suricata
detect-http-stat-code.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup httplayer
20  *
21  * @{
22  */
23 
24 /**
25  * \file
26  *
27  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
28  * \author Victor Julien <victor@inliniac.net>
29  */
30 
31 #include "../suricata-common.h"
32 #include "../suricata.h"
33 #include "../flow-util.h"
34 #include "../flow.h"
35 #include "../app-layer-parser.h"
36 #include "../util-unittest.h"
37 #include "../util-unittest-helper.h"
38 #include "../app-layer.h"
39 #include "../app-layer-htp.h"
40 #include "../app-layer-protos.h"
41 #include "../detect-engine-build.h"
42 #include "../detect-engine-alert.h"
43 
44 static int DetectEngineHttpStatCodeTest01(void)
45 {
46  TcpSession ssn;
47  ThreadVars th_v;
48  DetectEngineThreadCtx *det_ctx = NULL;
49  Flow f;
50  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
51  "Host: www.openinfosecfoundation.org\r\n"
52  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
53  "Gecko/20091221 Firefox/3.5.7\r\n"
54  "\r\n";
55  uint32_t http_len1 = sizeof(http_buf1) - 1;
56  uint8_t http_buf2[] = "HTTP/1.0 200 message\r\n"
57  "Content-Type: text/html\r\n"
58  "Content-Length: 7\r\n"
59  "\r\n"
60  "message";
61  uint32_t http_len2 = sizeof(http_buf2) - 1;
62  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
63 
64  memset(&th_v, 0, sizeof(th_v));
65  memset(&f, 0, sizeof(f));
66  memset(&ssn, 0, sizeof(ssn));
67 
68  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
69  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
70 
71  FLOW_INITIALIZE(&f);
72  f.protoctx = (void *)&ssn;
73  f.proto = IPPROTO_TCP;
74  f.flags |= FLOW_IPV4;
75 
76  p1->flow = &f;
77  p1->flowflags |= FLOW_PKT_TOSERVER;
78  p1->flowflags |= FLOW_PKT_ESTABLISHED;
79  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
80  p2->flow = &f;
81  p2->flowflags |= FLOW_PKT_TOCLIENT;
82  p2->flowflags |= FLOW_PKT_ESTABLISHED;
83  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
84  f.alproto = ALPROTO_HTTP1;
85 
86  StreamTcpInitConfig(true);
87 
88  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
89  FAIL_IF_NULL(de_ctx);
90  de_ctx->flags |= DE_QUIET;
91 
92  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
93  "(msg:\"http stat code test\"; "
94  "content:\"200\"; http_stat_code; "
95  "sid:1;)");
96  FAIL_IF_NULL(s);
97 
98  SigGroupBuild(de_ctx);
99  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
100 
101  int r = AppLayerParserParse(
102  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
103  FAIL_IF_NOT(r == 0);
104 
105  HtpState *http_state = f.alstate;
106  FAIL_IF_NULL(http_state);
107 
108  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
109  FAIL_IF((PacketAlertCheck(p1, 1)));
110 
111  r = AppLayerParserParse(
112  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
113  FAIL_IF_NOT(r == 0);
114 
115  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
116  FAIL_IF(!(PacketAlertCheck(p2, 1)));
117 
118  UTHFreePackets(&p1, 1);
119  UTHFreePackets(&p2, 1);
120  FLOW_DESTROY(&f);
121  AppLayerParserThreadCtxFree(alp_tctx);
122  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
123  DetectEngineCtxFree(de_ctx);
124  StreamTcpFreeConfig(true);
125  StatsThreadCleanup(&th_v);
126  PASS;
127 }
128 
129 static int DetectEngineHttpStatCodeTest02(void)
130 {
131  TcpSession ssn;
132  ThreadVars th_v;
133  DetectEngineThreadCtx *det_ctx = NULL;
134  Flow f;
135  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
136  "Host: www.openinfosecfoundation.org\r\n"
137  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
138  "Gecko/20091221 Firefox/3.5.7\r\n"
139  "\r\n";
140  uint32_t http_len1 = sizeof(http_buf1) - 1;
141  uint8_t http_buf2[] = "HTTP/1.0 2000123 xxxxABC\r\n"
142  "Content-Type: text/html\r\n"
143  "Content-Length: 7\r\n"
144  "\r\n"
145  "xxxxABC";
146  uint32_t http_len2 = sizeof(http_buf2) - 1;
147  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
148 
149  memset(&th_v, 0, sizeof(th_v));
150  memset(&f, 0, sizeof(f));
151  memset(&ssn, 0, sizeof(ssn));
152 
153  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
154 
155  FLOW_INITIALIZE(&f);
156  f.protoctx = (void *)&ssn;
157  f.proto = IPPROTO_TCP;
158  f.flags |= FLOW_IPV4;
159 
160  p1->flow = &f;
161  p1->flowflags |= FLOW_PKT_TOCLIENT;
162  p1->flowflags |= FLOW_PKT_ESTABLISHED;
163  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
164  f.alproto = ALPROTO_HTTP1;
165 
166  StreamTcpInitConfig(true);
167 
168  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
169  FAIL_IF_NULL(de_ctx);
170  de_ctx->flags |= DE_QUIET;
171 
172  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
173  "(msg:\"http stat code test\"; "
174  "content:\"123\"; http_stat_code; offset:4; "
175  "sid:1;)");
176  FAIL_IF_NULL(s);
177 
178  SigGroupBuild(de_ctx);
179  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
180 
181  int r = AppLayerParserParse(
182  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
183  FAIL_IF_NOT(r == 0);
184 
185  r = AppLayerParserParse(
186  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
187  FAIL_IF_NOT(r == 0);
188 
189  HtpState *http_state = f.alstate;
190  FAIL_IF_NULL(http_state);
191 
192  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
193  FAIL_IF(!(PacketAlertCheck(p1, 1)));
194 
195  UTHFreePackets(&p1, 1);
196  FLOW_DESTROY(&f);
197  AppLayerParserThreadCtxFree(alp_tctx);
198  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
199  DetectEngineCtxFree(de_ctx);
200  StreamTcpFreeConfig(true);
201  StatsThreadCleanup(&th_v);
202  PASS;
203 }
204 
205 static int DetectEngineHttpStatCodeTest03(void)
206 {
207  TcpSession ssn;
208  ThreadVars th_v;
209  DetectEngineThreadCtx *det_ctx = NULL;
210  Flow f;
211  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
212  "Host: www.openinfosecfoundation.org\r\n"
213  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
214  "Gecko/20091221 Firefox/3.5.7\r\n"
215  "\r\n";
216  uint32_t http_len1 = sizeof(http_buf1) - 1;
217  uint8_t http_buf2[] = "HTTP/1.0 123";
218  uint32_t http_len2 = sizeof(http_buf2) - 1;
219  uint8_t http_buf3[] = "456789\r\n"
220  "Content-Type: text/html\r\n"
221  "Content-Length: 17\r\n"
222  "\r\n"
223  "12345678901234ABC";
224  uint32_t http_len3 = sizeof(http_buf3) - 1;
225  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
226 
227  memset(&th_v, 0, sizeof(th_v));
228  memset(&f, 0, sizeof(f));
229  memset(&ssn, 0, sizeof(ssn));
230 
231  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
232  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
233 
234  FLOW_INITIALIZE(&f);
235  f.protoctx = (void *)&ssn;
236  f.proto = IPPROTO_TCP;
237  f.flags |= FLOW_IPV4;
238 
239  p1->flow = &f;
240  p1->flowflags |= FLOW_PKT_TOSERVER;
241  p1->flowflags |= FLOW_PKT_ESTABLISHED;
242  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
243  p2->flow = &f;
244  p2->flowflags |= FLOW_PKT_TOCLIENT;
245  p2->flowflags |= FLOW_PKT_ESTABLISHED;
