suricata
detect-http-raw-header.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup httplayer
20  *
21  * @{
22  */
23 
24 /** \file
25  *
26  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
27  * \author Victor Julien <victor@inliniac.net>
28  *
29  * \brief Handle HTTP raw header match.
30  *
31  */
32 
33 #include "../suricata-common.h"
34 #include "../suricata.h"
35 #include "../decode.h"
36 
37 #include "../detect.h"
38 #include "../detect-engine.h"
39 #include "../detect-isdataat.h"
40 #include "../detect-pcre.h"
41 #include "../detect-engine-build.h"
42 #include "../detect-engine-alert.h"
43 
44 #include "../stream-tcp.h"
45 #include "../app-layer.h"
46 #include "../app-layer-htp.h"
47 #include "../app-layer-protos.h"
48 #include "../app-layer-parser.h"
49 
50 #include "../util-unittest.h"
51 #include "../util-unittest-helper.h"
52 #include "../util-validate.h"
53 
54 /***********************************Unittests**********************************/
55 
56 #ifdef UNITTESTS
57 
58 /**
59  * \test Test parser accepting valid rules and rejecting invalid rules
60  */
61 static int DetectHttpRawHeaderParserTest01(void)
62 {
63  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; content:\"abc\"; "
64  "http_raw_header; sid:1;)",
65  true));
66  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; content:\"abc\"; "
67  "nocase; http_raw_header; sid:1;)",
68  true));
69  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; content:\"abc\"; "
70  "endswith; http_raw_header; sid:1;)",
71  true));
72  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; content:\"abc\"; "
73  "startswith; http_raw_header; sid:1;)",
74  true));
75  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; content:\"abc\"; "
76  "startswith; endswith; http_raw_header; sid:1;)",
77  true));
78 
79  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; content:\"abc\"; "
80  "rawbytes; http_raw_header; sid:1;)",
81  false));
82  FAIL_IF_NOT(UTHParseSignature(
83  "alert tcp any any -> any any (flow:to_server; http_raw_header; sid:1;)", false));
84  FAIL_IF_NOT(UTHParseSignature("alert tls any any -> any any (flow:to_server; content:\"abc\"; "
85  "http_raw_header; sid:1;)",
86  false));
87  PASS;
88 }
89 
90 /**
91  * \test Test parser accepting valid rules and rejecting invalid rules
92  */
93 static int DetectHttpRawHeaderParserTest02(void)
94 {
95  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; http.header.raw; "
96  "content:\"abc\"; sid:1;)",
97  true));
98  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; http.header.raw; "
99  "content:\"abc\"; nocase; sid:1;)",
100  true));
101  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; http.header.raw; "
102  "content:\"abc\"; endswith; sid:1;)",
103  true));
104  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; http.header.raw; "
105  "content:\"abc\"; startswith; sid:1;)",
106  true));
107  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; http.header.raw; "
108  "content:\"abc\"; startswith; endswith; sid:1;)",
109  true));
110  FAIL_IF_NOT(UTHParseSignature(
111  "alert http any any -> any any (flow:to_server; http.header.raw; bsize:10; sid:1;)",
112  true));
113 
114  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_server; http.header.raw; "
115  "content:\"abc\"; rawbytes; sid:1;)",
116  false));
117  FAIL_IF_NOT(UTHParseSignature(
118  "alert tcp any any -> any any (flow:to_server; http.header.raw; sid:1;)", false));
119  FAIL_IF_NOT(UTHParseSignature("alert tls any any -> any any (flow:to_server; http.header.raw; "
120  "content:\"abc\"; sid:1;)",
121  false));
122  PASS;
123 }
124 
125 /**
126  *\test Test that the http_header content matches against a http request
127  * which holds the content.
128  */
129 static int DetectEngineHttpRawHeaderTest01(void)
130 {
131  TcpSession ssn;
132  ThreadVars th_v;
133  DetectEngineThreadCtx *det_ctx = NULL;
134  Flow f;
135  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
136  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
137  uint32_t http_len = sizeof(http_buf) - 1;
138  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
139 
140  memset(&th_v, 0, sizeof(th_v));
141  memset(&f, 0, sizeof(f));
142  memset(&ssn, 0, sizeof(ssn));
143 
144  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
145 
146  FLOW_INITIALIZE(&f);
147  f.protoctx = (void *)&ssn;
148  f.proto = IPPROTO_TCP;
149  f.flags |= FLOW_IPV4;
150  p->flow = &f;
151  p->flowflags |= FLOW_PKT_TOSERVER;
152  p->flowflags |= FLOW_PKT_ESTABLISHED;
153  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
154  f.alproto = ALPROTO_HTTP1;
155 
156  StreamTcpInitConfig(true);
157 
158  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
159  FAIL_IF_NULL(de_ctx);
160 
161  de_ctx->flags |= DE_QUIET;
162 
163  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
164  "(msg:\"http header test\"; flow:to_server; "
165  "content:\"one\"; http_raw_header; "
166  "sid:1;)");
167  FAIL_IF_NULL(s);
168 
169  SigGroupBuild(de_ctx);
170  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
171 
172  int r = AppLayerParserParse(
173  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
174  FAIL_IF_NOT(r == 0);
175 
176  HtpState *http_state = f.alstate;
177  FAIL_IF_NULL(http_state);
178 
179  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
180  FAIL_IF(!(PacketAlertCheck(p, 1)));
181 
182  UTHFreePackets(&p, 1);
183  FLOW_DESTROY(&f);
184 
185  AppLayerParserThreadCtxFree(alp_tctx);
186  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
187  DetectEngineCtxFree(de_ctx);
188  StreamTcpFreeConfig(true);
189  StatsThreadCleanup(&th_v);
190  PASS;
191 }
192 
193 /**
194  *\test Test that the http_header content matches against a http request
195  * which holds the content.
196  */
197 static int DetectEngineHttpRawHeaderTest02(void)
198 {
199  TcpSession ssn;
200  ThreadVars th_v;
201  DetectEngineThreadCtx *det_ctx = NULL;
202  Flow f;
203  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
204  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
205  uint32_t http_len = sizeof(http_buf) - 1;
206  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
207 
208  memset(&th_v, 0, sizeof(th_v));
209  memset(&f, 0, sizeof(f));
210  memset(&ssn, 0, sizeof(ssn));
211 
212  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
213 
214  FLOW_INITIALIZE(&f);
215  f.protoctx = (void *)&ssn;
216  f.proto = IPPROTO_TCP;
217  f.flags |= FLOW_IPV4;
218  p->flow = &f;
219  p->flowflags |= FLOW_PKT_TOSERVER;
220  p->flowflags |= FLOW_PKT_ESTABLISHED;
221  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
222  f.alproto = ALPROTO_HTTP1;
223 
224  StreamTcpInitConfig(true);
225 
226  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
227  FAIL_IF_NULL(de_ctx);
228  de_ctx->flags |= DE_QUIET;
229 
230  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
231  "(msg:\"http header test\"; flow:to_server; "
232  "content:\"one\"; depth:15; http_raw_header; "
233  "sid:1;)");
234  FAIL_IF_NULL(s);
235 
236  SigGroupBuild(de_ctx);
237  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
238 
239  int r = AppLayerParserParse(
240  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
241  FAIL_IF_NOT(r == 0);
242 
243  HtpState *http_state = f.alstate;
244  FAIL_IF_NULL(http_state);
245 
246  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
247  FAIL_IF(!(PacketAlertCheck(p, 1)));
248 
249  UTHFreePackets(&p, 1);
250  FLOW_DESTROY(&f);
251 
252  AppLayerParserThreadCtxFree(alp_tctx);
253  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
254  DetectEngineCtxFree(de_ctx);
255  StreamTcpFreeConfig(true);
256  StatsThreadCleanup(&th_v);
257  PASS;
258 }
259 
260 /**
261  *\test Test that the http_header content matches against a http request
262  * which holds the content.
263  */
264 static int DetectEngineHttpRawHeaderTest03(void)
265 {
266  TcpSession ssn;
267  ThreadVars th_v;
268  DetectEngineThreadCtx *det_ctx = NULL;
269  Flow f;
270  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
271  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
272  uint32_t http_len = sizeof(http_buf) - 1;
273  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
274 
275  memset(&th_v, 0, sizeof(th_v));
276  memset(&f, 0, sizeof(f));
277  memset(&ssn, 0, sizeof(ssn));
278 
279  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
280 
281  FLOW_INITIALIZE(&f);
282  f.protoctx = (void *)&ssn;
283  f.proto = IPPROTO_TCP;
284  f.flags |= FLOW_IPV4;
285  p->flow = &f;
286  p->flowflags |= FLOW_PKT_TOSERVER;
287  p->flowflags |= FLOW_PKT_ESTABLISHED;
288  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
289  f.alproto = ALPROTO_HTTP1;
290 
291  StreamTcpInitConfig(true);
292 
293  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
294  FAIL_IF_NULL(de_ctx);
295  de_ctx->flags |= DE_QUIET;
296 
297  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
298  "(msg:\"http header test\"; flow:to_server; "
299  "content:!\"one\"; depth:5; http_raw_header; "
300  "sid:1;)");
301  FAIL_IF_NULL(s);
302 
303  SigGroupBuild(de_ctx);
304  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
305 
306  int r = AppLayerParserParse(
307  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
308  FAIL_IF_NOT(r == 0);
309 
310  HtpState *http_state = f.alstate;
311  FAIL_IF_NULL(http_state);
312 
313  /* do detect */
314  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
315 
316  FAIL_IF(!(PacketAlertCheck(p, 1)));
317 
318  UTHFreePackets(&p, 1);
319  FLOW_DESTROY(&f);
320 
321  AppLayerParserThreadCtxFree(alp_tctx);
322  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
323  DetectEngineCtxFree(de_ctx);
324  StreamTcpFreeConfig(true);
325  StatsThreadCleanup(&th_v);
326  PASS;
327 }
328 
329 /**
330  *\test Test that the http_header content matches against a http request
331  * which holds the content.
332  */
333 static int DetectEngineHttpRawHeaderTest04(void)
334 {
335  TcpSession ssn;
336  ThreadVars th_v;
337  DetectEngineThreadCtx *det_ctx = NULL;
338  Flow f;
339  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
340  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
341  uint32_t http_len = sizeof(http_buf) - 1;
342  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
343 
344  memset(&th_v, 0, sizeof(th_v));
345  memset(&f, 0, sizeof(f));
346  memset(&ssn, 0, sizeof(ssn));
347 
348  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
349 
350  FLOW_INITIALIZE(&f);
351  f.protoctx = (void *)&ssn;
352  f.proto = IPPROTO_TCP;
353  f.flags |= FLOW_IPV4;
354  p->flow = &f;
355  p->flowflags |= FLOW_PKT_TOSERVER;
356  p->flowflags |= FLOW_PKT_ESTABLISHED;
357  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
358  f.alproto = ALPROTO_HTTP1;
359 
360  StreamTcpInitConfig(true);
361 
362  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
363  FAIL_IF_NULL(de_ctx);
364  de_ctx->flags |= DE_QUIET;
365 
366  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
367  "(msg:\"http header test\"; flow:to_server; "
368  "content:\"one\"; depth:5; http_raw_header; "
369  "sid:1;)");
370  FAIL_IF_NULL(s);
371 
372  SigGroupBuild(de_ctx);
373  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
374 
375  int r = AppLayerParserParse(
376  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
377  FAIL_IF_NOT(r == 0);
378 
379  HtpState *http_state = f.alstate;
380  FAIL_IF_NULL(http_state);
381 
382  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
383 
384  FAIL_IF(PacketAlertCheck(p, 1));
385 
386  UTHFreePackets(&p, 1);
387  FLOW_DESTROY(&f);
388  AppLayerParserThreadCtxFree(alp_tctx);
389  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
390  DetectEngineCtxFree(de_ctx);
391  StreamTcpFreeConfig(true);
392  StatsThreadCleanup(&th_v);
393  PASS;
394 }
395 
396 /**
397  *\test Test that the http_header content matches against a http request
398  * which holds the content.
399  */
400 static int DetectEngineHttpRawHeaderTest05(void)
401 {
402  TcpSession ssn;
403  ThreadVars th_v;
404  DetectEngineThreadCtx *det_ctx = NULL;
405  Flow f;
406  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
407  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
408  uint32_t http_len = sizeof(http_buf) - 1;
409  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
410 
411  memset(&th_v, 0, sizeof(th_v));
412  memset(&f, 0, sizeof(f));
413  memset(&ssn, 0, sizeof(ssn));
414 
415  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
416 
417  FLOW_INITIALIZE(&f);
418  f.protoctx = (void *)&ssn;
419  f.proto = IPPROTO_TCP;
420  f.flags |= FLOW_IPV4;
421  p->flow = &f;
422  p->flowflags |= FLOW_PKT_TOSERVER;
423  p->flowflags |= FLOW_PKT_ESTABLISHED;
424  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
425  f.alproto = ALPROTO_HTTP1;
426 
427  StreamTcpInitConfig(true);
428 
429  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
430  FAIL_IF_NULL(de_ctx);
431 
432  de_ctx->flags |= DE_QUIET;
433 
434  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
435  "(msg:\"http header test\"; flow:to_server; "
436  "content:!\"one\"; depth:15; http_raw_header; "
437  "sid:1;)");
438  FAIL_IF_NULL(s);
439 
440  SigGroupBuild(de_ctx);
441  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
442 
443  int r = AppLayerParserParse(
444  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
445  FAIL_IF_NOT(r == 0);
446 
447  HtpState *http_state = f.alstate;
448  FAIL_IF_NULL(http_state);
449 
450  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
451  FAIL_IF(PacketAlertCheck(p, 1));
452 
453  UTHFreePackets(&p, 1);
454  FLOW_DESTROY(&f);
455  AppLayerParserThreadCtxFree(alp_tctx);
456  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
457  DetectEngineCtxFree(de_ctx);
458  StreamTcpFreeConfig(true);
459  StatsThreadCleanup(&th_v);
460  PASS;
461 }
462 
463 /**
464  *\test Test that the http_header content matches against a http request
465  * which holds the content.
