suricata
detect-http-uri.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2018 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /** \file
19  *
20  * \author Victor Julien <victor@inliniac.net>
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  */
23 
24 #include "../suricata-common.h"
25 #include "../app-layer.h"
26 #include "../app-layer-parser.h"
27 #include "../app-layer-htp.h"
28 #include "../util-unittest.h"
29 #include "../util-unittest-helper.h"
30 
31 #include "../flow.h"
32 #include "../flow-util.h"
33 
34 #include "../detect-isdataat.h"
35 #include "../detect-engine-build.h"
36 #include "../detect-engine-alert.h"
37 
38 /** \test Test a simple uricontent option */
39 static int UriTestSig01(void)
40 {
41  int result = 0;
42  Flow f;
43  HtpState *http_state = NULL;
44  uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n"
45  "User-Agent: Mozilla/1.0\r\n"
46  "Cookie: hellocatch\r\n\r\n";
47  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
48  uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n"
49  "User-Agent: Mozilla/1.0\r\n"
50  "Cookie: hellocatch\r\n\r\n";
51  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
52  TcpSession ssn;
53  Packet *p = NULL;
54  Signature *s = NULL;
55  ThreadVars tv;
56  DetectEngineThreadCtx *det_ctx = NULL;
57  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
58 
59  memset(&tv, 0, sizeof(ThreadVars));
60  memset(&f, 0, sizeof(Flow));
61  memset(&ssn, 0, sizeof(TcpSession));
62 
63  p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP);
64 
65  FLOW_INITIALIZE(&f);
66  f.protoctx = (void *)&ssn;
67  f.proto = IPPROTO_TCP;
68  f.flags |= FLOW_IPV4;
69 
70  p->flow = &f;
71  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
72  p->flowflags |= FLOW_PKT_TOSERVER;
73  p->flowflags |= FLOW_PKT_ESTABLISHED;
74  f.alproto = ALPROTO_HTTP1;
75 
76  StreamTcpInitConfig(true);
77 
78  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
79  if (de_ctx == NULL) {
80  goto end;
81  }
82  de_ctx->flags |= DE_QUIET;
83 
84  s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
85  "(msg:\"Test uricontent option\"; "
86  "uricontent:\"one\"; sid:1;)");
87  if (s == NULL) {
88  goto end;
89  }
90 
91  SigGroupBuild(de_ctx);
92  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
93 
94  int r = AppLayerParserParse(
95  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
96  if (r != 0) {
97  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
98  goto end;
99  }
100 
101  http_state = f.alstate;
102  if (http_state == NULL) {
103  printf("no http state: ");
104  goto end;
105  }
106 
107  /* do detect */
108  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
109 
110  if (!PacketAlertCheck(p, 1)) {
111  printf("sig 1 alerted, but it should not: ");
112  goto end;
113  }
114 
115  r = AppLayerParserParse(
116  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf2, http_buf2_len);
117  if (r != 0) {
118  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
119  goto end;
120  }
121 
122  http_state = f.alstate;
123  if (http_state == NULL) {
124  printf("no http state: ");
125  goto end;
126  }
127 
128  if (!PacketAlertCheck(p, 1)) {
129  printf("sig 1 alerted, but it should not: ");
130  goto end;
131  }
132 
133  /* do detect */
134  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
135 
136  result = 1;
137 
138 end:
139  if (alp_tctx != NULL)
140  AppLayerParserThreadCtxFree(alp_tctx);
141  if (det_ctx != NULL)
142  DetectEngineThreadCtxDeinit(&tv, det_ctx);
143  if (de_ctx != NULL)
144  SigGroupCleanup(de_ctx);
145  if (de_ctx != NULL)
146  DetectEngineCtxFree(de_ctx);
147 
148  StreamTcpFreeConfig(true);
149  FLOW_DESTROY(&f);
150  UTHFreePacket(p);
151  return result;
152 }
153 
154 /** \test Test the pcre /U option */
155 static int UriTestSig02(void)
156 {
157  int result = 0;
158  Flow f;
159  HtpState *http_state = NULL;
160  uint8_t http_buf1[] = "POST /on HTTP/1.0\r\n"
161  "User-Agent: Mozilla/1.0\r\n"
162  "Cookie: hellocatch\r\n\r\n";
163  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
164  uint8_t http_buf2[] = "POST /one HTTP/1.0\r\n"
165  "User-Agent: Mozilla/1.0\r\n"
166  "Cookie: hellocatch\r\n\r\n";
167  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
168  TcpSession ssn;
169  Packet *p = NULL;
170  Signature *s = NULL;
171  ThreadVars tv;
172  DetectEngineThreadCtx *det_ctx = NULL;
173  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
174 
175  memset(&tv, 0, sizeof(ThreadVars));
176  memset(&f, 0, sizeof(Flow));
177  memset(&ssn, 0, sizeof(TcpSession));
178 
179  p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP);
180 
181  FLOW_INITIALIZE(&f);
182  f.protoctx = (void *)&ssn;
183  f.proto = IPPROTO_TCP;
184  f.flags |= FLOW_IPV4;
185 
186  p->flow = &f;
187  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
188  p->flowflags |= FLOW_PKT_TOSERVER;
189  p->flowflags |= FLOW_PKT_ESTABLISHED;
190  f.alproto = ALPROTO_HTTP1;
191 
192  StreamTcpInitConfig(true);
193 
194  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
195  if (de_ctx == NULL) {
196  goto end;
197  }
198  de_ctx->flags |= DE_QUIET;
199 
200  s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
201  "(msg:\"Test pcre /U option\"; "
202  "pcre:/one/U; sid:1;)");
203  if (s == NULL) {
204  goto end;
205  }
206 
207  SigGroupBuild(de_ctx);
208  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
209 
210  int r = AppLayerParserParse(
211  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
212  if (r != 0) {
213  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
214  goto end;
215  }
216 
217  http_state = f.alstate;
218  if (http_state == NULL) {
219  printf("no http state: ");
220  goto end;
221  }
222 
223  /* do detect */
224  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
225 
226  if (PacketAlertCheck(p, 1)) {
227  printf("sig 1 alerted with payload2, but it should not: ");
228  goto end;
229  }
230 
231  r = AppLayerParserParse(
232  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf2, http_buf2_len);
233  if (r != 0) {
234  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
235  goto end;
236  }
237 
238  http_state = f.alstate;
239  if (http_state == NULL) {
240  printf("no http state: ");
241  goto end;
242  }
243 
244  /* do detect */
245  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
246 
247  if (!PacketAlertCheck(p, 1)) {
248  printf("sig 1 didnt alert, but it should: ");
249  goto end;
250  }
251 
252  result = 1;
253 
254 end:
255  if (alp_tctx != NULL)
256  AppLayerParserThreadCtxFree(alp_tctx);
257  if (det_ctx != NULL)
258  DetectEngineThreadCtxDeinit(&tv, det_ctx);
259  if (de_ctx != NULL)
260  SigGroupCleanup(de_ctx);
261  if (de_ctx != NULL)
262  DetectEngineCtxFree(de_ctx);
263 
264  StreamTcpFreeConfig(true);
265  FLOW_DESTROY(&f);
266  UTHFreePacket(p);
267  return result;
268 }
269 
270 /** \test Test the pcre /U option */
271 static int UriTestSig03(void)
272 {
273  int result = 0;
274  Flow f;
275  HtpState *http_state = NULL;
276  uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n"
277  "User-Agent: Mozilla/1.0\r\n"
278  "Cookie: hellocatch\r\n\r\n";
279  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
280  uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n"
281  "User-Agent: Mozilla/1.0\r\n"
282  "Cookie: hellocatch\r\n\r\n";
283  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
284  TcpSession ssn;
285  Packet *p = NULL;
286  Signature *s = NULL;
287  ThreadVars tv;
288  DetectEngineThreadCtx *det_ctx = NULL;
289  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
290 
291  memset(&tv, 0, sizeof(ThreadVars));
292  memset(&f, 0, sizeof(Flow));
293  memset(&ssn, 0, sizeof(TcpSession));
294 
295  p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP);
296 
297  FLOW_INITIALIZE(&f);
298  f.protoctx = (void *)&ssn;
299  f.proto = IPPROTO_TCP;
300  f.flags |= FLOW_IPV4;
301 
302  p->flow = &f;
303  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
304  p->flowflags |= FLOW_PKT_TOSERVER;
305  p->flowflags |= FLOW_PKT_ESTABLISHED;
306  f.alproto = ALPROTO_HTTP1;
307 
308  StreamTcpInitConfig(true);
309 
310  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
311  if (de_ctx == NULL) {
312  goto end;
313  }
314  de_ctx->flags |= DE_QUIET;
315 
316  s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
317  "(msg:\"Test pcre /U option\"; "
318  "pcre:/blah/U; sid:1;)");
319  if (s == NULL) {
320  goto end;
321  }
322 
323  SigGroupBuild(de_ctx);
324  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
325 
326  int r = AppLayerParserParse(
327  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
328  if (r != 0) {
329  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
330  goto end;
331  }
332 
333  http_state = f.alstate;
334  if (http_state == NULL) {
335  printf("no http state: ");
336  goto end;
337  }
338 
339  /* do detect */
340  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
341 
342  if (PacketAlertCheck(p, 1)) {
343  printf("sig 1 alerted, but it should not: ");
344  goto end;
345  }
346 
347  r = AppLayerParserParse(
348  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf2, http_buf2_len);
349  if (r != 0) {
350  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
351  goto end;
352  }
353 
354  http_state = f.alstate;
355  if (http_state == NULL) {
356  printf("no http state: ");
357  goto end;
358  }
359 
360  /* do detect */
361  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
362 
363  if (PacketAlertCheck(p, 1)) {
364  printf("sig 1 alerted, but it should not: ");
365  goto end;
366  }
367 
368  result = 1;
369 
370 end:
371  if (alp_tctx != NULL)
372  AppLayerParserThreadCtxFree(alp_tctx);
373  if (det_ctx != NULL)
374  DetectEngineThreadCtxDeinit(&tv, det_ctx);
375  if (de_ctx != NULL)
376  SigGroupCleanup(de_ctx);
377  if (de_ctx != NULL)
378  DetectEngineCtxFree(de_ctx);
379 
380  StreamTcpFreeConfig(true);
381  FLOW_DESTROY(&f);
382  UTHFreePacket(p);
383  return result;
384 }
385 
386 /** \test Test the urilen option */
387 static int UriTestSig04(void)
388 {
389  int result = 0;
390  Flow f;
391  HtpState *http_state = NULL;
392  uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n"
393  "User-Agent: Mozilla/1.0\r\n"
394  "Cookie: hellocatch\r\n\r\n";
395  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
396  uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n"
397  "User-Agent: Mozilla/1.0\r\n"
398  "Cookie: hellocatch\r\n\r\n";
399  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
400  TcpSession ssn;
401  Packet *p = NULL;
402  Signature *s = NULL;
403  ThreadVars tv;
404  DetectEngineThreadCtx *det_ctx = NULL;
405  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
406 
407  memset(&tv, 0, sizeof(ThreadVars));
408  memset(&f, 0, sizeof(Flow));
409  memset(&ssn, 0, sizeof(TcpSession));
410 
411  p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP);
412 
413  FLOW_INITIALIZE(&f);
414  f.protoctx = (void *)&ssn;
415  f.proto = IPPROTO_TCP;
416  f.flags |= FLOW_IPV4;
417 
418  p->flow = &f;
419  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
420  p->flowflags |= FLOW_PKT_TOSERVER;
421  p->flowflags |= FLOW_PKT_ESTABLISHED;
422  f.alproto = ALPROTO_HTTP1;
423 
424  StreamTcpInitConfig(true);
425 
426  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
427  if (de_ctx == NULL) {
428  goto end;
429  }
430  de_ctx->flags |= DE_QUIET;
431 
432  s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
433  "(msg:\"Test urilen option\"; "
434  "urilen:>20; sid:1;)");
435  if (s == NULL) {
436  goto end;
437  }
438 
439  SigGroupBuild(de_ctx);
440  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
441 
442  int r = AppLayerParserParse(
443  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
444  if (r != 0) {
445  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
446  goto end;
447  }
448 
449  http_state = f.alstate;
450  if (http_state == NULL) {
451  printf("no http state: ");
452  goto end;
453  }
454 
455  /* do detect */
456  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
457 
458  if (PacketAlertCheck(p, 1)) {
459  printf("sig 1 alerted, but it should not: ");
460  goto end;
461  }
462 
463  r = AppLayerParserParse(
464  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf2, http_buf2_len);
465  if (r != 0) {
466  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
467  goto end;
468  }
469 
470  http_state = f.alstate;
471  if (http_state == NULL) {
472  printf("no http state: ");
473  goto end;
474  }
475 
476  /* do detect */
477  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
478 
479  if (PacketAlertCheck(p, 1)) {
480  printf("sig 1 alerted, but it should not: ");
481  goto end;
482  }
483 
484  result = 1;
485 
486 end:
487  if (alp_tctx != NULL)
488  AppLayerParserThreadCtxFree(alp_tctx);
489  if (det_ctx != NULL)
490  DetectEngineThreadCtxDeinit(&tv, det_ctx);
491  if (de_ctx != NULL)
492  SigGroupCleanup(de_ctx);
493  if (de_ctx != NULL)
494  DetectEngineCtxFree(de_ctx);
495 
496  StreamTcpFreeConfig(true);
497  FLOW_DESTROY(&f);
498  UTHFreePacket(p);
499  return result;
500 }
501 
502 /** \test Test the urilen option */
503 static int UriTestSig05(void)
504 {
505  int result = 0;
506  Flow f;
507  HtpState *http_state = NULL;
508  uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n"
509  "User-Agent: Mozilla/1.0\r\n"
510  "Cookie: hellocatch\r\n\r\n";
511  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
512  uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n"
513  "User-Agent: Mozilla/1.0\r\n"
514  "Cookie: hellocatch\r\n\r\n";
515  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
516  TcpSession ssn;
517  Packet *p = NULL;
518  Signature *s = NULL;
519  ThreadVars tv;
520  DetectEngineThreadCtx *det_ctx = NULL;
521  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
522 
523  memset(&tv, 0, sizeof(ThreadVars));
524  memset(&f, 0, sizeof(Flow));
525  memset(&ssn, 0, sizeof(TcpSession));
526 
527  p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP);
528 
529  FLOW_INITIALIZE(&f);
530  f.protoctx = (void *)&ssn;
531  f.proto = IPPROTO_TCP;
532  f.flags |= FLOW_IPV4;
533 
534  p->flow = &f;
535  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
536  p->flowflags |= FLOW_PKT_TOSERVER;
537  p->flowflags |= FLOW_PKT_ESTABLISHED;
538  f.alproto = ALPROTO_HTTP1;
539 
540  StreamTcpInitConfig(true);
541 
542  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
543  if (de_ctx == NULL) {
544  goto end;
545  }
546  de_ctx->flags |= DE_QUIET;
547 
548  s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
549  "(msg:\"Test urilen option\"; "
550  "urilen:>4; sid:1;)");
551  if (s == NULL) {
552  goto end;
553  }
554 
555  SigGroupBuild(de_ctx);
556  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
557 
558  int r = AppLayerParserParse(
559  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
560  if (r != 0) {
561  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
562  goto end;
563  }
564 
565  http_state = f.alstate;
566  if (http_state == NULL) {
567  printf("no http state: ");
568  goto end;
569  }
570 
571  /* do detect */
572  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
573 
574  if (PacketAlertCheck(p, 1)) {
575  printf("sig 1 alerted, but it should not: ");
576  goto end;
577  }
578 
579  r = AppLayerParserParse(
580  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf2, http_buf2_len);
581  if (r != 0) {
582  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
583  goto end;
584  }
585 
586  http_state = f.alstate;
587  if (http_state == NULL) {
588  printf("no http state: ");
589  goto end;
590  }
591 
592  /* do detect */
593  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
594 
595  if (!PacketAlertCheck(p, 1)) {
596  printf("sig 1 didnt alert with payload2, but it should: ");
597  goto end;
598  }
599 
600  result = 1;
601 
602 end:
603  if (alp_tctx != NULL)
604  AppLayerParserThreadCtxFree(alp_tctx);
605  if (det_ctx != NULL)
606  DetectEngineThreadCtxDeinit(&tv, det_ctx);
607  if (de_ctx != NULL)
608  SigGroupCleanup(de_ctx);
609  if (de_ctx != NULL)
610  DetectEngineCtxFree(de_ctx);
611 
612  StreamTcpFreeConfig(true);
613  FLOW_DESTROY(&f);
614  UTHFreePacket(p);
615  return result;
616 }
617 
618 /** \test Test the pcre /U option */
619 static int UriTestSig06(void)
620 {
621  int result = 0;
622  Flow f;
623  HtpState *http_state = NULL;
624  uint8_t http_buf1[] = "POST /oneoneoneone HTTP/1.0\r\n"
625  "User-Agent: Mozilla/1.0\r\n"
626  "Cookie: hellocatch\r\n\r\n";
627  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
628  uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n"
629  "User-Agent: Mozilla/1.0\r\n"
630  "Cookie: hellocatch\r\n\r\n";
631  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
632  TcpSession ssn;
633  Packet *p = NULL;
634  Signature *s = NULL;
635  ThreadVars tv;
636  DetectEngineThreadCtx *det_ctx = NULL;
637  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
638 
639  memset(&tv, 0, sizeof(ThreadVars));
640  memset(&f, 0, sizeof(Flow));
641  memset(&ssn, 0, sizeof(TcpSession));
642 
643  p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP);
644 
645  FLOW_INITIALIZE(&f);
646  f.protoctx = (void *)&ssn;
647  f.proto = IPPROTO_TCP;
648  f.flags |= FLOW_IPV4;
649 
650  p->flow = &f;
651  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
652  p->flowflags |= FLOW_PKT_TOSERVER;
653  p->flowflags |= FLOW_PKT_ESTABLISHED;
654  f.alproto = ALPROTO_HTTP1;
655 
656  StreamTcpInitConfig(true);
657 
658  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
659  if (de_ctx == NULL) {
660  goto end;
661  }
662  de_ctx->flags |= DE_QUIET;
663 
664  s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
665  "(msg:\"Test pcre /U option\"; "
666  "pcre:/(oneself)+/U; sid:1;)");
667  if (s == NULL) {
668  goto end;
669  }
670 
671  SigGroupBuild(de_ctx);
672  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
673 
674  int r = AppLayerParserParse(
675  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
676  if (r != 0) {
677  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
678  goto end;
679  }
680 
681  http_state = f.alstate;
682  if (http_state == NULL) {
683  printf("no http state: ");
684  goto end;
685  }
686 
687  /* do detect */
688  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
689 
690  if (PacketAlertCheck(p, 1)) {
691  printf("sig 1 alerted, but it should not: ");
692  goto end;
693  }
694 
695  r = AppLayerParserParse(
696  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf2, http_buf2_len);
697  if (r != 0) {
698  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
699  goto end;
700  }
701 
702  http_state = f.alstate;
703  if (http_state == NULL) {
704  printf("no http state: ");
705  goto end;
706  }
707 
708  /* do detect */
709  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
710 
711  if (!PacketAlertCheck(p, 1)) {
712  printf("sig 1 didnt alert on payload2, but it should: ");
713  goto end;
714  }
715 
716  result = 1;
717 
718 end:
719  if (alp_tctx != NULL)
720  AppLayerParserThreadCtxFree(alp_tctx);
721  if (det_ctx != NULL)
722  DetectEngineThreadCtxDeinit(&tv, det_ctx);
723  if (de_ctx != NULL)
724  SigGroupCleanup(de_ctx);
725  if (de_ctx != NULL)
726  DetectEngineCtxFree(de_ctx);
727 
728  StreamTcpFreeConfig(true);
729  FLOW_DESTROY(&f);
730  UTHFreePacket(p);
731  return result;
732 }
733 
734 /** \test Test the pcre /U option in combination with urilen */
735 static int UriTestSig07(void)
736 {
737  int result = 0;
738  Flow f;
739  HtpState *http_state = NULL;
740  uint8_t http_buf1[] = "POST /oneoneoneone HTTP/1.0\r\n"
741  "User-Agent: Mozilla/1.0\r\n"
742  "Cookie: hellocatch\r\n\r\n";
743  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
744  uint8_t http_buf2[] = "POST /oneoneself HTTP/1.0\r\n"
745  "User-Agent: Mozilla/1.0\r\n"
746  "Cookie: hellocatch\r\n\r\n";
747  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
748  TcpSession ssn;
749  Packet *p = NULL;
750  Signature *s = NULL;
751  ThreadVars tv;
752  DetectEngineThreadCtx *det_ctx = NULL;
753  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
754 
755  memset(&tv, 0, sizeof(ThreadVars));
756  memset(&f, 0, sizeof(Flow));
757  memset(&ssn, 0, sizeof(TcpSession));
758 
759  p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP);
760 
761  FLOW_INITIALIZE(&f);
762  f.protoctx = (void *)&ssn;
763  f.proto = IPPROTO_TCP;