246  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
247  f.alproto = ALPROTO_HTTP1;
248 
249  StreamTcpInitConfig(true);
250 
251  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
252  FAIL_IF_NULL(de_ctx);
253  de_ctx->flags |= DE_QUIET;
254 
255  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
256  "(msg:\"http stat code test\"; "
257  "content:\"789\"; http_stat_code; offset:5; "
258  "sid:1;)");
259  FAIL_IF_NULL(s);
260 
261  SigGroupBuild(de_ctx);
262  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
263 
264  int r = AppLayerParserParse(
265  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
266  FAIL_IF_NOT(r == 0);
267 
268  HtpState *http_state = f.alstate;
269  FAIL_IF_NULL(http_state);
270 
271  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
272  FAIL_IF(PacketAlertCheck(p1, 1));
273 
274  r = AppLayerParserParse(
275  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
276  FAIL_IF_NOT(r == 0);
277 
278  r = AppLayerParserParse(
279  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf3, http_len3);
280  FAIL_IF_NOT(r == 0);
281 
282  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
283  FAIL_IF(!(PacketAlertCheck(p2, 1)));
284 
285  UTHFreePackets(&p1, 1);
286  UTHFreePackets(&p2, 1);
287  FLOW_DESTROY(&f);
288  AppLayerParserThreadCtxFree(alp_tctx);
289  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
290  DetectEngineCtxFree(de_ctx);
291  StreamTcpFreeConfig(true);
292  StatsThreadCleanup(&th_v);
293  PASS;
294 }
295 
296 static int DetectEngineHttpStatCodeTest04(void)
297 {
298  TcpSession ssn;
299  ThreadVars th_v;
300  DetectEngineThreadCtx *det_ctx = NULL;
301  Flow f;
302  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
303  "Host: www.openinfosecfoundation.org\r\n"
304  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
305  "Gecko/20091221 Firefox/3.5.7\r\n"
306  "\r\n";
307  uint32_t http_len1 = sizeof(http_buf1) - 1;
308  uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n"
309  "Content-Type: text/html\r\n"
310  "Content-Length: 6\r\n"
311  "\r\n"
312  "abcdef";
313  uint32_t http_len2 = sizeof(http_buf2) - 1;
314  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
315 
316  memset(&th_v, 0, sizeof(th_v));
317  memset(&f, 0, sizeof(f));
318  memset(&ssn, 0, sizeof(ssn));
319 
320  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
321  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
322 
323  FLOW_INITIALIZE(&f);
324  f.protoctx = (void *)&ssn;
325  f.proto = IPPROTO_TCP;
326  f.flags |= FLOW_IPV4;
327 
328  p1->flow = &f;
329  p1->flowflags |= FLOW_PKT_TOSERVER;
330  p1->flowflags |= FLOW_PKT_ESTABLISHED;
331  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
332  p2->flow = &f;
333  p2->flowflags |= FLOW_PKT_TOCLIENT;
334  p2->flowflags |= FLOW_PKT_ESTABLISHED;
335  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
336  f.alproto = ALPROTO_HTTP1;
337 
338  StreamTcpInitConfig(true);
339 
340  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
341  FAIL_IF_NULL(de_ctx);
342  de_ctx->flags |= DE_QUIET;
343 
344  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
345  "(msg:\"http stat code test\"; "
346  "content:!\"200\"; http_stat_code; offset:3; "
347  "sid:1;)");
348  FAIL_IF_NULL(s);
349 
350  SigGroupBuild(de_ctx);
351  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
352 
353  int r = AppLayerParserParse(
354  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
355  FAIL_IF_NOT(r == 0);
356 
357  HtpState *http_state = f.alstate;
358  FAIL_IF_NULL(http_state);
359 
360  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
361  FAIL_IF(PacketAlertCheck(p1, 1));
362 
363  r = AppLayerParserParse(
364  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
365  FAIL_IF_NOT(r == 0);
366 
367  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
368  FAIL_IF(!PacketAlertCheck(p2, 1));
369 
370  UTHFreePackets(&p1, 1);
371  UTHFreePackets(&p2, 1);
372  FLOW_DESTROY(&f);
373  AppLayerParserThreadCtxFree(alp_tctx);
374  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
375  DetectEngineCtxFree(de_ctx);
376  StreamTcpFreeConfig(true);
377  StatsThreadCleanup(&th_v);
378  PASS;
379 }
380 
381 static int DetectEngineHttpStatCodeTest05(void)
382 {
383  TcpSession ssn;
384  ThreadVars th_v;
385  DetectEngineThreadCtx *det_ctx = NULL;
386  Flow f;
387  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
388  "Host: www.openinfosecfoundation.org\r\n"
389  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
390  "Gecko/20091221 Firefox/3.5.7\r\n"
391  "\r\n";
392  uint32_t http_len1 = sizeof(http_buf1) - 1;
393  uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n"
394  "Content-Type: text/html\r\n"
395  "Content-Length: 6\r\n"
396  "\r\n"
397  "abcdef";
398  uint32_t http_len2 = sizeof(http_buf2) - 1;
399  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
400 
401  memset(&th_v, 0, sizeof(th_v));
402  memset(&f, 0, sizeof(f));
403  memset(&ssn, 0, sizeof(ssn));
404 
405  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
406  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
407 
408  FLOW_INITIALIZE(&f);
409  f.protoctx = (void *)&ssn;
410  f.proto = IPPROTO_TCP;
411  f.flags |= FLOW_IPV4;
412 
413  p1->flow = &f;
414  p1->flowflags |= FLOW_PKT_TOSERVER;
415  p1->flowflags |= FLOW_PKT_ESTABLISHED;
416  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
417  p2->flow = &f;
418  p2->flowflags |= FLOW_PKT_TOCLIENT;
419  p2->flowflags |= FLOW_PKT_ESTABLISHED;
420  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
421  f.alproto = ALPROTO_HTTP1;
422 
423  StreamTcpInitConfig(true);
424 
425  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
426  FAIL_IF_NULL(de_ctx);
427  de_ctx->flags |= DE_QUIET;
428 
429  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
430  "(msg:\"http stat code test\"; "
431  "content:\"200\"; http_stat_code; depth:3; "
432  "sid:1;)");
433  FAIL_IF_NULL(s);
434 
435  SigGroupBuild(de_ctx);
436  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
437 
438  int r = AppLayerParserParse(
439  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
440  FAIL_IF_NOT(r == 0);
441 
442  HtpState *http_state = f.alstate;
443  FAIL_IF_NULL(http_state);
444 
445  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
446  FAIL_IF(PacketAlertCheck(p1, 1));
447 
448  r = AppLayerParserParse(
449  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
450  FAIL_IF_NOT(r == 0);
451 
452  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
453  FAIL_IF(!PacketAlertCheck(p2, 1));
454 
455  UTHFreePackets(&p1, 1);
456  UTHFreePackets(&p2, 1);
457  FLOW_DESTROY(&f);
458  AppLayerParserThreadCtxFree(alp_tctx);
459  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
460  DetectEngineCtxFree(de_ctx);
461  StreamTcpFreeConfig(true);
462  StatsThreadCleanup(&th_v);
463  PASS;
464 }
465 
466 static int DetectEngineHttpStatCodeTest06(void)
467 {
468  TcpSession ssn;
469  ThreadVars th_v;
