROY(&f);
527  AppLayerParserThreadCtxFree(alp_tctx);
528  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
529  DetectEngineCtxFree(de_ctx);
530  StreamTcpFreeConfig(true);
531  StatsThreadCleanup(&th_v.stats);
532  PASS;
533 }
534 
535 /**
536  *\test Test that the http_header content matches against a http request
537  * which holds the content.
538  */
539 static int DetectEngineHttpRawHeaderTest07(void)
540 {
541  TcpSession ssn;
542  ThreadVars th_v;
543  DetectEngineThreadCtx *det_ctx = NULL;
544  Flow f;
545  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
546  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
547  uint32_t http_len = sizeof(http_buf) - 1;
548  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
549 
550  memset(&th_v, 0, sizeof(th_v));
551  StatsThreadInit(&th_v.stats);
552  memset(&f, 0, sizeof(f));
553  memset(&ssn, 0, sizeof(ssn));
554 
555  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
556 
557  FLOW_INITIALIZE(&f);
558  f.protoctx = (void *)&ssn;
559  f.proto = IPPROTO_TCP;
560  f.flags |= FLOW_IPV4;
561  p->flow = &f;
562  p->flowflags |= FLOW_PKT_TOSERVER;
563  p->flowflags |= FLOW_PKT_ESTABLISHED;
564  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
565  f.alproto = ALPROTO_HTTP1;
566 
567  StreamTcpInitConfig(true);
568 
569  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
570  FAIL_IF_NULL(de_ctx);
571  de_ctx->flags |= DE_QUIET;
572 
573  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
574  "(msg:\"http header test\"; flow:to_server; "
575  "content:!\"one\"; offset:15; http_raw_header; "
576  "sid:1;)");
577  FAIL_IF_NULL(s);
578 
579  SigGroupBuild(de_ctx);
580  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
581 
582  int r = AppLayerParserParse(
583  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
584  FAIL_IF_NOT(r == 0);
585 
586  HtpState *http_state = f.alstate;
587  FAIL_IF_NULL(http_state);
588 
589  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
590  FAIL_IF(!(PacketAlertCheck(p, 1)));
591 
592  UTHFreePackets(&p, 1);
593  FLOW_DESTROY(&f);
594  AppLayerParserThreadCtxFree(alp_tctx);
595  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
596  DetectEngineCtxFree(de_ctx);
597  StreamTcpFreeConfig(true);
598  StatsThreadCleanup(&th_v.stats);
599  PASS;
600 }
601 
602 /**
603  *\test Test that the http_header content matches against a http request
604  * which holds the content.
605  */
606 static int DetectEngineHttpRawHeaderTest08(void)
607 {
608  TcpSession ssn;
609  ThreadVars th_v;
610  DetectEngineThreadCtx *det_ctx = NULL;
611  Flow f;
612  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
613  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
614  uint32_t http_len = sizeof(http_buf) - 1;
615  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
616 
617  memset(&th_v, 0, sizeof(th_v));
618  StatsThreadInit(&th_v.stats);
619  memset(&f, 0, sizeof(f));
620  memset(&ssn, 0, sizeof(ssn));
621 
622  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
623 
624  FLOW_INITIALIZE(&f);
625  f.protoctx = (void *)&ssn;
626  f.proto = IPPROTO_TCP;
627  f.flags |= FLOW_IPV4;
628  p->flow = &f;
629  p->flowflags |= FLOW_PKT_TOSERVER;
630  p->flowflags |= FLOW_PKT_ESTABLISHED;
631  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
632  f.alproto = ALPROTO_HTTP1;
633 
634  StreamTcpInitConfig(true);
635 
636  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
637  FAIL_IF_NULL(de_ctx);
638  de_ctx->flags |= DE_QUIET;
639 
640  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
641  "(msg:\"http header test\"; flow:to_server; "
642  "content:\"one\"; offset:15; http_raw_header; "
643  "sid:1;)");
644  FAIL_IF_NULL(s);
645 
646  SigGroupBuild(de_ctx);
647  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
648 
649  int r = AppLayerParserParse(
650  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
651  FAIL_IF_NOT(r == 0);
652 
653  HtpState *http_state = f.alstate;
654  FAIL_IF_NULL(http_state);
655 
656  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
657  FAIL_IF(PacketAlertCheck(p, 1));
658 
659  UTHFreePackets(&p, 1);
660  FLOW_DESTROY(&f);
661  AppLayerParserThreadCtxFree(alp_tctx);
662  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
663  DetectEngineCtxFree(de_ctx);
664  StreamTcpFreeConfig(true);
665  StatsThreadCleanup(&th_v.stats);
666  PASS;
667 }
668 
669 /**
670  *\test Test that the http_header content matches against a http request
671  * which holds the content.
672  */
673 static int DetectEngineHttpRawHeaderTest09(void)
674 {
675  TcpSession ssn;
676  ThreadVars th_v;
677  DetectEngineThreadCtx *det_ctx = NULL;
678  Flow f;
679  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
680  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
681  uint32_t http_len = sizeof(http_buf) - 1;
682  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
683 
684  memset(&th_v, 0, sizeof(th_v));
685  StatsThreadInit(&th_v.stats);
686  memset(&f, 0, sizeof(f));
687  memset(&ssn, 0, sizeof(ssn));
688 
689  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
690 
691  FLOW_INITIALIZE(&f);
692  f.protoctx = (void *)&ssn;
693  f.proto = IPPROTO_TCP;
694  f.flags |= FLOW_IPV4;
695  p->flow = &f;
696  p->flowflags |= FLOW_PKT_TOSERVER;
697  p->flowflags |= FLOW_PKT_ESTABLISHED;
698  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
699  f.alproto = ALPROTO_HTTP1;
700 
701  StreamTcpInitConfig(true);
702 
703  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
704  FAIL_IF_NULL(de_ctx);
705  de_ctx->flags |= DE_QUIET;
706 
707  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
708  "(msg:\"http header test\"; flow:to_server; "
709  "content:!\"one\"; offset:10; http_raw_header; "
710  "sid:1;)");
711  FAIL_IF_NULL(s);
712 
713  SigGroupBuild(de_ctx);
714  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
715 
716  int r = AppLayerParserParse(
717  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
718  FAIL_IF_NOT(r == 0);
719 
720  HtpState *http_state = f.alstate;
721  FAIL_IF_NULL(http_state);
722 
723  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
724  FAIL_IF(PacketAlertCheck(p, 1));
725 
726  UTHFreePackets(&p, 1);
727  FLOW_DESTROY(&f);
728  AppLayerParserThreadCtxFree(alp_tctx);
729  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
730  DetectEngineCtxFree(de_ctx);
731  StreamTcpFreeConfig(true);
732  StatsThreadCleanup(&th_v.stats);
733  PASS;
734 }
735 
736 /**
737  *\test Test that the http_header content matches against a http request
738  * which holds the content.
739  */
740 static int DetectEngineHttpRawHeaderTest10(void)
741 {
742  TcpSession ssn;
743  ThreadVars th_v;
744  DetectEngineThreadCtx *det_ctx = NULL;
745  Flow f;
746  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
747  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
748  uint32_t http_len = sizeof(http_buf) - 1;
749  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
750 
751  memset(&th_v, 0, sizeof(th_v));
752  StatsThreadInit(&th_v.stats);
753  memset(&f, 0, sizeof(f));
754  memset(&ssn, 0, sizeof(ssn));
755 
756  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
757 
758  FLOW_INITIALIZE(&f);
759  f.protoctx = (void *)&ssn;
760  f.proto = IPPROTO_TCP;
761  f.flags |= FLOW_IPV4;
762  p->flow = &f;
763  p->flowflags |= FLOW_PKT_TOSERVER;
764  p->flowflags |= FLOW_PKT_ESTABLISHED;
765  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
766  f.alproto = ALPROTO_HTTP1;
767 
768  StreamTcpInitConfig(true);
769 
770  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
771  FAIL_IF_NULL(de_ctx);
772  de_ctx->flags |= DE_QUIET;
773 
774  Signature *s = DetectEngineAppendSig(de_ctx,
775  "alert http any any -> any any "
776  "(msg:\"http header test\"; flow:to_server; "
777  "content:\"one\"; http_raw_header; content:\"three\"; http_raw_header; within:10; "
778  "sid:1;)");
779  FAIL_IF_NULL(s);
780 
781  SigGroupBuild(de_ctx);
782  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
783 
784  int r = AppLayerParserParse(
785  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
786  FAIL_IF_NOT(r == 0);
787 
788  HtpState *http_state = f.alstate;
789  FAIL_IF_NULL(http_state);
790 
791  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
792  FAIL_IF(!(PacketAlertCheck(p, 1)));
793 
794  UTHFreePackets(&p, 1);
795  FLOW_DESTROY(&f);
796  AppLayerParserThreadCtxFree(alp_tctx);
797  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
798  DetectEngineCtxFree(de_ctx);
799  StreamTcpFreeConfig(true);
800  StatsThreadCleanup(&th_v.stats);
801  PASS;
802 }
803 
804 /**
805  *\test Test that the http_header content matches against a http request
806  * which holds the content.
807  */
808 static int DetectEngineHttpRawHeaderTest11(void)
809 {
810  TcpSession ssn;
811  ThreadVars th_v;
812  DetectEngineThreadCtx *det_ctx = NULL;
813  Flow f;
814  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
815  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
816  uint32_t http_len = sizeof(http_buf) - 1;
817  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
818 
819  memset(&th_v, 0, sizeof(th_v));
820  StatsThreadInit(&th_v.stats);
821  memset(&f, 0, sizeof(f));
822  memset(&ssn, 0, sizeof(ssn));
823 
824  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
825 
826  FLOW_INITIALIZE(&f);
827  f.protoctx = (void *)&ssn;
828  f.proto = IPPROTO_TCP;
829  f.flags |= FLOW_IPV4;
830  p->flow = &f;
831  p->flowflags |= FLOW_PKT_TOSERVER;
832  p->flowflags |= FLOW_PKT_ESTABLISHED;
833  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
834  f.alproto = ALPROTO_HTTP1;
835 
836  StreamTcpInitConfig(true);
837 
838  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
839  FAIL_IF_NULL(de_ctx);
840  de_ctx->flags |= DE_QUIET;
841 
842  Signature *s = DetectEngineAppendSig(de_ctx,
843  "alert http any any -> any any "
844  "(msg:\"http header test\"; flow:to_server; "
845  "content:\"one\"; http_raw_header; content:!\"three\"; http_raw_header; within:5; "
846  "sid:1;)");
847  FAIL_IF_NULL(s);
848 
849  SigGroupBuild(de_ctx);
850  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
851 
852  int r = AppLayerParserParse(
853  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
854  FAIL_IF_NOT(r == 0);
855 
856  HtpState *http_state = f.alstate;
857  FAIL_IF_NULL(http_state);
858 
859  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
860 
861  FAIL_IF(!(PacketAlertCheck(p, 1)));
862 
863  UTHFreePackets(&p, 1);
864  FLOW_DESTROY(&f);
865  AppLayerParserThreadCtxFree(alp_tctx);
866  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
867  DetectEngineCtxFree(de_ctx);
868  StreamTcpFreeConfig(true);
869  StatsThreadCleanup(&th_v.stats);
870  PASS;
871 }
872 
873 /**
874  *\test Test that the http_header content matches against a http request
875  * which holds the content.