764  f.flags |= FLOW_IPV4;
765 
766  p->flow = &f;
767  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
768  p->flowflags |= FLOW_PKT_TOSERVER;
769  p->flowflags |= FLOW_PKT_ESTABLISHED;
770  f.alproto = ALPROTO_HTTP1;
771 
772  StreamTcpInitConfig(true);
773 
774  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
775  if (de_ctx == NULL) {
776  goto end;
777  }
778  de_ctx->flags |= DE_QUIET;
779 
780  s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
781  "(msg:\"Test pcre /U option with urilen \"; "
782  "pcre:/(one){2,}(self)?/U; urilen:3<>20; sid:1;)");
783  if (s == NULL) {
784  goto end;
785  }
786 
787  SigGroupBuild(de_ctx);
788  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
789 
790  int r = AppLayerParserParse(
791  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
792  if (r != 0) {
793  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
794  goto end;
795  }
796 
797  http_state = f.alstate;
798  if (http_state == NULL) {
799  printf("no http state: ");
800  goto end;
801  }
802 
803  /* do detect */
804  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
805 
806  if (!PacketAlertCheck(p, 1)) {
807  printf("sig 1 didnt alert, but it should: ");
808  goto end;
809  }
810 
811  r = AppLayerParserParse(
812  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf2, http_buf2_len);
813  if (r != 0) {
814  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
815  goto end;
816  }
817 
818  http_state = f.alstate;
819  if (http_state == NULL) {
820  printf("no http state: ");
821  goto end;
822  }
823 
824  /* do detect */
825  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
826 
827  if (!PacketAlertCheck(p, 1)) {
828  printf("sig 1 didnt alert with payload2, but it should: ");
829  goto end;
830  }
831 
832  result = 1;
833 
834 end:
835  if (alp_tctx != NULL)
836  AppLayerParserThreadCtxFree(alp_tctx);
837  if (det_ctx != NULL)
838  DetectEngineThreadCtxDeinit(&tv, det_ctx);
839  if (de_ctx != NULL)
840  SigGroupCleanup(de_ctx);
841  if (de_ctx != NULL)
842  DetectEngineCtxFree(de_ctx);
843 
844  StreamTcpFreeConfig(true);
845  FLOW_DESTROY(&f);
846  UTHFreePacket(p);
847  return result;
848 }
849 
850 /** \test Test the pcre /U option in combination with urilen */
851 static int UriTestSig08(void)
852 {
853  int result = 0;
854  Flow f;
855  HtpState *http_state = NULL;
856  uint8_t http_buf1[] = "POST /oneoneoneone HTTP/1.0\r\n"
857  "User-Agent: Mozilla/1.0\r\n"
858  "Cookie: hellocatch\r\n\r\n";
859  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
860  uint8_t http_buf2[] = "POST /oneoneself HTTP/1.0\r\n"
861  "User-Agent: Mozilla/1.0\r\n"
862  "Cookie: hellocatch\r\n\r\n";
863  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
864  TcpSession ssn;
865  Packet *p = NULL;
866  Signature *s = NULL;
867  ThreadVars tv;
868  DetectEngineThreadCtx *det_ctx = NULL;
869  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
870 
871  memset(&tv, 0, sizeof(ThreadVars));
872  memset(&f, 0, sizeof(Flow));
873  memset(&ssn, 0, sizeof(TcpSession));
874 
875  p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP);
876 
877  FLOW_INITIALIZE(&f);
878  f.protoctx = (void *)&ssn;
879  f.proto = IPPROTO_TCP;
880  f.flags |= FLOW_IPV4;
881 
882  p->flow = &f;
883  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
884  p->flowflags |= FLOW_PKT_TOSERVER;
885  p->flowflags |= FLOW_PKT_ESTABLISHED;
886  f.alproto = ALPROTO_HTTP1;
887 
888  StreamTcpInitConfig(true);
889 
890  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
891  if (de_ctx == NULL) {
892  goto end;
893  }
894  de_ctx->flags |= DE_QUIET;
895 
896  s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
897  "(msg:\"Test pcre /U option with urilen\"; "
898  "pcre:/(blabla){2,}(self)?/U; urilen:3<>20; sid:1;)");
899  if (s == NULL) {
900  goto end;
901  }
902 
903  SigGroupBuild(de_ctx);
904  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
905 
906  int r = AppLayerParserParse(
907  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
908  if (r != 0) {
909  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
910  goto end;
911  }
912 
913  http_state = f.alstate;
914  if (http_state == NULL) {
915  printf("no http state: ");
916  goto end;
917  }
918 
919  /* do detect */
920  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
921 
922  if (PacketAlertCheck(p, 1)) {
923  printf("sig 1 alerted, but it should not: ");
924  goto end;
925  }
926 
927  r = AppLayerParserParse(
928  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf2, http_buf2_len);
929  if (r != 0) {
930  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
931  goto end;
932  }
933 
934  http_state = f.alstate;
935  if (http_state == NULL) {
936  printf("no http state: ");
937  goto end;
938  }
939 
940  /* do detect */
941  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
942 
943  if (PacketAlertCheck(p, 1)) {
944  printf("sig 1 alerted, but it should not: ");
945  goto end;
946  }
947 
948  result = 1;
949 
950 end:
951  if (alp_tctx != NULL)
952  AppLayerParserThreadCtxFree(alp_tctx);
953  if (det_ctx != NULL)
954  DetectEngineThreadCtxDeinit(&tv, det_ctx);
955  if (de_ctx != NULL)
956  SigGroupCleanup(de_ctx);
957  if (de_ctx != NULL)
958  DetectEngineCtxFree(de_ctx);
959 
960  StreamTcpFreeConfig(true);
961  FLOW_DESTROY(&f);
962  UTHFreePacket(p);
963  return result;
964 }
965 
966 /** \test Test the pcre /U option in combination with urilen */
967 static int UriTestSig09(void)
968 {
969  int result = 0;
970  Flow f;
971  HtpState *http_state = NULL;
972  uint8_t http_buf1[] = "POST /oneoneoneone HTTP/1.0\r\n"
973  "User-Agent: Mozilla/1.0\r\n"
974  "Cookie: hellocatch\r\n\r\n";
975  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
976  uint8_t http_buf2[] = "POST /oneoneself HTTP/1.0\r\n"
977  "User-Agent: Mozilla/1.0\r\n"
978  "Cookie: hellocatch\r\n\r\n";
979  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
980  TcpSession ssn;
981  Packet *p = NULL;
982  Signature *s = NULL;
983  ThreadVars tv;
984  DetectEngineThreadCtx *det_ctx = NULL;
985  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
986 
987  memset(&tv, 0, sizeof(ThreadVars));
988  memset(&f, 0, sizeof(Flow));
989  memset(&ssn, 0, sizeof(TcpSession));
990 
991  p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP);
992 
993  FLOW_INITIALIZE(&f);
994  f.protoctx = (void *)&ssn;
995  f.proto = IPPROTO_TCP;
996  f.flags |= FLOW_IPV4;
997 
998  p->flow = &f;
999  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1000  p->flowflags |= FLOW_PKT_TOSERVER;
1001  p->flowflags |= FLOW_PKT_ESTABLISHED;
1002  f.alproto = ALPROTO_HTTP1;
1003 
1004  StreamTcpInitConfig(true);
1005 
1006  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1007  if (de_ctx == NULL) {
1008  goto end;
1009  }
1010  de_ctx->flags |= DE_QUIET;
1011 
1012  s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1013  "(msg:\"Test pcre /U option with urilen \"; "
1014  "pcre:/(one){2,}(self)?/U; urilen:<2; sid:1;)");
1015  if (s == NULL) {
1016  goto end;
1017  }
1018 
1019  SigGroupBuild(de_ctx);
1020  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1021 
1022  int r = AppLayerParserParse(
1023  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
1024  if (r != 0) {
1025  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
1026  goto end;
1027  }
1028 
1029  http_state = f.alstate;
1030  if (http_state == NULL) {
1031  printf("no http state: ");
1032  goto end;
1033  }
1034 
1035  /* do detect */
1036  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1037 
1038  if (PacketAlertCheck(p, 1)) {
1039  printf("sig 1 alerted, but it should not: ");
1040  goto end;
1041  }
1042 
1043  r = AppLayerParserParse(
1044  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf2, http_buf2_len);
1045  if (r != 0) {
1046  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
1047  goto end;
1048  }
1049 
1050  http_state = f.alstate;
1051  if (http_state == NULL) {
1052  printf("no http state: ");
1053  goto end;
1054  }
1055 
1056  /* do detect */
1057  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1058 
1059  if (PacketAlertCheck(p, 1)) {
1060  printf("sig 1 alerted, but it should not: ");
1061  goto end;
1062  }
1063 
1064  result = 1;
1065 
1066 end:
1067  if (alp_tctx != NULL)
1068  AppLayerParserThreadCtxFree(alp_tctx);
1069  if (det_ctx != NULL)
1070  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1071  if (de_ctx != NULL)
1072  SigGroupCleanup(de_ctx);
1073  if (de_ctx != NULL)
1074  DetectEngineCtxFree(de_ctx);
1075 
1076  StreamTcpFreeConfig(true);
1077  FLOW_DESTROY(&f);
1078  UTHFreePacket(p);
1079  return result;
1080 }
1081 
1082 /** \test Test uricontent, urilen, pcre /U options */
1083 static int UriTestSig12(void)
1084 {
1085  int result = 0;
1086  Flow f;
1087  HtpState *http_state = NULL;
1088  uint8_t http_buf1[] = "POST /oneoneoneone HTTP/1.0\r\n"
1089  "User-Agent: Mozilla/1.0\r\n"
1090  "Cookie: hellocatch\r\n\r\n";
1091  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
1092  uint8_t http_buf2[] = "POST /oneoneself HTTP/1.0\r\n"
1093  "User-Agent: Mozilla/1.0\r\n"
1094  "Cookie: hellocatch\r\n\r\n";
1095  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
1096  TcpSession ssn;
1097  Packet *p = NULL;
1098  Signature *s = NULL;
1099  ThreadVars tv;
1100  DetectEngineThreadCtx *det_ctx = NULL;
1101  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1102 
1103  memset(&tv, 0, sizeof(ThreadVars));
1104  memset(&f, 0, sizeof(Flow));
1105  memset(&ssn, 0, sizeof(TcpSession));
1106 
1107  p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP);
1108 
1109  FLOW_INITIALIZE(&f);
1110  f.protoctx = (void *)&ssn;
1111  f.proto = IPPROTO_TCP;
1112  f.flags |= FLOW_IPV4;
1113 
1114  p->flow = &f;
1115  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1116  p->flowflags |= FLOW_PKT_TOSERVER;
1117  p->flowflags |= FLOW_PKT_ESTABLISHED;
1118  f.alproto = ALPROTO_HTTP1;
1119 
1120  StreamTcpInitConfig(true);
1121 
1122  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1123  if (de_ctx == NULL) {
1124  goto end;
1125  }
1126  de_ctx->flags |= DE_QUIET;
1127 
1128  s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1129  "(msg:\"Test pcre /U, uricontent and urilen option\"; "
1130  "uricontent:\"one\"; "
1131  "pcre:/(one)+self/U; urilen:>2; sid:1;)");
1132  if (s == NULL) {
1133  goto end;
1134  }
1135 
1136  SigGroupBuild(de_ctx);
1137  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1138 
1139  int r = AppLayerParserParse(
1140  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
1141  if (r != 0) {
1142  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
1143  goto end;
1144  }
1145 
1146  http_state = f.alstate;
1147  if (http_state == NULL) {
1148  printf("no http state: ");
1149  goto end;
1150  }
1151 
1152  /* do detect */
1153  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1154 
1155  if (PacketAlertCheck(p, 1)) {
1156  printf("sig 1 alerted, but it should not: ");
1157  goto end;
1158  }
1159 
1160  r = AppLayerParserParse(
1161  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf2, http_buf2_len);
1162  if (r != 0) {
1163  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
1164  goto end;
1165  }
1166 
1167  http_state = f.alstate;
1168  if (http_state == NULL) {
1169  printf("no http state: ");
1170  goto end;
1171  }
1172 
1173  /* do detect */
1174  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1175 
1176  if (!PacketAlertCheck(p, 1)) {
1177  printf("sig 1 didnt alert with payload2, but it should: ");
1178  goto end;
1179  }
1180 
1181  result = 1;
1182 
1183 end:
1184  if (alp_tctx != NULL)
1185  AppLayerParserThreadCtxFree(alp_tctx);
1186  if (det_ctx != NULL)
1187  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1188  if (de_ctx != NULL)
1189  SigGroupCleanup(de_ctx);
1190  if (de_ctx != NULL)
1191  DetectEngineCtxFree(de_ctx);
1192 
1193  StreamTcpFreeConfig(true);
1194  FLOW_DESTROY(&f);
1195  UTHFreePacket(p);
1196  return result;
1197 }
1198 
1199 /** \test Test uricontent, urilen */
1200 static int UriTestSig13(void)
1201 {
1202  int result = 0;
1203  Flow f;
1204  HtpState *http_state = NULL;
1205  uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n"
1206  "User-Agent: Mozilla/1.0\r\n"
1207  "Cookie: hellocatch\r\n\r\n";
1208  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
1209  uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n"
1210  "User-Agent: Mozilla/1.0\r\n"
1211  "Cookie: hellocatch\r\n\r\n";
1212  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
1213  TcpSession ssn;
1214  Packet *p = NULL;
1215  Signature *s = NULL;
1216  ThreadVars tv;
1217  DetectEngineThreadCtx *det_ctx = NULL;
1218  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1219 
1220  memset(&tv, 0, sizeof(ThreadVars));
1221  memset(&f, 0, sizeof(Flow));
1222  memset(&ssn, 0, sizeof(TcpSession));
1223 
1224  p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP);
1225 
1226  FLOW_INITIALIZE(&f);
1227  f.protoctx = (void *)&ssn;
1228  f.proto = IPPROTO_TCP;
1229  f.flags |= FLOW_IPV4;
1230 
1231  p->flow = &f;
1232  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1233  p->flowflags |= FLOW_PKT_TOSERVER;
1234  p->flowflags |= FLOW_PKT_ESTABLISHED;
1235  f.alproto = ALPROTO_HTTP1;
1236 
1237  StreamTcpInitConfig(true);
1238 
1239  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1240  if (de_ctx == NULL) {
1241  goto end;
1242  }
1243  de_ctx->flags |= DE_QUIET;
1244 
1245  s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1246  "(msg:\"Test urilen option\"; "
1247  "urilen:>2; uricontent:\"one\"; sid:1;)");
1248  if (s == NULL) {
1249  goto end;
1250  }
1251 
1252  SigGroupBuild(de_ctx);
1253  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1254 
1255  int r = AppLayerParserParse(
1256  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
1257  if (r != 0) {
1258  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
1259  goto end;
1260  }
1261 
1262  http_state = f.alstate;
1263  if (http_state == NULL) {
1264  printf("no http state: ");
1265  goto end;
1266  }
1267 
1268  /* do detect */
1269  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1270 
1271  if (!PacketAlertCheck(p, 1)) {
1272  printf("sig 1 didnt alert with pkt, but it should: ");
1273  goto end;
1274  }
1275 
1276  r = AppLayerParserParse(
1277  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf2, http_buf2_len);
1278  if (r != 0) {
1279  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
1280  goto end;
1281  }
1282 
1283  http_state = f.alstate;
1284  if (http_state == NULL) {
1285  printf("no http state: ");
1286  goto end;
1287  }
1288 
1289  /* do detect */
1290  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1291 
1292 
1293  if (!PacketAlertCheck(p, 1)) {
1294  printf("sig 1 didnt alert with payload2, but it should: ");
1295  goto end;
1296  }
1297 
1298  result = 1;
1299 
1300 end:
1301  if (alp_tctx != NULL)
1302  AppLayerParserThreadCtxFree(alp_tctx);
1303  if (det_ctx != NULL)
1304  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1305  if (de_ctx != NULL)
1306  SigGroupCleanup(de_ctx);
1307  if (de_ctx != NULL)
1308  DetectEngineCtxFree(de_ctx);
1309 
1310  StreamTcpFreeConfig(true);
1311  FLOW_DESTROY(&f);
1312  UTHFreePacket(p);
1313  return result;
1314 }
1315 
1316 /** \test Test uricontent, pcre /U */
1317 static int UriTestSig14(void)
1318 {
1319  int result = 0;
1320  Flow f;
1321  HtpState *http_state = NULL;
1322  uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n"
1323  "User-Agent: Mozilla/1.0\r\n"
1324  "Cookie: hellocatch\r\n\r\n";
1325  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
1326  uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n"
1327  "User-Agent: Mozilla/1.0\r\n"
1328  "Cookie: hellocatch\r\n\r\n";
1329  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
1330  TcpSession ssn;
1331  Packet *p = NULL;
1332  Signature *s = NULL;
1333  ThreadVars tv;
1334  DetectEngineThreadCtx *det_ctx = NULL;
1335  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1336 
1337  memset(&tv, 0, sizeof(ThreadVars));
1338  memset(&f, 0, sizeof(Flow));
1339  memset(&ssn, 0, sizeof(TcpSession));
1340 
1341  p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP);
1342 
1343  FLOW_INITIALIZE(&f);
1344  f.protoctx = (void *)&ssn;
1345  f.proto = IPPROTO_TCP;
1346  f.flags |= FLOW_IPV4;
1347 
1348  p->flow = &f;
1349  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1350  p->flowflags |= FLOW_PKT_TOSERVER;
1351  p->flowflags |= FLOW_PKT_ESTABLISHED;
1352  f.alproto = ALPROTO_HTTP1;
1353 
1354  StreamTcpInitConfig(true);
1355 
1356  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1357  if (de_ctx == NULL) {
1358  goto end;
1359  }
1360  de_ctx->flags |= DE_QUIET;
1361 
1362  s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1363  "(msg:\"Test uricontent option\"; "
1364  "uricontent:\"one\"; pcre:/one(self)?/U;sid:1;)");
1365  if (s == NULL) {
1366  goto end;
1367  }
1368 
1369  SigGroupBuild(de_ctx);
1370  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1371 
1372  int r = AppLayerParserParse(
1373  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
1374  if (r != 0) {
1375  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
1376  goto end;
1377  }
1378 
1379  http_state = f.alstate;
1380  if (http_state == NULL) {
1381  printf("no http state: ");
1382  goto end;
1383  }
1384 
1385  /* do detect */
1386  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1387 
1388  if (!PacketAlertCheck(p, 1)) {
1389  printf("sig 1 didnt alert with pkt, but it should: ");
1390  goto end;
1391  }
1392 
1393  r = AppLayerParserParse(
1394  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf2, http_buf2_len);
1395  if (r != 0) {
1396  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
1397  goto end;
1398  }
1399 
1400  http_state = f.alstate;
1401  if (http_state == NULL) {
1402  printf("no http state: ");
1403  goto end;
1404  }
1405 
1406  /* do detect */
1407  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1408 
1409 
1410  if (!PacketAlertCheck(p, 1)) {
1411  printf("sig 1 didnt alert with payload2, but it should: ");
1412  goto end;
1413  }
1414 
1415  result = 1;
1416 
1417 end:
1418  if (alp_tctx != NULL)
1419  AppLayerParserThreadCtxFree(alp_tctx);
1420  if (det_ctx != NULL)
1421  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1422  if (de_ctx != NULL)
1423  SigGroupCleanup(de_ctx);
1424  if (de_ctx != NULL)
1425  DetectEngineCtxFree(de_ctx);
1426 
1427  StreamTcpFreeConfig(true);
1428  FLOW_DESTROY(&f);
1429  UTHFreePacket(p);
1430  return result;
1431 }
1432 
1433 /** \test Test pcre /U with anchored regex (bug 155) */
1434 static int UriTestSig15(void)
1435 {
1436  int result = 0;
1437  Flow f;
1438  HtpState *http_state = NULL;
1439  uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n"
1440  "User-Agent: Mozilla/1.0\r\n"
1441  "Cookie: hellocatch\r\n\r\n";
1442  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
1443  uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n"
1444  "User-Agent: Mozilla/1.0\r\n"
1445  "Cookie: hellocatch\r\n\r\n";
1446  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
1447  TcpSession ssn;
1448  Packet *p = NULL;
1449  Signature *s = NULL;
1450  ThreadVars tv;
1451  DetectEngineThreadCtx *det_ctx = NULL;
1452  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1453 
1454  memset(&tv, 0, sizeof(ThreadVars));
1455  memset(&f, 0, sizeof(Flow));
1456  memset(&ssn, 0, sizeof(TcpSession));
1457 
1458  p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP);
1459 
1460  FLOW_INITIALIZE(&f);
1461  f.protoctx = (void *)&ssn;
1462  f.proto = IPPROTO_TCP;
1463  f.flags |= FLOW_IPV4;
1464 
1465  p->flow = &f;
1466  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1467  p->flowflags |= FLOW_PKT_TOSERVER;
1468  p->flowflags |= FLOW_PKT_ESTABLISHED;
1469  f.alproto = ALPROTO_HTTP1;
1470 
1471  StreamTcpInitConfig(true);
1472 
1473  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1474  if (de_ctx == NULL) {
1475  goto end;
1476  }
1477  de_ctx->flags |= DE_QUIET;
1478 
1479  s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1480  "(msg:\"Test uricontent option\"; "
1481  "uricontent:\"one\"; pcre:/^\\/one(self)?$/U;sid:1;)");
1482  if (s == NULL) {
1483  goto end;
1484  }
1485 
1486  SigGroupBuild(de_ctx);
1487  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1488 
1489  int r = AppLayerParserParse(