470  DetectEngineThreadCtx *det_ctx = NULL;
471  Flow f;
472  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
473  "Host: www.openinfosecfoundation.org\r\n"
474  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
475  "Gecko/20091221 Firefox/3.5.7\r\n"
476  "\r\n";
477  uint32_t http_len1 = sizeof(http_buf1) - 1;
478  uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n"
479  "Content-Type: text/html\r\n"
480  "Content-Length: 6\r\n"
481  "\r\n"
482  "abcdef";
483  uint32_t http_len2 = sizeof(http_buf2) - 1;
484  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
485 
486  memset(&th_v, 0, sizeof(th_v));
487  memset(&f, 0, sizeof(f));
488  memset(&ssn, 0, sizeof(ssn));
489 
490  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
491  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
492 
493  FLOW_INITIALIZE(&f);
494  f.protoctx = (void *)&ssn;
495  f.proto = IPPROTO_TCP;
496  f.flags |= FLOW_IPV4;
497 
498  p1->flow = &f;
499  p1->flowflags |= FLOW_PKT_TOSERVER;
500  p1->flowflags |= FLOW_PKT_ESTABLISHED;
501  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
502  p2->flow = &f;
503  p2->flowflags |= FLOW_PKT_TOCLIENT;
504  p2->flowflags |= FLOW_PKT_ESTABLISHED;
505  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
506  f.alproto = ALPROTO_HTTP1;
507 
508  StreamTcpInitConfig(true);
509 
510  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
511  FAIL_IF_NULL(de_ctx);
512  de_ctx->flags |= DE_QUIET;
513 
514  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
515  "(msg:\"http stat code test\"; "
516  "content:!\"123\"; http_stat_code; depth:3; "
517  "sid:1;)");
518  FAIL_IF_NULL(s);
519 
520  SigGroupBuild(de_ctx);
521  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
522 
523  int r = AppLayerParserParse(
524  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
525  FAIL_IF_NOT(r == 0);
526 
527  HtpState *http_state = f.alstate;
528  FAIL_IF_NULL(http_state);
529 
530  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
531  FAIL_IF(PacketAlertCheck(p1, 1));
532 
533  r = AppLayerParserParse(
534  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
535  FAIL_IF_NOT(r == 0);
536 
537  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
538  FAIL_IF(!PacketAlertCheck(p2, 1));
539 
540  UTHFreePackets(&p1, 1);
541  UTHFreePackets(&p2, 1);
542  FLOW_DESTROY(&f);
543  AppLayerParserThreadCtxFree(alp_tctx);
544  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
545  DetectEngineCtxFree(de_ctx);
546  StreamTcpFreeConfig(true);
547  StatsThreadCleanup(&th_v);
548  PASS;
549 }
550 
551 static int DetectEngineHttpStatCodeTest07(void)
552 {
553  TcpSession ssn;
554  ThreadVars th_v;
555  DetectEngineThreadCtx *det_ctx = NULL;
556  Flow f;
557  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
558  "Host: www.openinfosecfoundation.org\r\n"
559  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
560  "Gecko/20091221 Firefox/3.5.7\r\n"
561  "\r\n";
562  uint32_t http_len1 = sizeof(http_buf1) - 1;
563  uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n"
564  "Content-Type: text/html\r\n"
565  "Content-Length: 6\r\n"
566  "\r\n"
567  "abcdef";
568  uint32_t http_len2 = sizeof(http_buf2) - 1;
569  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
570 
571  memset(&th_v, 0, sizeof(th_v));
572  memset(&f, 0, sizeof(f));
573  memset(&ssn, 0, sizeof(ssn));
574 
575  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
576  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
577 
578  FLOW_INITIALIZE(&f);
579  f.protoctx = (void *)&ssn;
580  f.proto = IPPROTO_TCP;
581  f.flags |= FLOW_IPV4;
582 
583  p1->flow = &f;
584  p1->flowflags |= FLOW_PKT_TOSERVER;
585  p1->flowflags |= FLOW_PKT_ESTABLISHED;
586  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
587  p2->flow = &f;
588  p2->flowflags |= FLOW_PKT_TOCLIENT;
589  p2->flowflags |= FLOW_PKT_ESTABLISHED;
590  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
591  f.alproto = ALPROTO_HTTP1;
592 
593  StreamTcpInitConfig(true);
594 
595  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
596  FAIL_IF_NULL(de_ctx);
597  de_ctx->flags |= DE_QUIET;
598 
599  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
600  "(msg:\"http stat code test\"; "
601  "content:!\"123\"; http_stat_code; offset:3; "
602  "sid:1;)");
603  FAIL_IF_NULL(s);
604 
605  SigGroupBuild(de_ctx);
606  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
607 
608  int r = AppLayerParserParse(
609  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
610  FAIL_IF_NOT(r == 0);
611 
612  HtpState *http_state = f.alstate;
613  FAIL_IF_NULL(http_state);
614 
615  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
616  FAIL_IF(PacketAlertCheck(p1, 1));
617 
618  r = AppLayerParserParse(
619  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
620  FAIL_IF_NOT(r == 0);
621 
622  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
623  FAIL_IF(PacketAlertCheck(p2, 1));
624 
625  UTHFreePackets(&p1, 1);
626  UTHFreePackets(&p2, 1);
627  FLOW_DESTROY(&f);
628  AppLayerParserThreadCtxFree(alp_tctx);
629  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
630  DetectEngineCtxFree(de_ctx);
631  StreamTcpFreeConfig(true);
632  StatsThreadCleanup(&th_v);
633  PASS;
634 }
635 
636 static int DetectEngineHttpStatCodeTest08(void)
637 {
638  TcpSession ssn;
639  ThreadVars th_v;
640  DetectEngineThreadCtx *det_ctx = NULL;
641  Flow f;
642  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
643  "Host: www.openinfosecfoundation.org\r\n"
644  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
645  "Gecko/20091221 Firefox/3.5.7\r\n"
646  "\r\n";
647  uint32_t http_len1 = sizeof(http_buf1) - 1;
648  uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n"
649  "Content-Type: text/html\r\n"
650  "Content-Length: 6\r\n"
651  "\r\n"
652  "abcdef";
653  uint32_t http_len2 = sizeof(http_buf2) - 1;
654  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
655 
656  memset(&th_v, 0, sizeof(th_v));
657  memset(&f, 0, sizeof(f));
658  memset(&ssn, 0, sizeof(ssn));
659 
660  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
661  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
662 
663  FLOW_INITIALIZE(&f);
664  f.protoctx = (void *)&ssn;
665  f.proto = IPPROTO_TCP;
666  f.flags |= FLOW_IPV4;
667 
668  p1->flow = &f;
669  p1->flowflags |= FLOW_PKT_TOSERVER;
670  p1->flowflags |= FLOW_PKT_ESTABLISHED;
671  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
672  p2->flow = &f;
673  p2->flowflags |= FLOW_PKT_TOCLIENT;
674  p2->flowflags |= FLOW_PKT_ESTABLISHED;
675  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
676  f.alproto = ALPROTO_HTTP1;
677 
678  StreamTcpInitConfig(true);
679 
680  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
681  FAIL_IF_NULL(de_ctx);
682  de_ctx->flags |= DE_QUIET;
683 
684  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
685  "(msg:\"http stat code test\"; "
686  "content:!\"200\"; http_stat_code; depth:3; "
687  "sid:1;)");
