suricata
stream-tcp-inline.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "../suricata-common.h"
19 #include "../stream-tcp-private.h"
20 #include "../stream-tcp.h"
21 #include "../stream-tcp-reassemble.h"
22 #include "../stream-tcp-inline.h"
23 #include "../stream-tcp-list.h"
24 #include "../stream-tcp-util.h"
25 #include "../util-streaming-buffer.h"
26 #include "../util-print.h"
27 #include "../util-unittest.h"
28 
29 static int VALIDATE(TcpStream *stream, uint8_t *data, uint32_t data_len)
30 {
31  if (StreamingBufferCompareRawData(&stream->sb,
32  data, data_len) == 0)
33  {
34  SCReturnInt(0);
35  }
36  SCLogInfo("OK");
37  PrintRawDataFp(stdout, data, data_len);
38  return 1;
39 }
40 
41 #define INLINE_START(isn) \
42  Packet *p; \
43  TcpReassemblyThreadCtx *ra_ctx = NULL; \
44  TcpSession ssn; \
45  ThreadVars tv; \
46  memset(&tv, 0, sizeof(tv)); \
47  \
48  StreamTcpUTInit(&ra_ctx); \
49  StreamTcpUTInitInline(); \
50  \
51  StreamTcpUTSetupSession(&ssn); \
52  StreamTcpUTSetupStream(&ssn.server, (isn)); \
53  StreamTcpUTSetupStream(&ssn.client, (isn)); \
54  \
55  TcpStream *stream = &ssn.client;
56 
57 #define INLINE_END \
58  StreamTcpUTClearSession(&ssn); \
59  StreamTcpUTDeinit(ra_ctx); \
60  PASS
61 
62 #define INLINE_ADD_PAYLOAD(rseq, seg, seglen, packet, packetlen) \
63  p = UTHBuildPacketReal( \
64  (uint8_t *)(seg), (seglen), IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); \
65  FAIL_IF(p == NULL); \
66  p->tcph->th_seq = htonl(stream->isn + (rseq)); \
67  p->tcph->th_ack = htonl(31); \
68  FAIL_IF(StreamTcpReassembleHandleSegmentHandleData(&tv, ra_ctx, &ssn, stream, p) < 0); \
69  FAIL_IF(memcmp(p->payload, packet, MIN((packetlen), p->payload_len)) != 0); \
70  UTHFreePacket(p);
71 
72 #define INLINE_STEP(rseq, seg, seglen, buf, buflen, packet, packetlen) \
73  INLINE_ADD_PAYLOAD((rseq), (seg), (seglen), (packet), (packetlen)); \
74  FAIL_IF(!(VALIDATE(stream, (uint8_t *)(buf), (buflen))));
75 
76 int UTHCheckGapAtPosition(TcpStream *stream, int pos, uint64_t offset, uint32_t len);
77 int UTHCheckDataAtPosition(
78  TcpStream *stream, int pos, uint64_t offset, const char *data, uint32_t len);
79 
80 /** \test full overlap */
81 static int StreamTcpInlineTest01(void)
82 {
83  INLINE_START(0);
84  INLINE_STEP(1, "AAC", 3, "AAC", 3, "AAC", 3);
85  INLINE_STEP(1, "ABC", 3, "AAC", 3, "AAC", 3);
86  INLINE_END;
87 }
88 
89 /** \test full overlap */
90 static int StreamTcpInlineTest02(void)
91 {
92  INLINE_START(0);
93  INLINE_STEP(1, "ABCDE", 5, "ABCDE", 5, "ABCDE", 5);
94  INLINE_STEP(2, "xxx", 3, "ABCDE", 5, "BCD", 3);
95  INLINE_END;
96 }
97 
98 /** \test partial overlap */
99 static int StreamTcpInlineTest03(void)
100 {
101  INLINE_START(0);
102  INLINE_STEP(1, "ABCDE", 5, "ABCDE", 5, "ABCDE", 5);
103  INLINE_STEP(3, "xxxxx", 5, "ABCDExx", 7, "CDExx", 5);
104  INLINE_END;