1490  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
1491  if (r != 0) {
1492  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
1493  goto end;
1494  }
1495 
1496  http_state = f.alstate;
1497  if (http_state == NULL) {
1498  printf("no http state: ");
1499  goto end;
1500  }
1501 
1502  /* do detect */
1503  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1504 
1505  if (!PacketAlertCheck(p, 1)) {
1506  printf("sig 1 didnt alert with pkt, but it should: ");
1507  goto end;
1508  }
1509 
1510  r = AppLayerParserParse(
1511  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf2, http_buf2_len);
1512  if (r != 0) {
1513  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
1514  goto end;
1515  }
1516 
1517  http_state = f.alstate;
1518  if (http_state == NULL) {
1519  printf("no http state: ");
1520  goto end;
1521  }
1522 
1523  /* do detect */
1524  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1525 
1526 
1527  if (!PacketAlertCheck(p, 1)) {
1528  printf("sig 1 didnt alert with payload2, but it should: ");
1529  goto end;
1530  }
1531 
1532  result = 1;
1533 
1534 end:
1535  if (alp_tctx != NULL)
1536  AppLayerParserThreadCtxFree(alp_tctx);
1537  if (det_ctx != NULL)
1538  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1539  if (de_ctx != NULL)
1540  SigGroupCleanup(de_ctx);
1541  if (de_ctx != NULL)
1542  DetectEngineCtxFree(de_ctx);
1543 
1544  StreamTcpFreeConfig(true);
1545  FLOW_DESTROY(&f);
1546  UTHFreePacket(p);
1547  return result;
1548 }
1549 
1550 /** \test Test pcre /U with anchored regex (bug 155) */
1551 static int UriTestSig16(void)
1552 {
1553  HtpState *http_state = NULL;
1554  uint8_t http_buf1[] = "POST /search?q=123&aq=7123abcee HTTP/1.0\r\n"
1555  "User-Agent: Mozilla/1.0/\r\n"
1556  "Host: 1.2.3.4\r\n\r\n";
1557  uint32_t http_buf1_len = sizeof(http_buf1) - 1;
1558  uint8_t http_buf2[] = "POST /search?q=123&aq=7123abcee HTTP/1.0\r\n"
1559  "User-Agent: Mozilla/1.0\r\n"
1560  "Cookie: hellocatch\r\n\r\n";
1561  uint32_t http_buf2_len = sizeof(http_buf2) - 1;
1562  TcpSession ssn;
1563  Signature *s = NULL;
1564  ThreadVars tv;
1565  DetectEngineThreadCtx *det_ctx = NULL;
1566  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1567 
1568  memset(&tv, 0, sizeof(ThreadVars));
1569  memset(&ssn, 0, sizeof(TcpSession));
1570  StreamTcpInitConfig(true);
1571 
1572  Packet *p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP);
1573  FAIL_IF_NULL(p);
1574  p->tcph->th_seq = htonl(1000);
1575  Flow *f = UTHBuildFlow(AF_INET, "192.168.1.5", "192.168.1.1", 41424, 80);
1576  FAIL_IF_NULL(f);
1577  f->proto = IPPROTO_TCP;
1578 
1579  UTHAddSessionToFlow(f, 1000, 1000);
1580  UTHAddStreamToFlow(f, 0, http_buf1, http_buf1_len);
1581 
1582  p->flow = f;
1583  p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST | PKT_DETECT_HAS_STREAMDATA;
1584  p->flowflags |= FLOW_PKT_TOSERVER;
1585  p->flowflags |= FLOW_PKT_ESTABLISHED;
1586  f->alproto = ALPROTO_HTTP1;
1587 
1588  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1589  FAIL_IF_NULL(de_ctx);
1590  de_ctx->flags |= DE_QUIET;
1591 
1592  s = de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any any (flow:to_server,established; uricontent:\"/search?q=\"; pcre:\"/^\\/search\\?q=[0-9]{1,3}(&aq=7(\\?[0-9a-f]{8})?)?/U\"; pcre:\"/\\x0d\\x0aHost\\: \\d+\\.\\d+\\.\\d+\\.\\d+\\x0d\\x0a/\"; sid:2009024; rev:9;)");
1593  FAIL_IF_NULL(s);
1594 
1595  SigGroupBuild(de_ctx);
1596  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1597 
1598  UTHAddStreamToFlow(f, 0, http_buf2, http_buf2_len);
1599 
1600  int r = AppLayerParserParse(
1601  NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf1, http_buf1_len);
1602  FAIL_IF(r != 0);
1603 
1604  http_state = f->alstate;
1605  FAIL_IF_NULL(http_state);
1606 
1607  /* do detect */
1608  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1609  FAIL_IF(!PacketAlertCheck(p, 2009024));
1610  p->alerts.cnt = 0;
1611 
1612  p->payload = http_buf2;
1613  p->payload_len = http_buf2_len;
1614 
1615  r = AppLayerParserParse(
1616  NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf2, http_buf2_len);
1617  FAIL_IF(r != 0);
1618 
1619  http_state = f->alstate;
1620  FAIL_IF_NULL(http_state);
1621 
1622  /* do detect */
1623  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1624  FAIL_IF(PacketAlertCheck(p, 2009024));
1625 
1626  AppLayerParserThreadCtxFree(alp_tctx);
1627  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1628  DetectEngineCtxFree(de_ctx);
1629 
1630  UTHRemoveSessionFromFlow(f);
1631  UTHFreeFlow(f);
1632 
1633  StreamTcpFreeConfig(true);
1634  UTHFreePacket(p);
1635  PASS;
1636 }
1637 
1638 /**
1639  * \test Test multiple relative contents
1640  */
1641 static int UriTestSig17(void)
1642 {
1643  int result = 0;
1644  uint8_t *http_buf = (uint8_t *)"POST /now_this_is_is_big_big_string_now HTTP/1.0\r\n"
1645  "User-Agent: Mozilla/1.0\r\n";
1646  uint32_t http_buf_len = strlen((char *)http_buf);
1647  Flow f;
1648  TcpSession ssn;
1649  HtpState *http_state = NULL;
1650  Packet *p = NULL;
1651  ThreadVars tv;
1652  DetectEngineThreadCtx *det_ctx = NULL;
1653  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1654 
1655  memset(&tv, 0, sizeof(ThreadVars));
1656  memset(&f, 0, sizeof(Flow));
1657  memset(&ssn, 0, sizeof(TcpSession));
1658 
1659  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
1660 
1661  FLOW_INITIALIZE(&f);
1662  f.protoctx = (void *)&ssn;
1663  f.proto = IPPROTO_TCP;
1664  f.flags |= FLOW_IPV4;
1665 
1666  p->flow = &f;
1667  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1668  p->flowflags |= FLOW_PKT_TOSERVER;
1669  p->flowflags |= FLOW_PKT_ESTABLISHED;
1670  f.alproto = ALPROTO_HTTP1;
1671 
1672  StreamTcpInitConfig(true);
1673 
1674  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1675  if (de_ctx == NULL) {
1676  goto end;
1677  }
1678  de_ctx->flags |= DE_QUIET;
1679 
1680  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1681  "(msg:\"test multiple relative uricontents\"; "
1682  "uricontent:\"this\"; uricontent:\"is\"; within:6; "
1683  "uricontent:\"big\"; within:8; "
1684  "uricontent:\"string\"; within:8; sid:1;)");
1685  if (de_ctx->sig_list == NULL) {
1686  goto end;
1687  }
1688 
1689  SigGroupBuild(de_ctx);
1690  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1691 
1692  int r = AppLayerParserParse(
1693  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
1694  if (r != 0) {
1695  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
1696  goto end;
1697  }
1698 
1699  http_state = f.alstate;
1700  if (http_state == NULL) {
1701  printf("no http state: ");
1702  goto end;
1703  }
1704 
1705  /* do detect */
1706  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1707 
1708  if (!PacketAlertCheck(p, 1)) {
1709  printf("sig 1 alerted, but it should not: ");
1710  goto end;
1711  }
1712 
1713  result = 1;
1714 
1715 end:
1716  if (alp_tctx != NULL)
1717  AppLayerParserThreadCtxFree(alp_tctx);
1718  if (det_ctx != NULL)
1719  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1720  if (de_ctx != NULL)
1721  SigGroupCleanup(de_ctx);
1722  if (de_ctx != NULL)
1723  DetectEngineCtxFree(de_ctx);
1724 
1725  StreamTcpFreeConfig(true);
1726  FLOW_DESTROY(&f);
1727  UTHFreePacket(p);
1728  return result;
1729 }
1730 
1731 /**
1732  * \test Test multiple relative contents
1733  */
1734 static int UriTestSig18(void)
1735 {
1736  int result = 0;
1737  uint8_t *http_buf = (uint8_t *)"POST /now_this_is_is_is_big_big_big_string_now HTTP/1.0\r\n"
1738  "User-Agent: Mozilla/1.0\r\n";
1739  uint32_t http_buf_len = strlen((char *)http_buf);
1740  Flow f;
1741  TcpSession ssn;
1742  HtpState *http_state = NULL;
1743  Packet *p = NULL;
1744  ThreadVars tv;
1745  DetectEngineThreadCtx *det_ctx = NULL;
1746  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1747 
1748  memset(&tv, 0, sizeof(ThreadVars));
1749  memset(&f, 0, sizeof(Flow));
1750  memset(&ssn, 0, sizeof(TcpSession));
1751 
1752  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
1753 
1754  FLOW_INITIALIZE(&f);
1755  f.protoctx = (void *)&ssn;
1756  f.proto = IPPROTO_TCP;
1757  f.flags |= FLOW_IPV4;
1758 
1759  p->flow = &f;
1760  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1761  p->flowflags |= FLOW_PKT_TOSERVER;
1762  p->flowflags |= FLOW_PKT_ESTABLISHED;
1763  f.alproto = ALPROTO_HTTP1;
1764 
1765  StreamTcpInitConfig(true);
1766 
1767  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1768  if (de_ctx == NULL) {
1769  goto end;
1770  }
1771  de_ctx->flags |= DE_QUIET;
1772 
1773  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1774  "(msg:\"test multiple relative uricontents\"; "
1775  "uricontent:\"this\"; uricontent:\"is\"; within:9; "
1776  "uricontent:\"big\"; within:12; "
1777  "uricontent:\"string\"; within:8; sid:1;)");
1778  if (de_ctx->sig_list == NULL) {
1779  goto end;
1780  }
1781 
1782  SigGroupBuild(de_ctx);
1783  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1784 
1785  int r = AppLayerParserParse(
1786  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
1787  if (r != 0) {
1788  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
1789  goto end;
1790  }
1791 
1792  http_state = f.alstate;
1793  if (http_state == NULL) {
1794  printf("no http state: ");
1795  goto end;
1796  }
1797 
1798  /* do detect */
1799  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1800 
1801  if (!PacketAlertCheck(p, 1)) {
1802  printf("sig 1 alerted, but it should not: ");
1803  goto end;
1804  }
1805 
1806  result = 1;
1807 
1808 end:
1809  if (alp_tctx != NULL)
1810  AppLayerParserThreadCtxFree(alp_tctx);
1811  if (det_ctx != NULL)
1812  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1813  if (de_ctx != NULL)
1814  SigGroupCleanup(de_ctx);
1815  if (de_ctx != NULL)
1816  DetectEngineCtxFree(de_ctx);
1817 
1818  StreamTcpFreeConfig(true);
1819  FLOW_DESTROY(&f);
1820  UTHFreePacket(p);
1821  return result;
1822 }
1823 
1824 /**
1825  * \test Test multiple relative contents
1826  */
1827 static int UriTestSig19(void)
1828 {
1829  int result = 0;
1830  uint8_t *http_buf = (uint8_t *)"POST /this_this_now_is_is_____big_string_now HTTP/1.0\r\n"
1831  "User-Agent: Mozilla/1.0\r\n";
1832  uint32_t http_buf_len = strlen((char *)http_buf);
1833  Flow f;
1834  TcpSession ssn;
1835  HtpState *http_state = NULL;
1836  Packet *p = NULL;
1837  ThreadVars tv;
1838  DetectEngineThreadCtx *det_ctx = NULL;
1839  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1840 
1841  memset(&tv, 0, sizeof(ThreadVars));
1842  memset(&f, 0, sizeof(Flow));
1843  memset(&ssn, 0, sizeof(TcpSession));
1844 
1845  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
1846 
1847  FLOW_INITIALIZE(&f);
1848  f.protoctx = (void *)&ssn;
1849  f.proto = IPPROTO_TCP;
1850  f.flags |= FLOW_IPV4;
1851 
1852  p->flow = &f;
1853  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1854  p->flowflags |= FLOW_PKT_TOSERVER;
1855  p->flowflags |= FLOW_PKT_ESTABLISHED;
1856  f.alproto = ALPROTO_HTTP1;
1857 
1858  StreamTcpInitConfig(true);
1859 
1860  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1861  if (de_ctx == NULL) {
1862  goto end;
1863  }
1864  de_ctx->flags |= DE_QUIET;
1865 
1866  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1867  "(msg:\"test multiple relative uricontents\"; "
1868  "uricontent:\"now\"; uricontent:\"this\"; "
1869  "uricontent:\"is\"; within:12; "
1870  "uricontent:\"big\"; within:8; "
1871  "uricontent:\"string\"; within:8; sid:1;)");
1872  if (de_ctx->sig_list == NULL) {
1873  goto end;
1874  }
1875 
1876  SigGroupBuild(de_ctx);
1877  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1878 
1879  int r = AppLayerParserParse(
1880  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
1881  if (r != 0) {
1882  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
1883  goto end;
1884  }
1885 
1886  http_state = f.alstate;
1887  if (http_state == NULL) {
1888  printf("no http state: ");
1889  goto end;
1890  }
1891 
1892  /* do detect */
1893  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1894 
1895  if (!PacketAlertCheck(p, 1)) {
1896  printf("sig 1 alerted, but it should not: ");
1897  goto end;
1898  }
1899 
1900  result = 1;
1901 
1902 end:
1903  if (alp_tctx != NULL)
1904  AppLayerParserThreadCtxFree(alp_tctx);
1905  if (det_ctx != NULL)
1906  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1907  if (de_ctx != NULL)
1908  SigGroupCleanup(de_ctx);
1909  if (de_ctx != NULL)
1910  DetectEngineCtxFree(de_ctx);
1911 
1912  StreamTcpFreeConfig(true);
1913  FLOW_DESTROY(&f);
1914  UTHFreePacket(p);
1915  return result;
1916 }
1917 
1918 /**
1919  * \test Test multiple relative contents with offset
1920  */
1921 static int UriTestSig20(void)
1922 {
1923  int result = 0;
1924  uint8_t *http_buf = (uint8_t *)"POST /_________thus_thus_is_a_big HTTP/1.0\r\n"
1925  "User-Agent: Mozilla/1.0\r\n";
1926  uint32_t http_buf_len = strlen((char *)http_buf);
1927  Flow f;
1928  TcpSession ssn;
1929  HtpState *http_state = NULL;
1930  Packet *p = NULL;
1931  ThreadVars tv;
1932  DetectEngineThreadCtx *det_ctx = NULL;
1933  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1934 
1935  memset(&tv, 0, sizeof(ThreadVars));
1936  memset(&f, 0, sizeof(Flow));
1937  memset(&ssn, 0, sizeof(TcpSession));
1938 
1939  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
1940 
1941  FLOW_INITIALIZE(&f);
1942  f.protoctx = (void *)&ssn;
1943  f.proto = IPPROTO_TCP;
1944  f.flags |= FLOW_IPV4;
1945 
1946  p->flow = &f;
1947  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1948  p->flowflags |= FLOW_PKT_TOSERVER;
1949  p->flowflags |= FLOW_PKT_ESTABLISHED;
1950  f.alproto = ALPROTO_HTTP1;
1951 
1952  StreamTcpInitConfig(true);
1953 
1954  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1955  if (de_ctx == NULL) {
1956  goto end;
1957  }
1958  de_ctx->flags |= DE_QUIET;
1959 
1960  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1961  "(msg:\"test multiple relative uricontents\"; "
1962  "uricontent:\"thus\"; offset:8; "
1963  "uricontent:\"is\"; within:6; "
1964  "uricontent:\"big\"; within:8; sid:1;)");
1965  if (de_ctx->sig_list == NULL) {
1966  goto end;
1967  }
1968 
1969  SigGroupBuild(de_ctx);
1970  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1971 
1972  int r = AppLayerParserParse(
1973  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
1974  if (r != 0) {
1975  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
1976  goto end;
1977  }
1978 
1979  http_state = f.alstate;
1980  if (http_state == NULL) {
1981  printf("no http state: ");
1982  goto end;
1983  }
1984 
1985  /* do detect */
1986  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
1987 
1988  if (!PacketAlertCheck(p, 1)) {
1989  printf("sig 1 alerted, but it should not: ");
1990  goto end;
1991  }
1992 
1993  result = 1;
1994 
1995 end:
1996  if (alp_tctx != NULL)
1997  AppLayerParserThreadCtxFree(alp_tctx);
1998  if (det_ctx != NULL)
1999  DetectEngineThreadCtxDeinit(&tv, det_ctx);
2000  if (de_ctx != NULL)
2001  SigGroupCleanup(de_ctx);
2002  if (de_ctx != NULL)
2003  DetectEngineCtxFree(de_ctx);
2004 
2005  StreamTcpFreeConfig(true);
2006  FLOW_DESTROY(&f);
2007  UTHFreePacket(p);
2008  return result;
2009 }
2010 
2011 /**
2012  * \test Test multiple relative contents with a negated content.
2013  */
2014 static int UriTestSig21(void)
2015 {
2016  int result = 0;
2017  uint8_t *http_buf = (uint8_t *)"POST /we_need_to_fix_this_and_yes_fix_this_now HTTP/1.0\r\n"
2018  "User-Agent: Mozilla/1.0\r\n";
2019  uint32_t http_buf_len = strlen((char *)http_buf);
2020  Flow f;
2021  TcpSession ssn;
2022  HtpState *http_state = NULL;
2023  Packet *p = NULL;
2024  ThreadVars tv;
2025  DetectEngineThreadCtx *det_ctx = NULL;
2026  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2027 
2028  memset(&tv, 0, sizeof(ThreadVars));
2029  memset(&f, 0, sizeof(Flow));
2030  memset(&ssn, 0, sizeof(TcpSession));
2031 
2032  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
2033 
2034  FLOW_INITIALIZE(&f);
2035  f.protoctx = (void *)&ssn;
2036  f.proto = IPPROTO_TCP;
2037  f.flags |= FLOW_IPV4;
2038 
2039  p->flow = &f;
2040  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
2041  p->flowflags |= FLOW_PKT_TOSERVER;
2042  p->flowflags |= FLOW_PKT_ESTABLISHED;
2043  f.alproto = ALPROTO_HTTP1;
2044 
2045  StreamTcpInitConfig(true);
2046 
2047  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2048  if (de_ctx == NULL) {
2049  goto end;
2050  }
2051  de_ctx->flags |= DE_QUIET;
2052 
2053  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2054  "(msg:\"test multiple relative uricontents\"; "
2055  "uricontent:\"fix\"; uricontent:\"this\"; within:6; "
2056  "uricontent:!\"and\"; distance:0; sid:1;)");
2057  if (de_ctx->sig_list == NULL) {
2058  goto end;
2059  }
2060 
2061  SigGroupBuild(de_ctx);
2062  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
2063 
2064  int r = AppLayerParserParse(
2065  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
2066  if (r != 0) {
2067  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
2068  goto end;
2069  }
2070 
2071  http_state = f.alstate;
2072  if (http_state == NULL) {
2073  printf("no http state: ");
2074  goto end;
2075  }
2076 
2077  /* do detect */
2078  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
2079 
2080  if (!PacketAlertCheck(p, 1)) {
2081  printf("sig 1 alerted, but it should not: ");
2082  goto end;
2083  }
2084 
2085  result = 1;
2086 
2087 end:
2088  if (alp_tctx != NULL)
2089  AppLayerParserThreadCtxFree(alp_tctx);
2090  if (det_ctx != NULL)
2091  DetectEngineThreadCtxDeinit(&tv, det_ctx);
2092  if (de_ctx != NULL)
2093  SigGroupCleanup(de_ctx);
2094  if (de_ctx != NULL)
2095  DetectEngineCtxFree(de_ctx);
2096 
2097  StreamTcpFreeConfig(true);
2098  FLOW_DESTROY(&f);
2099  UTHFreePacket(p);
2100  return result;
2101 }
2102 
2103 /**
2104  * \test Test relative pcre.
2105  */
2106 static int UriTestSig22(void)
2107 {
2108  int result = 0;
2109  uint8_t *http_buf = (uint8_t *)"POST /this_is_a_super_duper_"
2110  "nova_in_super_nova_now HTTP/1.0\r\n"
2111  "User-Agent: Mozilla/1.0\r\n";
2112  uint32_t http_buf_len = strlen((char *)http_buf);
2113  Flow f;
2114  TcpSession ssn;
2115  HtpState *http_state = NULL;
2116  Packet *p = NULL;
2117  ThreadVars tv;
2118  DetectEngineThreadCtx *det_ctx = NULL;
2119  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2120 
2121  memset(&tv, 0, sizeof(ThreadVars));
2122  memset(&f, 0, sizeof(Flow));
2123  memset(&ssn, 0, sizeof(TcpSession));
2124 
2125  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
2126 
2127  FLOW_INITIALIZE(&f);
2128  f.protoctx = (void *)&ssn;
2129  f.proto = IPPROTO_TCP;
2130  f.flags |= FLOW_IPV4;
2131 
2132  p->flow = &f;
2133  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
2134  p->flowflags |= FLOW_PKT_TOSERVER;
2135  p->flowflags |= FLOW_PKT_ESTABLISHED;
2136  f.alproto = ALPROTO_HTTP1;
2137 
2138  StreamTcpInitConfig(true);
2139 
2140  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2141  if (de_ctx == NULL) {
2142  goto end;
2143  }
2144  de_ctx->flags |= DE_QUIET;
2145 
2146  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2147  "(msg:\"test multiple relative uricontents\"; "
2148  "pcre:/super/U; uricontent:\"nova\"; within:7; sid:1;)");
2149  if (de_ctx->sig_list == NULL) {
2150  goto end;
2151  }
2152 
2153  SigGroupBuild(de_ctx);
2154  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
2155 
2156  int r = AppLayerParserParse(
2157  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
2158  if (r != 0) {
2159  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
2160  goto end;
2161  }
2162 
2163  http_state = f.alstate;
2164  if (http_state == NULL) {
2165  printf("no http state: ");
2166  goto end;
2167  }
2168 
2169  /* do detect */
2170  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
2171 
2172  if (!PacketAlertCheck(p, 1)) {
2173  printf("sig 1 didn't alert, but it should have: ");
2174  goto end;
2175  }
2176 
2177  result = 1;
2178 
2179 end:
2180  if (alp_tctx != NULL)
2181  AppLayerParserThreadCtxFree(alp_tctx);
2182  if (det_ctx != NULL)
2183  DetectEngineThreadCtxDeinit(&tv, det_ctx);
2184  if (de_ctx != NULL)
2185  SigGroupCleanup(de_ctx);
2186  if (de_ctx != NULL)
2187  DetectEngineCtxFree(de_ctx);
2188 
2189  StreamTcpFreeConfig(true);
2190  FLOW_DESTROY(&f);
2191  UTHFreePacket(p);
2192  return result;
2193 }
2194 
2195 /**
2196  * \test Test multiple relative contents with a negated content.