688  FAIL_IF_NULL(s);
689 
690  SigGroupBuild(de_ctx);
691  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
692 
693  int r = AppLayerParserParse(
694  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
695  FAIL_IF_NOT(r == 0);
696 
697  HtpState *http_state = f.alstate;
698  FAIL_IF_NULL(http_state);
699 
700  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
701  FAIL_IF(PacketAlertCheck(p1, 1));
702 
703  r = AppLayerParserParse(
704  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
705  FAIL_IF_NOT(r == 0);
706 
707  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
708  FAIL_IF(PacketAlertCheck(p2, 1));
709 
710  UTHFreePackets(&p1, 1);
711  UTHFreePackets(&p2, 1);
712  FLOW_DESTROY(&f);
713  AppLayerParserThreadCtxFree(alp_tctx);
714  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
715  DetectEngineCtxFree(de_ctx);
716  StreamTcpFreeConfig(true);
717  StatsThreadCleanup(&th_v);
718  PASS;
719 }
720 
721 static int DetectEngineHttpStatCodeTest09(void)
722 {
723  TcpSession ssn;
724  ThreadVars th_v;
725  DetectEngineThreadCtx *det_ctx = NULL;
726  Flow f;
727  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
728  "Host: www.openinfosecfoundation.org\r\n"
729  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
730  "Gecko/20091221 Firefox/3.5.7\r\n"
731  "\r\n";
732  uint32_t http_len1 = sizeof(http_buf1) - 1;
733  uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n"
734  "Content-Type: text/html\r\n"
735  "Content-Length: 6\r\n"
736  "\r\n"
737  "abcdef";
738  uint32_t http_len2 = sizeof(http_buf2) - 1;
739  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
740 
741  memset(&th_v, 0, sizeof(th_v));
742  memset(&f, 0, sizeof(f));
743  memset(&ssn, 0, sizeof(ssn));
744 
745  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
746  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
747 
748  FLOW_INITIALIZE(&f);
749  f.protoctx = (void *)&ssn;
750  f.proto = IPPROTO_TCP;
751  f.flags |= FLOW_IPV4;
752 
753  p1->flow = &f;
754  p1->flowflags |= FLOW_PKT_TOSERVER;
755  p1->flowflags |= FLOW_PKT_ESTABLISHED;
756  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
757  p2->flow = &f;
758  p2->flowflags |= FLOW_PKT_TOCLIENT;
759  p2->flowflags |= FLOW_PKT_ESTABLISHED;
760  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
761  f.alproto = ALPROTO_HTTP1;
762 
763  StreamTcpInitConfig(true);
764 
765  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
766  FAIL_IF_NULL(de_ctx);
767  de_ctx->flags |= DE_QUIET;
768 
769  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
770  "(msg:\"http stat code test\"; "
771  "content:\"200\"; http_stat_code; depth:3; "
772  "content:\"123\"; http_stat_code; within:3; "
773  "sid:1;)");
774  FAIL_IF_NULL(s);
775 
776  SigGroupBuild(de_ctx);
777  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
778 
779  int r = AppLayerParserParse(
780  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
781  FAIL_IF_NOT(r == 0);
782 
783  HtpState *http_state = f.alstate;
784  FAIL_IF_NULL(http_state);
785 
786  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
787  FAIL_IF(PacketAlertCheck(p1, 1));
788 
789  r = AppLayerParserParse(
790  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
791  FAIL_IF_NOT(r == 0);
792 
793  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
794  FAIL_IF(!PacketAlertCheck(p2, 1));
795 
796  UTHFreePackets(&p1, 1);
797  UTHFreePackets(&p2, 1);
798  FLOW_DESTROY(&f);
799  AppLayerParserThreadCtxFree(alp_tctx);
800  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
801  DetectEngineCtxFree(de_ctx);
802  StreamTcpFreeConfig(true);
803  StatsThreadCleanup(&th_v);
804  PASS;
805 }
806 
807 static int DetectEngineHttpStatCodeTest10(void)
808 {
809  TcpSession ssn;
810  ThreadVars th_v;
811  DetectEngineThreadCtx *det_ctx = NULL;
812  Flow f;
813  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
814  "Host: www.openinfosecfoundation.org\r\n"
815  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
816  "Gecko/20091221 Firefox/3.5.7\r\n"
817  "\r\n";
818  uint32_t http_len1 = sizeof(http_buf1) - 1;
819  uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n"
820  "Content-Type: text/html\r\n"
821  "Content-Length: 6\r\n"
822  "\r\n"
823  "abcdef";
824  uint32_t http_len2 = sizeof(http_buf2) - 1;
825  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
826 
827  memset(&th_v, 0, sizeof(th_v));
828  memset(&f, 0, sizeof(f));
829  memset(&ssn, 0, sizeof(ssn));
830 
831  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
832  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
833 
834  FLOW_INITIALIZE(&f);
835  f.protoctx = (void *)&ssn;
836  f.proto = IPPROTO_TCP;
837  f.flags |= FLOW_IPV4;
838 
839  p1->flow = &f;
840  p1->flowflags |= FLOW_PKT_TOSERVER;
841  p1->flowflags |= FLOW_PKT_ESTABLISHED;
842  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
843  p2->flow = &f;
844  p2->flowflags |= FLOW_PKT_TOCLIENT;
845  p2->flowflags |= FLOW_PKT_ESTABLISHED;
846  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
847  f.alproto = ALPROTO_HTTP1;
848 
849  StreamTcpInitConfig(true);
850 
851  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
852  FAIL_IF_NULL(de_ctx);
853  de_ctx->flags |= DE_QUIET;
854 
855  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
856  "(msg:\"http stat code test\"; "
857  "content:\"200\"; http_stat_code; depth:3; "
858  "content:!\"124\"; http_stat_code; within:3; "
859  "sid:1;)");
860  FAIL_IF_NULL(s);
861 
862  SigGroupBuild(de_ctx);
863  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
864 
865  int r = AppLayerParserParse(
866  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
867  FAIL_IF_NOT(r == 0);
868 
869  HtpState *http_state = f.alstate;
870  FAIL_IF_NULL(http_state);
871 
872  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
873  FAIL_IF(PacketAlertCheck(p1, 1));
874 
875  r = AppLayerParserParse(
876  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
877  FAIL_IF_NOT(r == 0);
878 
879  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
880  FAIL_IF(!PacketAlertCheck(p2, 1));
881 
882  UTHFreePackets(&p1, 1);
883  UTHFreePackets(&p2, 1);
884  FLOW_DESTROY(&f);
885  AppLayerParserThreadCtxFree(alp_tctx);
886  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
887  DetectEngineCtxFree(de_ctx);
888  StreamTcpFreeConfig(true);
889  StatsThreadCleanup(&th_v);
890  PASS;
891 }
892 
893 static int DetectEngineHttpStatCodeTest11(void)
894 {
895  TcpSession ssn;
896  ThreadVars th_v;
897  DetectEngineThreadCtx *det_ctx = NULL;
898  Flow f;
899  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
900  "Host: www.openinfosecfoundation.org\r\n"
901  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
902  "Gecko/20091221 Firefox/3.5.7\r\n"
903  "\r\n";
904  uint32_t http_len1 = sizeof(http_buf1) - 1;
905  uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n"
906  "Content-Type: text/html\r\n"
907  "Content-Length: 6\r\n"
908  "\r\n"
909  "abcdef";