105 }
106 
107 /** \test partial overlap */
108 static int StreamTcpInlineTest04(void)
109 {
110  INLINE_START(0);
111  INLINE_ADD_PAYLOAD(3, "ABCDE", 5, "ABCDE", 5);
112  FAIL_IF_NOT(UTHCheckGapAtPosition(stream, 0, 0, 2) == 1);
113  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 1, 2, "ABCDE", 5) == 1);
114  INLINE_STEP(1, "xxxxx", 5, "xxABCDE", 7, "xxABC", 5);
115  INLINE_END;
116 }
117 
118 /** \test no overlap */
119 static int StreamTcpInlineTest05(void)
120 {
121  INLINE_START(0);
122  INLINE_ADD_PAYLOAD(8, "ABCDE", 5, "ABCDE", 5);
123  FAIL_IF_NOT(UTHCheckGapAtPosition(stream, 0, 0, 7) == 1);
124  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 1, 7, "ABCDE", 5) == 1);
125  INLINE_ADD_PAYLOAD(1, "xxxxx", 5, "xxxxx", 5);
126  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 0, 0, "xxxxx", 5) == 1);
127  FAIL_IF_NOT(UTHCheckGapAtPosition(stream, 1, 5, 2) == 1);
128  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 2, 7, "ABCDE", 5) == 1);
129  INLINE_END;
130 }
131 
132 /** \test multiple overlaps */
133 static int StreamTcpInlineTest06(void)
134 {
135  INLINE_START(0);
136  INLINE_ADD_PAYLOAD(2, "A", 1, "A", 1);
137  FAIL_IF_NOT(UTHCheckGapAtPosition(stream, 0, 0, 1) == 1);
138  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 1, 1, "A", 1) == 1);
139  INLINE_ADD_PAYLOAD(4, "A", 1, "A", 1);
140  FAIL_IF_NOT(UTHCheckGapAtPosition(stream, 0, 0, 1) == 1);
141  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 1, 1, "A", 1) == 1);
142  FAIL_IF_NOT(UTHCheckGapAtPosition(stream, 2, 2, 1) == 1);
143  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 3, 3, "A", 1) == 1);
144  INLINE_ADD_PAYLOAD(6, "A", 1, "A", 1);
145  FAIL_IF_NOT(UTHCheckGapAtPosition(stream, 0, 0, 1) == 1);
146  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 1, 1, "A", 1) == 1);
147  FAIL_IF_NOT(UTHCheckGapAtPosition(stream, 2, 2, 1) == 1);
148  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 3, 3, "A", 1) == 1);
149  FAIL_IF_NOT(UTHCheckGapAtPosition(stream, 4, 4, 1) == 1);
150  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 5, 5, "A", 1) == 1);
151  INLINE_ADD_PAYLOAD(8, "A", 1, "A", 1);
152  FAIL_IF_NOT(UTHCheckGapAtPosition(stream, 0, 0, 1) == 1);
153  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 1, 1, "A", 1) == 1);
154  FAIL_IF_NOT(UTHCheckGapAtPosition(stream, 2, 2, 1) == 1);
155  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 3, 3, "A", 1) == 1);
156  FAIL_IF_NOT(UTHCheckGapAtPosition(stream, 4, 4, 1) == 1);
157  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 5, 5, "A", 1) == 1);
158  FAIL_IF_NOT(UTHCheckGapAtPosition(stream, 6, 6, 1) == 1);
159  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 7, 7, "A", 1) == 1);
160  INLINE_STEP(1, "xxxxxxxxx", 9, "xAxAxAxAx", 9, "xAxAxAxAx", 9);
161  INLINE_END;
162 }
163 
164 /** \test overlap, data not different */