876  */
877 static int DetectEngineHttpRawHeaderTest12(void)
878 {
879  TcpSession ssn;
880  ThreadVars th_v;
881  DetectEngineThreadCtx *det_ctx = NULL;
882  Flow f;
883  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
884  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
885  uint32_t http_len = sizeof(http_buf) - 1;
886  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
887 
888  memset(&th_v, 0, sizeof(th_v));
889  StatsThreadInit(&th_v.stats);
890  memset(&f, 0, sizeof(f));
891  memset(&ssn, 0, sizeof(ssn));
892 
893  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
894 
895  FLOW_INITIALIZE(&f);
896  f.protoctx = (void *)&ssn;
897  f.proto = IPPROTO_TCP;
898  f.flags |= FLOW_IPV4;
899  p->flow = &f;
900  p->flowflags |= FLOW_PKT_TOSERVER;
901  p->flowflags |= FLOW_PKT_ESTABLISHED;
902  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
903  f.alproto = ALPROTO_HTTP1;
904 
905  StreamTcpInitConfig(true);
906 
907  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
908  FAIL_IF_NULL(de_ctx);
909  de_ctx->flags |= DE_QUIET;
910 
911  Signature *s = DetectEngineAppendSig(de_ctx,
912  "alert http any any -> any any "
913  "(msg:\"http header test\"; flow:to_server; "
914  "content:\"one\"; http_raw_header; content:!\"three\"; http_raw_header; within:10; "
915  "sid:1;)");
916  FAIL_IF_NULL(s);
917 
918  SigGroupBuild(de_ctx);
919  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
920 
921  int r = AppLayerParserParse(
922  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
923  FAIL_IF_NOT(r == 0);
924 
925  HtpState *http_state = f.alstate;
926  FAIL_IF_NULL(http_state);
927 
928  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
929 
930  FAIL_IF(PacketAlertCheck(p, 1));
931 
932  UTHFreePackets(&p, 1);
933  FLOW_DESTROY(&f);
934  AppLayerParserThreadCtxFree(alp_tctx);
935  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
936  DetectEngineCtxFree(de_ctx);
937  StreamTcpFreeConfig(true);
938  StatsThreadCleanup(&th_v.stats);
939  PASS;
940 }
941 
942 /**
943  *\test Test that the http_header content matches against a http request
944  * which holds the content.
945  */
946 static int DetectEngineHttpRawHeaderTest13(void)
947 {
948  TcpSession ssn;
949  ThreadVars th_v;
950  DetectEngineThreadCtx *det_ctx = NULL;
951  Flow f;
952  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
953  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
954  uint32_t http_len = sizeof(http_buf) - 1;
955  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
956 
957  memset(&th_v, 0, sizeof(th_v));
958  StatsThreadInit(&th_v.stats);
959  memset(&f, 0, sizeof(f));
960  memset(&ssn, 0, sizeof(ssn));
961 
962  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
963 
964  FLOW_INITIALIZE(&f);
965  f.protoctx = (void *)&ssn;
966  f.proto = IPPROTO_TCP;
967  f.flags |= FLOW_IPV4;
968  p->flow = &f;
969  p->flowflags |= FLOW_PKT_TOSERVER;
970  p->flowflags |= FLOW_PKT_ESTABLISHED;
971  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
972  f.alproto = ALPROTO_HTTP1;
973 
974  StreamTcpInitConfig(true);
975 
976  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
977  FAIL_IF_NULL(de_ctx);
978  de_ctx->flags |= DE_QUIET;
979 
980  Signature *s = DetectEngineAppendSig(de_ctx,
981  "alert http any any -> any any "
982  "(msg:\"http header test\"; flow:to_server; "
983  "content:\"one\"; http_raw_header; content:\"three\"; http_raw_header; within:5; "
984  "sid:1;)");
985  FAIL_IF_NULL(s);
986 
987  SigGroupBuild(de_ctx);
988  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
989 
990  int r = AppLayerParserParse(
991  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
992  FAIL_IF_NOT(r == 0);
993 
994  HtpState *http_state = f.alstate;
995  FAIL_IF_NULL(http_state);
996 
997  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
998  FAIL_IF(PacketAlertCheck(p, 1));
999 
1000  UTHFreePackets(&p, 1);
1001  FLOW_DESTROY(&f);
1002  AppLayerParserThreadCtxFree(alp_tctx);
1003  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1004  DetectEngineCtxFree(de_ctx);
1005  StreamTcpFreeConfig(true);
1006  StatsThreadCleanup(&th_v.stats);
1007  PASS;
1008 }
1009 
1010 /**
1011  *\test Test that the http_header content matches against a http request
1012  * which holds the content.
1013  */
1014 static int DetectEngineHttpRawHeaderTest14(void)
1015 {
1016  TcpSession ssn;
1017  ThreadVars th_v;
1018  DetectEngineThreadCtx *det_ctx = NULL;
1019  Flow f;
1020  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
1021  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
1022  uint32_t http_len = sizeof(http_buf) - 1;
1023  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1024 
1025  memset(&th_v, 0, sizeof(th_v));
1026  StatsThreadInit(&th_v.stats);
1027  memset(&f, 0, sizeof(f));
1028  memset(&ssn, 0, sizeof(ssn));
1029 
1030  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1031 
1032  FLOW_INITIALIZE(&f);
1033  f.protoctx = (void *)&ssn;
1034  f.proto = IPPROTO_TCP;
1035  f.flags |= FLOW_IPV4;
1036  p->flow = &f;
1037  p->flowflags |= FLOW_PKT_TOSERVER;
1038  p->flowflags |= FLOW_PKT_ESTABLISHED;
1039  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1040  f.alproto = ALPROTO_HTTP1;
1041 
1042  StreamTcpInitConfig(true);
1043 
1044  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1045  FAIL_IF_NULL(de_ctx);
1046  de_ctx->flags |= DE_QUIET;
1047 
1048  Signature *s = DetectEngineAppendSig(de_ctx,
1049  "alert http any any -> any any "
1050  "(msg:\"http header test\"; flow:to_server; "
1051  "content:\"one\"; http_raw_header; content:\"five\"; http_raw_header; distance:7; "
1052  "sid:1;)");
1053  FAIL_IF_NULL(s);
1054 
1055  SigGroupBuild(de_ctx);
1056  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1057 
1058  int r = AppLayerParserParse(
1059  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
1060  FAIL_IF_NOT(r == 0);
1061 
1062  HtpState *http_state = f.alstate;
1063  FAIL_IF_NULL(http_state);
1064 
1065  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1066  FAIL_IF(!(PacketAlertCheck(p, 1)));
1067 
1068  UTHFreePackets(&p, 1);
1069  FLOW_DESTROY(&f);
1070  AppLayerParserThreadCtxFree(alp_tctx);
1071  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1072  DetectEngineCtxFree(de_ctx);
1073  StreamTcpFreeConfig(true);
1074  StatsThreadCleanup(&th_v.stats);
1075  PASS;
1076 }
1077 
1078 /**
1079  *\test Test that the http_header content matches against a http request
1080  * which holds the content.
1081  */
1082 static int DetectEngineHttpRawHeaderTest15(void)
1083 {
1084  TcpSession ssn;
1085  ThreadVars th_v;
1086  DetectEngineThreadCtx *det_ctx = NULL;
1087  Flow f;
1088  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
1089  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
1090  uint32_t http_len = sizeof(http_buf) - 1;
1091  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1092 
1093  memset(&th_v, 0, sizeof(th_v));
1094  StatsThreadInit(&th_v.stats);
1095  memset(&f, 0, sizeof(f));
1096  memset(&ssn, 0, sizeof(ssn));
1097 
1098  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1099 
1100  FLOW_INITIALIZE(&f);
1101  f.protoctx = (void *)&ssn;
1102  f.proto = IPPROTO_TCP;
1103  f.flags |= FLOW_IPV4;
1104  p->flow = &f;
1105  p->flowflags |= FLOW_PKT_TOSERVER;
1106  p->flowflags |= FLOW_PKT_ESTABLISHED;
1107  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1108  f.alproto = ALPROTO_HTTP1;
1109 
1110  StreamTcpInitConfig(true);
1111 
1112  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1113  FAIL_IF_NULL(de_ctx);
1114  de_ctx->flags |= DE_QUIET;
1115 
1116  Signature *s = DetectEngineAppendSig(de_ctx,
1117  "alert http any any -> any any "
1118  "(msg:\"http header test\"; flow:to_server; "
1119  "content:\"one\"; http_raw_header; content:!\"five\"; http_raw_header; distance:15; "
1120  "sid:1;)");
1121  FAIL_IF_NULL(s);
1122 
1123  SigGroupBuild(de_ctx);
1124  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1125 
1126  int r = AppLayerParserParse(
1127  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
1128  FAIL_IF_NOT(r == 0);
1129 
1130  HtpState *http_state = f.alstate;
1131  FAIL_IF_NULL(http_state);
1132 
1133  /* do detect */
1134  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1135  FAIL_IF(!(PacketAlertCheck(p, 1)));
1136 
1137  UTHFreePackets(&p, 1);
1138  FLOW_DESTROY(&f);
1139  AppLayerParserThreadCtxFree(alp_tctx);
1140  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1141  DetectEngineCtxFree(de_ctx);
1142  StreamTcpFreeConfig(true);
1143  StatsThreadCleanup(&th_v.stats);
1144  PASS;
1145 }
1146 
1147 /**
1148  *\test Test that the http_header content matches against a http request
1149  * which holds the content.
1150  */
1151 static int DetectEngineHttpRawHeaderTest16(void)
1152 {
1153  TcpSession ssn;
1154  ThreadVars th_v;
1155  DetectEngineThreadCtx *det_ctx = NULL;
1156  Flow f;
1157  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
1158  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
1159  uint32_t http_len = sizeof(http_buf) - 1;
1160  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1161 
1162  memset(&th_v, 0, sizeof(th_v));
1163  StatsThreadInit(&th_v.stats);
1164  memset(&f, 0, sizeof(f));
1165  memset(&ssn, 0, sizeof(ssn));
1166 
1167  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1168 
1169  FLOW_INITIALIZE(&f);
1170  f.protoctx = (void *)&ssn;
1171  f.proto = IPPROTO_TCP;
1172  f.flags |= FLOW_IPV4;
1173  p->flow = &f;
1174  p->flowflags |= FLOW_PKT_TOSERVER;
1175  p->flowflags |= FLOW_PKT_ESTABLISHED;
1176  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1177  f.alproto = ALPROTO_HTTP1;
1178 
1179  StreamTcpInitConfig(true);
1180 
1181  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1182  FAIL_IF_NULL(de_ctx);
1183  de_ctx->flags |= DE_QUIET;
1184 
1185  Signature *s = DetectEngineAppendSig(de_ctx,
1186  "alert http any any -> any any "
1187  "(msg:\"http header test\"; flow:to_server; "
1188  "content:\"one\"; http_raw_header; content:!\"five\"; http_raw_header; distance:7; "
1189  "sid:1;)");
1190  FAIL_IF_NULL(s);
1191 
1192  SigGroupBuild(de_ctx);
1193  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1194 
1195  int r = AppLayerParserParse(
1196  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
1197  FAIL_IF_NOT(r == 0);
1198 
1199  HtpState *http_state = f.alstate;
1200  FAIL_IF_NULL(http_state);
1201 
1202  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1203  FAIL_IF(PacketAlertCheck(p, 1));
1204 
1205  UTHFreePackets(&p, 1);
1206  FLOW_DESTROY(&f);
1207  AppLayerParserThreadCtxFree(alp_tctx);
1208  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1209  DetectEngineCtxFree(de_ctx);
1210  StreamTcpFreeConfig(true);
1211  StatsThreadCleanup(&th_v.stats);
1212  PASS;
1213 }
1214 
1215 /**
1216  *\test Test that the http_header content matches against a http request
1217  * which holds the content.