466  */
467 static int DetectEngineHttpRawHeaderTest06(void)
468 {
469  TcpSession ssn;
470  ThreadVars th_v;
471  DetectEngineThreadCtx *det_ctx = NULL;
472  Flow f;
473  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
474  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
475  uint32_t http_len = sizeof(http_buf) - 1;
476  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
477 
478  memset(&th_v, 0, sizeof(th_v));
479  memset(&f, 0, sizeof(f));
480  memset(&ssn, 0, sizeof(ssn));
481 
482  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
483 
484  FLOW_INITIALIZE(&f);
485  f.protoctx = (void *)&ssn;
486  f.proto = IPPROTO_TCP;
487  f.flags |= FLOW_IPV4;
488  p->flow = &f;
489  p->flowflags |= FLOW_PKT_TOSERVER;
490  p->flowflags |= FLOW_PKT_ESTABLISHED;
491  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
492  f.alproto = ALPROTO_HTTP1;
493 
494  StreamTcpInitConfig(true);
495 
496  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
497  FAIL_IF_NULL(de_ctx);
498  de_ctx->flags |= DE_QUIET;
499 
500  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
501  "(msg:\"http header test\"; flow:to_server; "
502  "content:\"one\"; offset:10; http_raw_header; "
503  "sid:1;)");
504  FAIL_IF_NULL(s);
505 
506  SigGroupBuild(de_ctx);
507  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
508 
509  int r = AppLayerParserParse(
510  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
511  FAIL_IF_NOT(r == 0);
512 
513  HtpState *http_state = f.alstate;
514  FAIL_IF_NULL(http_state);
515 
516  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
517  FAIL_IF(!(PacketAlertCheck(p, 1)));
518 
519  UTHFreePackets(&p, 1);
520  FLOW_DESTROY(&f);
521  AppLayerParserThreadCtxFree(alp_tctx);
522  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
523  DetectEngineCtxFree(de_ctx);
524  StreamTcpFreeConfig(true);
525  StatsThreadCleanup(&th_v);
526  PASS;
527 }
528 
529 /**
530  *\test Test that the http_header content matches against a http request
531  * which holds the content.
532  */
533 static int DetectEngineHttpRawHeaderTest07(void)
534 {
535  TcpSession ssn;
536  ThreadVars th_v;
537  DetectEngineThreadCtx *det_ctx = NULL;
538  Flow f;
539  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
540  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
541  uint32_t http_len = sizeof(http_buf) - 1;
542  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
543 
544  memset(&th_v, 0, sizeof(th_v));
545  memset(&f, 0, sizeof(f));
546  memset(&ssn, 0, sizeof(ssn));
547 
548  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
549 
550  FLOW_INITIALIZE(&f);
551  f.protoctx = (void *)&ssn;
552  f.proto = IPPROTO_TCP;
553  f.flags |= FLOW_IPV4;
554  p->flow = &f;
555  p->flowflags |= FLOW_PKT_TOSERVER;
556  p->flowflags |= FLOW_PKT_ESTABLISHED;
557  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
558  f.alproto = ALPROTO_HTTP1;
559 
560  StreamTcpInitConfig(true);
561 
562  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
563  FAIL_IF_NULL(de_ctx);
564  de_ctx->flags |= DE_QUIET;
565 
566  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
567  "(msg:\"http header test\"; flow:to_server; "
568  "content:!\"one\"; offset:15; http_raw_header; "
569  "sid:1;)");
570  FAIL_IF_NULL(s);
571 
572  SigGroupBuild(de_ctx);
573  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
574 
575  int r = AppLayerParserParse(
576  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
577  FAIL_IF_NOT(r == 0);
578 
579  HtpState *http_state = f.alstate;
580  FAIL_IF_NULL(http_state);
581 
582  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
583  FAIL_IF(!(PacketAlertCheck(p, 1)));
584 
585  UTHFreePackets(&p, 1);
586  FLOW_DESTROY(&f);
587  AppLayerParserThreadCtxFree(alp_tctx);
588  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
589  DetectEngineCtxFree(de_ctx);
590  StreamTcpFreeConfig(true);
591  StatsThreadCleanup(&th_v);
592  PASS;
593 }
594 
595 /**
596  *\test Test that the http_header content matches against a http request
597  * which holds the content.
598  */
599 static int DetectEngineHttpRawHeaderTest08(void)
600 {
601  TcpSession ssn;
602  ThreadVars th_v;
603  DetectEngineThreadCtx *det_ctx = NULL;
604  Flow f;
605  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
606  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
607  uint32_t http_len = sizeof(http_buf) - 1;
608  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
609 
610  memset(&th_v, 0, sizeof(th_v));
611  memset(&f, 0, sizeof(f));
612  memset(&ssn, 0, sizeof(ssn));
613 
614  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
615 
616  FLOW_INITIALIZE(&f);
617  f.protoctx = (void *)&ssn;
618  f.proto = IPPROTO_TCP;
619  f.flags |= FLOW_IPV4;
620  p->flow = &f;
621  p->flowflags |= FLOW_PKT_TOSERVER;
622  p->flowflags |= FLOW_PKT_ESTABLISHED;
623  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
624  f.alproto = ALPROTO_HTTP1;
625 
626  StreamTcpInitConfig(true);
627 
628  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
629  FAIL_IF_NULL(de_ctx);
630  de_ctx->flags |= DE_QUIET;
631 
632  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
633  "(msg:\"http header test\"; flow:to_server; "
634  "content:\"one\"; offset:15; http_raw_header; "
635  "sid:1;)");
636  FAIL_IF_NULL(s);
637 
638  SigGroupBuild(de_ctx);
639  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
640 
641  int r = AppLayerParserParse(
642  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
643  FAIL_IF_NOT(r == 0);
644 
645  HtpState *http_state = f.alstate;
646  FAIL_IF_NULL(http_state);
647 
648  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
649  FAIL_IF(PacketAlertCheck(p, 1));
650 
651  UTHFreePackets(&p, 1);
652  FLOW_DESTROY(&f);
653  AppLayerParserThreadCtxFree(alp_tctx);
654  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
655  DetectEngineCtxFree(de_ctx);
656  StreamTcpFreeConfig(true);
657  StatsThreadCleanup(&th_v);
658  PASS;
659 }
660 
661 /**
662  *\test Test that the http_header content matches against a http request
663  * which holds the content.
664  */
665 static int DetectEngineHttpRawHeaderTest09(void)
666 {
667  TcpSession ssn;
668  ThreadVars th_v;
669  DetectEngineThreadCtx *det_ctx = NULL;
670  Flow f;
671  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
672  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
673  uint32_t http_len = sizeof(http_buf) - 1;
674  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
675 
676  memset(&th_v, 0, sizeof(th_v));
677  memset(&f, 0, sizeof(f));
678  memset(&ssn, 0, sizeof(ssn));
679 
680  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
681 
682  FLOW_INITIALIZE(&f);
683  f.protoctx = (void *)&ssn;
684  f.proto = IPPROTO_TCP;
685  f.flags |= FLOW_IPV4;
686  p->flow = &f;
687  p->flowflags |= FLOW_PKT_TOSERVER;
688  p->flowflags |= FLOW_PKT_ESTABLISHED;
689  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
690  f.alproto = ALPROTO_HTTP1;
691 
692  StreamTcpInitConfig(true);
693 
694  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
695  FAIL_IF_NULL(de_ctx);
696  de_ctx->flags |= DE_QUIET;
697 
698  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
699  "(msg:\"http header test\"; flow:to_server; "
700  "content:!\"one\"; offset:10; http_raw_header; "
701  "sid:1;)");
702  FAIL_IF_NULL(s);
703 
704  SigGroupBuild(de_ctx);
705  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
706 
707  int r = AppLayerParserParse(
708  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
709  FAIL_IF_NOT(r == 0);
710 
711  HtpState *http_state = f.alstate;
712  FAIL_IF_NULL(http_state);
713 
714  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
715  FAIL_IF(PacketAlertCheck(p, 1));
716 
717  UTHFreePackets(&p, 1);
718  FLOW_DESTROY(&f);
719  AppLayerParserThreadCtxFree(alp_tctx);
720  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
721  DetectEngineCtxFree(de_ctx);
722  StreamTcpFreeConfig(true);
723  StatsThreadCleanup(&th_v);
724  PASS;
725 }
726 
727 /**
728  *\test Test that the http_header content matches against a http request
729  * which holds the content.
730  */
731 static int DetectEngineHttpRawHeaderTest10(void)
732 {
733  TcpSession ssn;
734  ThreadVars th_v;
735  DetectEngineThreadCtx *det_ctx = NULL;
736  Flow f;
737  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
738  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
739  uint32_t http_len = sizeof(http_buf) - 1;
740  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
741 
742  memset(&th_v, 0, sizeof(th_v));
743  memset(&f, 0, sizeof(f));
744  memset(&ssn, 0, sizeof(ssn));
745 
746  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
747 
748  FLOW_INITIALIZE(&f);
749  f.protoctx = (void *)&ssn;
750  f.proto = IPPROTO_TCP;
751  f.flags |= FLOW_IPV4;
752  p->flow = &f;
753  p->flowflags |= FLOW_PKT_TOSERVER;
754  p->flowflags |= FLOW_PKT_ESTABLISHED;
755  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
756  f.alproto = ALPROTO_HTTP1;
757 
758  StreamTcpInitConfig(true);
759 
760  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
761  FAIL_IF_NULL(de_ctx);
762  de_ctx->flags |= DE_QUIET;
763 
764  Signature *s = DetectEngineAppendSig(de_ctx,
765  "alert http any any -> any any "
766  "(msg:\"http header test\"; flow:to_server; "
767  "content:\"one\"; http_raw_header; content:\"three\"; http_raw_header; within:10; "
768  "sid:1;)");
769  FAIL_IF_NULL(s);
770 
771  SigGroupBuild(de_ctx);
772  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
773 
774  int r = AppLayerParserParse(
775  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
776  FAIL_IF_NOT(r == 0);
777 
778  HtpState *http_state = f.alstate;
779  FAIL_IF_NULL(http_state);
780 
781  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
782  FAIL_IF(!(PacketAlertCheck(p, 1)));
783 
784  UTHFreePackets(&p, 1);
785  FLOW_DESTROY(&f);
786  AppLayerParserThreadCtxFree(alp_tctx);
787  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
788  DetectEngineCtxFree(de_ctx);
789  StreamTcpFreeConfig(true);
790  StatsThreadCleanup(&th_v);
791  PASS;
792 }
793 
794 /**
795  *\test Test that the http_header content matches against a http request
796  * which holds the content.
797  */
798 static int DetectEngineHttpRawHeaderTest11(void)
799 {
800  TcpSession ssn;
801  ThreadVars th_v;
802  DetectEngineThreadCtx *det_ctx = NULL;
803  Flow f;
804  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
805  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
806  uint32_t http_len = sizeof(http_buf) - 1;
807  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
808 
809  memset(&th_v, 0, sizeof(th_v));
810  memset(&f, 0, sizeof(f));
811  memset(&ssn, 0, sizeof(ssn));
812 
813  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
814 
815  FLOW_INITIALIZE(&f);
816  f.protoctx = (void *)&ssn;
817  f.proto = IPPROTO_TCP;
818  f.flags |= FLOW_IPV4;
819  p->flow = &f;
820  p->flowflags |= FLOW_PKT_TOSERVER;
821  p->flowflags |= FLOW_PKT_ESTABLISHED;
822  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
823  f.alproto = ALPROTO_HTTP1;
824 
825  StreamTcpInitConfig(true);
826 
827  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
828  FAIL_IF_NULL(de_ctx);
829  de_ctx->flags |= DE_QUIET;
830 
831  Signature *s = DetectEngineAppendSig(de_ctx,
832  "alert http any any -> any any "
833  "(msg:\"http header test\"; flow:to_server; "
834  "content:\"one\"; http_raw_header; content:!\"three\"; http_raw_header; within:5; "
835  "sid:1;)");
836  FAIL_IF_NULL(s);
837 
838  SigGroupBuild(de_ctx);
839  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
840 
841  int r = AppLayerParserParse(
842  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
843  FAIL_IF_NOT(r == 0);
844 
845  HtpState *http_state = f.alstate;
846  FAIL_IF_NULL(http_state);
847 
848  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
849 
850  FAIL_IF(!(PacketAlertCheck(p, 1)));
851 
852  UTHFreePackets(&p, 1);
853  FLOW_DESTROY(&f);
854  AppLayerParserThreadCtxFree(alp_tctx);
855  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
856  DetectEngineCtxFree(de_ctx);
857  StreamTcpFreeConfig(true);
858  StatsThreadCleanup(&th_v);
859  PASS;
860 }
861 
862 /**
863  *\test Test that the http_header content matches against a http request
864  * which holds the content.