910  uint32_t http_len2 = sizeof(http_buf2) - 1;
911  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
912 
913  memset(&th_v, 0, sizeof(th_v));
914  memset(&f, 0, sizeof(f));
915  memset(&ssn, 0, sizeof(ssn));
916 
917  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
918  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
919 
920  FLOW_INITIALIZE(&f);
921  f.protoctx = (void *)&ssn;
922  f.proto = IPPROTO_TCP;
923  f.flags |= FLOW_IPV4;
924 
925  p1->flow = &f;
926  p1->flowflags |= FLOW_PKT_TOSERVER;
927  p1->flowflags |= FLOW_PKT_ESTABLISHED;
928  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
929  p2->flow = &f;
930  p2->flowflags |= FLOW_PKT_TOCLIENT;
931  p2->flowflags |= FLOW_PKT_ESTABLISHED;
932  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
933  f.alproto = ALPROTO_HTTP1;
934 
935  StreamTcpInitConfig(true);
936 
937  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
938  FAIL_IF_NULL(de_ctx);
939  de_ctx->flags |= DE_QUIET;
940 
941  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
942  "(msg:\"http stat code test\"; "
943  "content:\"200\"; http_stat_code; depth:3; "
944  "content:\"124\"; http_stat_code; within:3; "
945  "sid:1;)");
946  FAIL_IF_NULL(s);
947 
948  SigGroupBuild(de_ctx);
949  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
950 
951  int r = AppLayerParserParse(
952  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
953  FAIL_IF_NOT(r == 0);
954 
955  HtpState *http_state = f.alstate;
956  FAIL_IF_NULL(http_state);
957 
958  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
959  FAIL_IF(PacketAlertCheck(p1, 1));
960 
961  r = AppLayerParserParse(
962  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
963  FAIL_IF_NOT(r == 0);
964 
965  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
966  FAIL_IF(PacketAlertCheck(p2, 1));
967 
968  UTHFreePackets(&p1, 1);
969  UTHFreePackets(&p2, 1);
970  FLOW_DESTROY(&f);
971  AppLayerParserThreadCtxFree(alp_tctx);
972  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
973  DetectEngineCtxFree(de_ctx);
974  StreamTcpFreeConfig(true);
975  StatsThreadCleanup(&th_v);
976  PASS;
977 }
978 
979 static int DetectEngineHttpStatCodeTest12(void)
980 {
981  TcpSession ssn;
982  ThreadVars th_v;
983  DetectEngineThreadCtx *det_ctx = NULL;
984  Flow f;
985  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
986  "Host: www.openinfosecfoundation.org\r\n"
987  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
988  "Gecko/20091221 Firefox/3.5.7\r\n"
989  "\r\n";
990  uint32_t http_len1 = sizeof(http_buf1) - 1;
991  uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n"
992  "Content-Type: text/html\r\n"
993  "Content-Length: 6\r\n"
994  "\r\n"
995  "abcdef";
996  uint32_t http_len2 = sizeof(http_buf2) - 1;
997  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
998 
999  memset(&th_v, 0, sizeof(th_v));
1000  memset(&f, 0, sizeof(f));
1001  memset(&ssn, 0, sizeof(ssn));
1002 
1003  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1004  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1005 
1006  FLOW_INITIALIZE(&f);
1007  f.protoctx = (void *)&ssn;
1008  f.proto = IPPROTO_TCP;
1009  f.flags |= FLOW_IPV4;
1010 
1011  p1->flow = &f;
1012  p1->flowflags |= FLOW_PKT_TOSERVER;
1013  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1014  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1015  p2->flow = &f;
1016  p2->flowflags |= FLOW_PKT_TOCLIENT;
1017  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1018  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1019  f.alproto = ALPROTO_HTTP1;
1020 
1021  StreamTcpInitConfig(true);
1022 
1023  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1024  FAIL_IF_NULL(de_ctx);
1025  de_ctx->flags |= DE_QUIET;
1026 
1027  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1028  "(msg:\"http stat code test\"; "
1029  "content:\"20\"; http_stat_code; depth:2; "
1030  "content:\"23\"; http_stat_code; distance:2; "
1031  "sid:1;)");
1032  FAIL_IF_NULL(s);
1033 
1034  SigGroupBuild(de_ctx);
1035  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1036 
1037  int r = AppLayerParserParse(
1038  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
1039  FAIL_IF_NOT(r == 0);
1040 
1041  HtpState *http_state = f.alstate;
1042  FAIL_IF_NULL(http_state);
1043 
1044  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1045  FAIL_IF(PacketAlertCheck(p1, 1));
1046 
1047  r = AppLayerParserParse(
1048  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
1049  FAIL_IF_NOT(r == 0);
1050 
1051  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1052  FAIL_IF(!PacketAlertCheck(p2, 1));
1053 
1054  UTHFreePackets(&p1, 1);
1055  UTHFreePackets(&p2, 1);
1056  FLOW_DESTROY(&f);
1057  AppLayerParserThreadCtxFree(alp_tctx);
1058  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1059  DetectEngineCtxFree(de_ctx);
1060  StreamTcpFreeConfig(true);
1061  StatsThreadCleanup(&th_v);
1062  PASS;
1063 }
1064 
1065 static int DetectEngineHttpStatCodeTest13(void)
1066 {
1067  TcpSession ssn;
1068  ThreadVars th_v;
1069  DetectEngineThreadCtx *det_ctx = NULL;
1070  Flow f;
1071  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
1072  "Host: www.openinfosecfoundation.org\r\n"
1073  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
1074  "Gecko/20091221 Firefox/3.5.7\r\n"
1075  "\r\n";
1076  uint32_t http_len1 = sizeof(http_buf1) - 1;
1077  uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n"
1078  "Content-Type: text/html\r\n"
1079  "Content-Length: 6\r\n"
1080  "\r\n"
1081  "abcdef";
1082  uint32_t http_len2 = sizeof(http_buf2) - 1;
1083  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1084 
1085  memset(&th_v, 0, sizeof(th_v));
1086  memset(&f, 0, sizeof(f));
1087  memset(&ssn, 0, sizeof(ssn));
1088 
1089  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1090  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1091 
1092  FLOW_INITIALIZE(&f);
1093  f.protoctx = (void *)&ssn;
1094  f.proto = IPPROTO_TCP;
1095  f.flags |= FLOW_IPV4;
1096 
1097  p1->flow = &f;
1098  p1->flowflags |= FLOW_PKT_TOSERVER;
1099  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1100  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1101  p2->flow = &f;
1102  p2->flowflags |= FLOW_PKT_TOCLIENT;
1103  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1104  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1105  f.alproto = ALPROTO_HTTP1;
1106 
1107  StreamTcpInitConfig(true);
1108 
1109  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1110  FAIL_IF_NULL(de_ctx);
1111  de_ctx->flags |= DE_QUIET;
1112 
1113  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1114  "(msg:\"http stat code test\"; "
1115  "content:\"20\"; http_stat_code; depth:3; "
1116  "content:!\"25\"; http_stat_code; distance:2; "
1117  "sid:1;)");
1118  FAIL_IF_NULL(s);
1119 
1120  SigGroupBuild(de_ctx);
1121  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1122 
1123  int r = AppLayerParserParse(