2197  */
2198 static int UriTestSig23(void)
2199 {
2200  int result = 0;
2201  uint8_t *http_buf = (uint8_t *)"POST /we_need_to_fix_this_and_yes_fix_this_now HTTP/1.0\r\n"
2202  "User-Agent: Mozilla/1.0\r\n";
2203  uint32_t http_buf_len = strlen((char *)http_buf);
2204  Flow f;
2205  TcpSession ssn;
2206  HtpState *http_state = NULL;
2207  Packet *p = NULL;
2208  ThreadVars tv;
2209  DetectEngineThreadCtx *det_ctx = NULL;
2210  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2211 
2212  memset(&tv, 0, sizeof(ThreadVars));
2213  memset(&f, 0, sizeof(Flow));
2214  memset(&ssn, 0, sizeof(TcpSession));
2215 
2216  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
2217 
2218  FLOW_INITIALIZE(&f);
2219  f.protoctx = (void *)&ssn;
2220  f.proto = IPPROTO_TCP;
2221  f.flags |= FLOW_IPV4;
2222 
2223  p->flow = &f;
2224  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
2225  p->flowflags |= FLOW_PKT_TOSERVER;
2226  p->flowflags |= FLOW_PKT_ESTABLISHED;
2227  f.alproto = ALPROTO_HTTP1;
2228 
2229  StreamTcpInitConfig(true);
2230 
2231  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2232  if (de_ctx == NULL) {
2233  goto end;
2234  }
2235  de_ctx->flags |= DE_QUIET;
2236 
2237  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2238  "(msg:\"test multiple relative uricontents\"; "
2239  "uricontent:!\"fix_this_now\"; sid:1;)");
2240  if (de_ctx->sig_list == NULL) {
2241  goto end;
2242  }
2243 
2244  SigGroupBuild(de_ctx);
2245  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
2246 
2247  int r = AppLayerParserParse(
2248  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
2249  if (r != 0) {
2250  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
2251  goto end;
2252  }
2253 
2254  http_state = f.alstate;
2255  if (http_state == NULL) {
2256  printf("no http state: ");
2257  goto end;
2258  }
2259 
2260  /* do detect */
2261  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
2262 
2263  if (PacketAlertCheck(p, 1)) {
2264  printf("sig 1 alerted, but it should not: ");
2265  goto end;
2266  }
2267 
2268  result = 1;
2269 
2270 end:
2271  if (alp_tctx != NULL)
2272  AppLayerParserThreadCtxFree(alp_tctx);
2273  if (det_ctx != NULL)
2274  DetectEngineThreadCtxDeinit(&tv, det_ctx);
2275  if (de_ctx != NULL)
2276  SigGroupCleanup(de_ctx);
2277  if (de_ctx != NULL)
2278  DetectEngineCtxFree(de_ctx);
2279 
2280  StreamTcpFreeConfig(true);
2281  FLOW_DESTROY(&f);
2282  UTHFreePacket(p);
2283  return result;
2284 }
2285 
2286 /**
2287  * \test Test multiple relative contents with a negated content.
2288  */
2289 static int UriTestSig24(void)
2290 {
2291  int result = 0;
2292  uint8_t *http_buf = (uint8_t *)"POST /we_need_to_fix_this_and_yes_fix_this_now HTTP/1.0\r\n"
2293  "User-Agent: Mozilla/1.0\r\n";
2294  uint32_t http_buf_len = strlen((char *)http_buf);
2295  Flow f;
2296  TcpSession ssn;
2297  HtpState *http_state = NULL;
2298  Packet *p = NULL;
2299  ThreadVars tv;
2300  DetectEngineThreadCtx *det_ctx = NULL;
2301  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2302 
2303  memset(&tv, 0, sizeof(ThreadVars));
2304  memset(&f, 0, sizeof(Flow));
2305  memset(&ssn, 0, sizeof(TcpSession));
2306 
2307  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
2308 
2309  FLOW_INITIALIZE(&f);
2310  f.protoctx = (void *)&ssn;
2311  f.proto = IPPROTO_TCP;
2312  f.flags |= FLOW_IPV4;
2313 
2314  p->flow = &f;
2315  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
2316  p->flowflags |= FLOW_PKT_TOSERVER;
2317  p->flowflags |= FLOW_PKT_ESTABLISHED;
2318  f.alproto = ALPROTO_HTTP1;
2319 
2320  StreamTcpInitConfig(true);
2321 
2322  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2323  if (de_ctx == NULL) {
2324  goto end;
2325  }
2326  de_ctx->flags |= DE_QUIET;
2327 
2328  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2329  "(msg:\"test multiple relative uricontents\"; "
2330  "uricontent:\"we_need_to\"; uricontent:!\"fix_this_now\"; sid:1;)");
2331  if (de_ctx->sig_list == NULL) {
2332  goto end;
2333  }
2334 
2335  SigGroupBuild(de_ctx);
2336  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
2337 
2338  int r = AppLayerParserParse(
2339  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
2340  if (r != 0) {
2341  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
2342  goto end;
2343  }
2344 
2345  http_state = f.alstate;
2346  if (http_state == NULL) {
2347  printf("no http state: ");
2348  goto end;
2349  }
2350 
2351  /* do detect */
2352  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
2353 
2354  if (PacketAlertCheck(p, 1)) {
2355  printf("sig 1 alerted, but it should not: ");
2356  goto end;
2357  }
2358 
2359  result = 1;
2360 
2361 end:
2362  if (alp_tctx != NULL)
2363  AppLayerParserThreadCtxFree(alp_tctx);
2364  if (det_ctx != NULL)
2365  DetectEngineThreadCtxDeinit(&tv, det_ctx);
2366  if (de_ctx != NULL)
2367  SigGroupCleanup(de_ctx);
2368  if (de_ctx != NULL)
2369  DetectEngineCtxFree(de_ctx);
2370 
2371  StreamTcpFreeConfig(true);
2372  FLOW_DESTROY(&f);
2373  UTHFreePacket(p);
2374  return result;
2375 }
2376 
2377 /**
2378  * \test Test normalized uricontents.
2379  */
2380 static int UriTestSig25(void)
2381 {
2382  int result = 0;
2383  uint8_t *http_buf = (uint8_t *)"POST /normalized%20uri "
2384  "HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n";
2385  uint32_t http_buf_len = strlen((char *)http_buf);
2386  Flow f;
2387  TcpSession ssn;
2388  HtpState *http_state = NULL;
2389  Packet *p = NULL;
2390  ThreadVars tv;
2391  DetectEngineThreadCtx *det_ctx = NULL;
2392  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2393 
2394  memset(&tv, 0, sizeof(ThreadVars));
2395  memset(&f, 0, sizeof(Flow));
2396  memset(&ssn, 0, sizeof(TcpSession));
2397 
2398  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
2399 
2400  FLOW_INITIALIZE(&f);
2401  f.protoctx = (void *)&ssn;
2402  f.proto = IPPROTO_TCP;
2403  f.flags |= FLOW_IPV4;
2404 
2405  p->flow = &f;
2406  p->flowflags |= FLOW_PKT_TOSERVER;
2407  p->flowflags |= FLOW_PKT_ESTABLISHED;
2408  f.alproto = ALPROTO_HTTP1;
2409  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
2410 
2411  StreamTcpInitConfig(true);
2412 
2413  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2414  if (de_ctx == NULL) {
2415  goto end;
2416  }
2417  de_ctx->flags |= DE_QUIET;
2418 
2419  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2420  "(msg:\"test multiple relative uricontents\"; "
2421  "pcre:/normalized/U; uricontent:\"normalized uri\"; sid:1;)");
2422  if (de_ctx->sig_list == NULL) {
2423  goto end;
2424  }
2425 
2426  SigGroupBuild(de_ctx);
2427  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
2428 
2429  int r = AppLayerParserParse(
2430  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
2431  if (r != 0) {
2432  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
2433  goto end;
2434  }
2435 
2436  http_state = f.alstate;
2437  if (http_state == NULL) {
2438  printf("no http state: ");
2439  goto end;
2440  }
2441 
2442  /* do detect */
2443  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
2444 
2445  if (!PacketAlertCheck(p, 1)) {
2446  printf("sig 1 didn't alert, but it should have: ");
2447  goto end;
2448  }
2449 
2450  result = 1;
2451 
2452 end:
2453  if (alp_tctx != NULL)
2454  AppLayerParserThreadCtxFree(alp_tctx);
2455  if (det_ctx != NULL)
2456  DetectEngineThreadCtxDeinit(&tv, det_ctx);
2457  if (de_ctx != NULL)
2458  SigGroupCleanup(de_ctx);
2459  if (de_ctx != NULL)
2460  DetectEngineCtxFree(de_ctx);
2461 
2462  StreamTcpFreeConfig(true);
2463  FLOW_DESTROY(&f);
2464  UTHFreePacket(p);
2465  return result;
2466 }
2467 
2468 /**
2469  * \test Test multiple relative contents with a negated content.
2470  */
2471 static int UriTestSig26(void)
2472 {
2473  int result = 0;
2474  uint8_t *http_buf = (uint8_t *)"POST /we_need_to_fix_this_and_yes_fix_this_now HTTP/1.0\r\n"
2475  "User-Agent: Mozilla/1.0\r\n";
2476  uint32_t http_buf_len = strlen((char *)http_buf);
2477  Flow f;
2478  TcpSession ssn;
2479  HtpState *http_state = NULL;
2480  Packet *p = NULL;
2481  ThreadVars tv;
2482  DetectEngineThreadCtx *det_ctx = NULL;
2483  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2484 
2485  memset(&tv, 0, sizeof(ThreadVars));
2486  memset(&f, 0, sizeof(Flow));
2487  memset(&ssn, 0, sizeof(TcpSession));
2488 
2489  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
2490 
2491  FLOW_INITIALIZE(&f);
2492  f.protoctx = (void *)&ssn;
2493  f.proto = IPPROTO_TCP;
2494  f.flags |= FLOW_IPV4;
2495 
2496  p->flow = &f;
2497  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
2498  p->flowflags |= FLOW_PKT_TOSERVER;
2499  p->flowflags |= FLOW_PKT_ESTABLISHED;
2500  f.alproto = ALPROTO_HTTP1;
2501 
2502  StreamTcpInitConfig(true);
2503 
2504  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2505  if (de_ctx == NULL) {
2506  goto end;
2507  }
2508  de_ctx->flags |= DE_QUIET;
2509 
2510  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
2511  "(msg:\"test multiple relative uricontents\"; "
2512  "uricontent:\"fix_this\"; isdataat:4,relative; sid:1;)");
2513  if (de_ctx->sig_list == NULL) {
2514  goto end;
2515  }
2516 
2517  SigGroupBuild(de_ctx);
2518  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
2519 
2520  int r = AppLayerParserParse(
2521  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
2522  if (r != 0) {
2523  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
2524  goto end;
2525  }
2526 
2527  http_state = f.alstate;
2528  if (http_state == NULL) {
2529  printf("no http state: ");
2530  goto end;
2531  }
2532 
2533  /* do detect */
2534  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
2535 
2536  if (!PacketAlertCheck(p, 1)) {
2537  printf("sig 1 didn't alert, but it should have: ");
2538  goto end;
2539  }
2540 
2541  result = 1;
2542 
2543 end:
2544  if (alp_tctx != NULL)
2545  AppLayerParserThreadCtxFree(alp_tctx);
2546  if (det_ctx != NULL)
2547  DetectEngineThreadCtxDeinit(&tv, det_ctx);
2548  if (de_ctx != NULL)
2549  SigGroupCleanup(de_ctx);
2550  if (de_ctx != NULL)
2551  DetectEngineCtxFree(de_ctx);
2552 
2553  StreamTcpFreeConfig(true);
2554  FLOW_DESTROY(&f);
2555  UTHFreePacket(p);
2556  return result;
2557 }
2558 
2559 /**
2560  * \test Test multiple relative contents with a negated content.
2561  */
2562 static int UriTestSig27(void)
2563 {
2564  uint8_t *http_buf = (uint8_t *)"POST /we_need_to_fix_this_and_yes_fix_this_now HTTP/1.0\r\n"
2565  "User-Agent: Mozilla/1.0\r\n";
2566  uint32_t http_buf_len = strlen((char *)http_buf);
2567  Flow f;
2568  TcpSession ssn;
2569  ThreadVars tv;
2570  DetectEngineThreadCtx *det_ctx = NULL;
2571  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2572  FAIL_IF_NULL(alp_tctx);
2573 
2574  memset(&tv, 0, sizeof(ThreadVars));
2575  memset(&f, 0, sizeof(Flow));
2576  memset(&ssn, 0, sizeof(TcpSession));
2577 
2578  Packet *p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
2579  FAIL_IF_NULL(p);
2580 
2581  FLOW_INITIALIZE(&f);
2582  f.protoctx = (void *)&ssn;
2583  f.proto = IPPROTO_TCP;
2584  f.flags |= FLOW_IPV4;
2585 
2586  p->flow = &f;
2587  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
2588  p->flowflags |= FLOW_PKT_TOSERVER;
2589  p->flowflags |= FLOW_PKT_ESTABLISHED;
2590  f.alproto = ALPROTO_HTTP1;
2591 
2592  StreamTcpInitConfig(true);
2593 
2594  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2595  FAIL_IF_NULL(de_ctx);
2596  de_ctx->flags |= DE_QUIET;
2597 
2598  Signature *s = DetectEngineAppendSig(de_ctx,
2599  "alert tcp any any -> any any ("
2600  "uricontent:\"fix_this\"; isdataat:!10,relative; sid:1;)");
2601  FAIL_IF_NULL(s);
2602 
2603  SigGroupBuild(de_ctx);
2604  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
2605 
2606  int r = AppLayerParserParse(
2607  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
2608  FAIL_IF_NOT(r == 0);
2609  FAIL_IF_NULL(f.alstate);
2610 
2611  /* do detect */
2612  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
2613 
2614  FAIL_IF_NOT(PacketAlertCheck(p, 1));
2615 
2616  AppLayerParserThreadCtxFree(alp_tctx);
2617  DetectEngineThreadCtxDeinit(&tv, det_ctx);
2618  DetectEngineCtxFree(de_ctx);
2619 
2620  StreamTcpFreeConfig(true);
2621  FLOW_DESTROY(&f);
2622  UTHFreePacket(p);
2623  PASS;
2624 }
2625 
2626 static int UriTestSig28(void)
2627 {
2628  int result = 0;
2629  uint8_t *http_buf = (uint8_t *)"POST /this_b5ig_string_now_in_http HTTP/1.0\r\n"
2630  "User-Agent: Mozilla/1.0\r\n";
2631  uint32_t http_buf_len = strlen((char *)http_buf);
2632  Flow f;
2633  TcpSession ssn;
2634  HtpState *http_state = NULL;
2635  Packet *p = NULL;
2636  ThreadVars tv;
2637  DetectEngineThreadCtx *det_ctx = NULL;
2638  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2639 
2640  memset(&tv, 0, sizeof(ThreadVars));
2641  memset(&f, 0, sizeof(Flow));
2642  memset(&ssn, 0, sizeof(TcpSession));
2643 
2644  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
2645 
2646  FLOW_INITIALIZE(&f);
2647  f.protoctx = (void *)&ssn;
2648  f.proto = IPPROTO_TCP;
2649  f.flags |= FLOW_IPV4;
2650 
2651  p->flow = &f;
2652  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
2653  p->flowflags |= FLOW_PKT_TOSERVER;
2654  p->flowflags |= FLOW_PKT_ESTABLISHED;
2655  f.alproto = ALPROTO_HTTP1;
2656 
2657  StreamTcpInitConfig(true);
2658 
2659  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2660  if (de_ctx == NULL) {
2661  goto end;
2662  }
2663  de_ctx->flags |= DE_QUIET;
2664 
2665  de_ctx->sig_list = SigInit(de_ctx,
2666  "alert tcp any any -> any any (msg:\"dummy\"; "
2667  "uricontent:\"this\"; "
2668  "byte_extract:1,2,one,string,dec,relative; "
2669  "uricontent:\"ring\"; distance:one; sid:1;)");
2670  if (de_ctx->sig_list == NULL) {
2671  goto end;
2672  }
2673 
2674  SigGroupBuild(de_ctx);
2675  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
2676 
2677  int r = AppLayerParserParse(
2678  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
2679  if (r != 0) {
2680  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
2681  goto end;
2682  }
2683 
2684  http_state = f.alstate;
2685  if (http_state == NULL) {
2686  printf("no http state: ");
2687  goto end;
2688  }
2689 
2690  /* do detect */
2691  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
2692 
2693  if (!PacketAlertCheck(p, 1)) {
2694  printf("sig 1 didn't alert, but should have: ");
2695  goto end;
2696  }
2697 
2698  result = 1;
2699 
2700 end:
2701  if (alp_tctx != NULL)
2702  AppLayerParserThreadCtxFree(alp_tctx);
2703  if (det_ctx != NULL)
2704  DetectEngineThreadCtxDeinit(&tv, det_ctx);
2705  if (de_ctx != NULL)
2706  SigGroupCleanup(de_ctx);
2707  if (de_ctx != NULL)
2708  DetectEngineCtxFree(de_ctx);
2709 
2710  StreamTcpFreeConfig(true);
2711  FLOW_DESTROY(&f);
2712  UTHFreePacket(p);
2713  return result;
2714 }
2715 
2716 static int UriTestSig29(void)
2717 {
2718  int result = 0;
2719  uint8_t *http_buf = (uint8_t *)"POST /this_b5ig_string_now_in_http HTTP/1.0\r\n"
2720  "User-Agent: Mozilla/1.0\r\n";
2721  uint32_t http_buf_len = strlen((char *)http_buf);
2722  Flow f;
2723  TcpSession ssn;
2724  HtpState *http_state = NULL;
2725  Packet *p = NULL;
2726  ThreadVars tv;
2727  DetectEngineThreadCtx *det_ctx = NULL;
2728  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2729 
2730  memset(&tv, 0, sizeof(ThreadVars));
2731  memset(&f, 0, sizeof(Flow));
2732  memset(&ssn, 0, sizeof(TcpSession));
2733 
2734  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
2735 
2736  FLOW_INITIALIZE(&f);
2737  f.protoctx = (void *)&ssn;
2738  f.proto = IPPROTO_TCP;
2739  f.flags |= FLOW_IPV4;
2740 
2741  p->flow = &f;
2742  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
2743  p->flowflags |= FLOW_PKT_TOSERVER;
2744  p->flowflags |= FLOW_PKT_ESTABLISHED;
2745  f.alproto = ALPROTO_HTTP1;
2746 
2747  StreamTcpInitConfig(true);
2748 
2749  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2750  if (de_ctx == NULL) {
2751  goto end;
2752  }
2753  de_ctx->flags |= DE_QUIET;
2754 
2755  de_ctx->sig_list = SigInit(de_ctx,
2756  "alert tcp any any -> any any (msg:\"dummy\"; "
2757  "uricontent:\"this\"; "
2758  "byte_extract:1,2,one,string,dec,relative; "
2759  "uricontent:\"ring\"; distance:one; sid:1;)");
2760  if (de_ctx->sig_list == NULL) {
2761  goto end;
2762  }
2763 
2764  SigGroupBuild(de_ctx);
2765  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
2766 
2767  int r = AppLayerParserParse(
2768  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
2769  if (r != 0) {
2770  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
2771  goto end;
2772  }
2773 
2774  http_state = f.alstate;
2775  if (http_state == NULL) {
2776  printf("no http state: ");
2777  goto end;
2778  }
2779 
2780  /* do detect */
2781  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
2782 
2783  if (!PacketAlertCheck(p, 1)) {
2784  printf("sig 1 didn't alert, but should have: ");
2785  goto end;
2786  }
2787 
2788  result = 1;
2789 
2790 end:
2791  if (alp_tctx != NULL)
2792  AppLayerParserThreadCtxFree(alp_tctx);
2793  if (det_ctx != NULL)
2794  DetectEngineThreadCtxDeinit(&tv, det_ctx);
2795  if (de_ctx != NULL)
2796  SigGroupCleanup(de_ctx);
2797  if (de_ctx != NULL)
2798  DetectEngineCtxFree(de_ctx);
2799 
2800  StreamTcpFreeConfig(true);
2801  FLOW_DESTROY(&f);
2802  UTHFreePacket(p);
2803  return result;
2804 }
2805 
2806 static int UriTestSig30(void)
2807 {
2808  int result = 0;
2809  uint8_t *http_buf = (uint8_t *)"POST /this_b5ig_string_now_in_http HTTP/1.0\r\n"
2810  "User-Agent: Mozilla/1.0\r\n";
2811  uint32_t http_buf_len = strlen((char *)http_buf);
2812  Flow f;
2813  TcpSession ssn;
2814  HtpState *http_state = NULL;
2815  Packet *p = NULL;
2816  ThreadVars tv;
2817  DetectEngineThreadCtx *det_ctx = NULL;
2818  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2819 
2820  memset(&tv, 0, sizeof(ThreadVars));
2821  memset(&f, 0, sizeof(Flow));
2822  memset(&ssn, 0, sizeof(TcpSession));
2823 
2824  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
2825 
2826  FLOW_INITIALIZE(&f);
2827  f.protoctx = (void *)&ssn;
2828  f.proto = IPPROTO_TCP;
2829  f.flags |= FLOW_IPV4;
2830 
2831  p->flow = &f;
2832  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
2833  p->flowflags |= FLOW_PKT_TOSERVER;
2834  p->flowflags |= FLOW_PKT_ESTABLISHED;
2835  f.alproto = ALPROTO_HTTP1;
2836 
2837  StreamTcpInitConfig(true);
2838 
2839  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2840  if (de_ctx == NULL) {
2841  goto end;
2842  }
2843  de_ctx->flags |= DE_QUIET;
2844 
2845  de_ctx->sig_list = SigInit(de_ctx,
2846  "alert tcp any any -> any any (msg:\"dummy\"; "
2847  "uricontent:\"this\"; "
2848  "byte_extract:1,2,one,string,dec,relative; "
2849  "uricontent:\"_b5ig\"; offset:one; sid:1;)");
2850  if (de_ctx->sig_list == NULL) {
2851  goto end;
2852  }
2853 
2854  SigGroupBuild(de_ctx);
2855  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
2856 
2857  int r = AppLayerParserParse(
2858  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
2859  if (r != 0) {
2860  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