865  */
866 static int DetectEngineHttpRawHeaderTest12(void)
867 {
868  TcpSession ssn;
869  ThreadVars th_v;
870  DetectEngineThreadCtx *det_ctx = NULL;
871  Flow f;
872  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
873  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
874  uint32_t http_len = sizeof(http_buf) - 1;
875  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
876 
877  memset(&th_v, 0, sizeof(th_v));
878  memset(&f, 0, sizeof(f));
879  memset(&ssn, 0, sizeof(ssn));
880 
881  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
882 
883  FLOW_INITIALIZE(&f);
884  f.protoctx = (void *)&ssn;
885  f.proto = IPPROTO_TCP;
886  f.flags |= FLOW_IPV4;
887  p->flow = &f;
888  p->flowflags |= FLOW_PKT_TOSERVER;
889  p->flowflags |= FLOW_PKT_ESTABLISHED;
890  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
891  f.alproto = ALPROTO_HTTP1;
892 
893  StreamTcpInitConfig(true);
894 
895  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
896  FAIL_IF_NULL(de_ctx);
897  de_ctx->flags |= DE_QUIET;
898 
899  Signature *s = DetectEngineAppendSig(de_ctx,
900  "alert http any any -> any any "
901  "(msg:\"http header test\"; flow:to_server; "
902  "content:\"one\"; http_raw_header; content:!\"three\"; http_raw_header; within:10; "
903  "sid:1;)");
904  FAIL_IF_NULL(s);
905 
906  SigGroupBuild(de_ctx);
907  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
908 
909  int r = AppLayerParserParse(
910  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
911  FAIL_IF_NOT(r == 0);
912 
913  HtpState *http_state = f.alstate;
914  FAIL_IF_NULL(http_state);
915 
916  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
917 
918  FAIL_IF(PacketAlertCheck(p, 1));
919 
920  UTHFreePackets(&p, 1);
921  FLOW_DESTROY(&f);
922  AppLayerParserThreadCtxFree(alp_tctx);
923  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
924  DetectEngineCtxFree(de_ctx);
925  StreamTcpFreeConfig(true);
926  StatsThreadCleanup(&th_v);
927  PASS;
928 }
929 
930 /**
931  *\test Test that the http_header content matches against a http request
932  * which holds the content.
933  */
934 static int DetectEngineHttpRawHeaderTest13(void)
935 {
936  TcpSession ssn;
937  ThreadVars th_v;
938  DetectEngineThreadCtx *det_ctx = NULL;
939  Flow f;
940  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
941  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
942  uint32_t http_len = sizeof(http_buf) - 1;
943  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
944 
945  memset(&th_v, 0, sizeof(th_v));
946  memset(&f, 0, sizeof(f));
947  memset(&ssn, 0, sizeof(ssn));
948 
949  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
950 
951  FLOW_INITIALIZE(&f);
952  f.protoctx = (void *)&ssn;
953  f.proto = IPPROTO_TCP;
954  f.flags |= FLOW_IPV4;
955  p->flow = &f;
956  p->flowflags |= FLOW_PKT_TOSERVER;
957  p->flowflags |= FLOW_PKT_ESTABLISHED;
958  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
959  f.alproto = ALPROTO_HTTP1;
960 
961  StreamTcpInitConfig(true);
962 
963  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
964  FAIL_IF_NULL(de_ctx);
965  de_ctx->flags |= DE_QUIET;
966 
967  Signature *s = DetectEngineAppendSig(de_ctx,
968  "alert http any any -> any any "
969  "(msg:\"http header test\"; flow:to_server; "
970  "content:\"one\"; http_raw_header; content:\"three\"; http_raw_header; within:5; "
971  "sid:1;)");
972  FAIL_IF_NULL(s);
973 
974  SigGroupBuild(de_ctx);
975  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
976 
977  int r = AppLayerParserParse(
978  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
979  FAIL_IF_NOT(r == 0);
980 
981  HtpState *http_state = f.alstate;
982  FAIL_IF_NULL(http_state);
983 
984  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
985  FAIL_IF(PacketAlertCheck(p, 1));
986 
987  UTHFreePackets(&p, 1);
988  FLOW_DESTROY(&f);
989  AppLayerParserThreadCtxFree(alp_tctx);
990  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
991  DetectEngineCtxFree(de_ctx);
992  StreamTcpFreeConfig(true);
993  StatsThreadCleanup(&th_v);
994  PASS;
995 }
996 
997 /**
998  *\test Test that the http_header content matches against a http request
999  * which holds the content.
1000  */
1001 static int DetectEngineHttpRawHeaderTest14(void)
1002 {
1003  TcpSession ssn;
1004  ThreadVars th_v;
1005  DetectEngineThreadCtx *det_ctx = NULL;
1006  Flow f;
1007  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
1008  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
1009  uint32_t http_len = sizeof(http_buf) - 1;
1010  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1011 
1012  memset(&th_v, 0, sizeof(th_v));
1013  memset(&f, 0, sizeof(f));
1014  memset(&ssn, 0, sizeof(ssn));
1015 
1016  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1017 
1018  FLOW_INITIALIZE(&f);
1019  f.protoctx = (void *)&ssn;
1020  f.proto = IPPROTO_TCP;
1021  f.flags |= FLOW_IPV4;
1022  p->flow = &f;
1023  p->flowflags |= FLOW_PKT_TOSERVER;
1024  p->flowflags |= FLOW_PKT_ESTABLISHED;
1025  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1026  f.alproto = ALPROTO_HTTP1;
1027 
1028  StreamTcpInitConfig(true);
1029 
1030  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1031  FAIL_IF_NULL(de_ctx);
1032  de_ctx->flags |= DE_QUIET;
1033 
1034  Signature *s = DetectEngineAppendSig(de_ctx,
1035  "alert http any any -> any any "
1036  "(msg:\"http header test\"; flow:to_server; "
1037  "content:\"one\"; http_raw_header; content:\"five\"; http_raw_header; distance:7; "
1038  "sid:1;)");
1039  FAIL_IF_NULL(s);
1040 
1041  SigGroupBuild(de_ctx);
1042  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1043 
1044  int r = AppLayerParserParse(
1045  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
1046  FAIL_IF_NOT(r == 0);
1047 
1048  HtpState *http_state = f.alstate;
1049  FAIL_IF_NULL(http_state);
1050 
1051  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1052  FAIL_IF(!(PacketAlertCheck(p, 1)));
1053 
1054  UTHFreePackets(&p, 1);
1055  FLOW_DESTROY(&f);
1056  AppLayerParserThreadCtxFree(alp_tctx);
1057  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1058  DetectEngineCtxFree(de_ctx);
1059  StreamTcpFreeConfig(true);
1060  StatsThreadCleanup(&th_v);
1061  PASS;
1062 }
1063 
1064 /**
1065  *\test Test that the http_header content matches against a http request
1066  * which holds the content.
1067  */
1068 static int DetectEngineHttpRawHeaderTest15(void)
1069 {
1070  TcpSession ssn;
1071  ThreadVars th_v;
1072  DetectEngineThreadCtx *det_ctx = NULL;
1073  Flow f;
1074  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
1075  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
1076  uint32_t http_len = sizeof(http_buf) - 1;
1077  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1078 
1079  memset(&th_v, 0, sizeof(th_v));
1080  memset(&f, 0, sizeof(f));
1081  memset(&ssn, 0, sizeof(ssn));
1082 
1083  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1084 
1085  FLOW_INITIALIZE(&f);
1086  f.protoctx = (void *)&ssn;
1087  f.proto = IPPROTO_TCP;
1088  f.flags |= FLOW_IPV4;
1089  p->flow = &f;
1090  p->flowflags |= FLOW_PKT_TOSERVER;
1091  p->flowflags |= FLOW_PKT_ESTABLISHED;
1092  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1093  f.alproto = ALPROTO_HTTP1;
1094 
1095  StreamTcpInitConfig(true);
1096 
1097  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1098  FAIL_IF_NULL(de_ctx);
1099  de_ctx->flags |= DE_QUIET;
1100 
1101  Signature *s = DetectEngineAppendSig(de_ctx,
1102  "alert http any any -> any any "
1103  "(msg:\"http header test\"; flow:to_server; "
1104  "content:\"one\"; http_raw_header; content:!\"five\"; http_raw_header; distance:15; "
1105  "sid:1;)");
1106  FAIL_IF_NULL(s);
1107 
1108  SigGroupBuild(de_ctx);
1109  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1110 
1111  int r = AppLayerParserParse(
1112  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
1113  FAIL_IF_NOT(r == 0);
1114 
1115  HtpState *http_state = f.alstate;
1116  FAIL_IF_NULL(http_state);
1117 
1118  /* do detect */
1119  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1120  FAIL_IF(!(PacketAlertCheck(p, 1)));
1121 
1122  UTHFreePackets(&p, 1);
1123  FLOW_DESTROY(&f);
1124  AppLayerParserThreadCtxFree(alp_tctx);
1125  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1126  DetectEngineCtxFree(de_ctx);
1127  StreamTcpFreeConfig(true);
1128  StatsThreadCleanup(&th_v);
1129  PASS;
1130 }
1131 
1132 /**
1133  *\test Test that the http_header content matches against a http request
1134  * which holds the content.
1135  */
1136 static int DetectEngineHttpRawHeaderTest16(void)
1137 {
1138  TcpSession ssn;
1139  ThreadVars th_v;
1140  DetectEngineThreadCtx *det_ctx = NULL;
1141  Flow f;
1142  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
1143  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
1144  uint32_t http_len = sizeof(http_buf) - 1;
1145  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1146 
1147  memset(&th_v, 0, sizeof(th_v));
1148  memset(&f, 0, sizeof(f));
1149  memset(&ssn, 0, sizeof(ssn));
1150 
1151  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1152 
1153  FLOW_INITIALIZE(&f);
1154  f.protoctx = (void *)&ssn;
1155  f.proto = IPPROTO_TCP;
1156  f.flags |= FLOW_IPV4;
1157  p->flow = &f;
1158  p->flowflags |= FLOW_PKT_TOSERVER;
1159  p->flowflags |= FLOW_PKT_ESTABLISHED;
1160  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1161  f.alproto = ALPROTO_HTTP1;
1162 
1163  StreamTcpInitConfig(true);
1164 
1165  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1166  FAIL_IF_NULL(de_ctx);
1167  de_ctx->flags |= DE_QUIET;
1168 
1169  Signature *s = DetectEngineAppendSig(de_ctx,
1170  "alert http any any -> any any "
1171  "(msg:\"http header test\"; flow:to_server; "
1172  "content:\"one\"; http_raw_header; content:!\"five\"; http_raw_header; distance:7; "
1173  "sid:1;)");
1174  FAIL_IF_NULL(s);
1175 
1176  SigGroupBuild(de_ctx);
1177  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1178 
1179  int r = AppLayerParserParse(
1180  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
1181  FAIL_IF_NOT(r == 0);
1182 
1183  HtpState *http_state = f.alstate;
1184  FAIL_IF_NULL(http_state);
1185 
1186  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1187  FAIL_IF(PacketAlertCheck(p, 1));
1188 
1189  UTHFreePackets(&p, 1);
1190  FLOW_DESTROY(&f);
1191  AppLayerParserThreadCtxFree(alp_tctx);
1192  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1193  DetectEngineCtxFree(de_ctx);
1194  StreamTcpFreeConfig(true);
1195  StatsThreadCleanup(&th_v);
1196  PASS;
1197 }
1198 
1199 /**
1200  *\test Test that the http_header content matches against a http request
1201  * which holds the content.