1218  */
1219 static int DetectEngineHttpRawHeaderTest17(void)
1220 {
1221  TcpSession ssn;
1222  ThreadVars th_v;
1223  DetectEngineThreadCtx *det_ctx = NULL;
1224  Flow f;
1225  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
1226  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
1227  uint32_t http_len = sizeof(http_buf) - 1;
1228  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1229 
1230  memset(&th_v, 0, sizeof(th_v));
1231  StatsThreadInit(&th_v.stats);
1232  memset(&f, 0, sizeof(f));
1233  memset(&ssn, 0, sizeof(ssn));
1234 
1235  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1236 
1237  FLOW_INITIALIZE(&f);
1238  f.protoctx = (void *)&ssn;
1239  f.proto = IPPROTO_TCP;
1240  f.flags |= FLOW_IPV4;
1241  p->flow = &f;
1242  p->flowflags |= FLOW_PKT_TOSERVER;
1243  p->flowflags |= FLOW_PKT_ESTABLISHED;
1244  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1245  f.alproto = ALPROTO_HTTP1;
1246 
1247  StreamTcpInitConfig(true);
1248 
1249  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1250  FAIL_IF_NULL(de_ctx);
1251  de_ctx->flags |= DE_QUIET;
1252 
1253  Signature *s = DetectEngineAppendSig(de_ctx,
1254  "alert http any any -> any any "
1255  "(msg:\"http header test\"; flow:to_server; "
1256  "content:\"one\"; http_raw_header; content:\"five\"; http_raw_header; distance:15; "
1257  "sid:1;)");
1258  FAIL_IF_NULL(s);
1259 
1260  SigGroupBuild(de_ctx);
1261  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1262 
1263  int r = AppLayerParserParse(
1264  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
1265  FAIL_IF_NOT(r == 0);
1266 
1267  HtpState *http_state = f.alstate;
1268  FAIL_IF_NULL(http_state);
1269 
1270  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1271  FAIL_IF(PacketAlertCheck(p, 1));
1272 
1273  UTHFreePackets(&p, 1);
1274  FLOW_DESTROY(&f);
1275  AppLayerParserThreadCtxFree(alp_tctx);
1276  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1277  DetectEngineCtxFree(de_ctx);
1278  StreamTcpFreeConfig(true);
1279  StatsThreadCleanup(&th_v.stats);
1280  PASS;
1281 }
1282 
1283 static int DetectEngineHttpRawHeaderTest20(void)
1284 {
1285  TcpSession ssn;
1286  ThreadVars th_v;
1287  DetectEngineThreadCtx *det_ctx = NULL;
1288  Flow f;
1289  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1290  "Host: This_is_dummy_body1";
1291  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1292  "\r\n";
1293  uint32_t http1_len = sizeof(http1_buf) - 1;
1294  uint32_t http2_len = sizeof(http2_buf) - 1;
1295  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1296  FAIL_IF_NULL(alp_tctx);
1297 
1298  memset(&th_v, 0, sizeof(th_v));
1299  StatsThreadInit(&th_v.stats);
1300  memset(&f, 0, sizeof(f));
1301  memset(&ssn, 0, sizeof(ssn));
1302 
1303  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1304  FAIL_IF_NULL(p1);
1305  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1306  FAIL_IF_NULL(p2);
1307 
1308  FLOW_INITIALIZE(&f);
1309  f.protoctx = (void *)&ssn;
1310  f.proto = IPPROTO_TCP;
1311  f.flags |= FLOW_IPV4;
1312 
1313  p1->flow = &f;
1314  p1->flowflags |= FLOW_PKT_TOSERVER;
1315  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1316  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1317  p2->flow = &f;
1318  p2->flowflags |= FLOW_PKT_TOSERVER;
1319  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1320  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1321  f.alproto = ALPROTO_HTTP1;
1322 
1323  StreamTcpInitConfig(true);
1324 
1325  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1326  FAIL_IF_NULL(de_ctx);
1327  de_ctx->flags |= DE_QUIET;
1328 
1329  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1330  "(flow:to_server; pcre:/body1/D; "
1331  "content:!\"dummy\"; http_raw_header; within:7; "
1332  "sid:1;)");
1333  FAIL_IF_NULL(s);
1334 
1335  SigGroupBuild(de_ctx);
1336  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1337  FAIL_IF_NULL(det_ctx);
1338 
1339  int r = AppLayerParserParse(
1340  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1341  FAIL_IF_NOT(r == 0);
1342 
1343  HtpState *http_state = f.alstate;
1344  FAIL_IF_NULL(http_state);
1345 
1346  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1347  FAIL_IF(PacketAlertCheck(p1, 1));
1348 
1349  r = AppLayerParserParse(
1350  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1351  FAIL_IF_NOT(r == 0);
1352 
1353  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1354  FAIL_IF(!PacketAlertCheck(p2, 1));
1355 
1356  UTHFreePackets(&p1, 1);
1357  UTHFreePackets(&p2, 1);
1358  FLOW_DESTROY(&f);
1359 
1360  AppLayerParserThreadCtxFree(alp_tctx);
1361  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1362  DetectEngineCtxFree(de_ctx);
1363  StreamTcpFreeConfig(true);
1364  StatsThreadCleanup(&th_v.stats);
1365  PASS;
1366 }
1367 
1368 static int DetectEngineHttpRawHeaderTest21(void)
1369 {
1370  TcpSession ssn;
1371  Packet *p1 = NULL;
1372  Packet *p2 = NULL;
1373  ThreadVars th_v;
1374  DetectEngineThreadCtx *det_ctx = NULL;
1375  Flow f;
1376  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1377  "Host: This_is_dummy_body1";
1378  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1379  "\r\n";
1380  uint32_t http1_len = sizeof(http1_buf) - 1;
1381  uint32_t http2_len = sizeof(http2_buf) - 1;
1382  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1383 
1384  memset(&th_v, 0, sizeof(th_v));
1385  StatsThreadInit(&th_v.stats);
1386  memset(&f, 0, sizeof(f));
1387  memset(&ssn, 0, sizeof(ssn));
1388 
1389  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1390  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1391 
1392  FLOW_INITIALIZE(&f);
1393  f.protoctx = (void *)&ssn;
1394  f.proto = IPPROTO_TCP;
1395  f.flags |= FLOW_IPV4;
1396 
1397  p1->flow = &f;
1398  p1->flowflags |= FLOW_PKT_TOSERVER;
1399  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1400  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1401  p2->flow = &f;
1402  p2->flowflags |= FLOW_PKT_TOSERVER;
1403  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1404  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1405  f.alproto = ALPROTO_HTTP1;
1406 
1407  StreamTcpInitConfig(true);
1408 
1409  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1410  FAIL_IF_NULL(de_ctx);
1411  de_ctx->flags |= DE_QUIET;
1412 
1413  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1414  "(msg:\"http client body test\"; flow:to_server; "
1415  "pcre:/body1/D; "
1416  "content:!\"dummy\"; within:7; http_raw_header; "
1417  "sid:1;)");
1418  FAIL_IF_NULL(s);
1419 
1420  SigGroupBuild(de_ctx);
1421  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1422 
1423  int r = AppLayerParserParse(
1424  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1425  FAIL_IF_NOT(r == 0);
1426 
1427  HtpState *http_state = f.alstate;
1428  FAIL_IF_NULL(http_state);
1429 
1430  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1431  FAIL_IF(PacketAlertCheck(p1, 1));
1432 
1433  r = AppLayerParserParse(
1434  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1435  FAIL_IF_NOT(r == 0);
1436 
1437  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1438  FAIL_IF(!PacketAlertCheck(p2, 1));
1439 
1440  UTHFreePackets(&p1, 1);
1441  UTHFreePackets(&p2, 1);
1442  FLOW_DESTROY(&f);
1443  AppLayerParserThreadCtxFree(alp_tctx);
1444  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1445  DetectEngineCtxFree(de_ctx);
1446  StreamTcpFreeConfig(true);
1447  StatsThreadCleanup(&th_v.stats);
1448  PASS;
1449 }
1450 
1451 static int DetectEngineHttpRawHeaderTest22(void)
1452 {
1453  TcpSession ssn;
1454  Packet *p1 = NULL;
1455  Packet *p2 = NULL;
1456  ThreadVars th_v;
1457  DetectEngineThreadCtx *det_ctx = NULL;
1458  Flow f;
1459  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1460  "Host: This_is_dummy_body1";
1461  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1462  "\r\n";
1463  uint32_t http1_len = sizeof(http1_buf) - 1;
1464  uint32_t http2_len = sizeof(http2_buf) - 1;
1465  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1466 
1467  memset(&th_v, 0, sizeof(th_v));
1468  StatsThreadInit(&th_v.stats);
1469  memset(&f, 0, sizeof(f));
1470  memset(&ssn, 0, sizeof(ssn));
1471 
1472  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1473  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1474 
1475  FLOW_INITIALIZE(&f);
1476  f.protoctx = (void *)&ssn;
1477  f.proto = IPPROTO_TCP;
1478  f.flags |= FLOW_IPV4;
1479 
1480  p1->flow = &f;
1481  p1->flowflags |= FLOW_PKT_TOSERVER;
1482  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1483  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1484  p2->flow = &f;
1485  p2->flowflags |= FLOW_PKT_TOSERVER;
1486  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1487  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1488  f.alproto = ALPROTO_HTTP1;
1489 
1490  StreamTcpInitConfig(true);
1491 
1492  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1493  FAIL_IF_NULL(de_ctx);
1494  de_ctx->flags |= DE_QUIET;
1495 
1496  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1497  "(msg:\"http client body test\"; flow:to_server; "
1498  "pcre:/body1/D; "
1499  "content:!\"dummy\"; distance:3; http_raw_header; "
1500  "sid:1;)");
1501  FAIL_IF_NULL(s);
1502 
1503  SigGroupBuild(de_ctx);
1504  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1505 
1506  int r = AppLayerParserParse(
1507  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1508  FAIL_IF_NOT(r == 0);
1509 
1510  HtpState *http_state = f.alstate;
1511  FAIL_IF_NULL(http_state);
1512 
1513  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1514 
1515  FAIL_IF(PacketAlertCheck(p1, 1));
1516 
1517  r = AppLayerParserParse(
1518  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1519  FAIL_IF_NOT(r == 0);
1520 
1521  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1522  FAIL_IF(PacketAlertCheck(p2, 1));
1523 
1524  UTHFreePackets(&p1, 1);
1525  UTHFreePackets(&p2, 1);
1526  FLOW_DESTROY(&f);
1527  AppLayerParserThreadCtxFree(alp_tctx);
1528  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1529  DetectEngineCtxFree(de_ctx);
1530  StreamTcpFreeConfig(true);
1531  StatsThreadCleanup(&th_v.stats);
1532  PASS;
1533 }
1534 
1535 static int DetectEngineHttpRawHeaderTest23(void)
1536 {
1537  TcpSession ssn;
1538  Packet *p1 = NULL;
1539  Packet *p2 = NULL;
1540  ThreadVars th_v;
1541  DetectEngineThreadCtx *det_ctx = NULL;
1542  Flow f;
1543  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1544  "Host: This_is_dummy_body1";
1545  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1546  "\r\n";
