suricata
reputation.c
Go to the documentation of this file.
1 /* Copyright (C) 2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  *
20  * \author Giuseppe Longo <giuseppe@glongo.it>
21  *
22  */
23 
24 #include "conf-yaml-loader.h"
25 #include "detect-engine.h"
26 #include "stream-tcp-private.h"
27 #include "stream-tcp-reassemble.h"
28 #include "stream-tcp.h"
29 #include "util-unittest-helper.h"
30 
31 #define TEST_INIT \
32  DetectEngineCtx *de_ctx = DetectEngineCtxInit(); \
33  FAIL_IF(de_ctx == NULL); \
34  SRepInit(de_ctx); \
35  \
36  Address a; \
37  uint8_t cat = 0, value = 0;
38 
39 #define TEST_INIT_WITH_PACKET_IPV6(src, dst) \
40  uint8_t *buf = (uint8_t *)"Hi all!"; \
41  uint16_t buflen = strlen((char *)buf); \
42  Packet *p = UTHBuildPacketIPV6SrcDst((uint8_t *)buf, buflen, IPPROTO_TCP, (src), (dst)); \
43  FAIL_IF(p == NULL); \
44  TEST_INIT
45 
46 #define TEST_INIT_WITH_PACKET(ip) \
47  uint8_t *buf = (uint8_t *)"Hi all!"; \
48  uint16_t buflen = strlen((char *)buf); \
49  Packet *p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); \
50  FAIL_IF(p == NULL); \
51  p->src.addr_data32[0] = UTHSetIPv4Address(ip); \
52  TEST_INIT
53 
54 #define TEST_CLEANUP \
55  DetectEngineCtxFree(de_ctx);
56 
57 #define TEST_CLEANUP_WITH_PACKET \
58  UTHFreePacket(p); \
59  TEST_CLEANUP
60 
61 static int SRepTest01(void)
62 {
63  TEST_INIT;
64 
65  char ipstr[16];
66  char str[] = "1.2.3.4,1,2";
67  FAIL_IF(SRepSplitLine(de_ctx->srepCIDR_ctx, str, &a, &cat, &value) != 0);
68  PrintInet(AF_INET, (const void *)&a.address, ipstr, sizeof(ipstr));
69  FAIL_IF(strcmp(ipstr, "1.2.3.4") != 0);
70  FAIL_IF(cat != 1);
71  FAIL_IF(value != 2);
72 
73  TEST_CLEANUP;
74  PASS;
75 }
76 
77 static int SRepTest02(void)
78 {
79  TEST_INIT;
80 
81  char str[] = "1.1.1.1,";
82  FAIL_IF(SRepSplitLine(de_ctx->srepCIDR_ctx, str, &a, &cat, &value) == 0);
83 
84  TEST_CLEANUP;
85  PASS;
86 }
87 
88 static int SRepTest03(void)
89 {
90  char str[] = "1,Shortname,Long Name";
91  uint8_t cat = 0;
92  char shortname[SREP_SHORTNAME_LEN];
93 
94  FAIL_IF(SRepCatSplitLine(str, &cat, shortname, sizeof(shortname)) != 0);
95  FAIL_IF(strcmp(shortname, "Shortname") != 0);
96  FAIL_IF(cat != 1);
97 
98  PASS;
99 }
100 
101 static int SRepTest04(void)
102 {
103  TEST_INIT;
104 
105  char str[] = "10.0.0.0/16,1,2";
106  FAIL_IF(SRepSplitLine(de_ctx->srepCIDR_ctx, str, &a, &cat, &value) != 1);
107 
108  TEST_CLEANUP;
109  PASS;
110 }
111 
112 static int SRepTest05(void)
113 {
114  TEST_INIT_WITH_PACKET("10.0.0.1");
115 
116  char str[] = "10.0.0.0/16,1,20";
117  FAIL_IF(SRepSplitLine(de_ctx->srepCIDR_ctx, str, &a, &cat, &value) != 1);
118 
119  cat = 1;
120  FAIL_IF(SRepCIDRGetIPRepSrc(de_ctx->srepCIDR_ctx, p, cat, 0) != 20);
121 
122  TEST_CLEANUP_WITH_PACKET;
123  PASS;
124 }
125 
126 static int SRepTest06(void)
127 {
128  TEST_INIT_WITH_PACKET("192.168.0.1");
129 
130  char str1[] = "0.0.0.0/0,1,10\n";
131  char str2[] = "192.168.0.0/16,2,127";
132 