1202  */
1203 static int DetectEngineHttpRawHeaderTest17(void)
1204 {
1205  TcpSession ssn;
1206  ThreadVars th_v;
1207  DetectEngineThreadCtx *det_ctx = NULL;
1208  Flow f;
1209  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
1210  "Host: www.onetwothreefourfivesixseven.org\r\n\r\n";
1211  uint32_t http_len = sizeof(http_buf) - 1;
1212  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1213 
1214  memset(&th_v, 0, sizeof(th_v));
1215  memset(&f, 0, sizeof(f));
1216  memset(&ssn, 0, sizeof(ssn));
1217 
1218  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1219 
1220  FLOW_INITIALIZE(&f);
1221  f.protoctx = (void *)&ssn;
1222  f.proto = IPPROTO_TCP;
1223  f.flags |= FLOW_IPV4;
1224  p->flow = &f;
1225  p->flowflags |= FLOW_PKT_TOSERVER;
1226  p->flowflags |= FLOW_PKT_ESTABLISHED;
1227  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1228  f.alproto = ALPROTO_HTTP1;
1229 
1230  StreamTcpInitConfig(true);
1231 
1232  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1233  FAIL_IF_NULL(de_ctx);
1234  de_ctx->flags |= DE_QUIET;
1235 
1236  Signature *s = DetectEngineAppendSig(de_ctx,
1237  "alert http any any -> any any "
1238  "(msg:\"http header test\"; flow:to_server; "
1239  "content:\"one\"; http_raw_header; content:\"five\"; http_raw_header; distance:15; "
1240  "sid:1;)");
1241  FAIL_IF_NULL(s);
1242 
1243  SigGroupBuild(de_ctx);
1244  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1245 
1246  int r = AppLayerParserParse(
1247  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
1248  FAIL_IF_NOT(r == 0);
1249 
1250  HtpState *http_state = f.alstate;
1251  FAIL_IF_NULL(http_state);
1252 
1253  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1254  FAIL_IF(PacketAlertCheck(p, 1));
1255 
1256  UTHFreePackets(&p, 1);
1257  FLOW_DESTROY(&f);
1258  AppLayerParserThreadCtxFree(alp_tctx);
1259  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1260  DetectEngineCtxFree(de_ctx);
1261  StreamTcpFreeConfig(true);
1262  StatsThreadCleanup(&th_v);
1263  PASS;
1264 }
1265 
1266 static int DetectEngineHttpRawHeaderTest20(void)
1267 {
1268  TcpSession ssn;
1269  ThreadVars th_v;
1270  DetectEngineThreadCtx *det_ctx = NULL;
1271  Flow f;
1272  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1273  "Host: This_is_dummy_body1";
1274  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1275  "\r\n";
1276  uint32_t http1_len = sizeof(http1_buf) - 1;
1277  uint32_t http2_len = sizeof(http2_buf) - 1;
1278  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1279  FAIL_IF_NULL(alp_tctx);
1280 
1281  memset(&th_v, 0, sizeof(th_v));
1282  memset(&f, 0, sizeof(f));
1283  memset(&ssn, 0, sizeof(ssn));
1284 
1285  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1286  FAIL_IF_NULL(p1);
1287  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1288  FAIL_IF_NULL(p2);
1289 
1290  FLOW_INITIALIZE(&f);
1291  f.protoctx = (void *)&ssn;
1292  f.proto = IPPROTO_TCP;
1293  f.flags |= FLOW_IPV4;
1294 
1295  p1->flow = &f;
1296  p1->flowflags |= FLOW_PKT_TOSERVER;
1297  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1298  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1299  p2->flow = &f;
1300  p2->flowflags |= FLOW_PKT_TOSERVER;
1301  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1302  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1303  f.alproto = ALPROTO_HTTP1;
1304 
1305  StreamTcpInitConfig(true);
1306 
1307  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1308  FAIL_IF_NULL(de_ctx);
1309  de_ctx->flags |= DE_QUIET;
1310 
1311  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1312  "(flow:to_server; pcre:/body1/D; "
1313  "content:!\"dummy\"; http_raw_header; within:7; "
1314  "sid:1;)");
1315  FAIL_IF_NULL(s);
1316 
1317  SigGroupBuild(de_ctx);
1318  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1319  FAIL_IF_NULL(det_ctx);
1320 
1321  int r = AppLayerParserParse(
1322  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1323  FAIL_IF_NOT(r == 0);
1324 
1325  HtpState *http_state = f.alstate;
1326  FAIL_IF_NULL(http_state);
1327 
1328  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1329  FAIL_IF(PacketAlertCheck(p1, 1));
1330 
1331  r = AppLayerParserParse(
1332  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1333  FAIL_IF_NOT(r == 0);
1334 
1335  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1336  FAIL_IF(!PacketAlertCheck(p2, 1));
1337 
1338  UTHFreePackets(&p1, 1);
1339  UTHFreePackets(&p2, 1);
1340  FLOW_DESTROY(&f);
1341 
1342  AppLayerParserThreadCtxFree(alp_tctx);
1343  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1344  DetectEngineCtxFree(de_ctx);
1345  StreamTcpFreeConfig(true);
1346  StatsThreadCleanup(&th_v);
1347  PASS;
1348 }
1349 
1350 static int DetectEngineHttpRawHeaderTest21(void)
1351 {
1352  TcpSession ssn;
1353  Packet *p1 = NULL;
1354  Packet *p2 = NULL;
1355  ThreadVars th_v;
1356  DetectEngineThreadCtx *det_ctx = NULL;
1357  Flow f;
1358  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1359  "Host: This_is_dummy_body1";
1360  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1361  "\r\n";
1362  uint32_t http1_len = sizeof(http1_buf) - 1;
1363  uint32_t http2_len = sizeof(http2_buf) - 1;
1364  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1365 
1366  memset(&th_v, 0, sizeof(th_v));
1367  memset(&f, 0, sizeof(f));
1368  memset(&ssn, 0, sizeof(ssn));
1369 
1370  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1371  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1372 
1373  FLOW_INITIALIZE(&f);
1374  f.protoctx = (void *)&ssn;
1375  f.proto = IPPROTO_TCP;
1376  f.flags |= FLOW_IPV4;
1377 
1378  p1->flow = &f;
1379  p1->flowflags |= FLOW_PKT_TOSERVER;
1380  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1381  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1382  p2->flow = &f;
1383  p2->flowflags |= FLOW_PKT_TOSERVER;
1384  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1385  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1386  f.alproto = ALPROTO_HTTP1;
1387 
1388  StreamTcpInitConfig(true);
1389 
1390  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1391  FAIL_IF_NULL(de_ctx);
1392  de_ctx->flags |= DE_QUIET;
1393 
1394  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1395  "(msg:\"http client body test\"; flow:to_server; "
1396  "pcre:/body1/D; "
1397  "content:!\"dummy\"; within:7; http_raw_header; "
1398  "sid:1;)");
1399  FAIL_IF_NULL(s);
1400 
1401  SigGroupBuild(de_ctx);
1402  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1403 
1404  int r = AppLayerParserParse(
1405  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1406  FAIL_IF_NOT(r == 0);
1407 
1408  HtpState *http_state = f.alstate;
1409  FAIL_IF_NULL(http_state);
1410 
1411  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1412  FAIL_IF(PacketAlertCheck(p1, 1));
1413 
1414  r = AppLayerParserParse(
1415  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1416  FAIL_IF_NOT(r == 0);
1417 
1418  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1419  FAIL_IF(!PacketAlertCheck(p2, 1));
1420 
1421  UTHFreePackets(&p1, 1);
1422  UTHFreePackets(&p2, 1);
1423  FLOW_DESTROY(&f);
1424  AppLayerParserThreadCtxFree(alp_tctx);
1425  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1426  DetectEngineCtxFree(de_ctx);
1427  StreamTcpFreeConfig(true);
1428  StatsThreadCleanup(&th_v);
1429  PASS;
1430 }
1431 
1432 static int DetectEngineHttpRawHeaderTest22(void)
1433 {
1434  TcpSession ssn;
1435  Packet *p1 = NULL;
1436  Packet *p2 = NULL;
1437  ThreadVars th_v;
1438  DetectEngineThreadCtx *det_ctx = NULL;
1439  Flow f;
1440  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1441  "Host: This_is_dummy_body1";
1442  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1443  "\r\n";
1444  uint32_t http1_len = sizeof(http1_buf) - 1;
1445  uint32_t http2_len = sizeof(http2_buf) - 1;
1446  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1447 
1448  memset(&th_v, 0, sizeof(th_v));
1449  memset(&f, 0, sizeof(f));
1450  memset(&ssn, 0, sizeof(ssn));
1451 
1452  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1453  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1454 
1455  FLOW_INITIALIZE(&f);
1456  f.protoctx = (void *)&ssn;
1457  f.proto = IPPROTO_TCP;
1458  f.flags |= FLOW_IPV4;
1459 
1460  p1->flow = &f;
1461  p1->flowflags |= FLOW_PKT_TOSERVER;
1462  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1463  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1464  p2->flow = &f;
1465  p2->flowflags |= FLOW_PKT_TOSERVER;
1466  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1467  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1468  f.alproto = ALPROTO_HTTP1;
1469 
1470  StreamTcpInitConfig(true);
1471 
1472  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1473  FAIL_IF_NULL(de_ctx);
1474  de_ctx->flags |= DE_QUIET;
1475 
1476  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1477  "(msg:\"http client body test\"; flow:to_server; "
1478  "pcre:/body1/D; "
1479  "content:!\"dummy\"; distance:3; http_raw_header; "
1480  "sid:1;)");
1481  FAIL_IF_NULL(s);
1482 
1483  SigGroupBuild(de_ctx);
1484  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1485 
1486  int r = AppLayerParserParse(
1487  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1488  FAIL_IF_NOT(r == 0);
1489 
1490  HtpState *http_state = f.alstate;
1491  FAIL_IF_NULL(http_state);
1492 
1493  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1494 
1495  FAIL_IF(PacketAlertCheck(p1, 1));
1496 
1497  r = AppLayerParserParse(
1498  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1499  FAIL_IF_NOT(r == 0);
1500 
1501  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1502  FAIL_IF(PacketAlertCheck(p2, 1));
1503 
1504  UTHFreePackets(&p1, 1);
1505  UTHFreePackets(&p2, 1);
1506  FLOW_DESTROY(&f);
1507  AppLayerParserThreadCtxFree(alp_tctx);
1508  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1509  DetectEngineCtxFree(de_ctx);
1510  StreamTcpFreeConfig(true);
1511  StatsThreadCleanup(&th_v);
1512  PASS;
1513 }
1514 
1515 static int DetectEngineHttpRawHeaderTest23(void)
1516 {
1517  TcpSession ssn;
1518  Packet *p1 = NULL;
1519  Packet *p2 = NULL;
1520  ThreadVars th_v;
1521  DetectEngineThreadCtx *det_ctx = NULL;
1522  Flow f;
1523  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1524  "Host: This_is_dummy_body1";
1525  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1526  "\r\n";
1527  uint32_t http1_len = sizeof(http1_buf) - 1;
1528  uint32_t http2_len = sizeof(http2_buf) - 1;
1529  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1530 
1531  memset(&th_v, 0, sizeof(th_v));
1532  memset(&f, 0, sizeof(f));
1533  memset(&ssn, 0, sizeof(ssn));
1534 
1535  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1536  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1537 
1538  FLOW_INITIALIZE(&f);
1539  f.protoctx = (void *)&ssn;
1540  f.proto = IPPROTO_TCP;
1541  f.flags |= FLOW_IPV4;
1542 
1543  p1->flow = &f;
1544  p1->flowflags |= FLOW_PKT_TOSERVER;
1545  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1546  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1547  p2->flow = &f;
1548  p2->flowflags |= FLOW_PKT_TOSERVER;
1549  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1550  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1551  f.alproto = ALPROTO_HTTP1;
1552 
1553  StreamTcpInitConfig(true);
1554 
1555  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1556  FAIL_IF_NULL(de_ctx);
1557  de_ctx->flags |= DE_QUIET;
1558 
1559  Signature *s =
1560  DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1561  "(msg:\"http client body test\"; flow:to_server; "
1562  "pcre:/body1/D; "
1563  "content:!\"dummy\"; distance:13; http_raw_header; "
1564  "sid:1;)");
1565  FAIL_IF_NULL(s);
1566 
1567  SigGroupBuild(de_ctx);
1568  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1569 
1570  int r = AppLayerParserParse(
1571  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1572  FAIL_IF_NOT(r == 0);
1573 
1574  HtpState *http_state = f.alstate;
1575  FAIL_IF_NULL(http_state);
1576 
1577  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1578  FAIL_IF(PacketAlertCheck(p1, 1));
1579 
1580  r = AppLayerParserParse(
1581  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1582  FAIL_IF_NOT(r == 0);
1583 
1584  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1585  FAIL_IF(!PacketAlertCheck(p2, 1));
1586 
1587  UTHFreePackets(&p1, 1);
1588  UTHFreePackets(&p2, 1);
1589  FLOW_DESTROY(&f);
1590  AppLayerParserThreadCtxFree(alp_tctx);
1591  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1592  DetectEngineCtxFree(de_ctx);
1593  StreamTcpFreeConfig(true);
1594  StatsThreadCleanup(&th_v);
1595  PASS;
1596 }
1597 
1598 static int DetectEngineHttpRawHeaderTest24(void)
1599 {
1600  TcpSession ssn;
1601  Packet *p1 = NULL;
1602  Packet *p2 = NULL;
1603  ThreadVars th_v;
1604  DetectEngineThreadCtx *det_ctx = NULL;
1605  Flow f;
1606  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1607  "Host: This_is_dummy_body1";
1608  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1609  "\r\n";
1610  uint32_t http1_len = sizeof(http1_buf) - 1;
1611  uint32_t http2_len = sizeof(http2_buf) - 1;
1612  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1613 
1614  memset(&th_v, 0, sizeof(th_v));
1615  memset(&f, 0, sizeof(f));
1616  memset(&ssn, 0, sizeof(ssn));
1617 
1618  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1619  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1620 
1621  FLOW_INITIALIZE(&f);
1622  f.protoctx = (void *)&ssn;
1623  f.proto = IPPROTO_TCP;
1624  f.flags |= FLOW_IPV4;
1625 
1626  p1->flow = &f;
1627  p1->flowflags |= FLOW_PKT_TOSERVER;
1628  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1629  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1630  p2->flow = &f;
1631  p2->flowflags |= FLOW_PKT_TOSERVER;
1632  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1633  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1634  f.alproto = ALPROTO_HTTP1;
1635 
1636  StreamTcpInitConfig(true);
1637 
1638  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1639  FAIL_IF_NULL(de_ctx);
1640  de_ctx->flags |= DE_QUIET;
1641 
1642  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1643  "(msg:\"http client body test\"; flow:to_server; "
1644  "pcre:/body1/D; "
1645  "content:\"dummy\"; within:15; http_raw_header; "
1646  "sid:1;)");
1647  FAIL_IF_NULL(s);
1648 
1649  SigGroupBuild(de_ctx);
1650  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1651 
1652  int r = AppLayerParserParse(