1124  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
1125  FAIL_IF_NOT(r == 0);
1126 
1127  HtpState *http_state = f.alstate;
1128  FAIL_IF_NULL(http_state);
1129 
1130  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1131  FAIL_IF(PacketAlertCheck(p1, 1));
1132 
1133  r = AppLayerParserParse(
1134  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
1135  FAIL_IF_NOT(r == 0);
1136 
1137  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1138  FAIL_IF(!PacketAlertCheck(p2, 1));
1139 
1140  UTHFreePackets(&p1, 1);
1141  UTHFreePackets(&p2, 1);
1142  FLOW_DESTROY(&f);
1143  AppLayerParserThreadCtxFree(alp_tctx);
1144  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1145  DetectEngineCtxFree(de_ctx);
1146  StreamTcpFreeConfig(true);
1147  StatsThreadCleanup(&th_v);
1148  PASS;
1149 }
1150 
1151 static int DetectEngineHttpStatCodeTest14(void)
1152 {
1153  TcpSession ssn;
1154  ThreadVars th_v;
1155  DetectEngineThreadCtx *det_ctx = NULL;
1156  Flow f;
1157  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
1158  "Host: www.openinfosecfoundation.org\r\n"
1159  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
1160  "Gecko/20091221 Firefox/3.5.7\r\n"
1161  "\r\n";
1162  uint32_t http_len1 = sizeof(http_buf1) - 1;
1163  uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n"
1164  "Content-Type: text/html\r\n"
1165  "Content-Length: 6\r\n"
1166  "\r\n"
1167  "abcdef";
1168  uint32_t http_len2 = sizeof(http_buf2) - 1;
1169  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1170 
1171  memset(&th_v, 0, sizeof(th_v));
1172  memset(&f, 0, sizeof(f));
1173  memset(&ssn, 0, sizeof(ssn));
1174 
1175  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1176  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1177 
1178  FLOW_INITIALIZE(&f);
1179  f.protoctx = (void *)&ssn;
1180  f.proto = IPPROTO_TCP;
1181  f.flags |= FLOW_IPV4;
1182 
1183  p1->flow = &f;
1184  p1->flowflags |= FLOW_PKT_TOSERVER;
1185  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1186  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1187  p2->flow = &f;
1188  p2->flowflags |= FLOW_PKT_TOCLIENT;
1189  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1190  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1191  f.alproto = ALPROTO_HTTP1;
1192 
1193  StreamTcpInitConfig(true);
1194 
1195  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1196  FAIL_IF_NULL(de_ctx);
1197  de_ctx->flags |= DE_QUIET;
1198 
1199  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1200  "(msg:\"http stat code test\"; "
1201  "pcre:/20/S; "
1202  "content:\"23\"; http_stat_code; distance:2; "
1203  "sid:1;)");
1204  FAIL_IF_NULL(s);
1205 
1206  SigGroupBuild(de_ctx);
1207  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1208 
1209  int r = AppLayerParserParse(
1210  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
1211  FAIL_IF_NOT(r == 0);
1212 
1213  HtpState *http_state = f.alstate;
1214  FAIL_IF_NULL(http_state);
1215 
1216  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1217  FAIL_IF(PacketAlertCheck(p1, 1));
1218 
1219  r = AppLayerParserParse(
1220  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
1221  FAIL_IF_NOT(r == 0);
1222 
1223  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1224  FAIL_IF(!PacketAlertCheck(p2, 1));
1225 
1226  UTHFreePackets(&p1, 1);
1227  UTHFreePackets(&p2, 1);
1228  FLOW_DESTROY(&f);
1229  AppLayerParserThreadCtxFree(alp_tctx);
1230  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1231  DetectEngineCtxFree(de_ctx);
1232  StreamTcpFreeConfig(true);
1233  StatsThreadCleanup(&th_v);
1234  PASS;
1235 }
1236 
1237 static int DetectEngineHttpStatCodeTest15(void)
1238 {
1239  TcpSession ssn;
1240  ThreadVars th_v;
1241  DetectEngineThreadCtx *det_ctx = NULL;
1242  Flow f;
1243  uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n"
1244  "Host: www.openinfosecfoundation.org\r\n"
1245  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) "
1246  "Gecko/20091221 Firefox/3.5.7\r\n"
1247  "\r\n";
1248  uint32_t http_len1 = sizeof(http_buf1) - 1;
1249  uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n"
1250  "Content-Type: text/html\r\n"
1251  "Content-Length: 6\r\n"
1252  "\r\n"
1253  "abcdef";
1254  uint32_t http_len2 = sizeof(http_buf2) - 1;
1255  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1256 
1257  memset(&th_v, 0, sizeof(th_v));
1258  memset(&f, 0, sizeof(f));
1259  memset(&ssn, 0, sizeof(ssn));
1260 
1261  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1262  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1263 
1264  FLOW_INITIALIZE(&f);
1265  f.protoctx = (void *)&ssn;
1266  f.proto = IPPROTO_TCP;
1267  f.flags |= FLOW_IPV4;
1268 
1269  p1->flow = &f;
1270  p1->flowflags |= FLOW_PKT_TOSERVER;
1271  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1272  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1273  p2->flow = &f;
1274  p2->flowflags |= FLOW_PKT_TOCLIENT;
1275  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1276  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1277  f.alproto = ALPROTO_HTTP1;
1278 
1279  StreamTcpInitConfig(true);
1280 
1281  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1282  FAIL_IF_NULL(de_ctx);
1283  de_ctx->flags |= DE_QUIET;
1284 
1285  Signature *s =
1286  DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
1287  "(msg:\"http stat code test\"; "
1288  "pcre:/200/S; "
1289  "content:!\"124\"; http_stat_code; distance:0; within:3; "
1290  "sid:1;)");
1291  FAIL_IF_NULL(s);
1292 
1293  SigGroupBuild(de_ctx);
1294  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1295 
1296  int r = AppLayerParserParse(
1297  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_len1);
1298  FAIL_IF_NOT(r == 0);
1299 
1300  HtpState *http_state = f.alstate;
1301  FAIL_IF_NULL(http_state);
1302 
1303  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
1304  FAIL_IF(PacketAlertCheck(p1, 1));
1305 
1306  r = AppLayerParserParse(
1307  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, http_buf2, http_len2);
1308  FAIL_IF_NOT(r == 0);
1309 
1310  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
1311  FAIL_IF(!PacketAlertCheck(p2, 1));
1312 
1313  UTHFreePackets(&p1, 1);
1314  UTHFreePackets(&p2, 1);
1315  FLOW_DESTROY(&f);
1316  AppLayerParserThreadCtxFree(alp_tctx);
1317  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1318  DetectEngineCtxFree(de_ctx);
1319  StreamTcpFreeConfig(true);
1320  StatsThreadCleanup(&th_v);
1321  PASS;
1322 }
1323 
1324 /** \test Check the signature working to alert when http_stat_code is matched . */
1325 static int DetectHttpStatCodeSigTest01(void)
1326 {
1327  Flow f;
1328  uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n\r\n";
1329  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
1330  uint8_t httpbuf2[] = "HTTP/1.0 200 OK\r\n\r\n";
1331  uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
1332  TcpSession ssn;
1333  ThreadVars th_v;
1334  DetectEngineThreadCtx *det_ctx = NULL;