133  FAIL_IF(SRepSplitLine(de_ctx->srepCIDR_ctx, str1, &a, &cat, &value) != 1);
134  FAIL_IF(SRepSplitLine(de_ctx->srepCIDR_ctx, str2, &a, &cat, &value) != 1);
135 
136  cat = 1;
137  FAIL_IF(SRepCIDRGetIPRepSrc(de_ctx->srepCIDR_ctx, p, cat, 0) != 10);
138 
139  TEST_CLEANUP_WITH_PACKET;
140  PASS;
141 }
142 
143 static int SRepTest07(void) {
144  TEST_INIT;
145 
146  char str[] = "2000:0000:0000:0000:0000:0000:0000:0001,";
147  FAIL_IF(SRepSplitLine(de_ctx->srepCIDR_ctx, str, &a, &cat, &value) == 0);
148 
149  TEST_CLEANUP;
150  PASS;
151 }
152 
153 static int SRepTest08(void)
154 {
155  TEST_INIT_WITH_PACKET_IPV6("2000:0000:0000:0000:0000:0000:0000:0001", "FFFF::1");
156 
157  char str1[] = "0.0.0.0/0,1,10\n";
158  char str2[] = "192.168.0.0/16,2,127\n";
159  char str3[] = "2000::/3,1,10\n";
160  char str4[] = "FFFF::/127,2,127\n";
161  FAIL_IF(SRepSplitLine(de_ctx->srepCIDR_ctx, str1, &a, &cat, &value) != 1);
162  FAIL_IF(SRepSplitLine(de_ctx->srepCIDR_ctx, str2, &a, &cat, &value) != 1);
163  FAIL_IF(SRepSplitLine(de_ctx->srepCIDR_ctx, str3, &a, &cat, &value) != 1);
164  FAIL_IF(SRepSplitLine(de_ctx->srepCIDR_ctx, str4, &a, &cat, &value) != 1);
165 
166  cat = 1;
167  FAIL_IF(SRepCIDRGetIPRepSrc(de_ctx->srepCIDR_ctx, p, cat, 0) != 10);
168 
169  TEST_CLEANUP_WITH_PACKET;
170  PASS;
171 }
172 
173 /** Register the following unittests for the Reputation module */
174 void SCReputationRegisterTests(void)
175 {
176  UtRegisterTest("SRepTest01", SRepTest01);
177  UtRegisterTest("SRepTest02", SRepTest02);
178  UtRegisterTest("SRepTest03", SRepTest03);
179  UtRegisterTest("SRepTest04", SRepTest04);
180  UtRegisterTest("SRepTest05", SRepTest05);
181  UtRegisterTest("SRepTest06", SRepTest06);
182  UtRegisterTest("SRepTest07", SRepTest07);
183  UtRegisterTest("SRepTest08", SRepTest08);
184 }
SREP_SHORTNAME_LEN
#define SREP_SHORTNAME_LEN
Definition: reputation.c:337
detect-engine.h
stream-tcp.h
TEST_CLEANUP
#define TEST_CLEANUP
Definition: reputation.c:54
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
stream-tcp-reassemble.h
TEST_INIT_WITH_PACKET_IPV6
#define TEST_INIT_WITH_PACKET_IPV6(src, dst)
Definition: reputation.c:39
util-unittest-helper.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineCtx_::srepCIDR_ctx
SRepCIDRTree * srepCIDR_ctx
Definition: detect.h:856
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:230
TEST_INIT
#define TEST_INIT
Definition: reputation.c:31
TEST_INIT_WITH_PACKET
#define TEST_INIT_WITH_PACKET(ip)
Definition: reputation.c:46
conf-yaml-loader.h
stream-tcp-private.h
SRepCIDRGetIPRepSrc
int8_t SRepCIDRGetIPRepSrc(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version)
Definition: reputation.c:146
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
TEST_CLEANUP_WITH_PACKET
#define TEST_CLEANUP_WITH_PACKET
Definition: reputation.c:57
str
#define str(s)
Definition: suricata-common.h:291
SCReputationRegisterTests
void SCReputationRegisterTests(void)
Definition: reputation.c:174