1653  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1654  FAIL_IF_NOT(r == 0);
1655 
1656  HtpState *http_state = f.alstate;
1657  FAIL_IF_NULL(http_state);
1658 
1659  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1660  FAIL_IF(PacketAlertCheck(p1, 1));
1661 
1662  r = AppLayerParserParse(
1663  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1664  FAIL_IF_NOT(r == 0);
1665 
1666  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1667 
1668  FAIL_IF(!PacketAlertCheck(p2, 1));
1669 
1670  UTHFreePackets(&p1, 1);
1671  UTHFreePackets(&p2, 1);
1672  FLOW_DESTROY(&f);
1673  AppLayerParserThreadCtxFree(alp_tctx);
1674  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1675  DetectEngineCtxFree(de_ctx);
1676  StreamTcpFreeConfig(true);
1677  StatsThreadCleanup(&th_v);
1678  PASS;
1679 }
1680 
1681 static int DetectEngineHttpRawHeaderTest25(void)
1682 {
1683  TcpSession ssn;
1684  Packet *p1 = NULL;
1685  Packet *p2 = NULL;
1686  ThreadVars th_v;
1687  DetectEngineThreadCtx *det_ctx = NULL;
1688  Flow f;
1689  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1690  "Host: This_is_dummy_body1";
1691  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1692  "\r\n";
1693  uint32_t http1_len = sizeof(http1_buf) - 1;
1694  uint32_t http2_len = sizeof(http2_buf) - 1;
1695  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1696 
1697  memset(&th_v, 0, sizeof(th_v));
1698  memset(&f, 0, sizeof(f));
1699  memset(&ssn, 0, sizeof(ssn));
1700 
1701  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1702  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1703 
1704  FLOW_INITIALIZE(&f);
1705  f.protoctx = (void *)&ssn;
1706  f.proto = IPPROTO_TCP;
1707  f.flags |= FLOW_IPV4;
1708 
1709  p1->flow = &f;
1710  p1->flowflags |= FLOW_PKT_TOSERVER;
1711  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1712  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1713  p2->flow = &f;
1714  p2->flowflags |= FLOW_PKT_TOSERVER;
1715  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1716  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1717  f.alproto = ALPROTO_HTTP1;
1718 
1719  StreamTcpInitConfig(true);
1720 
1721  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1722  FAIL_IF_NULL(de_ctx);
1723  de_ctx->flags |= DE_QUIET;
1724 
1725  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1726  "(msg:\"http client body test\"; flow:to_server; "
1727  "pcre:/body1/D; "
1728  "content:\"dummy\"; within:10; http_raw_header; "
1729  "sid:1;)");
1730  FAIL_IF_NULL(s);
1731 
1732  SigGroupBuild(de_ctx);
1733  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1734 
1735  int r = AppLayerParserParse(
1736  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1737  FAIL_IF_NOT(r == 0);
1738 
1739  HtpState *http_state = f.alstate;
1740  FAIL_IF_NULL(http_state);
1741 
1742  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1743  FAIL_IF(PacketAlertCheck(p1, 1));
1744 
1745  r = AppLayerParserParse(
1746  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1747  FAIL_IF_NOT(r == 0);
1748 
1749  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1750  FAIL_IF(PacketAlertCheck(p2, 1));
1751 
1752  UTHFreePackets(&p1, 1);
1753  UTHFreePackets(&p2, 1);
1754  FLOW_DESTROY(&f);
1755  AppLayerParserThreadCtxFree(alp_tctx);
1756  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1757  DetectEngineCtxFree(de_ctx);
1758  StreamTcpFreeConfig(true);
1759  StatsThreadCleanup(&th_v);
1760  PASS;
1761 }
1762 
1763 static int DetectEngineHttpRawHeaderTest26(void)
1764 {
1765  TcpSession ssn;
1766  Packet *p1 = NULL;
1767  Packet *p2 = NULL;
1768  ThreadVars th_v;
1769  DetectEngineThreadCtx *det_ctx = NULL;
1770  Flow f;
1771  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1772  "Host: This_is_dummy_body1";
1773  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1774  "\r\n";
1775  uint32_t http1_len = sizeof(http1_buf) - 1;
1776  uint32_t http2_len = sizeof(http2_buf) - 1;
1777  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1778 
1779  memset(&th_v, 0, sizeof(th_v));
1780  memset(&f, 0, sizeof(f));
1781  memset(&ssn, 0, sizeof(ssn));
1782 
1783  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1784  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1785 
1786  FLOW_INITIALIZE(&f);
1787  f.protoctx = (void *)&ssn;
1788  f.proto = IPPROTO_TCP;
1789  f.flags |= FLOW_IPV4;
1790 
1791  p1->flow = &f;
1792  p1->flowflags |= FLOW_PKT_TOSERVER;
1793  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1794  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1795  p2->flow = &f;
1796  p2->flowflags |= FLOW_PKT_TOSERVER;
1797  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1798  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1799  f.alproto = ALPROTO_HTTP1;
1800 
1801  StreamTcpInitConfig(true);
1802 
1803  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1804  FAIL_IF_NULL(de_ctx);
1805  de_ctx->flags |= DE_QUIET;
1806 
1807  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1808  "(msg:\"http client body test\"; flow:to_server; "
1809  "pcre:/body1/D; "
1810  "content:\"dummy\"; distance:8; http_raw_header; "
1811  "sid:1;)");
1812  FAIL_IF_NULL(s);
1813 
1814  SigGroupBuild(de_ctx);
1815  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1816 
1817  int r = AppLayerParserParse(
1818  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1819  FAIL_IF_NOT(r == 0);
1820 
1821  HtpState *http_state = f.alstate;
1822  FAIL_IF_NULL(http_state);
1823 
1824  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1825  FAIL_IF(PacketAlertCheck(p1, 1));
1826 
1827  r = AppLayerParserParse(
1828  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1829  FAIL_IF_NOT(r == 0);
1830 
1831  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1832  FAIL_IF(!PacketAlertCheck(p2, 1));
1833 
1834  UTHFreePackets(&p1, 1);
1835  UTHFreePackets(&p2, 1);
1836  FLOW_DESTROY(&f);
1837  AppLayerParserThreadCtxFree(alp_tctx);
1838  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1839  DetectEngineCtxFree(de_ctx);
1840  StreamTcpFreeConfig(true);
1841  StatsThreadCleanup(&th_v);
1842  PASS;
1843 }
1844 
1845 static int DetectEngineHttpRawHeaderTest27(void)
1846 {
1847  TcpSession ssn;
1848  Packet *p1 = NULL;
1849  Packet *p2 = NULL;
1850  ThreadVars th_v;
1851  DetectEngineThreadCtx *det_ctx = NULL;
1852  Flow f;
1853  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
1854  "Host: This_is_dummy_body1";
1855  uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n"
1856  "\r\n";
1857  uint32_t http1_len = sizeof(http1_buf) - 1;
1858  uint32_t http2_len = sizeof(http2_buf) - 1;
1859  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1860 
1861  memset(&th_v, 0, sizeof(th_v));
1862  memset(&f, 0, sizeof(f));
1863  memset(&ssn, 0, sizeof(ssn));
1864 
1865  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1866  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1867 
1868  FLOW_INITIALIZE(&f);
1869  f.protoctx = (void *)&ssn;
1870  f.proto = IPPROTO_TCP;
1871  f.flags |= FLOW_IPV4;
1872 
1873  p1->flow = &f;
1874  p1->flowflags |= FLOW_PKT_TOSERVER;
1875  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1876  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1877  p2->flow = &f;
1878  p2->flowflags |= FLOW_PKT_TOSERVER;
1879  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1880  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1881  f.alproto = ALPROTO_HTTP1;
1882 
1883  StreamTcpInitConfig(true);
1884 
1885  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1886  FAIL_IF_NULL(de_ctx);
1887  de_ctx->flags |= DE_QUIET;
1888 
1889  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1890  "(msg:\"http client body test\"; flow:to_server; "
1891  "pcre:/body1/D; "
1892  "content:\"dummy\"; distance:14; http_raw_header; "
1893  "sid:1;)");
1894  FAIL_IF_NULL(s);
1895 
1896  SigGroupBuild(de_ctx);
1897  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1898 
1899  int r = AppLayerParserParse(
1900  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
1901  FAIL_IF_NOT(r == 0);
1902 
1903  HtpState *http_state = f.alstate;
1904  FAIL_IF_NULL(http_state);
1905 
1906  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1907  FAIL_IF(PacketAlertCheck(p1, 1));
1908 
1909  r = AppLayerParserParse(
1910  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
1911  FAIL_IF_NOT(r == 0);
1912 
1913  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1914  FAIL_IF(PacketAlertCheck(p2, 1));
1915 
1916  UTHFreePackets(&p1, 1);
1917  UTHFreePackets(&p2, 1);
1918  FLOW_DESTROY(&f);
1919  AppLayerParserThreadCtxFree(alp_tctx);
1920  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1921  DetectEngineCtxFree(de_ctx);
1922  StreamTcpFreeConfig(true);
1923  StatsThreadCleanup(&th_v);
1924  PASS;
1925 }
1926 
1927 static int DetectEngineHttpRawHeaderTest28(void)
1928 {
1929  TcpSession ssn;
1930  Packet *p1 = NULL;
1931  Packet *p2 = NULL;
1932  ThreadVars th_v;
1933  DetectEngineThreadCtx *det_ctx = NULL;
1934  Flow f;
1935  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
1936  "Host: www.openinfosecfoundation.org\r\n"
1937  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
1938  "Gecko/20091221 Firefox/3.5.7\r\n"
1939  "\r\n";
1940  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
1941  uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n"
1942  "Content-Type: text/html\r\n"
1943  "Content-Length: 6\r\n"
1944  "\r\n"
1945  "abcdef";
1946  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
1947  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1948 
1949  memset(&th_v, 0, sizeof(th_v));
1950  memset(&f, 0, sizeof(f));
1951  memset(&ssn, 0, sizeof(ssn));
1952 
1953  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1954  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1955 
1956  FLOW_INITIALIZE(&f);
1957  f.protoctx = (void *)&ssn;
1958  f.proto = IPPROTO_TCP;
1959  f.flags |= FLOW_IPV4;
1960 
1961  p1->flow = &f;
1962  p1->flowflags |= FLOW_PKT_TOSERVER;
1963  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1964  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1965  p2->flow = &f;
1966  p2->flowflags |= FLOW_PKT_TOCLIENT;
1967  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1968  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1969  f.alproto = ALPROTO_HTTP1;
1970 
1971  StreamTcpInitConfig(true);
1972 
1973  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1974  FAIL_IF_NULL(de_ctx);
1975  de_ctx->flags |= DE_QUIET;
1976 
1977  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1978  "(msg:\"http header test\"; flow:to_client; "
1979  "content:\"Content-Length: 6\"; http_raw_header; "
1980  "sid:1;)");
1981  FAIL_IF_NULL(s);
1982 
1983  SigGroupBuild(de_ctx);
1984  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1985 
1986  int r = AppLayerParserParse(
1987  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
1988  FAIL_IF_NOT(r == 0);
1989 
1990  HtpState *http_state = f.alstate;
1991  FAIL_IF_NULL(http_state);
1992 
1993  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1994  FAIL_IF(PacketAlertCheck(p1, 1));
1995 
1996  r = AppLayerParserParse(
1997  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_buf2_len);
1998  FAIL_IF_NOT(r == 0);
1999 
2000  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
2001  FAIL_IF(!PacketAlertCheck(p2, 1));
2002 
2003  UTHFreePackets(&p1, 1);
2004  UTHFreePackets(&p2, 1);
2005  FLOW_DESTROY(&f);
2006  AppLayerParserThreadCtxFree(alp_tctx);
2007  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2008  DetectEngineCtxFree(de_ctx);
2009  StreamTcpFreeConfig(true);
2010  StatsThreadCleanup(&th_v);
2011  PASS;
2012 }
2013 
2014 static int DetectEngineHttpRawHeaderTest29(void)
2015 {
2016  TcpSession ssn;
2017  Packet *p1 = NULL;
2018  Packet *p2 = NULL;
2019  ThreadVars th_v;
2020  DetectEngineThreadCtx *det_ctx = NULL;
2021  Flow f;
2022  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
2023  "Host: www.openinfosecfoundation.org\r\n"
2024  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2025  "Gecko/20091221 Firefox/3.5.7\r\n"
2026  "\r\n";
2027  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
2028  uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n"
2029  "Content-Type: text/html\r\n"
2030  "Content-Length: 6\r\n"
2031  "\r\n"
2032  "abcdef";
2033  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
2034  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2035 
2036  memset(&th_v, 0, sizeof(th_v));
2037  memset(&f, 0, sizeof(f));
2038  memset(&ssn, 0, sizeof(ssn));
2039 
2040  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2041  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2042 
2043  FLOW_INITIALIZE(&f);
2044  f.protoctx = (void *)&ssn;
2045  f.proto = IPPROTO_TCP;
2046  f.flags |= FLOW_IPV4;
2047 
2048  p1->flow = &f;
2049  p1->flowflags |= FLOW_PKT_TOSERVER;
2050  p1->flowflags |= FLOW_PKT_ESTABLISHED;
2051  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2052  p2->flow = &f;
2053  p2->flowflags |= FLOW_PKT_TOCLIENT;
2054  p2->flowflags |= FLOW_PKT_ESTABLISHED;
2055  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2056  f.alproto = ALPROTO_HTTP1;
2057 
2058  StreamTcpInitConfig(true);
2059 
2060  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2061  FAIL_IF_NULL(de_ctx);
2062  de_ctx->flags |= DE_QUIET;
2063 
2064  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2065  "(msg:\"http header test\"; flow:to_client; "
2066  "content:\"Content-Length: 7\"; http_raw_header; "
2067  "sid:1;)");
2068  FAIL_IF_NULL(s);
2069 
2070  SigGroupBuild(de_ctx);
2071  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2072 
2073  int r = AppLayerParserParse(
2074  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
2075  FAIL_IF_NOT(r == 0);
2076 
2077  HtpState *http_state = f.alstate;
2078  FAIL_IF_NULL(http_state);
2079 
2080  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2081  FAIL_IF(PacketAlertCheck(p1, 1));
2082 
2083  r = AppLayerParserParse(
2084  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_buf2_len);
2085  FAIL_IF_NOT(r == 0);
2086 
2087  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
2088  FAIL_IF(PacketAlertCheck(p2, 1));
2089 
2090  UTHFreePackets(&p1, 1);
2091  UTHFreePackets(&p2, 1);
2092  FLOW_DESTROY(&f);
2093  AppLayerParserThreadCtxFree(alp_tctx);
2094  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2095  DetectEngineCtxFree(de_ctx);
2096  StreamTcpFreeConfig(true);
2097  StatsThreadCleanup(&th_v);
2098  PASS;
2099 }
2100 
2101 /**
2102  * \test Trailing headers.