1335  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1336 
1337  memset(&th_v, 0, sizeof(th_v));
1338  memset(&f, 0, sizeof(f));
1339  memset(&ssn, 0, sizeof(ssn));
1340 
1341  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1342 
1343  FLOW_INITIALIZE(&f);
1344  f.protoctx = (void *)&ssn;
1345  f.proto = IPPROTO_TCP;
1346  f.flags |= FLOW_IPV4;
1347 
1348  p->flow = &f;
1349  p->flowflags |= FLOW_PKT_TOCLIENT;
1350  p->flowflags |= FLOW_PKT_ESTABLISHED;
1351  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1352  f.alproto = ALPROTO_HTTP1;
1353 
1354  StreamTcpInitConfig(true);
1355 
1356  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1357  FAIL_IF_NULL(de_ctx);
1358  de_ctx->flags |= DE_QUIET;
1359 
1360  Signature *s = DetectEngineAppendSig(de_ctx,
1361  "alert http any any -> any any (msg:"
1362  "\"HTTP status code\"; content:\"200\"; http_stat_code; sid:1;)");
1363  FAIL_IF_NULL(s);
1364 
1365  SigGroupBuild(de_ctx);
1366  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1367 
1368  int r = AppLayerParserParse(
1369  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf1, httplen1);
1370  FAIL_IF_NOT(r == 0);
1371 
1372  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, httpbuf2, httplen2);
1373  FAIL_IF_NOT(r == 0);
1374 
1375  HtpState *http_state = f.alstate;
1376  FAIL_IF_NULL(http_state);
1377 
1378  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1379  FAIL_IF(!(PacketAlertCheck(p, 1)));
1380 
1381  UTHFreePackets(&p, 1);
1382  FLOW_DESTROY(&f);
1383  AppLayerParserThreadCtxFree(alp_tctx);
1384  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1385  DetectEngineCtxFree(de_ctx);
1386  StreamTcpFreeConfig(true);
1387  StatsThreadCleanup(&th_v);
1388  PASS;
1389 }
1390 
1391 /** \test Check the signature working to alert when http_stat_code is not matched . */
1392 static int DetectHttpStatCodeSigTest02(void)
1393 {
1394  Flow f;
1395  uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n\r\n";
1396  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
1397  uint8_t httpbuf2[] = "HTTP/1.0 200 OK\r\n\r\n";
1398  uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
1399  TcpSession ssn;
1400  ThreadVars th_v;
1401  DetectEngineThreadCtx *det_ctx = NULL;
1402  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1403 
1404  memset(&th_v, 0, sizeof(th_v));
1405  memset(&f, 0, sizeof(f));
1406  memset(&ssn, 0, sizeof(ssn));
1407 
1408  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1409 
1410  FLOW_INITIALIZE(&f);
1411  f.protoctx = (void *)&ssn;
1412  f.proto = IPPROTO_TCP;
1413  f.flags |= FLOW_IPV4;
1414 
1415  p->flow = &f;
1416  p->flowflags |= FLOW_PKT_TOCLIENT;
1417  p->flowflags |= FLOW_PKT_ESTABLISHED;
1418  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1419  f.alproto = ALPROTO_HTTP1;
1420 
1421  StreamTcpInitConfig(true);
1422 
1423  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1424  FAIL_IF_NULL(de_ctx);
1425  de_ctx->flags |= DE_QUIET;
1426 
1427  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (msg:"
1428  "\"HTTP status code\"; content:\"no\"; "
1429  "http_stat_code; sid:1;)");
1430  FAIL_IF_NULL(s);
1431 
1432  s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (msg:\"HTTP "
1433  "Status code\"; content:\"100\";"
1434  "http_stat_code; sid:2;)");
1435  FAIL_IF_NULL(s);
1436 
1437  SigGroupBuild(de_ctx);
1438  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1439 
1440  int r = AppLayerParserParse(
1441  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf1, httplen1);
1442  FAIL_IF_NOT(r == 0);
1443 
1444  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, httpbuf2, httplen2);
1445  FAIL_IF_NOT(r == 0);
1446 
1447  HtpState *http_state = f.alstate;
1448  FAIL_IF_NULL(http_state);
1449 
1450  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1451  FAIL_IF(PacketAlertCheck(p, 1));
1452  FAIL_IF((PacketAlertCheck(p, 2)));
1453 
1454  UTHFreePackets(&p, 1);
1455  FLOW_DESTROY(&f);
1456  AppLayerParserThreadCtxFree(alp_tctx);
1457  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1458  DetectEngineCtxFree(de_ctx);
1459  StreamTcpFreeConfig(true);
1460  StatsThreadCleanup(&th_v);
1461  PASS;
1462 }
1463 
1464 /** \test Check the signature working to alert when http_stat_code is matched for
1465  * for nocase or not */
1466 static int DetectHttpStatCodeSigTest03(void)
1467 {
1468  Flow f;
1469  uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n\r\n";
1470  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
1471  uint8_t httpbuf2[] = "HTTP/1.0 FAIL OK\r\n\r\n";
1472  uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
1473  TcpSession ssn;
1474  ThreadVars th_v;
1475  DetectEngineThreadCtx *det_ctx = NULL;
1476  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1477 
1478  memset(&th_v, 0, sizeof(th_v));
1479  memset(&f, 0, sizeof(f));
1480  memset(&ssn, 0, sizeof(ssn));
1481 
1482  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1483 
1484  FLOW_INITIALIZE(&f);
1485  f.protoctx = (void *)&ssn;
1486  f.proto = IPPROTO_TCP;
1487  f.flags |= FLOW_IPV4;
1488 
1489  p->flow = &f;
1490  p->flowflags |= FLOW_PKT_TOCLIENT;
1491  p->flowflags |= FLOW_PKT_ESTABLISHED;
1492  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1493  f.alproto = ALPROTO_HTTP1;
1494 
1495  StreamTcpInitConfig(true);
1496 
1497  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1498  FAIL_IF_NULL(de_ctx);
1499  de_ctx->flags |= DE_QUIET;
1500 
1501  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (msg:"
1502  "\"HTTP status code\"; content:\"FAIL\"; "
1503  "http_stat_code; sid:1;)");
1504  FAIL_IF_NULL(s);
1505 
1506  s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (msg:\"HTTP "
1507  "Status code nocase\"; content:\"fail\"; nocase; "
1508  "http_stat_code; sid:2;)");
1509  FAIL_IF_NULL(s);
1510 
1511  SigGroupBuild(de_ctx);
1512  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1513 
1514  int r = AppLayerParserParse(
1515  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf1, httplen1);
1516  FAIL_IF_NOT(r == 0);
1517 
1518  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, httpbuf2, httplen2);
1519  FAIL_IF_NOT(r == 0);
1520 
1521  HtpState *http_state = f.alstate;
1522  FAIL_IF_NULL(http_state);
1523 
1524  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1525  FAIL_IF(!(PacketAlertCheck(p, 1)));
1526  FAIL_IF(!(PacketAlertCheck(p, 2)));
1527 
1528  UTHFreePackets(&p, 1);
1529  FLOW_DESTROY(&f);
1530  AppLayerParserThreadCtxFree(alp_tctx);
1531  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1532  DetectEngineCtxFree(de_ctx);
1533  StreamTcpFreeConfig(true);
1534  StatsThreadCleanup(&th_v);
1535  PASS;
1536 }
1537 
1538 /** \test Check the signature working to alert when http_stat_code is matched for
1539  * for negation or not */
1540 static int DetectHttpStatCodeSigTest04(void)
1541 {
1542  Flow f;
1543  uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n\r\n";
1544  uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