2861  goto end;
2862  }
2863 
2864  http_state = f.alstate;
2865  if (http_state == NULL) {
2866  printf("no http state: ");
2867  goto end;
2868  }
2869 
2870  /* do detect */
2871  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
2872 
2873  if (!PacketAlertCheck(p, 1)) {
2874  printf("sig 1 didn't alert, but should have: ");
2875  goto end;
2876  }
2877 
2878  result = 1;
2879 
2880 end:
2881  if (alp_tctx != NULL)
2882  AppLayerParserThreadCtxFree(alp_tctx);
2883  if (det_ctx != NULL)
2884  DetectEngineThreadCtxDeinit(&tv, det_ctx);
2885  if (de_ctx != NULL)
2886  SigGroupCleanup(de_ctx);
2887  if (de_ctx != NULL)
2888  DetectEngineCtxFree(de_ctx);
2889 
2890  StreamTcpFreeConfig(true);
2891  FLOW_DESTROY(&f);
2892  UTHFreePacket(p);
2893  return result;
2894 }
2895 
2896 static int UriTestSig31(void)
2897 {
2898  int result = 0;
2899  uint8_t *http_buf = (uint8_t *)"POST /this_b5ig_string_now_in_http HTTP/1.0\r\n"
2900  "User-Agent: Mozilla/1.0\r\n";
2901  uint32_t http_buf_len = strlen((char *)http_buf);
2902  Flow f;
2903  TcpSession ssn;
2904  HtpState *http_state = NULL;
2905  Packet *p = NULL;
2906  ThreadVars tv;
2907  DetectEngineThreadCtx *det_ctx = NULL;
2908  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2909 
2910  memset(&tv, 0, sizeof(ThreadVars));
2911  memset(&f, 0, sizeof(Flow));
2912  memset(&ssn, 0, sizeof(TcpSession));
2913 
2914  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
2915 
2916  FLOW_INITIALIZE(&f);
2917  f.protoctx = (void *)&ssn;
2918  f.proto = IPPROTO_TCP;
2919  f.flags |= FLOW_IPV4;
2920 
2921  p->flow = &f;
2922  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
2923  p->flowflags |= FLOW_PKT_TOSERVER;
2924  p->flowflags |= FLOW_PKT_ESTABLISHED;
2925  f.alproto = ALPROTO_HTTP1;
2926 
2927  StreamTcpInitConfig(true);
2928 
2929  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
2930  if (de_ctx == NULL) {
2931  goto end;
2932  }
2933  de_ctx->flags |= DE_QUIET;
2934 
2935  de_ctx->sig_list = SigInit(de_ctx,
2936  "alert tcp any any -> any any (msg:\"dummy\"; "
2937  "uricontent:\"this\"; "
2938  "byte_extract:1,2,one,string,dec,relative; "
2939  "uricontent:\"his\"; depth:one; sid:1;)");
2940  if (de_ctx->sig_list == NULL) {
2941  goto end;
2942  }
2943 
2944  SigGroupBuild(de_ctx);
2945  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
2946 
2947  int r = AppLayerParserParse(
2948  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
2949  if (r != 0) {
2950  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
2951  goto end;
2952  }
2953 
2954  http_state = f.alstate;
2955  if (http_state == NULL) {
2956  printf("no http state: ");
2957  goto end;
2958  }
2959 
2960  /* do detect */
2961  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
2962 
2963  if (!PacketAlertCheck(p, 1)) {
2964  printf("sig 1 didn't alert, but should have: ");
2965  goto end;
2966  }
2967 
2968  result = 1;
2969 
2970 end:
2971  if (alp_tctx != NULL)
2972  AppLayerParserThreadCtxFree(alp_tctx);
2973  if (det_ctx != NULL)
2974  DetectEngineThreadCtxDeinit(&tv, det_ctx);
2975  if (de_ctx != NULL)
2976  SigGroupCleanup(de_ctx);
2977  if (de_ctx != NULL)
2978  DetectEngineCtxFree(de_ctx);
2979 
2980  StreamTcpFreeConfig(true);
2981  FLOW_DESTROY(&f);
2982  UTHFreePacket(p);
2983  return result;
2984 }
2985 
2986 static int UriTestSig32(void)
2987 {
2988  int result = 0;
2989  uint8_t *http_buf = (uint8_t *)"POST /this_b5ig_string_now_in_http HTTP/1.0\r\n"
2990  "User-Agent: Mozilla/1.0\r\n";
2991  uint32_t http_buf_len = strlen((char *)http_buf);
2992  Flow f;
2993  TcpSession ssn;
2994  HtpState *http_state = NULL;
2995  Packet *p = NULL;
2996  ThreadVars tv;
2997  DetectEngineThreadCtx *det_ctx = NULL;
2998  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2999 
3000  memset(&tv, 0, sizeof(ThreadVars));
3001  memset(&f, 0, sizeof(Flow));
3002  memset(&ssn, 0, sizeof(TcpSession));
3003 
3004  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
3005 
3006  FLOW_INITIALIZE(&f);
3007  f.protoctx = (void *)&ssn;
3008  f.proto = IPPROTO_TCP;
3009  f.flags |= FLOW_IPV4;
3010 
3011  p->flow = &f;
3012  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
3013  p->flowflags |= FLOW_PKT_TOSERVER;
3014  p->flowflags |= FLOW_PKT_ESTABLISHED;
3015  f.alproto = ALPROTO_HTTP1;
3016 
3017  StreamTcpInitConfig(true);
3018 
3019  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
3020  if (de_ctx == NULL) {
3021  goto end;
3022  }
3023  de_ctx->flags |= DE_QUIET;
3024 
3025  de_ctx->sig_list = SigInit(de_ctx,
3026  "alert tcp any any -> any any (msg:\"dummy\"; "
3027  "uricontent:\"this\"; "
3028  "byte_extract:1,2,one,string,dec,relative; "
3029  "uricontent:\"g_st\"; within:one; sid:1;)");
3030  if (de_ctx->sig_list == NULL) {
3031  goto end;
3032  }
3033 
3034  SigGroupBuild(de_ctx);
3035  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
3036 
3037  int r = AppLayerParserParse(
3038  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
3039  if (r != 0) {
3040  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
3041  goto end;
3042  }
3043 
3044  http_state = f.alstate;
3045  if (http_state == NULL) {
3046  printf("no http state: ");
3047  goto end;
3048  }
3049 
3050  /* do detect */
3051  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
3052 
3053  if (!PacketAlertCheck(p, 1)) {
3054  printf("sig 1 didn't alert, but should have: ");
3055  goto end;
3056  }
3057 
3058  result = 1;
3059 
3060 end:
3061  if (alp_tctx != NULL)
3062  AppLayerParserThreadCtxFree(alp_tctx);
3063  if (det_ctx != NULL)
3064  DetectEngineThreadCtxDeinit(&tv, det_ctx);
3065  if (de_ctx != NULL)
3066  SigGroupCleanup(de_ctx);
3067  if (de_ctx != NULL)
3068  DetectEngineCtxFree(de_ctx);
3069 
3070  StreamTcpFreeConfig(true);
3071  FLOW_DESTROY(&f);
3072  UTHFreePacket(p);
3073  return result;
3074 }
3075 
3076 static int UriTestSig33(void)
3077 {
3078  int result = 0;
3079  uint8_t *http_buf = (uint8_t *)"POST /normalized%20uri "
3080  "HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n";
3081  uint32_t http_buf_len = strlen((char *)http_buf);
3082  Flow f;
3083  TcpSession ssn;
3084  HtpState *http_state = NULL;
3085  Packet *p = NULL;
3086  ThreadVars tv;
3087  DetectEngineThreadCtx *det_ctx = NULL;
3088  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
3089 
3090  memset(&tv, 0, sizeof(ThreadVars));
3091  memset(&f, 0, sizeof(Flow));
3092  memset(&ssn, 0, sizeof(TcpSession));
3093 
3094  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
3095 
3096  FLOW_INITIALIZE(&f);
3097  f.protoctx = (void *)&ssn;
3098  f.proto = IPPROTO_TCP;
3099  f.flags |= FLOW_IPV4;
3100 
3101  p->flow = &f;
3102  p->flowflags |= FLOW_PKT_TOSERVER;
3103  p->flowflags |= FLOW_PKT_ESTABLISHED;
3104  f.alproto = ALPROTO_HTTP1;
3105  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
3106 
3107  StreamTcpInitConfig(true);
3108 
3109  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
3110  if (de_ctx == NULL) {
3111  goto end;
3112  }
3113  de_ctx->flags |= DE_QUIET;
3114 
3115  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3116  "(msg:\"test multiple relative uricontents\"; "
3117  "urilen:15; sid:1;)");
3118  if (de_ctx->sig_list == NULL) {
3119  goto end;
3120  }
3121 
3122  SigGroupBuild(de_ctx);
3123  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
3124 
3125  int r = AppLayerParserParse(
3126  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
3127  if (r != 0) {
3128  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
3129  goto end;
3130  }
3131 
3132  http_state = f.alstate;
3133  if (http_state == NULL) {
3134  printf("no http state: ");
3135  goto end;
3136  }
3137 
3138  /* do detect */
3139  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
3140 
3141  if (!PacketAlertCheck(p, 1)) {
3142  printf("sig 1 didn't alert, but it should have: ");
3143  goto end;
3144  }
3145 
3146  result = 1;
3147 
3148 end:
3149  if (alp_tctx != NULL)
3150  AppLayerParserThreadCtxFree(alp_tctx);
3151  if (det_ctx != NULL)
3152  DetectEngineThreadCtxDeinit(&tv, det_ctx);
3153  if (de_ctx != NULL)
3154  SigGroupCleanup(de_ctx);
3155  if (de_ctx != NULL)
3156  DetectEngineCtxFree(de_ctx);
3157 
3158  StreamTcpFreeConfig(true);
3159  FLOW_DESTROY(&f);
3160  UTHFreePacket(p);
3161  return result;
3162 }
3163 
3164 static int UriTestSig34(void)
3165 {
3166  int result = 0;
3167  uint8_t *http_buf = (uint8_t *)"POST /normalized%20uri "
3168  "HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n";
3169  uint32_t http_buf_len = strlen((char *)http_buf);
3170  Flow f;
3171  TcpSession ssn;
3172  HtpState *http_state = NULL;
3173  Packet *p = NULL;
3174  ThreadVars tv;
3175  DetectEngineThreadCtx *det_ctx = NULL;
3176  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
3177 
3178  memset(&tv, 0, sizeof(ThreadVars));
3179  memset(&f, 0, sizeof(Flow));
3180  memset(&ssn, 0, sizeof(TcpSession));
3181 
3182  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
3183 
3184  FLOW_INITIALIZE(&f);
3185  f.protoctx = (void *)&ssn;
3186  f.proto = IPPROTO_TCP;
3187  f.flags |= FLOW_IPV4;
3188 
3189  p->flow = &f;
3190  p->flowflags |= FLOW_PKT_TOSERVER;
3191  p->flowflags |= FLOW_PKT_ESTABLISHED;
3192  f.alproto = ALPROTO_HTTP1;
3193  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
3194 
3195  StreamTcpInitConfig(true);
3196 
3197  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
3198  if (de_ctx == NULL) {
3199  goto end;
3200  }
3201  de_ctx->flags |= DE_QUIET;
3202 
3203  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3204  "(msg:\"test multiple relative uricontents\"; "
3205  "urilen:15, norm; sid:1;)");
3206  if (de_ctx->sig_list == NULL) {
3207  goto end;
3208  }
3209 
3210  SigGroupBuild(de_ctx);
3211  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
3212 
3213  int r = AppLayerParserParse(
3214  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
3215  if (r != 0) {
3216  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
3217  goto end;
3218  }
3219 
3220  http_state = f.alstate;
3221  if (http_state == NULL) {
3222  printf("no http state: ");
3223  goto end;
3224  }
3225 
3226  /* do detect */
3227  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
3228 
3229  if (!PacketAlertCheck(p, 1)) {
3230  printf("sig 1 didn't alert, but it should have: ");
3231  goto end;
3232  }
3233 
3234  result = 1;
3235 
3236 end:
3237  if (alp_tctx != NULL)
3238  AppLayerParserThreadCtxFree(alp_tctx);
3239  if (det_ctx != NULL)
3240  DetectEngineThreadCtxDeinit(&tv, det_ctx);
3241  if (de_ctx != NULL)
3242  SigGroupCleanup(de_ctx);
3243  if (de_ctx != NULL)
3244  DetectEngineCtxFree(de_ctx);
3245 
3246  StreamTcpFreeConfig(true);
3247  FLOW_DESTROY(&f);
3248  UTHFreePacket(p);
3249  return result;
3250 }
3251 
3252 static int UriTestSig35(void)
3253 {
3254  int result = 0;
3255  uint8_t *http_buf = (uint8_t *)"POST /normalized%20uri "
3256  "HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n";
3257  uint32_t http_buf_len = strlen((char *)http_buf);
3258  Flow f;
3259  TcpSession ssn;
3260  HtpState *http_state = NULL;
3261  Packet *p = NULL;
3262  ThreadVars tv;
3263  DetectEngineThreadCtx *det_ctx = NULL;
3264  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
3265 
3266  memset(&tv, 0, sizeof(ThreadVars));
3267  memset(&f, 0, sizeof(Flow));
3268  memset(&ssn, 0, sizeof(TcpSession));
3269 
3270  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
3271 
3272  FLOW_INITIALIZE(&f);
3273  f.protoctx = (void *)&ssn;
3274  f.proto = IPPROTO_TCP;
3275  f.flags |= FLOW_IPV4;
3276 
3277  p->flow = &f;
3278  p->flowflags |= FLOW_PKT_TOSERVER;
3279  p->flowflags |= FLOW_PKT_ESTABLISHED;
3280  f.alproto = ALPROTO_HTTP1;
3281  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
3282 
3283  StreamTcpInitConfig(true);
3284 
3285  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
3286  if (de_ctx == NULL) {
3287  goto end;
3288  }
3289  de_ctx->flags |= DE_QUIET;
3290 
3291  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3292  "(msg:\"test multiple relative uricontents\"; "
3293  "urilen:16; sid:1;)");
3294  if (de_ctx->sig_list == NULL) {
3295  goto end;
3296  }
3297 
3298  SigGroupBuild(de_ctx);
3299  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
3300 
3301  int r = AppLayerParserParse(
3302  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
3303  if (r != 0) {
3304  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
3305  goto end;
3306  }
3307 
3308  http_state = f.alstate;
3309  if (http_state == NULL) {
3310  printf("no http state: ");
3311  goto end;
3312  }
3313 
3314  /* do detect */
3315  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
3316 
3317  if (PacketAlertCheck(p, 1)) {
3318  printf("sig 1 alerted, but it shouldn't have: ");
3319  goto end;
3320  }
3321 
3322  result = 1;
3323 
3324 end:
3325  if (alp_tctx != NULL)
3326  AppLayerParserThreadCtxFree(alp_tctx);
3327  if (det_ctx != NULL)
3328  DetectEngineThreadCtxDeinit(&tv, det_ctx);
3329  if (de_ctx != NULL)
3330  SigGroupCleanup(de_ctx);
3331  if (de_ctx != NULL)
3332  DetectEngineCtxFree(de_ctx);
3333 
3334  StreamTcpFreeConfig(true);
3335  FLOW_DESTROY(&f);
3336  UTHFreePacket(p);
3337  return result;
3338 }
3339 
3340 static int UriTestSig36(void)
3341 {
3342  int result = 0;
3343  uint8_t *http_buf = (uint8_t *)"POST /normalized%20uri "
3344  "HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n";
3345  uint32_t http_buf_len = strlen((char *)http_buf);
3346  Flow f;
3347  TcpSession ssn;
3348  HtpState *http_state = NULL;
3349  Packet *p = NULL;
3350  ThreadVars tv;
3351  DetectEngineThreadCtx *det_ctx = NULL;
3352  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
3353 
3354  memset(&tv, 0, sizeof(ThreadVars));
3355  memset(&f, 0, sizeof(Flow));
3356  memset(&ssn, 0, sizeof(TcpSession));
3357 
3358  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
3359 
3360  FLOW_INITIALIZE(&f);
3361  f.protoctx = (void *)&ssn;
3362  f.proto = IPPROTO_TCP;
3363  f.flags |= FLOW_IPV4;
3364 
3365  p->flow = &f;
3366  p->flowflags |= FLOW_PKT_TOSERVER;
3367  p->flowflags |= FLOW_PKT_ESTABLISHED;
3368  f.alproto = ALPROTO_HTTP1;
3369  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
3370 
3371  StreamTcpInitConfig(true);
3372 
3373  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
3374  if (de_ctx == NULL) {
3375  goto end;
3376  }
3377  de_ctx->flags |= DE_QUIET;
3378 
3379  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3380  "(msg:\"test multiple relative uricontents\"; "
3381  "urilen:16, norm; sid:1;)");
3382  if (de_ctx->sig_list == NULL) {
3383  goto end;
3384  }
3385 
3386  SigGroupBuild(de_ctx);
3387  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
3388 
3389  int r = AppLayerParserParse(
3390  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
3391  if (r != 0) {
3392  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
3393  goto end;
3394  }
3395 
3396  http_state = f.alstate;
3397  if (http_state == NULL) {
3398  printf("no http state: ");
3399  goto end;
3400  }
3401 
3402  /* do detect */
3403  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
3404 
3405  if (PacketAlertCheck(p, 1)) {
3406  printf("sig 1 alerted, but it shouldn't have: ");
3407  goto end;
3408  }
3409 
3410  result = 1;
3411 
3412 end:
3413  if (alp_tctx != NULL)
3414  AppLayerParserThreadCtxFree(alp_tctx);
3415  if (det_ctx != NULL)
3416  DetectEngineThreadCtxDeinit(&tv, det_ctx);
3417  if (de_ctx != NULL)
3418  SigGroupCleanup(de_ctx);
3419  if (de_ctx != NULL)
3420  DetectEngineCtxFree(de_ctx);
3421 
3422  StreamTcpFreeConfig(true);
3423  FLOW_DESTROY(&f);
3424  UTHFreePacket(p);
3425  return result;
3426 }
3427 
3428 static int UriTestSig37(void)
3429 {
3430  int result = 0;
3431  uint8_t *http_buf = (uint8_t *)"POST /normalized%20uri "
3432  "HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n";
3433  uint32_t http_buf_len = strlen((char *)http_buf);
3434  Flow f;
3435  TcpSession ssn;
3436  HtpState *http_state = NULL;
3437  Packet *p = NULL;
3438  ThreadVars tv;
3439  DetectEngineThreadCtx *det_ctx = NULL;
3440  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
3441 
3442  memset(&tv, 0, sizeof(ThreadVars));
3443  memset(&f, 0, sizeof(Flow));
3444  memset(&ssn, 0, sizeof(TcpSession));
3445 
3446  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
3447 
3448  FLOW_INITIALIZE(&f);
3449  f.protoctx = (void *)&ssn;
3450  f.proto = IPPROTO_TCP;
3451  f.flags |= FLOW_IPV4;
3452 
3453  p->flow = &f;
3454  p->flowflags |= FLOW_PKT_TOSERVER;
3455  p->flowflags |= FLOW_PKT_ESTABLISHED;
3456  f.alproto = ALPROTO_HTTP1;
3457  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
3458 
3459  StreamTcpInitConfig(true);
3460 
3461  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
3462  if (de_ctx == NULL) {
3463  goto end;
3464  }
3465  de_ctx->flags |= DE_QUIET;
3466 
3467  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3468  "(msg:\"test multiple relative uricontents\"; "
3469  "urilen:17, raw; sid:1;)");
3470  if (de_ctx->sig_list == NULL) {
3471  goto end;
3472  }
3473 
3474  SigGroupBuild(de_ctx);
3475  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
3476 
3477  int r = AppLayerParserParse(
3478  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
3479  if (r != 0) {
3480  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
3481  goto end;
3482  }
3483 
3484  http_state = f.alstate;
3485  if (http_state == NULL) {
3486  printf("no http state: ");
3487  goto end;
3488  }
3489 
3490  /* do detect */
3491  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
3492 
3493  if (!PacketAlertCheck(p, 1)) {
3494  printf("sig 1 didn't alert, but it should have: ");
3495  goto end;
3496  }
3497 
3498  result = 1;
3499 
3500 end:
3501  if (alp_tctx != NULL)
3502  AppLayerParserThreadCtxFree(alp_tctx);
3503  if (det_ctx != NULL)
3504  DetectEngineThreadCtxDeinit(&tv, det_ctx);
3505  if (de_ctx != NULL)
3506  SigGroupCleanup(de_ctx);
3507  if (de_ctx != NULL)
3508  DetectEngineCtxFree(de_ctx);
3509 
3510  StreamTcpFreeConfig(true);
3511  FLOW_DESTROY(&f);
3512  UTHFreePacket(p);
3513  return result;
3514 }
3515 
3516 static int UriTestSig38(void)
3517 {
3518  int result = 0;
3519  uint8_t *http_buf = (uint8_t *)"POST /normalized%20uri "
3520  "HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n";
3521  uint32_t http_buf_len = strlen((char *)http_buf);
3522  Flow f;
3523  TcpSession ssn;
3524  HtpState *http_state = NULL;
3525  Packet *p = NULL;
3526  ThreadVars tv;
3527  DetectEngineThreadCtx *det_ctx = NULL;
3528  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
3529 
3530  memset(&tv, 0, sizeof(ThreadVars));
3531  memset(&f, 0, sizeof(Flow));
3532  memset(&ssn, 0, sizeof(TcpSession));
3533 
3534  p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP);
3535 
3536  FLOW_INITIALIZE(&f);
3537  f.protoctx = (void *)&ssn;
3538  f.proto = IPPROTO_TCP;
3539  f.flags |= FLOW_IPV4;
3540 
3541  p->flow = &f;
3542  p->flowflags |= FLOW_PKT_TOSERVER;
3543  p->flowflags |= FLOW_PKT_ESTABLISHED;
3544  f.alproto = ALPROTO_HTTP1;