2103  */
2104 static int DetectEngineHttpRawHeaderTest31(void)
2105 {
2106  TcpSession ssn;
2107  Packet *p1 = NULL;
2108  ThreadVars th_v;
2109  DetectEngineThreadCtx *det_ctx = NULL;
2110  Flow f;
2111  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
2112  "host: boom\r\n"
2113  "Transfer-Encoding: chunked\r\n"
2114  "\r\n"
2115  "13\r\n"
2116  "This is dummy body1\r\n"
2117  "0\r\n"
2118  "Dummy-Header: kaboom\r\n"
2119  "\r\n";
2120  uint32_t http1_len = sizeof(http1_buf) - 1;
2121  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2122 
2123  memset(&th_v, 0, sizeof(th_v));
2124  memset(&f, 0, sizeof(f));
2125  memset(&ssn, 0, sizeof(ssn));
2126 
2127  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2128 
2129  FLOW_INITIALIZE(&f);
2130  f.protoctx = (void *)&ssn;
2131  f.proto = IPPROTO_TCP;
2132  f.flags |= FLOW_IPV4;
2133 
2134  p1->flow = &f;
2135  p1->flowflags |= FLOW_PKT_TOSERVER;
2136  p1->flowflags |= FLOW_PKT_ESTABLISHED;
2137  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2138  f.alproto = ALPROTO_HTTP1;
2139 
2140  StreamTcpInitConfig(true);
2141 
2142  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2143  FAIL_IF_NULL(de_ctx);
2144  de_ctx->flags |= DE_QUIET;
2145 
2146  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2147  "(flow:to_server; "
2148  "content:\"Dummy\"; http_raw_header; "
2149  "sid:1;)");
2150  FAIL_IF_NULL(s);
2151 
2152  SigGroupBuild(de_ctx);
2153  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2154 
2155  int r = AppLayerParserParse(
2156  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
2157  FAIL_IF_NOT(r == 0);
2158 
2159  HtpState *http_state = f.alstate;
2160  FAIL_IF_NULL(http_state);
2161 
2162  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2163  FAIL_IF(!(PacketAlertCheck(p1, 1)));
2164 
2165  UTHFreePackets(&p1, 1);
2166  FLOW_DESTROY(&f);
2167  AppLayerParserThreadCtxFree(alp_tctx);
2168  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2169  DetectEngineCtxFree(de_ctx);
2170  StreamTcpFreeConfig(true);
2171  StatsThreadCleanup(&th_v);
2172  PASS;
2173 }
2174 
2175 /**
2176  * \test Trailing headers.
2177  */
2178 static int DetectEngineHttpRawHeaderTest32(void)
2179 {
2180  TcpSession ssn;
2181  Packet *p1 = NULL;
2182  Packet *p2 = NULL;
2183  ThreadVars th_v;
2184  DetectEngineThreadCtx *det_ctx = NULL;
2185  Flow f;
2186  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
2187  "host: boom\r\n"
2188  "Transfer-Encoding: chunked\r\n"
2189  "\r\n"
2190  "13\r\n"
2191  "This is dummy body1\r\n"
2192  "0\r\n";
2193  uint8_t http2_buf[] = "Dummy-Header: kaboom\r\n"
2194  "\r\n";
2195  uint32_t http1_len = sizeof(http1_buf) - 1;
2196  uint32_t http2_len = sizeof(http2_buf) - 1;
2197  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2198 
2199  memset(&th_v, 0, sizeof(th_v));
2200  memset(&f, 0, sizeof(f));
2201  memset(&ssn, 0, sizeof(ssn));
2202 
2203  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2204  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2205 
2206  FLOW_INITIALIZE(&f);
2207  f.protoctx = (void *)&ssn;
2208  f.proto = IPPROTO_TCP;
2209  f.flags |= FLOW_IPV4;
2210 
2211  p1->flow = &f;
2212  p1->flowflags |= FLOW_PKT_TOSERVER;
2213  p1->flowflags |= FLOW_PKT_ESTABLISHED;
2214  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2215  p2->flow = &f;
2216  p2->flowflags |= FLOW_PKT_TOSERVER;
2217  p2->flowflags |= FLOW_PKT_ESTABLISHED;
2218  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2219  f.alproto = ALPROTO_HTTP1;
2220 
2221  StreamTcpInitConfig(true);
2222 
2223  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2224  FAIL_IF_NULL(de_ctx);
2225  de_ctx->flags |= DE_QUIET;
2226 
2227  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2228  "(flow:to_server; "
2229  "content:\"Dummy\"; http_raw_header; "
2230  "sid:1;)");
2231  FAIL_IF_NULL(s);
2232 
2233  SigGroupBuild(de_ctx);
2234  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2235 
2236  int r = AppLayerParserParse(
2237  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
2238  FAIL_IF_NOT(r == 0);
2239 
2240  HtpState *http_state = f.alstate;
2241  FAIL_IF_NULL(http_state);
2242 
2243  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2244 
2245  FAIL_IF(PacketAlertCheck(p1, 1));
2246 
2247  r = AppLayerParserParse(
2248  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
2249  FAIL_IF_NOT(r == 0);
2250 
2251  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
2252  FAIL_IF(!PacketAlertCheck(p2, 1));
2253 
2254  UTHFreePackets(&p1, 1);
2255  UTHFreePackets(&p2, 1);
2256  FLOW_DESTROY(&f);
2257  AppLayerParserThreadCtxFree(alp_tctx);
2258  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2259  DetectEngineCtxFree(de_ctx);
2260  StreamTcpFreeConfig(true);
2261  StatsThreadCleanup(&th_v);
2262  PASS;
2263 }
2264 
2265 /**
2266  *\test Test that the http_header content matches against a http request
2267  * which holds the content.
2268  */
2269 static int DetectHttpRawHeaderTest06(void)
2270 {
2271  TcpSession ssn;
2272  ThreadVars th_v;
2273  DetectEngineThreadCtx *det_ctx = NULL;
2274  Flow f;
2275  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
2276  "Host: www.openinfosecfoundation.org\r\n"
2277  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2278  "Gecko/20091221 Firefox/3.5.7\r\n"
2279  "Content-Type: text/html\r\n"
2280  "Content-Length: 26\r\n"
2281  "\r\n"
2282  "This is dummy message body\r\n";
2283  uint32_t http_len = sizeof(http_buf) - 1;
2284  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2285 
2286  memset(&th_v, 0, sizeof(th_v));
2287  memset(&f, 0, sizeof(f));
2288  memset(&ssn, 0, sizeof(ssn));
2289 
2290  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2291 
2292  FLOW_INITIALIZE(&f);
2293  f.protoctx = (void *)&ssn;
2294  f.proto = IPPROTO_TCP;
2295  f.flags |= FLOW_IPV4;
2296  p->flow = &f;
2297  p->flowflags |= FLOW_PKT_TOSERVER;
2298  p->flowflags |= FLOW_PKT_ESTABLISHED;
2299  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2300  f.alproto = ALPROTO_HTTP1;
2301 
2302  StreamTcpInitConfig(true);
2303 
2304  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2305  FAIL_IF_NULL(de_ctx);
2306  de_ctx->flags |= DE_QUIET;
2307 
2308  Signature *s =
2309  DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2310  "(msg:\"http header test\"; flow:to_server; "
2311  "content:\"Content-Type: text/html\"; http_raw_header; "
2312  "sid:1;)");
2313  FAIL_IF_NULL(s);
2314 
2315  SigGroupBuild(de_ctx);
2316  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2317 
2318  int r = AppLayerParserParse(
2319  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
2320  FAIL_IF_NOT(r == 0);
2321 
2322  HtpState *http_state = f.alstate;
2323  FAIL_IF_NULL(http_state);
2324 
2325  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2326  FAIL_IF(!(PacketAlertCheck(p, 1)));
2327 
2328  UTHFreePackets(&p, 1);
2329  FLOW_DESTROY(&f);
2330  AppLayerParserThreadCtxFree(alp_tctx);
2331  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2332  DetectEngineCtxFree(de_ctx);
2333  StreamTcpFreeConfig(true);
2334  StatsThreadCleanup(&th_v);
2335  PASS;
2336 }
2337 
2338 /**
2339  *\test Test that the http_header content matches against a http request
2340  * which holds the content.
2341  */
2342 static int DetectHttpRawHeaderTest07(void)
2343 {
2344  TcpSession ssn;
2345  Packet *p1 = NULL;
2346  Packet *p2 = NULL;
2347  ThreadVars th_v;
2348  DetectEngineThreadCtx *det_ctx = NULL;
2349  Flow f;
2350  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
2351  "Host: www.openinfosecfoundation.org\r\n"
2352  "User-Agent: Mozi";
2353  uint8_t http2_buf[] = "lla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 "
2354  "Firefox/3.5.7\r\nContent-Type: text/html\r\n"
2355  "Content-Length: 67\r\n"
2356  "\r\n"
2357  "This is dummy message body1";
2358  uint32_t http1_len = sizeof(http1_buf) - 1;
2359  uint32_t http2_len = sizeof(http2_buf) - 1;
2360  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2361 
2362  memset(&th_v, 0, sizeof(th_v));
2363  memset(&f, 0, sizeof(f));
2364  memset(&ssn, 0, sizeof(ssn));
2365 
2366  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2367  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2368 
2369  FLOW_INITIALIZE(&f);
2370  f.protoctx = (void *)&ssn;
2371  f.proto = IPPROTO_TCP;
2372  f.flags |= FLOW_IPV4;
2373  p1->flow = &f;
2374  p1->flowflags |= FLOW_PKT_TOSERVER;
2375  p1->flowflags |= FLOW_PKT_ESTABLISHED;
2376  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2377  p2->flow = &f;
2378  p2->flowflags |= FLOW_PKT_TOSERVER;
2379  p2->flowflags |= FLOW_PKT_ESTABLISHED;
2380  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2381  f.alproto = ALPROTO_HTTP1;
2382 
2383  StreamTcpInitConfig(true);
2384 
2385  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2386  FAIL_IF_NULL(de_ctx);
2387  de_ctx->flags |= DE_QUIET;
2388 
2389  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2390  "(msg:\"http header test\"; flow:to_server; "
2391  "content:\"Mozilla\"; http_raw_header; "
2392  "sid:1;)");
2393  FAIL_IF_NULL(s);
2394 
2395  SigGroupBuild(de_ctx);
2396  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2397 
2398  int r = AppLayerParserParse(
2399  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
2400  FAIL_IF_NOT(r == 0);
2401 
2402  HtpState *http_state = f.alstate;
2403  FAIL_IF_NULL(http_state);
2404 
2405  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2406  FAIL_IF((PacketAlertCheck(p1, 1)));
2407 
2408  r = AppLayerParserParse(
2409  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
2410  FAIL_IF_NOT(r == 0);
2411 
2412  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
2413  FAIL_IF(!(PacketAlertCheck(p2, 1)));
2414 
2415  UTHFreePackets(&p1, 1);
2416  UTHFreePackets(&p2, 1);
2417  FLOW_DESTROY(&f);
2418  AppLayerParserThreadCtxFree(alp_tctx);
2419  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2420  DetectEngineCtxFree(de_ctx);
2421  StreamTcpFreeConfig(true);
2422  StatsThreadCleanup(&th_v);
2423  PASS;
2424 }
2425 
2426 /**
2427  *\test Test that the http_header content matches against a http request
2428  * which holds the content.
