suricata
detect-snmp-community.c
Go to the documentation of this file.
1 /* Copyright (C) 2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "util-unittest.h"
19 #include "util-unittest-helper.h"
20 #include "app-layer-parser.h"
21 #include "detect-engine.h"
22 #include "detect-parse.h"
23 #include "flow-util.h"
24 #include "stream-tcp.h"
25 
26 static int DetectSNMPCommunityTest(void)
27 {
29  DetectEngineThreadCtx *det_ctx = NULL;
30  DetectEngineCtx *de_ctx = NULL;
31  Flow f;
32  Packet *p;
33  TcpSession tcp;
34  ThreadVars tv;
35  Signature *s;
36 
37  uint8_t request[] = {
38  0x30, 0x27, 0x02, 0x01, 0x01, 0x04, 0x0b, 0x5b,
39  0x52, 0x30, 0x5f, 0x43, 0x40, 0x63, 0x74, 0x69,
40  0x21, 0x5d, 0xa1, 0x15, 0x02, 0x04, 0x2b, 0x13,
41  0x3f, 0x85, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00,
42  0x30, 0x07, 0x30, 0x05, 0x06, 0x01, 0x01, 0x05,
43  0x00
44  };
45 
46  /* Setup flow. */
47  memset(&f, 0, sizeof(Flow));
48  memset(&tcp, 0, sizeof(TcpSession));
49  memset(&tv, 0, sizeof(ThreadVars));
50  p = UTHBuildPacket(request, sizeof(request), IPPROTO_UDP);
51  FLOW_INITIALIZE(&f);
53  f.protoctx = (void *)&tcp;
54  f.proto = IPPROTO_UDP;
56  f.flags |= FLOW_IPV4;
57  p->flow = &f;
61 
62  de_ctx = DetectEngineCtxInit();
63  FAIL_IF_NULL(de_ctx);
64 
65  /* This rule should match. */
66  s = DetectEngineAppendSig(de_ctx,
67  "alert snmp any any -> any any ("
68  "msg:\"SNMP Test Rule\"; "
69  "snmp.community; content:\"[R0_C@cti!]\"; "
70  "sid:1; rev:1;)");
71  FAIL_IF_NULL(s);
72 
73  /* This rule should not match. */
74  s = DetectEngineAppendSig(de_ctx,
75  "alert snmp any any -> any any ("
76  "msg:\"SNMP Test Rule\"; "
77  "snmp.community; content:\"private\"; "
78  "sid:2; rev:1;)");
79  FAIL_IF_NULL(s);
80 
81  SigGroupBuild(de_ctx);
82  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
83 
84  int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SNMP,
85  STREAM_TOSERVER, request, sizeof(request));
86  FAIL_IF(r != 0);
87 
88  /* Check that we have app-layer state. */
90 
91  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
92  FAIL_IF(!PacketAlertCheck(p, 1));
94 
95  /* Cleanup. */
97  DetectEngineThreadCtxDeinit(&tv, det_ctx);
98  SigGroupCleanup(de_ctx);
99  DetectEngineCtxFree(de_ctx);
101  FLOW_DESTROY(&f);
102  UTHFreePacket(p);
103 
104  PASS;
105 }
106 
107 static void DetectSNMPCommunityRegisterTests(void)
108 {
109  UtRegisterTest("DetectSNMPCommunityTest",
110  DetectSNMPCommunityTest);
111 }
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
struct Flow_ * flow
Definition: decode.h:445
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
uint8_t proto
Definition: flow.h:344
#define PASS
Pass the test.
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:95
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:203
void StreamTcpFreeConfig(char quiet)
Definition: stream-tcp.c:669
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
Signature container.
Definition: detect.h:522
#define TRUE
void * protoctx
Definition: flow.h:400
main detection engine ctx
Definition: detect.h:761
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
void * alstate
Definition: flow.h:438
#define FLOW_DESTROY(f)
Definition: flow-util.h:121
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
void SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:1669
void StreamTcpInitConfig(char)
To initialize the stream global configuration data.
Definition: stream-tcp.c:365
uint8_t flowflags
Definition: decode.h:439
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
#define FLOW_PKT_TOSERVER
Definition: flow.h:201
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
int SigGroupCleanup(DetectEngineCtx *de_ctx)
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
#define FLOW_INITIALIZE(f)
Definition: flow-util.h:39
#define STREAM_TOSERVER
Definition: stream.h:31
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself...
#define PKT_HAS_FLOW
Definition: decode.h:1093
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
Per thread variable structure.
Definition: threadvars.h:57
AppProto alproto
application level protocol
Definition: flow.h:409
uint32_t flags
Definition: decode.h:443
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
uint8_t protomap
Definition: flow.h:404
Flow data structure.
Definition: flow.h:325
#define FLOW_IPV4
Definition: flow.h:94
uint32_t flags
Definition: flow.h:379
#define PKT_STREAM_EST
Definition: decode.h:1091
DetectEngineCtx * DetectEngineCtxInit(void)