1547  uint32_t http1_len = sizeof(http1_buf) - 1;
1548  uint32_t http2_len = sizeof(http2_buf) - 1;
1549  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1550 
1551  memset(&th_v, 0, sizeof(th_v));
1552  StatsThreadInit(&th_v.stats);
1553  memset(&f, 0, sizeof(f));
1554  memset(&ssn, 0, sizeof(ssn));
1555 
1556  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1557  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1558 
1559  FLOW_INITIALIZE(&f);
1560  f.protoctx = (void *)&ssn;
1561  f.proto = IPPROTO_TCP;
1562  f.flags |= FLOW_IPV4;
1563 
1564  p1->flow = &f;
1565  p1->flowflags |= FLOW_PKT_TOSERVER;
1566  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1567  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1568  p2->flow = &f;
1569  p2->flowflags |= FLOW_PKT_TOSERVER;
1570  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1571  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1572  f.alproto = ALPROTO_HTTP1;
1573 
1574  StreamTcpInitConfig(true);
1575 
1576  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1577  FAIL_IF_NULL(de_ctx);
1578  de_ctx->flags |= DE_QUIET;
1579 
1580  Signature *s =
1581  DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1582  "(msg:\"http client body test\"; flow:to_server; "
1583  "pcre:/body1/D; "
1584  "content:!\"dummy\"; distance:13; http_raw_header; "
1585  "sid:1;)");
1586  FAIL_IF_NULL(s);
1587 
1588  SigGroupBuild(de_ctx);
1589  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1590 
1591  int r = AppLayerParserParse(
1592  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1593  FAIL_IF_NOT(r == 0);
1594 
1595  HtpState *http_state = f.alstate;
1596  FAIL_IF_NULL(http_state);
1597 
1598  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1599  FAIL_IF(PacketAlertCheck(p1, 1));
1600 
1601  r = AppLayerParserParse(
1602  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1603  FAIL_IF_NOT(r == 0);
1604 
1605  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1606  FAIL_IF(!PacketAlertCheck(p2, 1));
1607 
1608  UTHFreePackets(&p1, 1);
1609  UTHFreePackets(&p2, 1);
1610  FLOW_DESTROY(&f);
1611  AppLayerParserThreadCtxFree(alp_tctx);
1612  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1613  DetectEngineCtxFree(de_ctx);
1614  StreamTcpFreeConfig(true);
1615  StatsThreadCleanup(&th_v.stats);
1616  PASS;
1617 }
1618 
1619 static int DetectEngineHttpRawHeaderTest24(void)
1620 {
1621  TcpSession ssn;
1622  Packet *p1 = NULL;
1623  Packet *p2 = NULL;
1624  ThreadVars th_v;
1625  DetectEngineThreadCtx *det_ctx = NULL;
1626  Flow f;
1627  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1628  "Host: This_is_dummy_body1";
1629  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1630  "\r\n";
1631  uint32_t http1_len = sizeof(http1_buf) - 1;
1632  uint32_t http2_len = sizeof(http2_buf) - 1;
1633  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1634 
1635  memset(&th_v, 0, sizeof(th_v));
1636  StatsThreadInit(&th_v.stats);
1637  memset(&f, 0, sizeof(f));
1638  memset(&ssn, 0, sizeof(ssn));
1639 
1640  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1641  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1642 
1643  FLOW_INITIALIZE(&f);
1644  f.protoctx = (void *)&ssn;
1645  f.proto = IPPROTO_TCP;
1646  f.flags |= FLOW_IPV4;
1647 
1648  p1->flow = &f;
1649  p1->flowflags |= FLOW_PKT_TOSERVER;
1650  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1651  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1652  p2->flow = &f;
1653  p2->flowflags |= FLOW_PKT_TOSERVER;
1654  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1655  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1656  f.alproto = ALPROTO_HTTP1;
1657 
1658  StreamTcpInitConfig(true);
1659 
1660  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1661  FAIL_IF_NULL(de_ctx);
1662  de_ctx->flags |= DE_QUIET;
1663 
1664  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1665  "(msg:\"http client body test\"; flow:to_server; "
1666  "pcre:/body1/D; "
1667  "content:\"dummy\"; within:15; http_raw_header; "
1668  "sid:1;)");
1669  FAIL_IF_NULL(s);
1670 
1671  SigGroupBuild(de_ctx);
1672  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1673 
1674  int r = AppLayerParserParse(
1675  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1676  FAIL_IF_NOT(r == 0);
1677 
1678  HtpState *http_state = f.alstate;
1679  FAIL_IF_NULL(http_state);
1680 
1681  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1682  FAIL_IF(PacketAlertCheck(p1, 1));
1683 
1684  r = AppLayerParserParse(
1685  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1686  FAIL_IF_NOT(r == 0);
1687 
1688  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1689 
1690  FAIL_IF(!PacketAlertCheck(p2, 1));
1691 
1692  UTHFreePackets(&p1, 1);
1693  UTHFreePackets(&p2, 1);
1694  FLOW_DESTROY(&f);
1695  AppLayerParserThreadCtxFree(alp_tctx);
1696  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1697  DetectEngineCtxFree(de_ctx);
1698  StreamTcpFreeConfig(true);
1699  StatsThreadCleanup(&th_v.stats);
1700  PASS;
1701 }
1702 
1703 static int DetectEngineHttpRawHeaderTest25(void)
1704 {
1705  TcpSession ssn;
1706  Packet *p1 = NULL;
1707  Packet *p2 = NULL;
1708  ThreadVars th_v;
1709  DetectEngineThreadCtx *det_ctx = NULL;
1710  Flow f;
1711  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1712  "Host: This_is_dummy_body1";
1713  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1714  "\r\n";
1715  uint32_t http1_len = sizeof(http1_buf) - 1;
1716  uint32_t http2_len = sizeof(http2_buf) - 1;
1717  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1718 
1719  memset(&th_v, 0, sizeof(th_v));
1720  StatsThreadInit(&th_v.stats);
1721  memset(&f, 0, sizeof(f));
1722  memset(&ssn, 0, sizeof(ssn));
1723 
1724  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1725  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1726 
1727  FLOW_INITIALIZE(&f);
1728  f.protoctx = (void *)&ssn;
1729  f.proto = IPPROTO_TCP;
1730  f.flags |= FLOW_IPV4;
1731 
1732  p1->flow = &f;
1733  p1->flowflags |= FLOW_PKT_TOSERVER;
1734  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1735  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1736  p2->flow = &f;
1737  p2->flowflags |= FLOW_PKT_TOSERVER;
1738  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1739  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1740  f.alproto = ALPROTO_HTTP1;
1741 
1742  StreamTcpInitConfig(true);
1743 
1744  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1745  FAIL_IF_NULL(de_ctx);
1746  de_ctx->flags |= DE_QUIET;
1747 
1748  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1749  "(msg:\"http client body test\"; flow:to_server; "
1750  "pcre:/body1/D; "
1751  "content:\"dummy\"; within:10; http_raw_header; "
1752  "sid:1;)");
1753  FAIL_IF_NULL(s);
1754 
1755  SigGroupBuild(de_ctx);
1756  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1757 
1758  int r = AppLayerParserParse(
1759  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1760  FAIL_IF_NOT(r == 0);
1761 
1762  HtpState *http_state = f.alstate;
1763  FAIL_IF_NULL(http_state);
1764 
1765  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1766  FAIL_IF(PacketAlertCheck(p1, 1));
1767 
1768  r = AppLayerParserParse(
1769  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1770  FAIL_IF_NOT(r == 0);
1771 
1772  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1773  FAIL_IF(PacketAlertCheck(p2, 1));
1774 
1775  UTHFreePackets(&p1, 1);
1776  UTHFreePackets(&p2, 1);
1777  FLOW_DESTROY(&f);
1778  AppLayerParserThreadCtxFree(alp_tctx);
1779  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1780  DetectEngineCtxFree(de_ctx);
1781  StreamTcpFreeConfig(true);
1782  StatsThreadCleanup(&th_v.stats);
1783  PASS;
1784 }
1785 
1786 static int DetectEngineHttpRawHeaderTest26(void)
1787 {
1788  TcpSession ssn;
1789  Packet *p1 = NULL;
1790  Packet *p2 = NULL;
1791  ThreadVars th_v;
1792  DetectEngineThreadCtx *det_ctx = NULL;
1793  Flow f;
1794  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1795  "Host: This_is_dummy_body1";
1796  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1797  "\r\n";
1798  uint32_t http1_len = sizeof(http1_buf) - 1;
1799  uint32_t http2_len = sizeof(http2_buf) - 1;
1800  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1801 
1802  memset(&th_v, 0, sizeof(th_v));
1803  StatsThreadInit(&th_v.stats);
1804  memset(&f, 0, sizeof(f));
1805  memset(&ssn, 0, sizeof(ssn));
1806 
1807  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1808  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1809 
1810  FLOW_INITIALIZE(&f);
1811  f.protoctx = (void *)&ssn;
1812  f.proto = IPPROTO_TCP;
1813  f.flags |= FLOW_IPV4;
1814 
1815  p1->flow = &f;
1816  p1->flowflags |= FLOW_PKT_TOSERVER;
1817  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1818  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1819  p2->flow = &f;
1820  p2->flowflags |= FLOW_PKT_TOSERVER;
1821  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1822  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1823  f.alproto = ALPROTO_HTTP1;
1824 
1825  StreamTcpInitConfig(true);
1826 
1827  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1828  FAIL_IF_NULL(de_ctx);
1829  de_ctx->flags |= DE_QUIET;
1830 
1831  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1832  "(msg:\"http client body test\"; flow:to_server; "
1833  "pcre:/body1/D; "
1834  "content:\"dummy\"; distance:8; http_raw_header; "
1835  "sid:1;)");
1836  FAIL_IF_NULL(s);
1837 
1838  SigGroupBuild(de_ctx);
1839  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1840 
1841  int r = AppLayerParserParse(
1842  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1843  FAIL_IF_NOT(r == 0);
1844 
1845  HtpState *http_state = f.alstate;
1846  FAIL_IF_NULL(http_state);
1847 
1848  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1849  FAIL_IF(PacketAlertCheck(p1, 1));
1850 
1851  r = AppLayerParserParse(
1852  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1853  FAIL_IF_NOT(r == 0);
1854 
1855  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1856  FAIL_IF(!PacketAlertCheck(p2, 1));
1857 
1858  UTHFreePackets(&p1, 1);
1859  UTHFreePackets(&p2, 1);
1860  FLOW_DESTROY(&f);
1861  AppLayerParserThreadCtxFree(alp_tctx);
1862  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1863  DetectEngineCtxFree(de_ctx);
1864  StreamTcpFreeConfig(true);
1865  StatsThreadCleanup(&th_v.stats);
1866  PASS;
1867 }
1868 
1869 static int DetectEngineHttpRawHeaderTest27(void)
1870 {
1871  TcpSession ssn;
1872  Packet *p1 = NULL;
1873  Packet *p2 = NULL;