2429  */
2430 static int DetectHttpRawHeaderTest08(void)
2431 {
2432  TcpSession ssn;
2433  Packet *p1 = NULL;
2434  Packet *p2 = NULL;
2435  ThreadVars th_v;
2436  DetectEngineThreadCtx *det_ctx = NULL;
2437  Flow f;
2438  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
2439  "Host: www.openinfosecfoundation.org\r\n";
2440  uint8_t http2_buf[] = "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2441  "Gecko/20091221 Firefox/3.5.7\r\n"
2442  "Content-Type: text/html\r\n"
2443  "Content-Length: 67\r\n"
2444  "\r\n";
2445  uint32_t http1_len = sizeof(http1_buf) - 1;
2446  uint32_t http2_len = sizeof(http2_buf) - 1;
2447  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2448 
2449  memset(&th_v, 0, sizeof(th_v));
2450  memset(&f, 0, sizeof(f));
2451  memset(&ssn, 0, sizeof(ssn));
2452 
2453  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2454  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2455 
2456  FLOW_INITIALIZE(&f);
2457  f.protoctx = (void *)&ssn;
2458  f.proto = IPPROTO_TCP;
2459  f.flags |= FLOW_IPV4;
2460  p1->flow = &f;
2461  p1->flowflags |= FLOW_PKT_TOSERVER;
2462  p1->flowflags |= FLOW_PKT_ESTABLISHED;
2463  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2464  p2->flow = &f;
2465  p2->flowflags |= FLOW_PKT_TOSERVER;
2466  p2->flowflags |= FLOW_PKT_ESTABLISHED;
2467  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2468  f.alproto = ALPROTO_HTTP1;
2469 
2470  StreamTcpInitConfig(true);
2471 
2472  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2473  FAIL_IF_NULL(de_ctx);
2474  de_ctx->flags |= DE_QUIET;
2475 
2476  Signature *s = DetectEngineAppendSig(de_ctx,
2477  "alert http any any -> any any "
2478  "(msg:\"http header test\"; flow:to_server; "
2479  "content:\"Gecko/20091221 Firefox/3.5.7\"; http_raw_header; "
2480  "sid:1;)");
2481  FAIL_IF_NULL(s);
2482 
2483  SigGroupBuild(de_ctx);
2484  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2485 
2486  int r = AppLayerParserParse(
2487  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
2488  FAIL_IF_NOT(r == 0);
2489 
2490  HtpState *http_state = f.alstate;
2491  FAIL_IF_NULL(http_state);
2492 
2493  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2494  FAIL_IF((PacketAlertCheck(p1, 1)));
2495 
2496  r = AppLayerParserParse(
2497  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
2498  FAIL_IF_NOT(r == 0);
2499 
2500  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
2501  FAIL_IF(!(PacketAlertCheck(p2, 1)));
2502 
2503  UTHFreePackets(&p1, 1);
2504  UTHFreePackets(&p2, 1);
2505  FLOW_DESTROY(&f);
2506  AppLayerParserThreadCtxFree(alp_tctx);
2507  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2508  DetectEngineCtxFree(de_ctx);
2509  StreamTcpFreeConfig(true);
2510  StatsThreadCleanup(&th_v);
2511  PASS;
2512 }
2513 
2514 /**
2515  *\test Test that the http_header content matches against a http request
2516  * which holds the content, against a cross boundary present pattern.
2517  */
2518 static int DetectHttpRawHeaderTest09(void)
2519 {
2520  TcpSession ssn;
2521  Packet *p1 = NULL;
2522  Packet *p2 = NULL;
2523  ThreadVars th_v;
2524  DetectEngineThreadCtx *det_ctx = NULL;
2525  Flow f;
2526  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
2527  "Host: www.openinfosecfoundation.org\r\n"
2528  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2529  "Gecko/20091221 Firefox/3.5.7\r\n";
2530  uint8_t http2_buf[] = "Content-Type: text/html\r\n"
2531  "Content-Length: 67\r\n"
2532  "\r\n"
2533  "This is dummy body\r\n";
2534  uint32_t http1_len = sizeof(http1_buf) - 1;
2535  uint32_t http2_len = sizeof(http2_buf) - 1;
2536  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2537 
2538  memset(&th_v, 0, sizeof(th_v));
2539  memset(&f, 0, sizeof(f));
2540  memset(&ssn, 0, sizeof(ssn));
2541 
2542  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2543  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2544 
2545  FLOW_INITIALIZE(&f);
2546  f.protoctx = (void *)&ssn;
2547  f.proto = IPPROTO_TCP;
2548  f.flags |= FLOW_IPV4;
2549  p1->flow = &f;
2550  p1->flowflags |= FLOW_PKT_TOSERVER;
2551  p1->flowflags |= FLOW_PKT_ESTABLISHED;
2552  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2553  p2->flow = &f;
2554  p2->flowflags |= FLOW_PKT_TOSERVER;
2555  p2->flowflags |= FLOW_PKT_ESTABLISHED;
2556  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2557  f.alproto = ALPROTO_HTTP1;
2558 
2559  StreamTcpInitConfig(true);
2560 
2561  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2562  FAIL_IF_NULL(de_ctx);
2563  de_ctx->flags |= DE_QUIET;
2564 
2565  Signature *s = DetectEngineAppendSig(de_ctx,
2566  "alert http any any -> any any "
2567  "(msg:\"http header test\"; flow:to_server; "
2568  "content:\"Firefox/3.5.7|0D 0A|Content\"; http_raw_header; "
2569  "sid:1;)");
2570  FAIL_IF_NULL(s);
2571 
2572  SigGroupBuild(de_ctx);
2573  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2574 
2575  int r = AppLayerParserParse(
2576  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
2577  FAIL_IF_NOT(r == 0);
2578 
2579  HtpState *http_state = f.alstate;
2580  FAIL_IF_NULL(http_state);
2581 
2582  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2583  FAIL_IF((PacketAlertCheck(p1, 1)));
2584 
2585  r = AppLayerParserParse(
2586  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
2587  FAIL_IF_NOT(r == 0);
2588 
2589  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
2590  FAIL_IF(!(PacketAlertCheck(p2, 1)));
2591 
2592  UTHFreePackets(&p1, 1);
2593  UTHFreePackets(&p2, 1);
2594  FLOW_DESTROY(&f);
2595  AppLayerParserThreadCtxFree(alp_tctx);
2596  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2597  DetectEngineCtxFree(de_ctx);
2598  StreamTcpFreeConfig(true);
2599  StatsThreadCleanup(&th_v);
2600  PASS;
2601 }
2602 
2603 /**
2604  *\test Test that the http_header content matches against a http request
2605  * against a case insensitive pattern.
2606  */
2607 static int DetectHttpRawHeaderTest10(void)
2608 {
2609  TcpSession ssn;
2610  Packet *p1 = NULL;
2611  Packet *p2 = NULL;
2612  ThreadVars th_v;
2613  DetectEngineThreadCtx *det_ctx = NULL;
2614  Flow f;
2615  uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n"
2616  "Host: www.openinfosecfoundation.org\r\n"
2617  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2618  "Gecko/20091221 Firefox/3.5.7\r\n";
2619  uint8_t http2_buf[] = "Content-Type: text/html\r\n"
2620  "Content-Length: 67\r\n"
2621  "\r\n"
2622  "This is dummy body";
2623  uint32_t http1_len = sizeof(http1_buf) - 1;
2624  uint32_t http2_len = sizeof(http2_buf) - 1;
2625  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2626 
2627  memset(&th_v, 0, sizeof(th_v));
2628  memset(&f, 0, sizeof(f));
2629  memset(&ssn, 0, sizeof(ssn));
2630 
2631  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2632  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2633 
2634  FLOW_INITIALIZE(&f);
2635  f.protoctx = (void *)&ssn;
2636  f.proto = IPPROTO_TCP;
2637  f.flags |= FLOW_IPV4;
2638  p1->flow = &f;
2639  p1->flowflags |= FLOW_PKT_TOSERVER;
2640  p1->flowflags |= FLOW_PKT_ESTABLISHED;
2641  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2642  p2->flow = &f;
2643  p2->flowflags |= FLOW_PKT_TOSERVER;
2644  p2->flowflags |= FLOW_PKT_ESTABLISHED;
2645  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2646  f.alproto = ALPROTO_HTTP1;
2647 
2648  StreamTcpInitConfig(true);
2649 
2650  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2651  FAIL_IF_NULL(de_ctx);
2652  de_ctx->flags |= DE_QUIET;
2653 
2654  Signature *s = DetectEngineAppendSig(de_ctx,
2655  "alert http any any -> any any "
2656  "(msg:\"http header test\"; flow:to_server; "
2657  "content:\"firefox/3.5.7|0D 0A|content\"; nocase; http_raw_header;"
2658  "sid:1;)");
2659  FAIL_IF_NULL(s);
2660 
2661  SigGroupBuild(de_ctx);
2662  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2663 
2664  int r = AppLayerParserParse(
2665  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
2666  FAIL_IF_NOT(r == 0);
2667 
2668  HtpState *http_state = f.alstate;
2669  FAIL_IF_NULL(http_state);
2670 
2671  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
2672  FAIL_IF((PacketAlertCheck(p1, 1)));
2673 
2674  r = AppLayerParserParse(
2675  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
2676  FAIL_IF_NOT(r == 0);
2677 
2678  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
2679  FAIL_IF(!(PacketAlertCheck(p2, 1)));
2680 
2681  UTHFreePackets(&p1, 1);
2682  UTHFreePackets(&p2, 1);
2683  FLOW_DESTROY(&f);
2684  AppLayerParserThreadCtxFree(alp_tctx);
2685  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2686  DetectEngineCtxFree(de_ctx);
2687  StreamTcpFreeConfig(true);
2688  StatsThreadCleanup(&th_v);
2689  PASS;
2690 }
2691 
2692 /**
2693  *\test Test that the negated http_header content matches against a
2694  * http request which doesn't hold the content.
2695  */
2696 static int DetectHttpRawHeaderTest11(void)
2697 {
2698  TcpSession ssn;
2699  ThreadVars th_v;
2700  DetectEngineThreadCtx *det_ctx = NULL;
2701  Flow f;
2702  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
2703  "Host: www.openinfosecfoundation.org\r\n"
2704  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2705  "Gecko/20091221 Firefox/3.5.7\r\n"
2706  "Content-Type: text/html\r\n"
2707  "Content-Length: 26\r\n"
2708  "\r\n"
2709  "This is dummy message body\r\n";
2710  uint32_t http_len = sizeof(http_buf) - 1;
2711  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2712 
2713  memset(&th_v, 0, sizeof(th_v));
2714  memset(&f, 0, sizeof(f));
2715  memset(&ssn, 0, sizeof(ssn));
2716 
2717  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2718 
2719  FLOW_INITIALIZE(&f);
2720  f.protoctx = (void *)&ssn;
2721  f.proto = IPPROTO_TCP;
2722  f.flags |= FLOW_IPV4;
2723  p->flow = &f;
2724  p->flowflags |= FLOW_PKT_TOSERVER;
2725  p->flowflags |= FLOW_PKT_ESTABLISHED;
2726  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2727  f.alproto = ALPROTO_HTTP1;
2728 
2729  StreamTcpInitConfig(true);
2730 
2731  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2732  FAIL_IF_NULL(de_ctx);
2733  de_ctx->flags |= DE_QUIET;
2734 
2735  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2736  "(msg:\"http header test\"; flow:to_server; "
2737  "content:!\"lalalalala\"; http_raw_header; "
2738  "sid:1;)");
2739  FAIL_IF_NULL(s);
2740 
2741  SigGroupBuild(de_ctx);
2742  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2743 
2744  int r = AppLayerParserParse(
2745  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
2746  FAIL_IF_NOT(r == 0);
2747 
2748  HtpState *http_state = f.alstate;
2749  FAIL_IF_NULL(http_state);
2750 
2751  /* do detect */
2752  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2753  FAIL_IF(!(PacketAlertCheck(p, 1)));
2754 
2755  UTHFreePackets(&p, 1);
2756  FLOW_DESTROY(&f);
2757  AppLayerParserThreadCtxFree(alp_tctx);
2758  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2759  DetectEngineCtxFree(de_ctx);
2760  StreamTcpFreeConfig(true);
2761  StatsThreadCleanup(&th_v);
2762  PASS;
2763 }
2764 
2765 /**
2766  *\test Negative test that the negated http_header content matches against a
2767  * http request which holds hold the content.