3545  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
3546 
3547  StreamTcpInitConfig(true);
3548 
3549  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
3550  if (de_ctx == NULL) {
3551  goto end;
3552  }
3553  de_ctx->flags |= DE_QUIET;
3554 
3555  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
3556  "(msg:\"test multiple relative uricontents\"; "
3557  "urilen:18, raw; sid:1;)");
3558  if (de_ctx->sig_list == NULL) {
3559  goto end;
3560  }
3561 
3562  SigGroupBuild(de_ctx);
3563  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
3564 
3565  int r = AppLayerParserParse(
3566  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http_buf, http_buf_len);
3567  if (r != 0) {
3568  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
3569  goto end;
3570  }
3571 
3572  http_state = f.alstate;
3573  if (http_state == NULL) {
3574  printf("no http state: ");
3575  goto end;
3576  }
3577 
3578  /* do detect */
3579  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
3580 
3581  if (PacketAlertCheck(p, 1)) {
3582  printf("sig 1 alerted, but it shouldn't have: ");
3583  goto end;
3584  }
3585 
3586  result = 1;
3587 
3588 end:
3589  if (alp_tctx != NULL)
3590  AppLayerParserThreadCtxFree(alp_tctx);
3591  if (det_ctx != NULL)
3592  DetectEngineThreadCtxDeinit(&tv, det_ctx);
3593  if (de_ctx != NULL)
3594  SigGroupCleanup(de_ctx);
3595  if (de_ctx != NULL)
3596  DetectEngineCtxFree(de_ctx);
3597 
3598  StreamTcpFreeConfig(true);
3599  FLOW_DESTROY(&f);
3600  UTHFreePacket(p);
3601  return result;
3602 }
3603 
3604 static int DetectHttpUriIsdataatParseTest(void)
3605 {
3606  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
3607  FAIL_IF_NULL(de_ctx);
3608  de_ctx->flags |= DE_QUIET;
3609 
3610  Signature *s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any ("
3611  "content:\"one\"; http_uri; "
3612  "isdataat:!4,relative; sid:1;)");
3613  FAIL_IF_NULL(s);
3614 
3615  SigMatch *sm = DetectBufferGetLastSigMatch(s, g_http_uri_buffer_id);
3616  FAIL_IF_NULL(sm);
3617  FAIL_IF_NOT(sm->type == DETECT_ISDATAAT);
3618 
3619  DetectIsdataatData *data = (DetectIsdataatData *)sm->ctx;
3620  FAIL_IF_NOT(data->flags & ISDATAAT_RELATIVE);
3621  FAIL_IF_NOT(data->flags & ISDATAAT_NEGATED);
3622  FAIL_IF(data->flags & ISDATAAT_RAWBYTES);
3623 
3624  DetectEngineCtxFree(de_ctx);
3625  PASS;
3626 }
3627 
3628 static int DetectEngineHttpRawUriTest01(void)
3629 {
3630  TcpSession ssn;
3631  Packet *p1 = NULL;
3632  Packet *p2 = NULL;
3633  ThreadVars th_v;
3634  DetectEngineCtx *de_ctx = NULL;
3635  DetectEngineThreadCtx *det_ctx = NULL;
3636  HtpState *http_state = NULL;
3637  Flow f;
3638  uint8_t http1_buf[] =
3639  "GET /../a/b/../c";
3640  uint8_t http2_buf[] =
3641  "/./d.html HTTP/1.1\r\n"
3642  "Host: www.openinfosecfoundation.org\r\n"
3643  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n"
3644  "Content-Type: text/html\r\n"
3645  "Content-Length: 46\r\n"
3646  "\r\n"
3647  "This is dummy body1"
3648  "This is dummy message body2";
3649  uint32_t http1_len = sizeof(http1_buf) - 1;
3650  uint32_t http2_len = sizeof(http2_buf) - 1;
3651  int result = 0;
3652  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
3653 
3654  memset(&th_v, 0, sizeof(th_v));
3655  memset(&f, 0, sizeof(f));
3656  memset(&ssn, 0, sizeof(ssn));
3657 
3658  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
3659  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
3660 
3661  FLOW_INITIALIZE(&f);
3662  f.protoctx = (void *)&ssn;
3663  f.proto = IPPROTO_TCP;
3664  f.flags |= FLOW_IPV4;
3665 
3666  p1->flow = &f;
3667  p1->flowflags |= FLOW_PKT_TOSERVER;
3668  p1->flowflags |= FLOW_PKT_ESTABLISHED;
3669  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
3670  p2->flow = &f;
3671  p2->flowflags |= FLOW_PKT_TOSERVER;
3672  p2->flowflags |= FLOW_PKT_ESTABLISHED;
3673  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
3674  f.alproto = ALPROTO_HTTP1;
3675 
3676  StreamTcpInitConfig(true);
3677 
3678  de_ctx = DetectEngineCtxInit();
3679  if (de_ctx == NULL)
3680  goto end;
3681 
3682  de_ctx->flags |= DE_QUIET;
3683 
3684  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
3685  "(msg:\"http raw uri test\"; "
3686  "content:\"../c/./d\"; http_raw_uri; "
3687  "sid:1;)");
3688  if (de_ctx->sig_list == NULL)
3689  goto end;
3690 
3691  SigGroupBuild(de_ctx);
3692  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
3693 
3694  int r = AppLayerParserParse(
3695  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
3696  if (r != 0) {
3697  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
3698  result = 0;
3699  goto end;
3700  }
3701 
3702  http_state = f.alstate;
3703  if (http_state == NULL) {
3704  printf("no http state: \n");
3705  result = 0;
3706  goto end;
3707  }
3708 
3709  /* do detect */
3710  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
3711 
3712  if ((PacketAlertCheck(p1, 1))) {
3713  printf("sid 1 matched but shouldn't have\n");
3714  goto end;
3715  }
3716 
3717  r = AppLayerParserParse(
3718  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
3719  if (r != 0) {
3720  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
3721  result = 0;
3722  goto end;
3723  }
3724 
3725  /* do detect */
3726  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
3727 
3728  if (!(PacketAlertCheck(p2, 1))) {
3729  printf("sid 1 didn't match but should have");
3730  goto end;
3731  }
3732 
3733  result = 1;
3734 
3735 end:
3736  if (alp_tctx != NULL)
3737  AppLayerParserThreadCtxFree(alp_tctx);
3738  if (de_ctx != NULL)
3739  SigGroupCleanup(de_ctx);
3740  if (de_ctx != NULL)
3741  SigCleanSignatures(de_ctx);
3742  if (de_ctx != NULL)
3743  DetectEngineCtxFree(de_ctx);
3744 
3745  StreamTcpFreeConfig(true);
3746  FLOW_DESTROY(&f);
3747  UTHFreePackets(&p1, 1);
3748  UTHFreePackets(&p2, 1);
3749  return result;
3750 }
3751 
3752 static int DetectEngineHttpRawUriTest02(void)
3753 {
3754  TcpSession ssn;
3755  Packet *p1 = NULL;
3756  Packet *p2 = NULL;
3757  ThreadVars th_v;
3758  DetectEngineCtx *de_ctx = NULL;
3759  DetectEngineThreadCtx *det_ctx = NULL;
3760  HtpState *http_state = NULL;
3761  Flow f;
3762  uint8_t http1_buf[] =
3763  "GET /../a/b/../c/./d.html HTTP/1.0\r\n"
3764  "Host: www.openinfosecfoundation.org\r\n"
3765  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n"
3766  "Content-Type: text/html\r\n"
3767  "Content-Length: 19\r\n"
3768  "\r\n"
3769  "This is dummy body1";
3770  uint32_t http1_len = sizeof(http1_buf) - 1;
3771  int result = 0;
3772  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
3773 
3774  memset(&th_v, 0, sizeof(th_v));
3775  memset(&f, 0, sizeof(f));
3776  memset(&ssn, 0, sizeof(ssn));
3777 
3778  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
3779  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
3780 
3781  FLOW_INITIALIZE(&f);
3782  f.protoctx = (void *)&ssn;
3783  f.proto = IPPROTO_TCP;
3784  f.flags |= FLOW_IPV4;
3785 
3786  p1->flow = &f;
3787  p1->flowflags |= FLOW_PKT_TOSERVER;
3788  p1->flowflags |= FLOW_PKT_ESTABLISHED;
3789  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
3790  p2->flow = &f;
3791  p2->flowflags |= FLOW_PKT_TOSERVER;
3792  p2->flowflags |= FLOW_PKT_ESTABLISHED;
3793  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
3794  f.alproto = ALPROTO_HTTP1;
3795 
3796  StreamTcpInitConfig(true);
3797 
3798  de_ctx = DetectEngineCtxInit();
3799  if (de_ctx == NULL)
3800  goto end;
3801 
3802  de_ctx->flags |= DE_QUIET;
3803 
3804  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
3805  "(msg:\"http raw uri test\"; "
3806  "content:\"/c/./d\"; http_raw_uri; offset:5; "
3807  "sid:1;)");
3808  if (de_ctx->sig_list == NULL)
3809  goto end;
3810 
3811  SigGroupBuild(de_ctx);
3812  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
3813 
3814  int r = AppLayerParserParse(
3815  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
3816  if (r != 0) {
3817  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
3818  result = 0;
3819  goto end;
3820  }
3821 
3822  http_state = f.alstate;
3823  if (http_state == NULL) {
3824  printf("no http state: \n");
3825  result = 0;
3826  goto end;
3827  }
3828 
3829  /* do detect */
3830  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
3831 
3832  if (!(PacketAlertCheck(p1, 1))) {
3833  printf("sid 1 didn't match but should have\n");
3834  goto end;
3835  }
3836 
3837  result = 1;
3838 
3839 end:
3840  if (alp_tctx != NULL)
3841  AppLayerParserThreadCtxFree(alp_tctx);
3842  if (de_ctx != NULL)
3843  SigGroupCleanup(de_ctx);
3844  if (de_ctx != NULL)
3845  SigCleanSignatures(de_ctx);
3846  if (de_ctx != NULL)
3847  DetectEngineCtxFree(de_ctx);
3848 
3849  StreamTcpFreeConfig(true);
3850  FLOW_DESTROY(&f);
3851  UTHFreePackets(&p1, 1);
3852  UTHFreePackets(&p2, 1);
3853  return result;
3854 }
3855 
3856 static int DetectEngineHttpRawUriTest03(void)
3857 {
3858  TcpSession ssn;
3859  Packet *p1 = NULL;
3860  Packet *p2 = NULL;
3861  ThreadVars th_v;
3862  DetectEngineCtx *de_ctx = NULL;
3863  DetectEngineThreadCtx *det_ctx = NULL;
3864  HtpState *http_state = NULL;
3865  Flow f;
3866  uint8_t http1_buf[] =
3867  "GET /../a/b/../";
3868  uint8_t http2_buf[] =
3869  "c/./d.html HTTP/1.0\r\n"
3870  "Host: www.openinfosecfoundation.org\r\n"
3871  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n"
3872  "Content-Type: text/html\r\n"
3873  "Content-Length: 46\r\n"
3874  "\r\n"
3875  "This is dummy body1"
3876  "This is dummy message body2";
3877  uint32_t http1_len = sizeof(http1_buf) - 1;
3878  uint32_t http2_len = sizeof(http2_buf) - 1;
3879  int result = 0;
3880  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
3881 
3882  memset(&th_v, 0, sizeof(th_v));
3883  memset(&f, 0, sizeof(f));
3884  memset(&ssn, 0, sizeof(ssn));
3885 
3886  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
3887  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
3888 
3889  FLOW_INITIALIZE(&f);
3890  f.protoctx = (void *)&ssn;
3891  f.proto = IPPROTO_TCP;
3892  f.flags |= FLOW_IPV4;
3893 
3894  p1->flow = &f;
3895  p1->flowflags |= FLOW_PKT_TOSERVER;
3896  p1->flowflags |= FLOW_PKT_ESTABLISHED;
3897  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
3898  p2->flow = &f;
3899  p2->flowflags |= FLOW_PKT_TOSERVER;
3900  p2->flowflags |= FLOW_PKT_ESTABLISHED;
3901  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
3902  f.alproto = ALPROTO_HTTP1;
3903 
3904  StreamTcpInitConfig(true);
3905 
3906  de_ctx = DetectEngineCtxInit();
3907  if (de_ctx == NULL)
3908  goto end;
3909 
3910  de_ctx->flags |= DE_QUIET;
3911 
3912  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
3913  "(msg:\"http raw uri test\"; "
3914  "content:\"/a/b\"; http_raw_uri; offset:10; "
3915  "sid:1;)");
3916  if (de_ctx->sig_list == NULL)
3917  goto end;
3918 
3919  SigGroupBuild(de_ctx);
3920  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
3921 
3922  int r = AppLayerParserParse(
3923  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
3924  if (r != 0) {
3925  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
3926  result = 0;
3927  goto end;
3928  }
3929 
3930  http_state = f.alstate;
3931  if (http_state == NULL) {
3932  printf("no http state: \n");
3933  result = 0;
3934  goto end;
3935  }
3936 
3937  /* do detect */
3938  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
3939 
3940  if (PacketAlertCheck(p1, 1)) {
3941  printf("sid 1 matched but shouldn't have\n");
3942  goto end;
3943  }
3944 
3945  r = AppLayerParserParse(
3946  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
3947  if (r != 0) {
3948  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
3949  result = 0;
3950  goto end;
3951  }
3952 
3953  /* do detect */
3954  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
3955 
3956  if (PacketAlertCheck(p2, 1)) {
3957  printf("sid 1 didn't match but should have");
3958  goto end;
3959  }
3960 
3961  result = 1;
3962 
3963 end:
3964  if (alp_tctx != NULL)
3965  AppLayerParserThreadCtxFree(alp_tctx);
3966  if (de_ctx != NULL)
3967  SigGroupCleanup(de_ctx);
3968  if (de_ctx != NULL)
3969  SigCleanSignatures(de_ctx);
3970  if (de_ctx != NULL)
3971  DetectEngineCtxFree(de_ctx);
3972 
3973  StreamTcpFreeConfig(true);
3974  FLOW_DESTROY(&f);
3975  UTHFreePackets(&p1, 1);
3976  UTHFreePackets(&p2, 1);
3977  return result;
3978 }
3979 
3980 static int DetectEngineHttpRawUriTest04(void)
3981 {
3982  TcpSession ssn;
3983  Packet *p1 = NULL;
3984  Packet *p2 = NULL;
3985  ThreadVars th_v;
3986  DetectEngineCtx *de_ctx = NULL;
3987  DetectEngineThreadCtx *det_ctx = NULL;
3988  HtpState *http_state = NULL;
3989  Flow f;
3990  uint8_t http1_buf[] =
3991  "GET /../a/b/../";
3992  uint8_t http2_buf[] =
3993  "c/./d.html HTTP/1.0\r\n"
3994  "Host: www.openinfosecfoundation.org\r\n"
3995  "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n"
3996  "Content-Type: text/html\r\n"
3997  "Content-Length: 46\r\n"
3998  "\r\n"
3999  "This is dummy body1"
4000  "This is dummy message body2";
4001  uint32_t http1_len = sizeof(http1_buf) - 1;
4002  uint32_t http2_len = sizeof(http2_buf) - 1;
4003  int result = 0;
4004  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
4005 
4006  memset(&th_v, 0, sizeof(th_v));
4007  memset(&f, 0, sizeof(f));
4008  memset(&ssn, 0, sizeof(ssn));
4009 
4010  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4011  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4012 
4013  FLOW_INITIALIZE(&f);
4014  f.protoctx = (void *)&ssn;
4015  f.proto = IPPROTO_TCP;
4016  f.flags |= FLOW_IPV4;
4017 
4018  p1->flow = &f;
4019  p1->flowflags |= FLOW_PKT_TOSERVER;
4020  p1->flowflags |= FLOW_PKT_ESTABLISHED;
4021  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4022  p2->flow = &f;
4023  p2->flowflags |= FLOW_PKT_TOSERVER;
4024  p2->flowflags |= FLOW_PKT_ESTABLISHED;
4025  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4026  f.alproto = ALPROTO_HTTP1;
4027 
4028  StreamTcpInitConfig(true);
4029 
4030  de_ctx = DetectEngineCtxInit();
4031  if (de_ctx == NULL)
4032  goto end;
4033 
4034  de_ctx->flags |= DE_QUIET;
4035 
4036  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
4037  "(msg:\"http raw uri test\"; "
4038  "content:!\"/a/b\"; http_raw_uri; offset:10; "
4039  "sid:1;)");
4040  if (de_ctx->sig_list == NULL)
4041  goto end;
4042 
4043  SigGroupBuild(de_ctx);
4044  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
4045 
4046  int r = AppLayerParserParse(
4047  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
4048  if (r != 0) {
4049  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
4050  result = 0;
4051  goto end;
4052  }
4053 
4054  http_state = f.alstate;
4055  if (http_state == NULL) {
4056  printf("no http state: \n");
4057  result = 0;
4058  goto end;
4059  }
4060 
4061  /* do detect */
4062  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
4063 
4064  if (PacketAlertCheck(p1, 1)) {
4065  printf("sid 1 matched but shouldn't have\n");
4066  goto end;
4067  }
4068 
4069  r = AppLayerParserParse(
4070  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
4071  if (r != 0) {
4072  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
4073  result = 0;
4074  goto end;
4075  }
4076 
4077  /* do detect */
4078  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
4079 
4080  if (!PacketAlertCheck(p2, 1)) {
4081  printf("sid 1 didn't match but should have");
4082  goto end;
4083  }
4084 
4085  result = 1;
4086 
4087 end:
4088  if (alp_tctx != NULL)
4089  AppLayerParserThreadCtxFree(alp_tctx);
4090  if (de_ctx != NULL)
4091  SigGroupCleanup(de_ctx);
4092  if (de_ctx != NULL)
4093  SigCleanSignatures(de_ctx);
4094  if (de_ctx != NULL)
4095  DetectEngineCtxFree(de_ctx);
4096 
4097  StreamTcpFreeConfig(true);
4098  FLOW_DESTROY(&f);
4099  UTHFreePackets(&p1, 1);
4100  UTHFreePackets(&p2, 1);
4101  return result;
4102 }
4103 
4104 static int DetectEngineHttpRawUriTest05(void)
4105 {
4106  TcpSession ssn;
4107  Packet *p1 = NULL;
4108  Packet *p2 = NULL;
4109  ThreadVars th_v;
4110  DetectEngineCtx *de_ctx = NULL;
4111  DetectEngineThreadCtx *det_ctx = NULL;
4112  HtpState *http_state = NULL;
4113  Flow f;
4114  uint8_t http1_buf[] =
4115  "GET /../a/b/";
4116  uint8_t http2_buf[] =
4117  "../c/./d.html HTTP/1.0\r\n"
4118  "Host: www.openinfosecfoundation.org\r\n"
4119  "Content-Type: text/html\r\n"
4120  "Content-Length: 46\r\n"
4121  "\r\n"
4122  "This is dummy body1"
4123  "This is dummy message body2";
4124  uint32_t http1_len = sizeof(http1_buf) - 1;
4125  uint32_t http2_len = sizeof(http2_buf) - 1;
4126  int result = 0;
4127  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
4128 
4129  memset(&th_v, 0, sizeof(th_v));
4130  memset(&f, 0, sizeof(f));
4131  memset(&ssn, 0, sizeof(ssn));
4132 
4133  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4134  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4135 
4136  FLOW_INITIALIZE(&f);
4137  f.protoctx = (void *)&ssn;
4138  f.proto = IPPROTO_TCP;
4139  f.flags |= FLOW_IPV4;
4140 
4141  p1->flow = &f;
4142  p1->flowflags |= FLOW_PKT_TOSERVER;
4143  p1->flowflags |= FLOW_PKT_ESTABLISHED;
4144  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4145  p2->flow = &f;
4146  p2->flowflags |= FLOW_PKT_TOSERVER;
4147  p2->flowflags |= FLOW_PKT_ESTABLISHED;
4148  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4149  f.alproto = ALPROTO_HTTP1;
4150 
4151  StreamTcpInitConfig(true);
4152 
4153  de_ctx = DetectEngineCtxInit();
4154  if (de_ctx == NULL)
4155  goto end;
4156 
4157  de_ctx->flags |= DE_QUIET;
4158 
4159  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
4160  "(msg:\"http raw uri test\"; "
4161  "content:\"a/b\"; http_raw_uri; depth:10; "
4162  "sid:1;)");
4163  if (de_ctx->sig_list == NULL)
4164  goto end;
4165 
4166  SigGroupBuild(de_ctx);
4167  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
4168 
4169  int r = AppLayerParserParse(
4170  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
4171  if (r != 0) {
4172  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
4173  result = 0;
4174  goto end;
4175  }
4176 
4177  http_state = f.alstate;
4178  if (http_state == NULL) {
4179  printf("no http state: \n");
4180  result = 0;
4181  goto end;
4182  }
4183 
4184  /* do detect */
4185  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
4186 
4187  if (PacketAlertCheck(p1, 1)) {
4188  printf("sid 1 matched but shouldn't have\n");
4189  goto end;
4190  }
4191 
4192  r = AppLayerParserParse(
4193  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
4194  if (r != 0) {
4195  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
4196  result = 0;
4197  goto end;
4198  }
4199 
4200  /* do detect */
4201  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
4202 
4203  if (!PacketAlertCheck(p2, 1)) {
4204  printf("sid 1 didn't match but should have");
4205  goto end;
4206  }
4207 
4208  result = 1;
4209 
4210 end:
4211  if (alp_tctx != NULL)
4212  AppLayerParserThreadCtxFree(alp_tctx);
4213  if (de_ctx != NULL)
4214  SigGroupCleanup(de_ctx);
4215  if (de_ctx != NULL)
4216  SigCleanSignatures(de_ctx);