1545  uint8_t httpbuf2[] = "HTTP/1.0 200 OK\r\n\r\n";
1546  uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
1547  TcpSession ssn;
1548  ThreadVars th_v;
1549  DetectEngineThreadCtx *det_ctx = NULL;
1550  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1551 
1552  memset(&th_v, 0, sizeof(th_v));
1553  memset(&f, 0, sizeof(f));
1554  memset(&ssn, 0, sizeof(ssn));
1555 
1556  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1557 
1558  FLOW_INITIALIZE(&f);
1559  f.protoctx = (void *)&ssn;
1560  f.proto = IPPROTO_TCP;
1561  f.flags |= FLOW_IPV4;
1562 
1563  p->flow = &f;
1564  p->flowflags |= FLOW_PKT_TOCLIENT;
1565  p->flowflags |= FLOW_PKT_ESTABLISHED;
1566  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1567  f.alproto = ALPROTO_HTTP1;
1568 
1569  StreamTcpInitConfig(true);
1570 
1571  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1572  FAIL_IF_NULL(de_ctx);
1573  de_ctx->flags |= DE_QUIET;
1574 
1575  Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (msg:"
1576  "\"HTTP status code\"; content:\"200\"; "
1577  "http_stat_code; sid:1;)");
1578  FAIL_IF_NULL(s);
1579 
1580  s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (msg:\"HTTP "
1581  "Status code negation\"; content:!\"100\"; nocase; "
1582  "http_stat_code; sid:2;)");
1583  FAIL_IF_NULL(s);
1584 
1585  SigGroupBuild(de_ctx);
1586  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1587 
1588  int r = AppLayerParserParse(
1589  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf1, httplen1);
1590  FAIL_IF_NOT(r == 0);
1591 
1592  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOCLIENT, httpbuf2, httplen2);
1593  FAIL_IF_NOT(r == 0);
1594 
1595  HtpState *http_state = f.alstate;
1596  FAIL_IF_NULL(http_state);
1597 
1598  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1599 
1600  FAIL_IF(!(PacketAlertCheck(p, 1)));
1601  FAIL_IF(!(PacketAlertCheck(p, 2)));
1602 
1603  UTHFreePackets(&p, 1);
1604  FLOW_DESTROY(&f);
1605  AppLayerParserThreadCtxFree(alp_tctx);
1606  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1607  DetectEngineCtxFree(de_ctx);
1608  StreamTcpFreeConfig(true);
1609  StatsThreadCleanup(&th_v);
1610  PASS;
1611 }
1612 
1613 /**
1614  * \brief Register the UNITTESTS for the http_stat_code keyword
1615  */
1616 void DetectHttpStatCodeRegisterTests(void)
1617 {
1618  UtRegisterTest("DetectEngineHttpStatCodeTest01", DetectEngineHttpStatCodeTest01);
1619  UtRegisterTest("DetectEngineHttpStatCodeTest02", DetectEngineHttpStatCodeTest02);
1620  UtRegisterTest("DetectEngineHttpStatCodeTest03", DetectEngineHttpStatCodeTest03);
1621  UtRegisterTest("DetectEngineHttpStatCodeTest04", DetectEngineHttpStatCodeTest04);
1622  UtRegisterTest("DetectEngineHttpStatCodeTest05", DetectEngineHttpStatCodeTest05);
1623  UtRegisterTest("DetectEngineHttpStatCodeTest06", DetectEngineHttpStatCodeTest06);
1624  UtRegisterTest("DetectEngineHttpStatCodeTest07", DetectEngineHttpStatCodeTest07);
1625  UtRegisterTest("DetectEngineHttpStatCodeTest08", DetectEngineHttpStatCodeTest08);
1626  UtRegisterTest("DetectEngineHttpStatCodeTest09", DetectEngineHttpStatCodeTest09);
1627  UtRegisterTest("DetectEngineHttpStatCodeTest10", DetectEngineHttpStatCodeTest10);
1628  UtRegisterTest("DetectEngineHttpStatCodeTest11", DetectEngineHttpStatCodeTest11);
1629  UtRegisterTest("DetectEngineHttpStatCodeTest12", DetectEngineHttpStatCodeTest12);
1630  UtRegisterTest("DetectEngineHttpStatCodeTest13", DetectEngineHttpStatCodeTest13);
1631  UtRegisterTest("DetectEngineHttpStatCodeTest14", DetectEngineHttpStatCodeTest14);
1632  UtRegisterTest("DetectEngineHttpStatCodeTest15", DetectEngineHttpStatCodeTest15);
1633 
1634  UtRegisterTest("DetectHttpStatCodeSigTest01", DetectHttpStatCodeSigTest01);
1635  UtRegisterTest("DetectHttpStatCodeSigTest02", DetectHttpStatCodeSigTest02);
1636  UtRegisterTest("DetectHttpStatCodeSigTest03", DetectHttpStatCodeSigTest03);
1637  UtRegisterTest("DetectHttpStatCodeSigTest04", DetectHttpStatCodeSigTest04);
1638 }
1639 
1640 /**
1641  * @}
1642  */
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1268
DetectHttpStatCodeRegisterTests
void DetectHttpStatCodeRegisterTests(void)
Register the UNITTESTS for the http_stat_code keyword.
Definition: detect-http-stat-code.c:1616
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
Flow_::proto
uint8_t proto
Definition: flow.h:370
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:142
Packet_::flags
uint32_t flags
Definition: decode.h:544
Flow_
Flow data structure.
Definition: flow.h:348
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:932
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2633
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:324
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:225
DE_QUIET
#define DE_QUIET
Definition: detect.h:330
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:365
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:2416
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3439
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:532
Flow_::protoctx
void * protoctx
Definition: flow.h:433
FLOW_IPV4
#define FLOW_IPV4
Definition: flow.h:100
HtpState_
Definition: app-layer-htp.h:181
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
StreamTcpInitConfig
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
Definition: stream-tcp.c:488
FLOW_INITIALIZE
#define FLOW_INITIALIZE(f)
Definition: flow-util.h:38
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
DetectEngineThreadCtx_
Definition: detect.h:1244
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:23
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3360
Packet_
Definition: decode.h:501
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:226
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:2185
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:297
Packet_::flow
struct Flow_ * flow
Definition: decode.h:546
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
StreamTcpFreeConfig
void StreamTcpFreeConfig(bool quiet)
Definition: stream-tcp.c:859
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1291
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:36
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3592
Flow_::alstate
void * alstate
Definition: flow.h:471
Flow_::flags
uint32_t flags
Definition: flow.h:413
Signature_
Signature container.
Definition: detect.h:668
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:227
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2594
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:934
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:60
TcpSession_
Definition: stream-tcp-private.h:283
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:442
StatsThreadCleanup
void StatsThreadCleanup(ThreadVars *tv)
Definition: counters.c:1324
FLOW_DESTROY
#define FLOW_DESTROY(f)
Definition: flow-util.h:119
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:1264
UTHFreePackets
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:456