2768  */
2769 static int DetectHttpRawHeaderTest12(void)
2770 {
2771  TcpSession ssn;
2772  ThreadVars th_v;
2773  DetectEngineThreadCtx *det_ctx = NULL;
2774  Flow f;
2775  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
2776  "Host: www.openinfosecfoundation.org\r\n"
2777  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2778  "Gecko/20091221 Firefox/3.5.7\r\n"
2779  "Content-Type: text/html\r\n"
2780  "Content-Length: 26\r\n"
2781  "\r\n"
2782  "This is dummy message body\r\n";
2783  uint32_t http_len = sizeof(http_buf) - 1;
2784  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2785 
2786  memset(&th_v, 0, sizeof(th_v));
2787  memset(&f, 0, sizeof(f));
2788  memset(&ssn, 0, sizeof(ssn));
2789 
2790  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2791 
2792  FLOW_INITIALIZE(&f);
2793  f.protoctx = (void *)&ssn;
2794  f.proto = IPPROTO_TCP;
2795  f.flags |= FLOW_IPV4;
2796  p->flow = &f;
2797  p->flowflags |= FLOW_PKT_TOSERVER;
2798  p->flowflags |= FLOW_PKT_ESTABLISHED;
2799  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2800  f.alproto = ALPROTO_HTTP1;
2801 
2802  StreamTcpInitConfig(true);
2803 
2804  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2805  FAIL_IF_NULL(de_ctx);
2806  de_ctx->flags |= DE_QUIET;
2807 
2808  Signature *s =
2809  DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
2810  "(msg:\"http header test\"; flow:to_server; "
2811  "content:!\"User-Agent: Mozilla/5.0 \"; http_raw_header; "
2812  "sid:1;)");
2813  FAIL_IF_NULL(s);
2814 
2815  SigGroupBuild(de_ctx);
2816  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2817 
2818  int r = AppLayerParserParse(
2819  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
2820  FAIL_IF_NOT(r == 0);
2821 
2822  HtpState *http_state = f.alstate;
2823  FAIL_IF_NULL(http_state);
2824 
2825  /* do detect */
2826  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2827  FAIL_IF((PacketAlertCheck(p, 1)));
2828 
2829  UTHFreePackets(&p, 1);
2830  FLOW_DESTROY(&f);
2831 
2832  AppLayerParserThreadCtxFree(alp_tctx);
2833  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2834  DetectEngineCtxFree(de_ctx);
2835  StreamTcpFreeConfig(true);
2836  StatsThreadCleanup(&th_v);
2837  PASS;
2838 }
2839 
2840 /**
2841  *\test Test that the http_header content matches against a http request
2842  * which holds the content.
2843  */
2844 static int DetectHttpRawHeaderTest13(void)
2845 {
2846  TcpSession ssn;
2847  ThreadVars th_v;
2848  DetectEngineThreadCtx *det_ctx = NULL;
2849  Flow f;
2850  uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n"
2851  "Host: www.openinfosecfoundation.org\r\n"
2852  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
2853  "Gecko/20091221 Firefox/3.5.7\r\n"
2854  "Content-Type: text/html\r\n"
2855  "Content-Length: 100\r\n"
2856  "\r\n"
2857  "longbufferabcdefghijklmnopqrstuvwxyz0123456789bufferend\r\n";
2858  uint32_t http_len = sizeof(http_buf) - 1;
2859  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2860 
2861  memset(&th_v, 0, sizeof(th_v));
2862  memset(&f, 0, sizeof(f));
2863  memset(&ssn, 0, sizeof(ssn));
2864 
2865  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2866 
2867  FLOW_INITIALIZE(&f);
2868  f.protoctx = (void *)&ssn;
2869  f.proto = IPPROTO_TCP;
2870  f.flags |= FLOW_IPV4;
2871 
2872  p->flow = &f;
2873  p->flowflags |= FLOW_PKT_TOSERVER;
2874  p->flowflags |= FLOW_PKT_ESTABLISHED;
2875  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
2876  f.alproto = ALPROTO_HTTP1;
2877 
2878  StreamTcpInitConfig(true);
2879 
2880  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2881  FAIL_IF_NULL(de_ctx);
2882  de_ctx->flags |= DE_QUIET;
2883 
2884  Signature *s = DetectEngineAppendSig(de_ctx,
2885  "alert http any any -> any any "
2886  "(msg:\"http header test\"; flow:to_server; "
2887  "content:\"Host: www.openinfosecfoundation.org\"; http_raw_header; "
2888  "sid:1;)");
2889  FAIL_IF_NULL(s);
2890 
2891  SigGroupBuild(de_ctx);
2892  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2893 
2894  int r = AppLayerParserParse(
2895  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_len);
2896  FAIL_IF_NOT(r == 0);
2897 
2898  HtpState *http_state = f.alstate;
2899  FAIL_IF_NULL(http_state);
2900 
2901  /* do detect */
2902  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2903  FAIL_IF(!(PacketAlertCheck(p, 1)));
2904 
2905  AppLayerParserThreadCtxFree(alp_tctx);
2906  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2907  DetectEngineCtxFree(de_ctx);
2908 
2909  StreamTcpFreeConfig(true);
2910  FLOW_DESTROY(&f);
2911  UTHFreePackets(&p, 1);
2912  StatsThreadCleanup(&th_v);
2913  PASS;
2914 }
2915 
2916 void DetectHttpRawHeaderRegisterTests(void)
2917 {
2918  UtRegisterTest("DetectHttpRawHeaderParserTest01", DetectHttpRawHeaderParserTest01);
2919  UtRegisterTest("DetectHttpRawHeaderParserTest02", DetectHttpRawHeaderParserTest02);
2920 
2921  UtRegisterTest("DetectEngineHttpRawHeaderTest01", DetectEngineHttpRawHeaderTest01);
2922  UtRegisterTest("DetectEngineHttpRawHeaderTest02", DetectEngineHttpRawHeaderTest02);
2923  UtRegisterTest("DetectEngineHttpRawHeaderTest03", DetectEngineHttpRawHeaderTest03);
2924  UtRegisterTest("DetectEngineHttpRawHeaderTest04", DetectEngineHttpRawHeaderTest04);
2925  UtRegisterTest("DetectEngineHttpRawHeaderTest05", DetectEngineHttpRawHeaderTest05);
2926  UtRegisterTest("DetectEngineHttpRawHeaderTest06", DetectEngineHttpRawHeaderTest06);
2927  UtRegisterTest("DetectEngineHttpRawHeaderTest07", DetectEngineHttpRawHeaderTest07);
2928  UtRegisterTest("DetectEngineHttpRawHeaderTest08", DetectEngineHttpRawHeaderTest08);
2929  UtRegisterTest("DetectEngineHttpRawHeaderTest09", DetectEngineHttpRawHeaderTest09);
2930  UtRegisterTest("DetectEngineHttpRawHeaderTest10", DetectEngineHttpRawHeaderTest10);
2931  UtRegisterTest("DetectEngineHttpRawHeaderTest11", DetectEngineHttpRawHeaderTest11);
2932  UtRegisterTest("DetectEngineHttpRawHeaderTest12", DetectEngineHttpRawHeaderTest12);
2933  UtRegisterTest("DetectEngineHttpRawHeaderTest13", DetectEngineHttpRawHeaderTest13);
2934  UtRegisterTest("DetectEngineHttpRawHeaderTest14", DetectEngineHttpRawHeaderTest14);
2935  UtRegisterTest("DetectEngineHttpRawHeaderTest15", DetectEngineHttpRawHeaderTest15);
2936  UtRegisterTest("DetectEngineHttpRawHeaderTest16", DetectEngineHttpRawHeaderTest16);
2937  UtRegisterTest("DetectEngineHttpRawHeaderTest17", DetectEngineHttpRawHeaderTest17);
2938  UtRegisterTest("DetectEngineHttpRawHeaderTest20", DetectEngineHttpRawHeaderTest20);
2939  UtRegisterTest("DetectEngineHttpRawHeaderTest21", DetectEngineHttpRawHeaderTest21);
2940  UtRegisterTest("DetectEngineHttpRawHeaderTest22", DetectEngineHttpRawHeaderTest22);
2941  UtRegisterTest("DetectEngineHttpRawHeaderTest23", DetectEngineHttpRawHeaderTest23);
2942  UtRegisterTest("DetectEngineHttpRawHeaderTest24", DetectEngineHttpRawHeaderTest24);
2943  UtRegisterTest("DetectEngineHttpRawHeaderTest25", DetectEngineHttpRawHeaderTest25);
2944  UtRegisterTest("DetectEngineHttpRawHeaderTest26", DetectEngineHttpRawHeaderTest26);
2945  UtRegisterTest("DetectEngineHttpRawHeaderTest27", DetectEngineHttpRawHeaderTest27);
2946  UtRegisterTest("DetectEngineHttpRawHeaderTest28", DetectEngineHttpRawHeaderTest28);
2947  UtRegisterTest("DetectEngineHttpRawHeaderTest29", DetectEngineHttpRawHeaderTest29);
2948 #if 0
2949  UtRegisterTest("DetectEngineHttpRawHeaderTest30",
2950  DetectEngineHttpRawHeaderTest30, 1);
2951 #endif
2952  UtRegisterTest("DetectEngineHttpRawHeaderTest31", DetectEngineHttpRawHeaderTest31);
2953  UtRegisterTest("DetectEngineHttpRawHeaderTest32", DetectEngineHttpRawHeaderTest32);
2954 
2955  UtRegisterTest("DetectHttpRawHeaderTest06", DetectHttpRawHeaderTest06);
2956  UtRegisterTest("DetectHttpRawHeaderTest07", DetectHttpRawHeaderTest07);
2957  UtRegisterTest("DetectHttpRawHeaderTest08", DetectHttpRawHeaderTest08);
2958  UtRegisterTest("DetectHttpRawHeaderTest09", DetectHttpRawHeaderTest09);
2959  UtRegisterTest("DetectHttpRawHeaderTest10", DetectHttpRawHeaderTest10);
2960  UtRegisterTest("DetectHttpRawHeaderTest11", DetectHttpRawHeaderTest11);
2961  UtRegisterTest("DetectHttpRawHeaderTest12", DetectHttpRawHeaderTest12);
2962  UtRegisterTest("DetectHttpRawHeaderTest13", DetectHttpRawHeaderTest13);
2963 }
2964 
2965 #endif /* UNITTESTS */
2966 
2967 /**
2968  * @}
2969  */
UTHParseSignature
int UTHParseSignature(const char *str, bool expect)
parser a sig and see if the expected result is correct
Definition: util-unittest-helper.c:913
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1268
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
Flow_::proto
uint8_t proto
Definition: flow.h:370
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:142
Packet_::flags
uint32_t flags
Definition: decode.h:544
DetectHttpRawHeaderRegisterTests
void DetectHttpRawHeaderRegisterTests(void)
Definition: detect-http-raw-header.c:2916
Flow_
Flow data structure.
Definition: flow.h:348
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:932
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2634
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:324
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:225
DE_QUIET
#define DE_QUIET
Definition: detect.h:330
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:365
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:2416
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3439
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:532
Flow_::protoctx
void * protoctx
Definition: flow.h:433
FLOW_IPV4
#define FLOW_IPV4
Definition: flow.h:100
HtpState_
Definition: app-layer-htp.h:181
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
StreamTcpInitConfig
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
Definition: stream-tcp.c:488
FLOW_INITIALIZE
#define FLOW_INITIALIZE(f)
Definition: flow-util.h:38
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
DetectEngineThreadCtx_
Definition: detect.h:1244
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:23
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3364
Packet_
Definition: decode.h:501
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:226
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:2194
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:297
Packet_::flow
struct Flow_ * flow
Definition: decode.h:546
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
StreamTcpFreeConfig
void StreamTcpFreeConfig(bool quiet)
Definition: stream-tcp.c:859
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1291
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:36
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3596
Flow_::alstate
void * alstate
Definition: flow.h:471
Flow_::flags
uint32_t flags
Definition: flow.h:413
Signature_
Signature container.
Definition: detect.h:668
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:227
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2595
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:934
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:60
TcpSession_
Definition: stream-tcp-private.h:283
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:442
StatsThreadCleanup
void StatsThreadCleanup(ThreadVars *tv)
Definition: counters.c:1324
FLOW_DESTROY
#define FLOW_DESTROY(f)
Definition: flow-util.h:119
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:1264
UTHFreePackets
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:456