1874  ThreadVars th_v;
1875  DetectEngineThreadCtx *det_ctx = NULL;
1876  Flow f;
1877  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1878  "Host: This_is_dummy_body1";
1879  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1880  "\r\n";
1881  uint32_t http1_len = sizeof(http1_buf) - 1;
1882  uint32_t http2_len = sizeof(http2_buf) - 1;
1883  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1884 
1885  memset(&th_v, 0, sizeof(th_v));
1886  StatsThreadInit(&th_v.stats);
1887  memset(&f, 0, sizeof(f));
1888  memset(&ssn, 0, sizeof(ssn));
1889 
1890  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1891  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1892 
1893  FLOW_INITIALIZE(&f);
1894  f.protoctx = (void *)&ssn;
1895  f.proto = IPPROTO_TCP;
1896  f.flags |= FLOW_IPV4;
1897 
1898  p1->flow = &f;
1899  p1->flowflags |= FLOW_PKT_TOSERVER;
1900  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1901  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1902  p2->flow = &f;
1903  p2->flowflags |= FLOW_PKT_TOSERVER;
1904  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1905  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1906  f.alproto = ALPROTO_HTTP1;
1907 
1908  StreamTcpInitConfig(true);
1909 
1910  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1911  FAIL_IF_NULL(de_ctx);
1912  de_ctx->flags |= DE_QUIET;
1913 
1914  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1915  "(msg:\"http client body test\"; flow:to_server; "
1916  "pcre:/body1/D; "
1917  "content:\"dummy\"; distance:14; http_raw_header; "
1918  "sid:1;)");
1919  FAIL_IF_NULL(s);
1920 
1921  SigGroupBuild(de_ctx);
1922  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1923 
1924  int r = AppLayerParserParse(
1925  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1926  FAIL_IF_NOT(r == 0);
1927 
1928  HtpState *http_state = f.alstate;
1929  FAIL_IF_NULL(http_state);
1930 
1931  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1932  FAIL_IF(PacketAlertCheck(p1, 1));
1933 
1934  r = AppLayerParserParse(
1935  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1936  FAIL_IF_NOT(r == 0);
1937 
1938  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1939  FAIL_IF(PacketAlertCheck(p2, 1));
1940 
1941  UTHFreePackets(&p1, 1);
1942  UTHFreePackets(&p2, 1);
1943  FLOW_DESTROY(&f);
1944  AppLayerParserThreadCtxFree(alp_tctx);
1945  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1946  DetectEngineCtxFree(de_ctx);
1947  StreamTcpFreeConfig(true);
1948  StatsThreadCleanup(&th_v.stats);
1949  PASS;
1950 }
1951 
1952 static int DetectEngineHttpRawHeaderTest28(void)
1953 {
1954  TcpSession ssn;
1955  Packet *p1 = NULL;
1956  Packet *p2 = NULL;
1957  ThreadVars th_v;
1958  DetectEngineThreadCtx *det_ctx = NULL;
1959  Flow f;
1960  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
1961  "Host: www.openinfosecfoundation.org\r\n"
1962  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
1963  "Gecko/20091221 Firefox/3.5.7\r\n"
1964  "\r\n";
1965  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
1966  uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n"
1967  "Content-Type: text/html\r\n"
1968  "Content-Length: 6\r\n"
1969  "\r\n"
1970  "abcdef";
1971  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
1972  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1973 
1974  memset(&th_v, 0, sizeof(th_v));
1975  StatsThreadInit(&th_v.stats);
1976  memset(&f, 0, sizeof(f));
1977  memset(&ssn, 0, sizeof(ssn));
1978 
1979  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1980  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1981 
1982  FLOW_INITIALIZE(&f);
1983  f.protoctx = (void *)&ssn;
1984  f.proto = IPPROTO_TCP;
1985  f.flags |= FLOW_IPV4;
1986 
1987  p1->flow = &f;
1988  p1->flowflags |= FLOW_PKT_TOSERVER;
1989  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1990  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1991  p2->flow = &f;
1992  p2->flowflags |= FLOW_PKT_TOCLIENT;
1993  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1994  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1995  f.alproto = ALPROTO_HTTP1;
1996 
1997  StreamTcpInitConfig(true);
1998 
1999  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2000  FAIL_IF_NULL(de_ctx);
2001  de_ctx->flags |= DE_QUIET;
2002 
2003  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2004  "(msg:\"http header test\"; flow:to_client; "
2005  "content:\"Content-Length: 6\"; http_raw_header; "
2006  "sid:1;)");
2007  FAIL_IF_NULL(s);
2008 
2009  SigGroupBuild(de_ctx);
2010  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2011 
2012  int r = AppLayerParserParse(
2013  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
2014  FAIL_IF_NOT(r == 0);
2015 
2016  HtpState *http_state = f.alstate;
2017  FAIL_IF_NULL(http_state);
2018 
2019  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2020  FAIL_IF(PacketAlertCheck(p1, 1));
2021 
2022  r = AppLayerParserParse(
2023  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_buf2_len);
2024  FAIL_IF_NOT(r == 0);
2025 
2026  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
2027  FAIL_IF(!PacketAlertCheck(p2, 1));
2028 
2029  UTHFreePackets(&p1, 1);
2030  UTHFreePackets(&p2, 1);
2031  FLOW_DESTROY(&f);
2032  AppLayerParserThreadCtxFree(alp_tctx);
2033  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2034  DetectEngineCtxFree(de_ctx);
2035  StreamTcpFreeConfig(true);
2036  StatsThreadCleanup(&th_v.stats);
2037  PASS;
2038 }
2039 
2040 static int DetectEngineHttpRawHeaderTest29(void)
2041 {
2042  TcpSession ssn;
2043  Packet *p1 = NULL;
2044  Packet *p2 = NULL;
2045  ThreadVars th_v;
2046  DetectEngineThreadCtx *det_ctx = NULL;
2047  Flow f;
2048  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
2049  "Host: www.openinfosecfoundation.org\r\n"
2050  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2051  "Gecko/20091221 Firefox/3.5.7\r\n"
2052  "\r\n";
2053  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
2054  uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n"
2055  "Content-Type: text/html\r\n"
2056  "Content-Length: 6\r\n"
2057  "\r\n"
2058  "abcdef";
2059  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
2060  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2061 
2062  memset(&th_v, 0, sizeof(th_v));
2063  StatsThreadInit(&th_v.stats);
2064  memset(&f, 0, sizeof(f));
2065  memset(&ssn, 0, sizeof(ssn));
2066 
2067  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2068  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2069 
2070  FLOW_INITIALIZE(&f);
2071  f.protoctx = (void *)&ssn;
2072  f.proto = IPPROTO_TCP;
2073  f.flags |= FLOW_IPV4;
2074 
2075  p1->flow = &f;
2076  p1->flowflags |= FLOW_PKT_TOSERVER;
2077  p1->flowflags |= FLOW_PKT_ESTABLISHED;
2078  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2079  p2->flow = &f;
2080  p2->flowflags |= FLOW_PKT_TOCLIENT;
2081  p2->flowflags |= FLOW_PKT_ESTABLISHED;
2082  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2083  f.alproto = ALPROTO_HTTP1;
2084 
2085  StreamTcpInitConfig(true);
2086 
2087  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2088  FAIL_IF_NULL(de_ctx);
2089  de_ctx->flags |= DE_QUIET;
2090 
2091  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2092  "(msg:\"http header test\"; flow:to_client; "
2093  "content:\"Content-Length: 7\"; http_raw_header; "
2094  "sid:1;)");
2095  FAIL_IF_NULL(s);
2096 
2097  SigGroupBuild(de_ctx);
2098  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2099 
2100  int r = AppLayerParserParse(
2101  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
2102  FAIL_IF_NOT(r == 0);
2103 
2104  HtpState *http_state = f.alstate;
2105  FAIL_IF_NULL(http_state);
2106 
2107  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2108  FAIL_IF(PacketAlertCheck(p1, 1));
2109 
2110  r = AppLayerParserParse(
2111  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_buf2_len);
2112  FAIL_IF_NOT(r == 0);
2113 
2114  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
2115  FAIL_IF(PacketAlertCheck(p2, 1));
2116 
2117  UTHFreePackets(&p1, 1);
2118  UTHFreePackets(&p2, 1);
2119  FLOW_DESTROY(&f);
2120  AppLayerParserThreadCtxFree(alp_tctx);
2121  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2122  DetectEngineCtxFree(de_ctx);
2123  StreamTcpFreeConfig(true);
2124  StatsThreadCleanup(&th_v.stats);
2125  PASS;
2126 }
2127 
2128 /**
2129  * \test Trailing headers.
2130  */
2131 static int DetectEngineHttpRawHeaderTest31(void)
2132 {
2133  TcpSession ssn;
2134  Packet *p1 = NULL;
2135  ThreadVars th_v;
2136  DetectEngineThreadCtx *det_ctx = NULL;
2137  Flow f;
2138  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
2139  "host: boom\r\n"
2140  "Transfer-Encoding: chunked\r\n"
2141  "\r\n"
2142  "13\r\n"
2143  "This is dummy body1\r\n"
2144  "0\r\n"
2145  "Dummy-Header: kaboom\r\n"
2146  "\r\n";
2147  uint32_t http1_len = sizeof(http1_buf) - 1;
2148  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2149 
2150  memset(&th_v, 0, sizeof(th_v));
2151  StatsThreadInit(&th_v.stats);
2152  memset(&f, 0, sizeof(f));
2153  memset(&ssn, 0, sizeof(ssn));
2154 
2155  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2156 
2157  FLOW_INITIALIZE(&f);
2158  f.protoctx = (void *)&ssn;
2159  f.proto = IPPROTO_TCP;
2160  f.flags |= FLOW_IPV4;
2161 
2162  p1->flow = &f;
2163  p1->flowflags |= FLOW_PKT_TOSERVER;
2164  p1->flowflags |= FLOW_PKT_ESTABLISHED;
2165  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2166  f.alproto = ALPROTO_HTTP1;
2167 
2168  StreamTcpInitConfig(true);
2169 
2170  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2171  FAIL_IF_NULL(de_ctx);
2172  de_ctx->flags |= DE_QUIET;
2173 
2174  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2175  "(flow:to_server; "
2176  "content:\"Dummy\"; http_raw_header; "
2177  "sid:1;)");
2178  FAIL_IF_NULL(s);
2179 
2180  SigGroupBuild(de_ctx);
2181  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2182 
2183  int r = AppLayerParserParse(
2184  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
2185  FAIL_IF_NOT(r == 0);
2186 
2187  HtpState *http_state = f.alstate;
2188  FAIL_IF_NULL(http_state);
2189 
2190  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2191  FAIL_IF(!(PacketAlertCheck(p1, 1)));
2192 
2193  UTHFreePackets(&p1, 1);
2194  FLOW_DESTROY(&f);
2195  AppLayerParserThreadCtxFree(alp_tctx);
2196  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2197  DetectEngineCtxFree(de_ctx);
2198  StreamTcpFreeConfig(true);
2199  StatsThreadCleanup(&th_v.stats);
2200  PASS;
2201 }
2202 
2203 /**
2204  * \test Trailing headers.