165 static int StreamTcpInlineTest07(void)
166 {
167  INLINE_START(0);
168  INLINE_ADD_PAYLOAD(3, "ABCDE", 5, "ABCDE", 5);
169  FAIL_IF_NOT(UTHCheckGapAtPosition(stream, 0, 0, 2) == 1);
170  FAIL_IF_NOT(UTHCheckDataAtPosition(stream, 1, 2, "ABCDE", 5) == 1);
171  INLINE_STEP(1, "XXABC", 5, "XXABCDE", 7, "XXABC", 5);
172  INLINE_END;
173 }
174 
175 static int StreamTcpInlineTest08(void)
176 {
177  INLINE_START(0);
178  INLINE_STEP(1, "AAAAA", 5, "AAAAA", 5, "AAAAA", 5);
179  INLINE_STEP(1, "BBBBB", 5, "AAAAA", 5, "AAAAA", 5);
180  INLINE_STEP(1, "CCCCCCCCCC", 10, "AAAAACCCCC", 10, "AAAAACCCCC", 10);
181  INLINE_STEP(10, "X", 1, "AAAAACCCCC", 10, "C", 1);
182  INLINE_STEP(11, "X", 1, "AAAAACCCCCX", 11, "X", 1);
183  INLINE_END;
184 }
185 
186 void StreamTcpInlineRegisterTests(void)
187 {
188  UtRegisterTest("StreamTcpInlineTest01", StreamTcpInlineTest01);
189  UtRegisterTest("StreamTcpInlineTest02", StreamTcpInlineTest02);
190  UtRegisterTest("StreamTcpInlineTest03", StreamTcpInlineTest03);
191  UtRegisterTest("StreamTcpInlineTest04", StreamTcpInlineTest04);
192  UtRegisterTest("StreamTcpInlineTest05", StreamTcpInlineTest05);
193  UtRegisterTest("StreamTcpInlineTest06", StreamTcpInlineTest06);
194  UtRegisterTest("StreamTcpInlineTest07", StreamTcpInlineTest07);
195  UtRegisterTest("StreamTcpInlineTest08", StreamTcpInlineTest08);
196 }
TcpStream_
Definition: stream-tcp-private.h:106
len
uint8_t len
Definition: app-layer-dnp3.h:2
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
INLINE_END
#define INLINE_END
Definition: stream-tcp-inline.c:57
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
INLINE_ADD_PAYLOAD
#define INLINE_ADD_PAYLOAD(rseq, seg, seglen, packet, packetlen)
Definition: stream-tcp-inline.c:62
UTHCheckDataAtPosition
int UTHCheckDataAtPosition(TcpStream *stream, int pos, uint64_t offset, const char *data, uint32_t len)
Definition: stream-tcp-reassemble.c:2239
PrintRawDataFp
void PrintRawDataFp(FILE *fp, const uint8_t *buf, uint32_t buflen)
Definition: util-print.c:114
StreamingBufferCompareRawData
int StreamingBufferCompareRawData(const StreamingBuffer *sb, const uint8_t *rawdata, uint32_t rawdata_len)
Definition: util-streaming-buffer.c:1823
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
VALIDATE
#define VALIDATE(e)
INLINE_STEP
#define INLINE_STEP(rseq, seg, seglen, buf, buflen, packet, packetlen)
Definition: stream-tcp-inline.c:72
TcpStream_::sb
StreamingBuffer sb
Definition: stream-tcp-private.h:135
INLINE_START
#define INLINE_START(isn)
Definition: stream-tcp-inline.c:41
StreamTcpInlineRegisterTests
void StreamTcpInlineRegisterTests(void)
Definition: stream-tcp-inline.c:186
UTHCheckGapAtPosition
int UTHCheckGapAtPosition(TcpStream *stream, int pos, uint64_t offset, uint32_t len)
Definition: stream-tcp-reassemble.c:2216
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275