4217  if (de_ctx != NULL)
4218  DetectEngineCtxFree(de_ctx);
4219 
4220  StreamTcpFreeConfig(true);
4221  FLOW_DESTROY(&f);
4222  UTHFreePackets(&p1, 1);
4223  UTHFreePackets(&p2, 1);
4224  return result;
4225 }
4226 
4227 static int DetectEngineHttpRawUriTest06(void)
4228 {
4229  TcpSession ssn;
4230  Packet *p1 = NULL;
4231  Packet *p2 = NULL;
4232  ThreadVars th_v;
4233  DetectEngineCtx *de_ctx = NULL;
4234  DetectEngineThreadCtx *det_ctx = NULL;
4235  HtpState *http_state = NULL;
4236  Flow f;
4237  uint8_t http1_buf[] =
4238  "GET /../a/b/";
4239  uint8_t http2_buf[] =
4240  "../c/./d.html HTTP/1.0\r\n"
4241  "Host: www.openinfosecfoundation.org\r\n"
4242  "Content-Type: text/html\r\n"
4243  "Content-Length: 46\r\n"
4244  "\r\n"
4245  "This is dummy body1"
4246  "This is dummy message body2";
4247  uint32_t http1_len = sizeof(http1_buf) - 1;
4248  uint32_t http2_len = sizeof(http2_buf) - 1;
4249  int result = 0;
4250  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
4251 
4252  memset(&th_v, 0, sizeof(th_v));
4253  memset(&f, 0, sizeof(f));
4254  memset(&ssn, 0, sizeof(ssn));
4255 
4256  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4257  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4258 
4259  FLOW_INITIALIZE(&f);
4260  f.protoctx = (void *)&ssn;
4261  f.proto = IPPROTO_TCP;
4262  f.flags |= FLOW_IPV4;
4263 
4264  p1->flow = &f;
4265  p1->flowflags |= FLOW_PKT_TOSERVER;
4266  p1->flowflags |= FLOW_PKT_ESTABLISHED;
4267  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4268  p2->flow = &f;
4269  p2->flowflags |= FLOW_PKT_TOSERVER;
4270  p2->flowflags |= FLOW_PKT_ESTABLISHED;
4271  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4272  f.alproto = ALPROTO_HTTP1;
4273 
4274  StreamTcpInitConfig(true);
4275 
4276  de_ctx = DetectEngineCtxInit();
4277  if (de_ctx == NULL)
4278  goto end;
4279 
4280  de_ctx->flags |= DE_QUIET;
4281 
4282  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
4283  "(msg:\"http raw uri test\"; "
4284  "content:!\"/a/b\"; http_raw_uri; depth:25; "
4285  "sid:1;)");
4286  if (de_ctx->sig_list == NULL)
4287  goto end;
4288 
4289  SigGroupBuild(de_ctx);
4290  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
4291 
4292  int r = AppLayerParserParse(
4293  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
4294  if (r != 0) {
4295  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
4296  result = 0;
4297  goto end;
4298  }
4299 
4300  http_state = f.alstate;
4301  if (http_state == NULL) {
4302  printf("no http state: \n");
4303  result = 0;
4304  goto end;
4305  }
4306 
4307  /* do detect */
4308  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
4309 
4310  if (PacketAlertCheck(p1, 1)) {
4311  printf("sid 1 matched but shouldn't have\n");
4312  goto end;
4313  }
4314 
4315  r = AppLayerParserParse(
4316  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
4317  if (r != 0) {
4318  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
4319  result = 0;
4320  goto end;
4321  }
4322 
4323  /* do detect */
4324  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
4325 
4326  if (PacketAlertCheck(p2, 1)) {
4327  printf("sid 1 matched but shouldn't have");
4328  goto end;
4329  }
4330 
4331  result = 1;
4332 
4333 end:
4334  if (alp_tctx != NULL)
4335  AppLayerParserThreadCtxFree(alp_tctx);
4336  if (de_ctx != NULL)
4337  SigGroupCleanup(de_ctx);
4338  if (de_ctx != NULL)
4339  SigCleanSignatures(de_ctx);
4340  if (de_ctx != NULL)
4341  DetectEngineCtxFree(de_ctx);
4342 
4343  StreamTcpFreeConfig(true);
4344  FLOW_DESTROY(&f);
4345  UTHFreePackets(&p1, 1);
4346  UTHFreePackets(&p2, 1);
4347  return result;
4348 }
4349 
4350 static int DetectEngineHttpRawUriTest07(void)
4351 {
4352  TcpSession ssn;
4353  Packet *p1 = NULL;
4354  Packet *p2 = NULL;
4355  ThreadVars th_v;
4356  DetectEngineCtx *de_ctx = NULL;
4357  DetectEngineThreadCtx *det_ctx = NULL;
4358  HtpState *http_state = NULL;
4359  Flow f;
4360  uint8_t http1_buf[] =
4361  "GET /../a/b/";
4362  uint8_t http2_buf[] =
4363  "../c/./d.html HTTP/1.0\r\n"
4364  "Host: www.openinfosecfoundation.org\r\n"
4365  "Content-Type: text/html\r\n"
4366  "Content-Length: 46\r\n"
4367  "\r\n"
4368  "This is dummy body1"
4369  "This is dummy message body2";
4370  uint32_t http1_len = sizeof(http1_buf) - 1;
4371  uint32_t http2_len = sizeof(http2_buf) - 1;
4372  int result = 0;
4373  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
4374 
4375  memset(&th_v, 0, sizeof(th_v));
4376  memset(&f, 0, sizeof(f));
4377  memset(&ssn, 0, sizeof(ssn));
4378 
4379  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4380  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4381 
4382  FLOW_INITIALIZE(&f);
4383  f.protoctx = (void *)&ssn;
4384  f.proto = IPPROTO_TCP;
4385  f.flags |= FLOW_IPV4;
4386 
4387  p1->flow = &f;
4388  p1->flowflags |= FLOW_PKT_TOSERVER;
4389  p1->flowflags |= FLOW_PKT_ESTABLISHED;
4390  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4391  p2->flow = &f;
4392  p2->flowflags |= FLOW_PKT_TOSERVER;
4393  p2->flowflags |= FLOW_PKT_ESTABLISHED;
4394  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4395  f.alproto = ALPROTO_HTTP1;
4396 
4397  StreamTcpInitConfig(true);
4398 
4399  de_ctx = DetectEngineCtxInit();
4400  if (de_ctx == NULL)
4401  goto end;
4402 
4403  de_ctx->flags |= DE_QUIET;
4404 
4405  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
4406  "(msg:\"http raw uri test\"; "
4407  "content:!\"/c/./d\"; http_raw_uri; depth:12; "
4408  "sid:1;)");
4409  if (de_ctx->sig_list == NULL)
4410  goto end;
4411 
4412  SigGroupBuild(de_ctx);
4413  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
4414 
4415  int r = AppLayerParserParse(
4416  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
4417  if (r != 0) {
4418  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
4419  result = 0;
4420  goto end;
4421  }
4422 
4423  http_state = f.alstate;
4424  if (http_state == NULL) {
4425  printf("no http state: \n");
4426  result = 0;
4427  goto end;
4428  }
4429 
4430  /* do detect */
4431  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
4432 
4433  if (PacketAlertCheck(p1, 1)) {
4434  printf("sid 1 matched but shouldn't have\n");
4435  goto end;
4436  }
4437 
4438  r = AppLayerParserParse(
4439  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
4440  if (r != 0) {
4441  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
4442  result = 0;
4443  goto end;
4444  }
4445 
4446  /* do detect */
4447  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
4448 
4449  if (!PacketAlertCheck(p2, 1)) {
4450  printf("sid 1 didn't match but should have");
4451  goto end;
4452  }
4453 
4454  result = 1;
4455 
4456 end:
4457  if (alp_tctx != NULL)
4458  AppLayerParserThreadCtxFree(alp_tctx);
4459  if (de_ctx != NULL)
4460  SigGroupCleanup(de_ctx);
4461  if (de_ctx != NULL)
4462  SigCleanSignatures(de_ctx);
4463  if (de_ctx != NULL)
4464  DetectEngineCtxFree(de_ctx);
4465 
4466  StreamTcpFreeConfig(true);
4467  FLOW_DESTROY(&f);
4468  UTHFreePackets(&p1, 1);
4469  UTHFreePackets(&p2, 1);
4470  return result;
4471 }
4472 
4473 static int DetectEngineHttpRawUriTest08(void)
4474 {
4475  TcpSession ssn;
4476  Packet *p1 = NULL;
4477  Packet *p2 = NULL;
4478  ThreadVars th_v;
4479  DetectEngineCtx *de_ctx = NULL;
4480  DetectEngineThreadCtx *det_ctx = NULL;
4481  HtpState *http_state = NULL;
4482  Flow f;
4483  uint8_t http1_buf[] =
4484  "GET /../a/";
4485  uint8_t http2_buf[] =
4486  "b/../c/./d.html HTTP/1.0\r\n"
4487  "Host: www.openinfosecfoundation.org\r\n"
4488  "Content-Type: text/html\r\n"
4489  "Content-Length: 46\r\n"
4490  "\r\n"
4491  "This is dummy body1"
4492  "This is dummy message body2";
4493  uint32_t http1_len = sizeof(http1_buf) - 1;
4494  uint32_t http2_len = sizeof(http2_buf) - 1;
4495  int result = 0;
4496  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
4497 
4498  memset(&th_v, 0, sizeof(th_v));
4499  memset(&f, 0, sizeof(f));
4500  memset(&ssn, 0, sizeof(ssn));
4501 
4502  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4503  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4504 
4505  FLOW_INITIALIZE(&f);
4506  f.protoctx = (void *)&ssn;
4507  f.proto = IPPROTO_TCP;
4508  f.flags |= FLOW_IPV4;
4509 
4510  p1->flow = &f;
4511  p1->flowflags |= FLOW_PKT_TOSERVER;
4512  p1->flowflags |= FLOW_PKT_ESTABLISHED;
4513  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4514  p2->flow = &f;
4515  p2->flowflags |= FLOW_PKT_TOSERVER;
4516  p2->flowflags |= FLOW_PKT_ESTABLISHED;
4517  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4518  f.alproto = ALPROTO_HTTP1;
4519 
4520  StreamTcpInitConfig(true);
4521 
4522  de_ctx = DetectEngineCtxInit();
4523  if (de_ctx == NULL)
4524  goto end;
4525 
4526  de_ctx->flags |= DE_QUIET;
4527 
4528  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
4529  "(msg:\"http raw uri test\"; "
4530  "content:!\"/c/./d\"; http_raw_uri; depth:18; "
4531  "sid:1;)");
4532  if (de_ctx->sig_list == NULL)
4533  goto end;
4534 
4535  SigGroupBuild(de_ctx);
4536  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
4537 
4538  int r = AppLayerParserParse(
4539  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
4540  if (r != 0) {
4541  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
4542  result = 0;
4543  goto end;
4544  }
4545 
4546  http_state = f.alstate;
4547  if (http_state == NULL) {
4548  printf("no http state: \n");
4549  result = 0;
4550  goto end;
4551  }
4552 
4553  /* do detect */
4554  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
4555 
4556  if (PacketAlertCheck(p1, 1)) {
4557  printf("sid 1 matched but shouldn't have\n");
4558  goto end;
4559  }
4560 
4561  r = AppLayerParserParse(
4562  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
4563  if (r != 0) {
4564  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
4565  result = 0;
4566  goto end;
4567  }
4568 
4569  /* do detect */
4570  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
4571 
4572  if (PacketAlertCheck(p2, 1)) {
4573  printf("sid 1 matched but shouldn't have");
4574  goto end;
4575  }
4576 
4577  result = 1;
4578 
4579 end:
4580  if (alp_tctx != NULL)
4581  AppLayerParserThreadCtxFree(alp_tctx);
4582  if (de_ctx != NULL)
4583  SigGroupCleanup(de_ctx);
4584  if (de_ctx != NULL)
4585  SigCleanSignatures(de_ctx);
4586  if (de_ctx != NULL)
4587  DetectEngineCtxFree(de_ctx);
4588 
4589  StreamTcpFreeConfig(true);
4590  FLOW_DESTROY(&f);
4591  UTHFreePackets(&p1, 1);
4592  UTHFreePackets(&p2, 1);
4593  return result;
4594 }
4595 
4596 static int DetectEngineHttpRawUriTest09(void)
4597 {
4598  TcpSession ssn;
4599  Packet *p1 = NULL;
4600  Packet *p2 = NULL;
4601  ThreadVars th_v;
4602  DetectEngineCtx *de_ctx = NULL;
4603  DetectEngineThreadCtx *det_ctx = NULL;
4604  HtpState *http_state = NULL;
4605  Flow f;
4606  uint8_t http1_buf[] =
4607  "GET /../a";
4608  uint8_t http2_buf[] =
4609  "/b/../c/./d.html HTTP/1.0\r\n"
4610  "Host: www.openinfosecfoundation.org\r\n"
4611  "Content-Type: text/html\r\n"
4612  "Content-Length: 46\r\n"
4613  "\r\n"
4614  "This is dummy body1"
4615  "This is dummy message body2";
4616  uint32_t http1_len = sizeof(http1_buf) - 1;
4617  uint32_t http2_len = sizeof(http2_buf) - 1;
4618  int result = 0;
4619  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
4620 
4621  memset(&th_v, 0, sizeof(th_v));
4622  memset(&f, 0, sizeof(f));
4623  memset(&ssn, 0, sizeof(ssn));
4624 
4625  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4626  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4627 
4628  FLOW_INITIALIZE(&f);
4629  f.protoctx = (void *)&ssn;
4630  f.proto = IPPROTO_TCP;
4631  f.flags |= FLOW_IPV4;
4632 
4633  p1->flow = &f;
4634  p1->flowflags |= FLOW_PKT_TOSERVER;
4635  p1->flowflags |= FLOW_PKT_ESTABLISHED;
4636  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4637  p2->flow = &f;
4638  p2->flowflags |= FLOW_PKT_TOSERVER;
4639  p2->flowflags |= FLOW_PKT_ESTABLISHED;
4640  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4641  f.alproto = ALPROTO_HTTP1;
4642 
4643  StreamTcpInitConfig(true);
4644 
4645  de_ctx = DetectEngineCtxInit();
4646  if (de_ctx == NULL)
4647  goto end;
4648 
4649  de_ctx->flags |= DE_QUIET;
4650 
4651  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
4652  "(msg:\"http raw uri test\"; "
4653  "content:\"/a\"; http_raw_uri; "
4654  "content:\"./c/.\"; http_raw_uri; within:9; "
4655  "sid:1;)");
4656  if (de_ctx->sig_list == NULL)
4657  goto end;
4658 
4659  SigGroupBuild(de_ctx);
4660  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
4661 
4662  int r = AppLayerParserParse(
4663  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
4664  if (r != 0) {
4665  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
4666  result = 0;
4667  goto end;
4668  }
4669 
4670  http_state = f.alstate;
4671  if (http_state == NULL) {
4672  printf("no http state: \n");
4673  result = 0;
4674  goto end;
4675  }
4676 
4677  /* do detect */
4678  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
4679 
4680  if (PacketAlertCheck(p1, 1)) {
4681  printf("sid 1 matched but shouldn't have\n");
4682  goto end;
4683  }
4684 
4685  r = AppLayerParserParse(
4686  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
4687  if (r != 0) {
4688  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
4689  result = 0;
4690  goto end;
4691  }
4692 
4693  /* do detect */
4694  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
4695 
4696  if (!PacketAlertCheck(p2, 1)) {
4697  printf("sid 1 didn't match but should have");
4698  goto end;
4699  }
4700 
4701  result = 1;
4702 
4703 end:
4704  if (alp_tctx != NULL)
4705  AppLayerParserThreadCtxFree(alp_tctx);
4706  if (de_ctx != NULL)
4707  SigGroupCleanup(de_ctx);
4708  if (de_ctx != NULL)
4709  SigCleanSignatures(de_ctx);
4710  if (de_ctx != NULL)
4711  DetectEngineCtxFree(de_ctx);
4712 
4713  StreamTcpFreeConfig(true);
4714  FLOW_DESTROY(&f);
4715  UTHFreePackets(&p1, 1);
4716  UTHFreePackets(&p2, 1);
4717  return result;
4718 }
4719 
4720 static int DetectEngineHttpRawUriTest10(void)
4721 {
4722  TcpSession ssn;
4723  Packet *p1 = NULL;
4724  Packet *p2 = NULL;
4725  ThreadVars th_v;
4726  DetectEngineCtx *de_ctx = NULL;
4727  DetectEngineThreadCtx *det_ctx = NULL;
4728  HtpState *http_state = NULL;
4729  Flow f;
4730  uint8_t http1_buf[] =
4731  "GET /../a";
4732  uint8_t http2_buf[] =
4733  "/b/../c/./d.html HTTP/1.0\r\n"
4734  "Host: www.openinfosecfoundation.org\r\n"
4735  "Content-Type: text/html\r\n"
4736  "Content-Length: 46\r\n"
4737  "\r\n"
4738  "This is dummy body1"
4739  "This is dummy message body2";
4740  uint32_t http1_len = sizeof(http1_buf) - 1;
4741  uint32_t http2_len = sizeof(http2_buf) - 1;
4742  int result = 0;
4743  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
4744 
4745  memset(&th_v, 0, sizeof(th_v));
4746  memset(&f, 0, sizeof(f));
4747  memset(&ssn, 0, sizeof(ssn));
4748 
4749  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4750  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4751 
4752  FLOW_INITIALIZE(&f);
4753  f.protoctx = (void *)&ssn;
4754  f.proto = IPPROTO_TCP;
4755  f.flags |= FLOW_IPV4;
4756 
4757  p1->flow = &f;
4758  p1->flowflags |= FLOW_PKT_TOSERVER;
4759  p1->flowflags |= FLOW_PKT_ESTABLISHED;
4760  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4761  p2->flow = &f;
4762  p2->flowflags |= FLOW_PKT_TOSERVER;
4763  p2->flowflags |= FLOW_PKT_ESTABLISHED;
4764  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4765  f.alproto = ALPROTO_HTTP1;
4766 
4767  StreamTcpInitConfig(true);
4768 
4769  de_ctx = DetectEngineCtxInit();
4770  if (de_ctx == NULL)
4771  goto end;
4772 
4773  de_ctx->flags |= DE_QUIET;
4774 
4775  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
4776  "(msg:\"http raw uri test\"; "
4777  "content:\"/a\"; http_raw_uri; "
4778  "content:!\"boom\"; http_raw_uri; within:5; "
4779  "sid:1;)");
4780  if (de_ctx->sig_list == NULL)
4781  goto end;
4782 
4783  SigGroupBuild(de_ctx);
4784  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
4785 
4786  int r = AppLayerParserParse(
4787  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
4788  if (r != 0) {
4789  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
4790  result = 0;
4791  goto end;
4792  }
4793 
4794  http_state = f.alstate;
4795  if (http_state == NULL) {
4796  printf("no http state: \n");
4797  result = 0;
4798  goto end;
4799  }
4800 
4801  /* do detect */
4802  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
4803 
4804  if (PacketAlertCheck(p1, 1)) {
4805  printf("sid 1 matched but shouldn't have\n");
4806  goto end;
4807  }
4808 
4809  r = AppLayerParserParse(
4810  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
4811  if (r != 0) {
4812  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
4813  result = 0;
4814  goto end;
4815  }
4816 
4817  /* do detect */
4818  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
4819 
4820  if (!PacketAlertCheck(p2, 1)) {
4821  printf("sid 1 didn't match but should have");
4822  goto end;
4823  }
4824 
4825  result = 1;
4826 
4827 end:
4828  if (alp_tctx != NULL)
4829  AppLayerParserThreadCtxFree(alp_tctx);
4830  if (de_ctx != NULL)
4831  SigGroupCleanup(de_ctx);
4832  if (de_ctx != NULL)
4833  SigCleanSignatures(de_ctx);
4834  if (de_ctx != NULL)
4835  DetectEngineCtxFree(de_ctx);
4836 
4837  StreamTcpFreeConfig(true);
4838  FLOW_DESTROY(&f);
4839  UTHFreePackets(&p1, 1);
4840  UTHFreePackets(&p2, 1);
4841  return result;
4842 }
4843 
4844 static int DetectEngineHttpRawUriTest11(void)
4845 {
4846  TcpSession ssn;
4847  Packet *p1 = NULL;
4848  Packet *p2 = NULL;
4849  ThreadVars th_v;
4850  DetectEngineCtx *de_ctx = NULL;
4851  DetectEngineThreadCtx *det_ctx = NULL;
4852  HtpState *http_state = NULL;
4853  Flow f;
4854  uint8_t http1_buf[] =
4855  "GET /../a";
4856  uint8_t http2_buf[] =
4857  "/b/../c/./d.html HTTP/1.0\r\n"
4858  "Host: www.openinfosecfoundation.org\r\n"
4859  "Content-Type: text/html\r\n"
4860  "Content-Length: 46\r\n"
4861  "\r\n"
4862  "This is dummy body1"
4863  "This is dummy message body2";
4864  uint32_t http1_len = sizeof(http1_buf) - 1;
4865  uint32_t http2_len = sizeof(http2_buf) - 1;
4866  int result = 0;
4867  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
4868 
4869  memset(&th_v, 0, sizeof(th_v));
4870  memset(&f, 0, sizeof(f));
4871  memset(&ssn, 0, sizeof(ssn));
4872 
4873  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4874  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4875 
4876  FLOW_INITIALIZE(&f);
4877  f.protoctx = (void *)&ssn;
4878  f.proto = IPPROTO_TCP;
4879  f.flags |= FLOW_IPV4;
4880 
4881  p1->flow = &f;
4882  p1->flowflags |= FLOW_PKT_TOSERVER;
4883  p1->flowflags |= FLOW_PKT_ESTABLISHED;
4884  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4885  p2->flow = &f;
4886  p2->flowflags |= FLOW_PKT_TOSERVER;
4887  p2->flowflags |= FLOW_PKT_ESTABLISHED;
4888  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
4889  f.alproto = ALPROTO_HTTP1;
4890 
4891  StreamTcpInitConfig(true);
4892 
4893  de_ctx = DetectEngineCtxInit();