2205  */
2206 static int DetectEngineHttpRawHeaderTest32(void)
2207 {
2208  TcpSession ssn;
2209  Packet *p1 = NULL;
2210  Packet *p2 = NULL;
2211  ThreadVars th_v;
2212  DetectEngineThreadCtx *det_ctx = NULL;
2213  Flow f;
2214  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
2215  "host: boom\r\n"
2216  "Transfer-Encoding: chunked\r\n"
2217  "\r\n"
2218  "13\r\n"
2219  "This is dummy body1\r\n"
2220  "0\r\n";
2221  uint8_t http2_buf[] = "Dummy-Header: kaboom\r\n"
2222  "\r\n";
2223  uint32_t http1_len = sizeof(http1_buf) - 1;
2224  uint32_t http2_len = sizeof(http2_buf) - 1;
2225  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2226 
2227  memset(&th_v, 0, sizeof(th_v));
2228  StatsThreadInit(&th_v.stats);
2229  memset(&f, 0, sizeof(f));
2230  memset(&ssn, 0, sizeof(ssn));
2231 
2232  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2233  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2234 
2235  FLOW_INITIALIZE(&f);
2236  f.protoctx = (void *)&ssn;
2237  f.proto = IPPROTO_TCP;
2238  f.flags |= FLOW_IPV4;
2239 
2240  p1->flow = &f;
2241  p1->flowflags |= FLOW_PKT_TOSERVER;
2242  p1->flowflags |= FLOW_PKT_ESTABLISHED;
2243  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2244  p2->flow = &f;
2245  p2->flowflags |= FLOW_PKT_TOSERVER;
2246  p2->flowflags |= FLOW_PKT_ESTABLISHED;
2247  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2248  f.alproto = ALPROTO_HTTP1;
2249 
2250  StreamTcpInitConfig(true);
2251 
2252  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2253  FAIL_IF_NULL(de_ctx);
2254  de_ctx->flags |= DE_QUIET;
2255 
2256  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2257  "(flow:to_server; "
2258  "content:\"Dummy\"; http_raw_header; "
2259  "sid:1;)");
2260  FAIL_IF_NULL(s);
2261 
2262  SigGroupBuild(de_ctx);
2263  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2264 
2265  int r = AppLayerParserParse(
2266  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
2267  FAIL_IF_NOT(r == 0);
2268 
2269  HtpState *http_state = f.alstate;
2270  FAIL_IF_NULL(http_state);
2271 
2272  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2273 
2274  FAIL_IF(PacketAlertCheck(p1, 1));
2275 
2276  r = AppLayerParserParse(
2277  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
2278  FAIL_IF_NOT(r == 0);
2279 
2280  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
2281  FAIL_IF(!PacketAlertCheck(p2, 1));
2282 
2283  UTHFreePackets(&p1, 1);
2284  UTHFreePackets(&p2, 1);
2285  FLOW_DESTROY(&f);
2286  AppLayerParserThreadCtxFree(alp_tctx);
2287  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2288  DetectEngineCtxFree(de_ctx);
2289  StreamTcpFreeConfig(true);
2290  StatsThreadCleanup(&th_v.stats);
2291  PASS;
2292 }
2293 
2294 /**
2295  *\test Test that the http_header content matches against a http request
2296  * which holds the content.
2297  */
2298 static int DetectHttpRawHeaderTest06(void)
2299 {
2300  TcpSession ssn;
2301  ThreadVars th_v;
2302  DetectEngineThreadCtx *det_ctx = NULL;
2303  Flow f;
2304  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
2305  "Host: www.openinfosecfoundation.org\r\n"
2306  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2307  "Gecko/20091221 Firefox/3.5.7\r\n"
2308  "Content-Type: text/html\r\n"
2309  "Content-Length: 26\r\n"
2310  "\r\n"
2311  "This is dummy message body\r\n";
2312  uint32_t http_len = sizeof(http_buf) - 1;
2313  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2314 
2315  memset(&th_v, 0, sizeof(th_v));
2316  StatsThreadInit(&th_v.stats);
2317  memset(&f, 0, sizeof(f));
2318  memset(&ssn, 0, sizeof(ssn));
2319 
2320  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2321 
2322  FLOW_INITIALIZE(&f);
2323  f.protoctx = (void *)&ssn;
2324  f.proto = IPPROTO_TCP;
2325  f.flags |= FLOW_IPV4;
2326  p->flow = &f;
2327  p->flowflags |= FLOW_PKT_TOSERVER;
2328  p->flowflags |= FLOW_PKT_ESTABLISHED;
2329  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2330  f.alproto = ALPROTO_HTTP1;
2331 
2332  StreamTcpInitConfig(true);
2333 
2334  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2335  FAIL_IF_NULL(de_ctx);
2336  de_ctx->flags |= DE_QUIET;
2337 
2338  Signature *s =
2339  DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2340  "(msg:\"http header test\"; flow:to_server; "
2341  "content:\"Content-Type: text/html\"; http_raw_header; "
2342  "sid:1;)");
2343  FAIL_IF_NULL(s);
2344 
2345  SigGroupBuild(de_ctx);
2346  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2347 
2348  int r = AppLayerParserParse(
2349  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
2350  FAIL_IF_NOT(r == 0);
2351 
2352  HtpState *http_state = f.alstate;
2353  FAIL_IF_NULL(http_state);
2354 
2355  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2356  FAIL_IF(!(PacketAlertCheck(p, 1)));
2357 
2358  UTHFreePackets(&p, 1);
2359  FLOW_DESTROY(&f);
2360  AppLayerParserThreadCtxFree(alp_tctx);
2361  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2362  DetectEngineCtxFree(de_ctx);
2363  StreamTcpFreeConfig(true);
2364  StatsThreadCleanup(&th_v.stats);
2365  PASS;
2366 }
2367 
2368 /**
2369  *\test Test that the http_header content matches against a http request
2370  * which holds the content.
2371  */
2372 static int DetectHttpRawHeaderTest07(void)
2373 {
2374  TcpSession ssn;
2375  Packet *p1 = NULL;
2376  Packet *p2 = NULL;
2377  ThreadVars th_v;
2378  DetectEngineThreadCtx *det_ctx = NULL;
2379  Flow f;
2380  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
2381  "Host: www.openinfosecfoundation.org\r\n"
2382  "User-Agent: Mozi";
2383  uint8_t http2_buf[] = "lla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 "
2384  "Firefox/3.5.7\r\nContent-Type: text/html\r\n"
2385  "Content-Length: 67\r\n"
2386  "\r\n"
2387  "This is dummy message body1";
2388  uint32_t http1_len = sizeof(http1_buf) - 1;
2389  uint32_t http2_len = sizeof(http2_buf) - 1;
2390  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2391 
2392  memset(&th_v, 0, sizeof(th_v));
2393  StatsThreadInit(&th_v.stats);
2394  memset(&f, 0, sizeof(f));
2395  memset(&ssn, 0, sizeof(ssn));
2396 
2397  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2398  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2399 
2400  FLOW_INITIALIZE(&f);
2401  f.protoctx = (void *)&ssn;
2402  f.proto = IPPROTO_TCP;
2403  f.flags |= FLOW_IPV4;
2404  p1->flow = &f;
2405  p1->flowflags |= FLOW_PKT_TOSERVER;
2406  p1->flowflags |= FLOW_PKT_ESTABLISHED;
2407  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2408  p2->flow = &f;
2409  p2->flowflags |= FLOW_PKT_TOSERVER;
2410  p2->flowflags |= FLOW_PKT_ESTABLISHED;
2411  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2412  f.alproto = ALPROTO_HTTP1;
2413 
2414  StreamTcpInitConfig(true);
2415 
2416  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2417  FAIL_IF_NULL(de_ctx);
2418  de_ctx->flags |= DE_QUIET;
2419 
2420  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2421  "(msg:\"http header test\"; flow:to_server; "
2422  "content:\"Mozilla\"; http_raw_header; "
2423  "sid:1;)");
2424  FAIL_IF_NULL(s);
2425 
2426  SigGroupBuild(de_ctx);
2427  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2428 
2429  int r = AppLayerParserParse(
2430  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
2431  FAIL_IF_NOT(r == 0);
2432 
2433  HtpState *http_state = f.alstate;
2434  FAIL_IF_NULL(http_state);
2435 
2436  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2437  FAIL_IF((PacketAlertCheck(p1, 1)));
2438 
2439  r = AppLayerParserParse(
2440  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
2441  FAIL_IF_NOT(r == 0);
2442 
2443  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
2444  FAIL_IF(!(PacketAlertCheck(p2, 1)));
2445 
2446  UTHFreePackets(&p1, 1);
2447  UTHFreePackets(&p2, 1);
2448  FLOW_DESTROY(&f);
2449  AppLayerParserThreadCtxFree(alp_tctx);
2450  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2451  DetectEngineCtxFree(de_ctx);
2452  StreamTcpFreeConfig(true);
2453  StatsThreadCleanup(&th_v.stats);
2454  PASS;
2455 }
2456 
2457 /**
2458  *\test Test that the http_header content matches against a http request
2459  * which holds the content.
2460  */
2461 static int DetectHttpRawHeaderTest08(void)
2462 {
2463  TcpSession ssn;
2464  Packet *p1 = NULL;
2465  Packet *p2 = NULL;
2466  ThreadVars th_v;
2467  DetectEngineThreadCtx *det_ctx = NULL;
2468  Flow f;
2469  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
2470  "Host: www.openinfosecfoundation.org\r\n";
2471  uint8_t http2_buf[] = "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2472  "Gecko/20091221 Firefox/3.5.7\r\n"
2473  "Content-Type: text/html\r\n"
2474  "Content-Length: 67\r\n"
2475  "\r\n";
2476  uint32_t http1_len = sizeof(http1_buf) - 1;
2477  uint32_t http2_len = sizeof(http2_buf) - 1;
2478  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2479 
2480  memset(&th_v, 0, sizeof(th_v));
2481  StatsThreadInit(&th_v.stats);
2482  memset(&f, 0, sizeof(f));
2483  memset(&ssn, 0, sizeof(ssn));
2484 
2485  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2486  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2487 
2488  FLOW_INITIALIZE(&f);
2489  f.protoctx = (void *)&ssn;
2490  f.proto = IPPROTO_TCP;
2491  f.flags |= FLOW_IPV4;
2492  p1->flow = &f;
2493  p1->flowflags |= FLOW_PKT_TOSERVER;
2494  p1->flowflags |= FLOW_PKT_ESTABLISHED;
2495  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2496  p2->flow = &f;
2497  p2->flowflags |= FLOW_PKT_TOSERVER;
2498  p2->flowflags |= FLOW_PKT_ESTABLISHED;
2499  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2500  f.alproto = ALPROTO_HTTP1;
2501 
2502  StreamTcpInitConfig(true);
2503 
2504  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2505  FAIL_IF_NULL(de_ctx);
2506  de_ctx->flags |= DE_QUIET;
2507 
2508  Signature *s = DetectEngineAppendSig(de_ctx,
2509  "alert http any any -> any any "
2510  "(msg:\"http header test\"; flow:to_server; "
2511  "content:\"Gecko/20091221 Firefox/3.5.7\"; http_raw_header; "
2512  "sid:1;)");
2513  FAIL_IF_NULL(s);
2514 
2515  SigGroupBuild(de_ctx);
2516  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2517 
2518  int r = AppLayerParserParse(
2519  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
2520  FAIL_IF_NOT(r == 0);
2521 
2522  HtpState *http_state = f.alstate;
2523  FAIL_IF_NULL(http_state);
2524 
2525  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2526  FAIL_IF((PacketAlertCheck(p1, 1)));
2527 
2528  r = AppLayerParserParse(
2529  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
2530  FAIL_IF_NOT(r == 0);
2531 
2532  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
2533  FAIL_IF(!(PacketAlertCheck(p2, 1)));
2534 
2535  UTHFreePackets(&p1, 1);
2536  UTHFreePackets(&p2, 1);
2537  FLOW_DESTROY(&f);
2538  AppLayerParserThreadCtxFree(alp_tctx);
2539  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2540  DetectEngineCtxFree(de_ctx);
2541  StreamTcpFreeConfig(true);
2542  StatsThreadCleanup(&th_v.stats);
2543  PASS;
2544 }
2545 
2546 /**
2547  *\test Test that the http_header content matches against a http request
2548  * which holds the content, against a cross boundary present pattern.
2549  */
2550 static int DetectHttpRawHeaderTest09(void)
2551 {
2552  TcpSession ssn;
2553  Packet *p1 = NULL;
2554  Packet *p2 = NULL;
2555  ThreadVars th_v;
2556  DetectEngineThreadCtx *det_ctx = NULL;
2557  Flow f;
2558  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
2559  "Host: www.openinfosecfoundation.org\r\n"
2560  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2561  "Gecko/20091221 Firefox/3.5.7\r\n";
2562  uint8_t http2_buf[] = "Content-Type: text/html\r\n"
2563  "Content-Length: 67\r\n"
2564  "\r\n"
2565  "This is dummy body\r\n";
2566  uint32_t http1_len = sizeof(http1_buf) - 1;
2567  uint32_t http2_len = sizeof(http2_buf) - 1;
2568  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2569 
2570  memset(&th_v, 0, sizeof(th_v));
2571  StatsThreadInit(&th_v.stats);
2572  memset(&f, 0, sizeof(f));
2573  memset(&ssn, 0, sizeof(ssn));
2574 
2575  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2576  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2577 
2578  FLOW_INITIALIZE(&f);
2579  f.protoctx = (void *)&ssn;
2580  f.proto = IPPROTO_TCP;
2581  f.flags |= FLOW_IPV4;
2582  p1->flow = &f;
2583  p1->flowflags |= FLOW_PKT_TOSERVER;
2584  p1->flowflags |= FLOW_PKT_ESTABLISHED;
2585  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2586  p2->flow = &f;
2587  p2->flowflags |= FLOW_PKT_TOSERVER;
2588  p2->flowflags |= FLOW_PKT_ESTABLISHED;
2589  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2590  f.alproto = ALPROTO_HTTP1;
2591 
2592  StreamTcpInitConfig(true);
2593 
2594  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2595  FAIL_IF_NULL(de_ctx);
2596  de_ctx->flags |= DE_QUIET;
2597 
2598  Signature *s = DetectEngineAppendSig(de_ctx,
2599  "alert http any any -> any any "
2600  "(msg:\"http header test\"; flow:to_server; "
2601  "content:\"Firefox/3.5.7|0D 0A|Content\"; http_raw_header; "
2602  "sid:1;)");
2603  FAIL_IF_NULL(s);
2604 
2605  SigGroupBuild(de_ctx);
2606  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2607 
2608  int r = AppLayerParserParse(
2609  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
2610  FAIL_IF_NOT(r == 0);
2611 
2612  HtpState *http_state = f.alstate;
2613  FAIL_IF_NULL(http_state);
2614 
2615  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2616  FAIL_IF((PacketAlertCheck(p1, 1)));
2617 
2618  r = AppLayerParserParse(
2619  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
2620  FAIL_IF_NOT(r == 0);
2621 
2622  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
2623  FAIL_IF(!(PacketAlertCheck(p2, 1)));
2624 
2625  UTHFreePackets(&p1, 1);
2626  UTHFreePackets(&p2, 1);
2627  FLOW_DESTROY(&f);
2628  AppLayerParserThreadCtxFree(alp_tctx);
2629  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2630  DetectEngineCtxFree(de_ctx);
2631  StreamTcpFreeConfig(true);
2632  StatsThreadCleanup(&th_v.stats);
2633  PASS;
2634 }
2635 
2636 /**
2637  *\test Test that the http_header content matches against a http request
2638  * against a case insensitive pattern.
2639  */
2640 static int DetectHttpRawHeaderTest10(void)
2641 {
2642  TcpSession ssn;
2643  Packet *p1 = NULL;
2644  Packet *p2 = NULL;
2645  ThreadVars th_v;
2646  DetectEngineThreadCtx *det_ctx = NULL;
2647  Flow f;
2648  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
2649  "Host: www.openinfosecfoundation.org\r\n"
2650  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2651  "Gecko/20091221 Firefox/3.5.7\r\n";
2652  uint8_t http2_buf[] = "Content-Type: text/html\r\n"
2653  "Content-Length: 67\r\n"
2654  "\r\n"
2655  "This is dummy body";
2656  uint32_t http1_len = sizeof(http1_buf) - 1;
2657  uint32_t http2_len = sizeof(http2_buf) - 1;
2658  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2659 
2660  memset(&th_v, 0, sizeof(th_v));
2661  StatsThreadInit(&th_v.stats);
2662  memset(&f, 0, sizeof(f));
2663  memset(&ssn, 0, sizeof(ssn));
2664 
2665  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2666  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2667 
2668  FLOW_INITIALIZE(&f);
2669  f.protoctx = (void *)&ssn;
2670  f.proto = IPPROTO_TCP;
2671  f.flags |= FLOW_IPV4;
2672  p1->flow = &f;
2673  p1->flowflags |= FLOW_PKT_TOSERVER;
2674  p1->flowflags |= FLOW_PKT_ESTABLISHED;
2675  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2676  p2->flow = &f;
2677  p2->flowflags |= FLOW_PKT_TOSERVER;
2678  p2->flowflags |= FLOW_PKT_ESTABLISHED;
2679  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2680  f.alproto = ALPROTO_HTTP1;
2681 
2682  StreamTcpInitConfig(true);
2683 
2684  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2685  FAIL_IF_NULL(de_ctx);
2686  de_ctx->flags |= DE_QUIET;
2687 
2688  Signature *s = DetectEngineAppendSig(de_ctx,
2689  "alert http any any -> any any "
2690  "(msg:\"http header test\"; flow:to_server; "
2691  "content:\"firefox/3.5.7|0D 0A|content\"; nocase; http_raw_header;"
2692  "sid:1;)");
2693  FAIL_IF_NULL(s);
2694 
2695  SigGroupBuild(de_ctx);
2696  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2697 
2698  int r = AppLayerParserParse(
2699  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
2700  FAIL_IF_NOT(r == 0);
2701 
2702  HtpState *http_state = f.alstate;
2703  FAIL_IF_NULL(http_state);
2704 
2705  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2706  FAIL_IF((PacketAlertCheck(p1, 1)));
2707 
2708  r = AppLayerParserParse(
2709  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
2710  FAIL_IF_NOT(r == 0);
2711 
2712  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
2713  FAIL_IF(!(PacketAlertCheck(p2, 1)));
2714 
2715  UTHFreePackets(&p1, 1);
2716  UTHFreePackets(&p2, 1);
2717  FLOW_DESTROY(&f);
2718  AppLayerParserThreadCtxFree(alp_tctx);
2719  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2720  DetectEngineCtxFree(de_ctx);
2721  StreamTcpFreeConfig(true);
2722  StatsThreadCleanup(&th_v.stats);
2723  PASS;
2724 }
2725 
2726 /**
2727  *\test Test that the negated http_header content matches against a
2728  * http request which doesn't hold the content.
2729  */
2730 static int DetectHttpRawHeaderTest11(void)
2731 {
2732  TcpSession ssn;
2733  ThreadVars th_v;
2734  DetectEngineThreadCtx *det_ctx = NULL;
2735  Flow f;
2736  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
2737  "Host: www.openinfosecfoundation.org\r\n"
2738  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2739  "Gecko/20091221 Firefox/3.5.7\r\n"
2740  "Content-Type: text/html\r\n"
2741  "Content-Length: 26\r\n"
2742  "\r\n"
2743  "This is dummy message body\r\n";
2744  uint32_t http_len = sizeof(http_buf) - 1;
2745  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2746 
2747  memset(&th_v, 0, sizeof(th_v));
2748  StatsThreadInit(&th_v.stats);
2749  memset(&f, 0, sizeof(f));
2750  memset(&ssn, 0, sizeof(ssn));
2751 
2752  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2753 
2754  FLOW_INITIALIZE(&f);
2755  f.protoctx = (void *)&ssn;
2756  f.proto = IPPROTO_TCP;
2757  f.flags |= FLOW_IPV4;
2758  p->flow = &f;
2759  p->flowflags |= FLOW_PKT_TOSERVER;
2760  p->flowflags |= FLOW_PKT_ESTABLISHED;
2761  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2762  f.alproto = ALPROTO_HTTP1;
2763 
2764  StreamTcpInitConfig(true);
2765 
2766  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2767  FAIL_IF_NULL(de_ctx);
2768  de_ctx->flags |= DE_QUIET;
2769 
2770  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2771  "(msg:\"http header test\"; flow:to_server; "
2772  "content:!\"lalalalala\"; http_raw_header; "
2773  "sid:1;)");
2774  FAIL_IF_NULL(s);
2775 
2776  SigGroupBuild(de_ctx);
2777  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2778 
2779  int r = AppLayerParserParse(
2780  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
2781  FAIL_IF_NOT(r == 0);
2782 
2783  HtpState *http_state = f.alstate;
2784  FAIL_IF_NULL(http_state);
2785 
2786  /* do detect */
2787  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2788  FAIL_IF(!(PacketAlertCheck(p, 1)));
2789 
2790  UTHFreePackets(&p, 1);
2791  FLOW_DESTROY(&f);
2792  AppLayerParserThreadCtxFree(alp_tctx);
2793  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2794  DetectEngineCtxFree(de_ctx);
2795  StreamTcpFreeConfig(true);
2796  StatsThreadCleanup(&th_v.stats);
2797  PASS;
2798 }
2799 
2800 /**
2801  *\test Negative test that the negated http_header content matches against a
2802  * http request which holds hold the content.
2803  */
2804 static int DetectHttpRawHeaderTest12(void)
2805 {
2806  TcpSession ssn;
2807  ThreadVars th_v;
2808  DetectEngineThreadCtx *det_ctx = NULL;
2809  Flow f;
2810  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
2811  "Host: www.openinfosecfoundation.org\r\n"
2812  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2813  "Gecko/20091221 Firefox/3.5.7\r\n"
2814  "Content-Type: text/html\r\n"
2815  "Content-Length: 26\r\n"
2816  "\r\n"
2817  "This is dummy message body\r\n";
2818  uint32_t http_len = sizeof(http_buf) - 1;
2819  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2820 
2821  memset(&th_v, 0, sizeof(th_v));
2822  StatsThreadInit(&th_v.stats);
2823  memset(&f, 0, sizeof(f));
2824  memset(&ssn, 0, sizeof(ssn));
2825 
2826  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2827 
2828  FLOW_INITIALIZE(&f);
2829  f.protoctx = (void *)&ssn;
2830  f.proto = IPPROTO_TCP;
2831  f.flags |= FLOW_IPV4;
2832  p->flow = &f;
2833  p->flowflags |= FLOW_PKT_TOSERVER;
2834  p->flowflags |= FLOW_PKT_ESTABLISHED;
2835  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2836  f.alproto = ALPROTO_HTTP1;
2837 
2838  StreamTcpInitConfig(true);
2839 
2840  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2841  FAIL_IF_NULL(de_ctx);
2842  de_ctx->flags |= DE_QUIET;
2843 
2844  Signature *s =
2845  DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2846  "(msg:\"http header test\"; flow:to_server; "
2847  "content:!\"User-Agent: Mozilla/5.0 \"; http_raw_header; "
2848  "sid:1;)");
2849  FAIL_IF_NULL(s);
2850 
2851  SigGroupBuild(de_ctx);
2852  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2853 
2854  int r = AppLayerParserParse(
2855  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
2856  FAIL_IF_NOT(r == 0);
2857 
2858  HtpState *http_state = f.alstate;
2859  FAIL_IF_NULL(http_state);
2860 
2861  /* do detect */
2862  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2863  FAIL_IF((PacketAlertCheck(p, 1)));
2864 
2865  UTHFreePackets(&p, 1);
2866  FLOW_DESTROY(&f);
2867 
2868  AppLayerParserThreadCtxFree(alp_tctx);
2869  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2870  DetectEngineCtxFree(de_ctx);
2871  StreamTcpFreeConfig(true);
2872  StatsThreadCleanup(&th_v.stats);
2873  PASS;
2874 }
2875 
2876 /**
2877  *\test Test that the http_header content matches against a http request
2878  * which holds the content.