4894  if (de_ctx == NULL)
4895  goto end;
4896 
4897  de_ctx->flags |= DE_QUIET;
4898 
4899  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
4900  "(msg:\"http raw uri test\"; "
4901  "content:\"./a\"; http_raw_uri; "
4902  "content:\"boom\"; http_raw_uri; within:5; "
4903  "sid:1;)");
4904  if (de_ctx->sig_list == NULL)
4905  goto end;
4906 
4907  SigGroupBuild(de_ctx);
4908  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
4909 
4910  int r = AppLayerParserParse(
4911  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
4912  if (r != 0) {
4913  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
4914  result = 0;
4915  goto end;
4916  }
4917 
4918  http_state = f.alstate;
4919  if (http_state == NULL) {
4920  printf("no http state: \n");
4921  result = 0;
4922  goto end;
4923  }
4924 
4925  /* do detect */
4926  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
4927 
4928  if (PacketAlertCheck(p1, 1)) {
4929  printf("sid 1 matched but shouldn't have\n");
4930  goto end;
4931  }
4932 
4933  r = AppLayerParserParse(
4934  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
4935  if (r != 0) {
4936  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
4937  result = 0;
4938  goto end;
4939  }
4940 
4941  /* do detect */
4942  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
4943 
4944  if (PacketAlertCheck(p2, 1)) {
4945  printf("sid 1 matched but shouldn't have");
4946  goto end;
4947  }
4948 
4949  result = 1;
4950 
4951 end:
4952  if (alp_tctx != NULL)
4953  AppLayerParserThreadCtxFree(alp_tctx);
4954  if (de_ctx != NULL)
4955  SigGroupCleanup(de_ctx);
4956  if (de_ctx != NULL)
4957  SigCleanSignatures(de_ctx);
4958  if (de_ctx != NULL)
4959  DetectEngineCtxFree(de_ctx);
4960 
4961  StreamTcpFreeConfig(true);
4962  FLOW_DESTROY(&f);
4963  UTHFreePackets(&p1, 1);
4964  UTHFreePackets(&p2, 1);
4965  return result;
4966 }
4967 
4968 static int DetectEngineHttpRawUriTest12(void)
4969 {
4970  TcpSession ssn;
4971  Packet *p1 = NULL;
4972  Packet *p2 = NULL;
4973  ThreadVars th_v;
4974  DetectEngineCtx *de_ctx = NULL;
4975  DetectEngineThreadCtx *det_ctx = NULL;
4976  HtpState *http_state = NULL;
4977  Flow f;
4978  uint8_t http1_buf[] =
4979  "GET /../a";
4980  uint8_t http2_buf[] =
4981  "/b/../c/./d.html HTTP/1.0\r\n"
4982  "Host: www.openinfosecfoundation.org\r\n"
4983  "Content-Type: text/html\r\n"
4984  "Content-Length: 46\r\n"
4985  "\r\n"
4986  "This is dummy body1"
4987  "This is dummy message body2";
4988  uint32_t http1_len = sizeof(http1_buf) - 1;
4989  uint32_t http2_len = sizeof(http2_buf) - 1;
4990  int result = 0;
4991  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
4992 
4993  memset(&th_v, 0, sizeof(th_v));
4994  memset(&f, 0, sizeof(f));
4995  memset(&ssn, 0, sizeof(ssn));
4996 
4997  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4998  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
4999 
5000  FLOW_INITIALIZE(&f);
5001  f.protoctx = (void *)&ssn;
5002  f.proto = IPPROTO_TCP;
5003  f.flags |= FLOW_IPV4;
5004 
5005  p1->flow = &f;
5006  p1->flowflags |= FLOW_PKT_TOSERVER;
5007  p1->flowflags |= FLOW_PKT_ESTABLISHED;
5008  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
5009  p2->flow = &f;
5010  p2->flowflags |= FLOW_PKT_TOSERVER;
5011  p2->flowflags |= FLOW_PKT_ESTABLISHED;
5012  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
5013  f.alproto = ALPROTO_HTTP1;
5014 
5015  StreamTcpInitConfig(true);
5016 
5017  de_ctx = DetectEngineCtxInit();
5018  if (de_ctx == NULL)
5019  goto end;
5020 
5021  de_ctx->flags |= DE_QUIET;
5022 
5023  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
5024  "(msg:\"http raw uri test\"; "
5025  "content:\"./a\"; http_raw_uri; "
5026  "content:!\"/b/..\"; http_raw_uri; within:5; "
5027  "sid:1;)");
5028  if (de_ctx->sig_list == NULL)
5029  goto end;
5030 
5031  SigGroupBuild(de_ctx);
5032  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
5033 
5034  int r = AppLayerParserParse(
5035  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
5036  if (r != 0) {
5037  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
5038  result = 0;
5039  goto end;
5040  }
5041 
5042  http_state = f.alstate;
5043  if (http_state == NULL) {
5044  printf("no http state: \n");
5045  result = 0;
5046  goto end;
5047  }
5048 
5049  /* do detect */
5050  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
5051 
5052  if (PacketAlertCheck(p1, 1)) {
5053  printf("sid 1 matched but shouldn't have\n");
5054  goto end;
5055  }
5056 
5057  r = AppLayerParserParse(
5058  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
5059  if (r != 0) {
5060  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
5061  result = 0;
5062  goto end;
5063  }
5064 
5065  /* do detect */
5066  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
5067 
5068  if (PacketAlertCheck(p2, 1)) {
5069  printf("sid 1 matched but shouldn't have");
5070  goto end;
5071  }
5072 
5073  result = 1;
5074 
5075 end:
5076  if (alp_tctx != NULL)
5077  AppLayerParserThreadCtxFree(alp_tctx);
5078  if (de_ctx != NULL)
5079  SigGroupCleanup(de_ctx);
5080  if (de_ctx != NULL)
5081  SigCleanSignatures(de_ctx);
5082  if (de_ctx != NULL)
5083  DetectEngineCtxFree(de_ctx);
5084 
5085  StreamTcpFreeConfig(true);
5086  FLOW_DESTROY(&f);
5087  UTHFreePackets(&p1, 1);
5088  UTHFreePackets(&p2, 1);
5089  return result;
5090 }
5091 
5092 static int DetectEngineHttpRawUriTest13(void)
5093 {
5094  TcpSession ssn;
5095  Packet *p1 = NULL;
5096  Packet *p2 = NULL;
5097  ThreadVars th_v;
5098  DetectEngineCtx *de_ctx = NULL;
5099  DetectEngineThreadCtx *det_ctx = NULL;
5100  HtpState *http_state = NULL;
5101  Flow f;
5102  uint8_t http1_buf[] =
5103  "GET /../a";
5104  uint8_t http2_buf[] =
5105  "/b/../c/./d.html HTTP/1.0\r\n"
5106  "Host: www.openinfosecfoundation.org\r\n"
5107  "Content-Type: text/html\r\n"
5108  "Content-Length: 46\r\n"
5109  "\r\n"
5110  "This is dummy body1"
5111  "This is dummy message body2";
5112  uint32_t http1_len = sizeof(http1_buf) - 1;
5113  uint32_t http2_len = sizeof(http2_buf) - 1;
5114  int result = 0;
5115  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
5116 
5117  memset(&th_v, 0, sizeof(th_v));
5118  memset(&f, 0, sizeof(f));
5119  memset(&ssn, 0, sizeof(ssn));
5120 
5121  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
5122  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
5123 
5124  FLOW_INITIALIZE(&f);
5125  f.protoctx = (void *)&ssn;
5126  f.proto = IPPROTO_TCP;
5127  f.flags |= FLOW_IPV4;
5128 
5129  p1->flow = &f;
5130  p1->flowflags |= FLOW_PKT_TOSERVER;
5131  p1->flowflags |= FLOW_PKT_ESTABLISHED;
5132  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
5133  p2->flow = &f;
5134  p2->flowflags |= FLOW_PKT_TOSERVER;
5135  p2->flowflags |= FLOW_PKT_ESTABLISHED;
5136  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
5137  f.alproto = ALPROTO_HTTP1;
5138 
5139  StreamTcpInitConfig(true);
5140 
5141  de_ctx = DetectEngineCtxInit();
5142  if (de_ctx == NULL)
5143  goto end;
5144 
5145  de_ctx->flags |= DE_QUIET;
5146 
5147  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
5148  "(msg:\"http raw uri test\"; "
5149  "content:\"./a\"; http_raw_uri; "
5150  "content:\"/c/.\"; http_raw_uri; distance:5; "
5151  "sid:1;)");
5152  if (de_ctx->sig_list == NULL)
5153  goto end;
5154 
5155  SigGroupBuild(de_ctx);
5156  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
5157 
5158  int r = AppLayerParserParse(
5159  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
5160  if (r != 0) {
5161  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
5162  result = 0;
5163  goto end;
5164  }
5165 
5166  http_state = f.alstate;
5167  if (http_state == NULL) {
5168  printf("no http state: \n");
5169  result = 0;
5170  goto end;
5171  }
5172 
5173  /* do detect */
5174  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
5175 
5176  if (PacketAlertCheck(p1, 1)) {
5177  printf("sid 1 matched but shouldn't have\n");
5178  goto end;
5179  }
5180 
5181  r = AppLayerParserParse(
5182  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
5183  if (r != 0) {
5184  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
5185  result = 0;
5186  goto end;
5187  }
5188 
5189  /* do detect */
5190  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
5191 
5192  if (!PacketAlertCheck(p2, 1)) {
5193  printf("sid 1 didn't match but should have");
5194  goto end;
5195  }
5196 
5197  result = 1;
5198 
5199 end:
5200  if (alp_tctx != NULL)
5201  AppLayerParserThreadCtxFree(alp_tctx);
5202  if (de_ctx != NULL)
5203  SigGroupCleanup(de_ctx);
5204  if (de_ctx != NULL)
5205  SigCleanSignatures(de_ctx);
5206  if (de_ctx != NULL)
5207  DetectEngineCtxFree(de_ctx);
5208 
5209  StreamTcpFreeConfig(true);
5210  FLOW_DESTROY(&f);
5211  UTHFreePackets(&p1, 1);
5212  UTHFreePackets(&p2, 1);
5213  return result;
5214 }
5215 
5216 static int DetectEngineHttpRawUriTest14(void)
5217 {
5218  TcpSession ssn;
5219  Packet *p1 = NULL;
5220  Packet *p2 = NULL;
5221  ThreadVars th_v;
5222  DetectEngineCtx *de_ctx = NULL;
5223  DetectEngineThreadCtx *det_ctx = NULL;
5224  HtpState *http_state = NULL;
5225  Flow f;
5226  uint8_t http1_buf[] =
5227  "GET /../a";
5228  uint8_t http2_buf[] =
5229  "/b/../c/./d.html HTTP/1.0\r\n"
5230  "Host: www.openinfosecfoundation.org\r\n"
5231  "Content-Type: text/html\r\n"
5232  "Content-Length: 46\r\n"
5233  "\r\n"
5234  "This is dummy body1"
5235  "This is dummy message body2";
5236  uint32_t http1_len = sizeof(http1_buf) - 1;
5237  uint32_t http2_len = sizeof(http2_buf) - 1;
5238  int result = 0;
5239  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
5240 
5241  memset(&th_v, 0, sizeof(th_v));
5242  memset(&f, 0, sizeof(f));
5243  memset(&ssn, 0, sizeof(ssn));
5244 
5245  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
5246  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
5247 
5248  FLOW_INITIALIZE(&f);
5249  f.protoctx = (void *)&ssn;
5250  f.proto = IPPROTO_TCP;
5251  f.flags |= FLOW_IPV4;
5252 
5253  p1->flow = &f;
5254  p1->flowflags |= FLOW_PKT_TOSERVER;
5255  p1->flowflags |= FLOW_PKT_ESTABLISHED;
5256  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
5257  p2->flow = &f;
5258  p2->flowflags |= FLOW_PKT_TOSERVER;
5259  p2->flowflags |= FLOW_PKT_ESTABLISHED;
5260  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
5261  f.alproto = ALPROTO_HTTP1;
5262 
5263  StreamTcpInitConfig(true);
5264 
5265  de_ctx = DetectEngineCtxInit();
5266  if (de_ctx == NULL)
5267  goto end;
5268 
5269  de_ctx->flags |= DE_QUIET;
5270 
5271  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
5272  "(msg:\"http raw uri test\"; "
5273  "content:\"./a\"; http_raw_uri; "
5274  "content:!\"b/..\"; http_raw_uri; distance:5; "
5275  "sid:1;)");
5276  if (de_ctx->sig_list == NULL)
5277  goto end;
5278 
5279  SigGroupBuild(de_ctx);
5280  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
5281 
5282  int r = AppLayerParserParse(
5283  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
5284  if (r != 0) {
5285  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
5286  result = 0;
5287  goto end;
5288  }
5289 
5290  http_state = f.alstate;
5291  if (http_state == NULL) {
5292  printf("no http state: \n");
5293  result = 0;
5294  goto end;
5295  }
5296 
5297  /* do detect */
5298  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
5299 
5300  if (PacketAlertCheck(p1, 1)) {
5301  printf("sid 1 matched but shouldn't have\n");
5302  goto end;
5303  }
5304 
5305  r = AppLayerParserParse(
5306  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
5307  if (r != 0) {
5308  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
5309  result = 0;
5310  goto end;
5311  }
5312 
5313  /* do detect */
5314  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
5315 
5316  if (!PacketAlertCheck(p2, 1)) {
5317  printf("sid 1 didn't match but should have");
5318  goto end;
5319  }
5320 
5321  result = 1;
5322 
5323 end:
5324  if (alp_tctx != NULL)
5325  AppLayerParserThreadCtxFree(alp_tctx);
5326  if (de_ctx != NULL)
5327  SigGroupCleanup(de_ctx);
5328  if (de_ctx != NULL)
5329  SigCleanSignatures(de_ctx);
5330  if (de_ctx != NULL)
5331  DetectEngineCtxFree(de_ctx);
5332 
5333  StreamTcpFreeConfig(true);
5334  FLOW_DESTROY(&f);
5335  UTHFreePackets(&p1, 1);
5336  UTHFreePackets(&p2, 1);
5337  return result;
5338 }
5339 
5340 static int DetectEngineHttpRawUriTest15(void)
5341 {
5342  TcpSession ssn;
5343  Packet *p1 = NULL;
5344  Packet *p2 = NULL;
5345  ThreadVars th_v;
5346  DetectEngineCtx *de_ctx = NULL;
5347  DetectEngineThreadCtx *det_ctx = NULL;
5348  HtpState *http_state = NULL;
5349  Flow f;
5350  uint8_t http1_buf[] =
5351  "GET /../a";
5352  uint8_t http2_buf[] =
5353  "/b/../c/./d.html HTTP/1.0\r\n"
5354  "Host: www.openinfosecfoundation.org\r\n"
5355  "Content-Type: text/html\r\n"
5356  "Content-Length: 46\r\n"
5357  "\r\n"
5358  "This is dummy body1"
5359  "This is dummy message body2";
5360  uint32_t http1_len = sizeof(http1_buf) - 1;
5361  uint32_t http2_len = sizeof(http2_buf) - 1;
5362  int result = 0;
5363  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
5364 
5365  memset(&th_v, 0, sizeof(th_v));
5366  memset(&f, 0, sizeof(f));
5367  memset(&ssn, 0, sizeof(ssn));
5368 
5369  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
5370  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
5371 
5372  FLOW_INITIALIZE(&f);
5373  f.protoctx = (void *)&ssn;
5374  f.proto = IPPROTO_TCP;
5375  f.flags |= FLOW_IPV4;
5376 
5377  p1->flow = &f;
5378  p1->flowflags |= FLOW_PKT_TOSERVER;
5379  p1->flowflags |= FLOW_PKT_ESTABLISHED;
5380  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
5381  p2->flow = &f;
5382  p2->flowflags |= FLOW_PKT_TOSERVER;
5383  p2->flowflags |= FLOW_PKT_ESTABLISHED;
5384  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
5385  f.alproto = ALPROTO_HTTP1;
5386 
5387  StreamTcpInitConfig(true);
5388 
5389  de_ctx = DetectEngineCtxInit();
5390  if (de_ctx == NULL)
5391  goto end;
5392 
5393  de_ctx->flags |= DE_QUIET;
5394 
5395  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
5396  "(msg:\"http raw uri test\"; "
5397  "content:\"./a\"; http_raw_uri; "
5398  "content:\"/c/\"; http_raw_uri; distance:7; "
5399  "sid:1;)");
5400  if (de_ctx->sig_list == NULL)
5401  goto end;
5402 
5403  SigGroupBuild(de_ctx);
5404  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
5405 
5406  int r = AppLayerParserParse(
5407  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
5408  if (r != 0) {
5409  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
5410  result = 0;
5411  goto end;
5412  }
5413 
5414  http_state = f.alstate;
5415  if (http_state == NULL) {
5416  printf("no http state: \n");
5417  result = 0;
5418  goto end;
5419  }
5420 
5421  /* do detect */
5422  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
5423 
5424  if (PacketAlertCheck(p1, 1)) {
5425  printf("sid 1 matched but shouldn't have\n");
5426  goto end;
5427  }
5428 
5429  r = AppLayerParserParse(
5430  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
5431  if (r != 0) {
5432  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
5433  result = 0;
5434  goto end;
5435  }
5436 
5437  /* do detect */
5438  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
5439 
5440  if (PacketAlertCheck(p2, 1)) {
5441  printf("sid 1 matched but shouldn't have");
5442  goto end;
5443  }
5444 
5445  result = 1;
5446 
5447 end:
5448  if (alp_tctx != NULL)
5449  AppLayerParserThreadCtxFree(alp_tctx);
5450  if (de_ctx != NULL)
5451  SigGroupCleanup(de_ctx);
5452  if (de_ctx != NULL)
5453  SigCleanSignatures(de_ctx);
5454  if (de_ctx != NULL)
5455  DetectEngineCtxFree(de_ctx);
5456 
5457  StreamTcpFreeConfig(true);
5458  FLOW_DESTROY(&f);
5459  UTHFreePackets(&p1, 1);
5460  UTHFreePackets(&p2, 1);
5461  return result;
5462 }
5463 
5464 static int DetectEngineHttpRawUriTest16(void)
5465 {
5466  TcpSession ssn;
5467  Packet *p1 = NULL;
5468  Packet *p2 = NULL;
5469  ThreadVars th_v;
5470  DetectEngineCtx *de_ctx = NULL;
5471  DetectEngineThreadCtx *det_ctx = NULL;
5472  HtpState *http_state = NULL;
5473  Flow f;
5474  uint8_t http1_buf[] =
5475  "GET /../a";
5476  uint8_t http2_buf[] =
5477  "/b/../c/./d.html HTTP/1.0\r\n"
5478  "Host: www.openinfosecfoundation.org\r\n"
5479  "Content-Type: text/html\r\n"
5480  "Content-Length: 46\r\n"
5481  "\r\n"
5482  "This is dummy body1"
5483  "This is dummy message body2";
5484  uint32_t http1_len = sizeof(http1_buf) - 1;
5485  uint32_t http2_len = sizeof(http2_buf) - 1;
5486  int result = 0;
5487  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
5488 
5489  memset(&th_v, 0, sizeof(th_v));
5490  memset(&f, 0, sizeof(f));
5491  memset(&ssn, 0, sizeof(ssn));
5492 
5493  p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
5494  p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
5495 
5496  FLOW_INITIALIZE(&f);
5497  f.protoctx = (void *)&ssn;
5498  f.proto = IPPROTO_TCP;
5499  f.flags |= FLOW_IPV4;
5500 
5501  p1->flow = &f;
5502  p1->flowflags |= FLOW_PKT_TOSERVER;
5503  p1->flowflags |= FLOW_PKT_ESTABLISHED;
5504  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
5505  p2->flow = &f;
5506  p2->flowflags |= FLOW_PKT_TOSERVER;
5507  p2->flowflags |= FLOW_PKT_ESTABLISHED;
5508  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
5509  f.alproto = ALPROTO_HTTP1;
5510 
5511  StreamTcpInitConfig(true);
5512 
5513  de_ctx = DetectEngineCtxInit();
5514  if (de_ctx == NULL)
5515  goto end;
5516 
5517  de_ctx->flags |= DE_QUIET;
5518 
5519  de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
5520  "(msg:\"http raw uri test\"; "
5521  "content:\"./a\"; http_raw_uri; "
5522  "content:!\"/c/\"; http_raw_uri; distance:4; "
5523  "sid:1;)");
5524  if (de_ctx->sig_list == NULL)
5525  goto end;
5526 
5527  SigGroupBuild(de_ctx);
5528  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
5529 
5530  int r = AppLayerParserParse(
5531  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http1_buf, http1_len);
5532  if (r != 0) {
5533  printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
5534  result = 0;
5535  goto end;
5536  }
5537 
5538  http_state = f.alstate;
5539  if (http_state == NULL) {
5540  printf("no http state: \n");
5541  result = 0;
5542  goto end;
5543  }
5544 
5545  /* do detect */
5546  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
5547 
5548  if (PacketAlertCheck(p1, 1)) {
5549  printf("sid 1 matched but shouldn't have\n");
5550  goto end;
5551  }
5552 
5553  r = AppLayerParserParse(
5554  NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, http2_buf, http2_len);
5555  if (r != 0) {
5556  printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r);
5557  result = 0;
5558  goto end;
5559  }
5560 
5561  /* do detect */
5562  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
5563 
5564  if (PacketAlertCheck(p2, 1)) {
5565  printf("sid 1 matched but shouldn't have");
5566  goto end;
5567  }
5568 
5569  result = 1;
5570 
5571 end:
5572  if (alp_tctx != NULL)
5573  AppLayerParserThreadCtxFree(alp_tctx);
5574  if (de_ctx != NULL)