2879  */
2880 static int DetectHttpRawHeaderTest13(void)
2881 {
2882  TcpSession ssn;
2883  ThreadVars th_v;
2884  DetectEngineThreadCtx *det_ctx = NULL;
2885  Flow f;
2886  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
2887  "Host: www.openinfosecfoundation.org\r\n"
2888  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2889  "Gecko/20091221 Firefox/3.5.7\r\n"
2890  "Content-Type: text/html\r\n"
2891  "Content-Length: 100\r\n"
2892  "\r\n"
2893  "longbufferabcdefghijklmnopqrstuvwxyz0123456789bufferend\r\n";
2894  uint32_t http_len = sizeof(http_buf) - 1;
2895  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2896 
2897  memset(&th_v, 0, sizeof(th_v));
2898  StatsThreadInit(&th_v.stats);
2899  memset(&f, 0, sizeof(f));
2900  memset(&ssn, 0, sizeof(ssn));
2901 
2902  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2903 
2904  FLOW_INITIALIZE(&f);
2905  f.protoctx = (void *)&ssn;
2906  f.proto = IPPROTO_TCP;
2907  f.flags |= FLOW_IPV4;
2908 
2909  p->flow = &f;
2910  p->flowflags |= FLOW_PKT_TOSERVER;
2911  p->flowflags |= FLOW_PKT_ESTABLISHED;
2912  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2913  f.alproto = ALPROTO_HTTP1;
2914 
2915  StreamTcpInitConfig(true);
2916 
2917  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2918  FAIL_IF_NULL(de_ctx);
2919  de_ctx->flags |= DE_QUIET;
2920 
2921  Signature *s = DetectEngineAppendSig(de_ctx,
2922  "alert http any any -> any any "
2923  "(msg:\"http header test\"; flow:to_server; "
2924  "content:\"Host: www.openinfosecfoundation.org\"; http_raw_header; "
2925  "sid:1;)");
2926  FAIL_IF_NULL(s);
2927 
2928  SigGroupBuild(de_ctx);
2929  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2930 
2931  int r = AppLayerParserParse(
2932  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
2933  FAIL_IF_NOT(r == 0);
2934 
2935  HtpState *http_state = f.alstate;
2936  FAIL_IF_NULL(http_state);
2937 
2938  /* do detect */
2939  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2940  FAIL_IF(!(PacketAlertCheck(p, 1)));
2941 
2942  AppLayerParserThreadCtxFree(alp_tctx);
2943  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2944  DetectEngineCtxFree(de_ctx);
2945 
2946  StreamTcpFreeConfig(true);
2947  FLOW_DESTROY(&f);
2948  UTHFreePackets(&p, 1);
2949  StatsThreadCleanup(&th_v.stats);
2950  PASS;
2951 }
2952 
2953 void DetectHttpRawHeaderRegisterTests(void)
2954 {
2955  UtRegisterTest("DetectHttpRawHeaderParserTest01", DetectHttpRawHeaderParserTest01);
2956  UtRegisterTest("DetectHttpRawHeaderParserTest02", DetectHttpRawHeaderParserTest02);
2957 
2958  UtRegisterTest("DetectEngineHttpRawHeaderTest01", DetectEngineHttpRawHeaderTest01);
2959  UtRegisterTest("DetectEngineHttpRawHeaderTest02", DetectEngineHttpRawHeaderTest02);
2960  UtRegisterTest("DetectEngineHttpRawHeaderTest03", DetectEngineHttpRawHeaderTest03);
2961  UtRegisterTest("DetectEngineHttpRawHeaderTest04", DetectEngineHttpRawHeaderTest04);
2962  UtRegisterTest("DetectEngineHttpRawHeaderTest05", DetectEngineHttpRawHeaderTest05);
2963  UtRegisterTest("DetectEngineHttpRawHeaderTest06", DetectEngineHttpRawHeaderTest06);
2964  UtRegisterTest("DetectEngineHttpRawHeaderTest07", DetectEngineHttpRawHeaderTest07);
2965  UtRegisterTest("DetectEngineHttpRawHeaderTest08", DetectEngineHttpRawHeaderTest08);
2966  UtRegisterTest("DetectEngineHttpRawHeaderTest09", DetectEngineHttpRawHeaderTest09);
2967  UtRegisterTest("DetectEngineHttpRawHeaderTest10", DetectEngineHttpRawHeaderTest10);
2968  UtRegisterTest("DetectEngineHttpRawHeaderTest11", DetectEngineHttpRawHeaderTest11);
2969  UtRegisterTest("DetectEngineHttpRawHeaderTest12", DetectEngineHttpRawHeaderTest12);
2970  UtRegisterTest("DetectEngineHttpRawHeaderTest13", DetectEngineHttpRawHeaderTest13);
2971  UtRegisterTest("DetectEngineHttpRawHeaderTest14", DetectEngineHttpRawHeaderTest14);
2972  UtRegisterTest("DetectEngineHttpRawHeaderTest15", DetectEngineHttpRawHeaderTest15);
2973  UtRegisterTest("DetectEngineHttpRawHeaderTest16", DetectEngineHttpRawHeaderTest16);
2974  UtRegisterTest("DetectEngineHttpRawHeaderTest17", DetectEngineHttpRawHeaderTest17);
2975  UtRegisterTest("DetectEngineHttpRawHeaderTest20", DetectEngineHttpRawHeaderTest20);
2976  UtRegisterTest("DetectEngineHttpRawHeaderTest21", DetectEngineHttpRawHeaderTest21);
2977  UtRegisterTest("DetectEngineHttpRawHeaderTest22", DetectEngineHttpRawHeaderTest22);
2978  UtRegisterTest("DetectEngineHttpRawHeaderTest23", DetectEngineHttpRawHeaderTest23);
2979  UtRegisterTest("DetectEngineHttpRawHeaderTest24", DetectEngineHttpRawHeaderTest24);
2980  UtRegisterTest("DetectEngineHttpRawHeaderTest25", DetectEngineHttpRawHeaderTest25);
2981  UtRegisterTest("DetectEngineHttpRawHeaderTest26", DetectEngineHttpRawHeaderTest26);
2982  UtRegisterTest("DetectEngineHttpRawHeaderTest27", DetectEngineHttpRawHeaderTest27);
2983  UtRegisterTest("DetectEngineHttpRawHeaderTest28", DetectEngineHttpRawHeaderTest28);
2984  UtRegisterTest("DetectEngineHttpRawHeaderTest29", DetectEngineHttpRawHeaderTest29);
2985 #if 0
2986  UtRegisterTest("DetectEngineHttpRawHeaderTest30",
2987  DetectEngineHttpRawHeaderTest30, 1);
2988 #endif
2989  UtRegisterTest("DetectEngineHttpRawHeaderTest31", DetectEngineHttpRawHeaderTest31);
2990  UtRegisterTest("DetectEngineHttpRawHeaderTest32", DetectEngineHttpRawHeaderTest32);
2991 
2992  UtRegisterTest("DetectHttpRawHeaderTest06", DetectHttpRawHeaderTest06);
2993  UtRegisterTest("DetectHttpRawHeaderTest07", DetectHttpRawHeaderTest07);
2994  UtRegisterTest("DetectHttpRawHeaderTest08", DetectHttpRawHeaderTest08);
2995  UtRegisterTest("DetectHttpRawHeaderTest09", DetectHttpRawHeaderTest09);
2996  UtRegisterTest("DetectHttpRawHeaderTest10", DetectHttpRawHeaderTest10);
2997  UtRegisterTest("DetectHttpRawHeaderTest11", DetectHttpRawHeaderTest11);
2998  UtRegisterTest("DetectHttpRawHeaderTest12", DetectHttpRawHeaderTest12);
2999  UtRegisterTest("DetectHttpRawHeaderTest13", DetectHttpRawHeaderTest13);
3000 }
3001 
3002 #endif /* UNITTESTS */
3003 
3004 /**
3005  * @}
3006  */
UTHParseSignature
int UTHParseSignature(const char *str, bool expect)
parser a sig and see if the expected result is correct
Definition: util-unittest-helper.c:917
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1268
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
Flow_::proto
uint8_t proto
Definition: flow.h:370
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:142
Packet_::flags
uint32_t flags
Definition: decode.h:544
DetectHttpRawHeaderRegisterTests
void DetectHttpRawHeaderRegisterTests(void)
Definition: detect-http-raw-header.c:2953
Flow_
Flow data structure.
Definition: flow.h:348
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:933
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2634
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:324
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:225
DE_QUIET
#define DE_QUIET
Definition: detect.h:330
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:365
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:2418
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3447
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:532
Flow_::protoctx
void * protoctx
Definition: flow.h:433
FLOW_IPV4
#define FLOW_IPV4
Definition: flow.h:100
HtpState_
Definition: app-layer-htp.h:181
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
StreamTcpInitConfig
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
Definition: stream-tcp.c:496
FLOW_INITIALIZE
#define FLOW_INITIALIZE(f)
Definition: flow-util.h:38
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
DetectEngineThreadCtx_
Definition: detect.h:1245
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:23
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3364
Packet_
Definition: decode.h:501
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:226
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:2194
StatsThreadInit
void StatsThreadInit(StatsThreadContext *stats)
Definition: counters.c:1258
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:297
Packet_::flow
struct Flow_ * flow
Definition: decode.h:546
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
StreamTcpFreeConfig
void StreamTcpFreeConfig(bool quiet)
Definition: stream-tcp.c:867
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1277
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:36
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3601
Flow_::alstate
void * alstate
Definition: flow.h:471
Flow_::flags
uint32_t flags
Definition: flow.h:413
Signature_
Signature container.
Definition: detect.h:668
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:227
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2595
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:935
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:60
TcpSession_
Definition: stream-tcp-private.h:283
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:442
ThreadVars_::stats
StatsThreadContext stats
Definition: threadvars.h:121
StatsThreadCleanup
void StatsThreadCleanup(StatsThreadContext *stats)
Definition: counters.c:1354
FLOW_DESTROY
#define FLOW_DESTROY(f)
Definition: flow-util.h:119
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:1264
UTHFreePackets
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:456