77 static uint8_t ActionAsciiToFlag(
const char *action)
79 if (strcmp(action,
"pass") == 0)
81 if (strcmp(action,
"drop") == 0)
83 if (strcmp(action,
"reject") == 0)
85 if (strcmp(action,
"alert") == 0)
100 uint8_t actions_used = 0;
101 uint8_t action_flag = 0;
102 uint8_t actions_config[4] = {0, 0, 0, 0};
110 if (action_order == NULL) {
117 action_flag = ActionAsciiToFlag(action->
val);
118 if (action_flag == 0) {
120 " \"pass\",\"drop\",\"alert\",\"reject\". You have" 121 " to specify all of them, without quotes and without" 122 " capital letters", action->
val);
126 if (actions_used & action_flag) {
128 " use \"pass\",\"drop\",\"alert\",\"reject\". You" 129 " have to specify all of them, without quotes and" 130 " without capital letters", action->
val);
136 "possible actions plus \"%s\". Please, use \"pass\"," 137 "\"drop\",\"alert\",\"reject\". You have to specify" 138 " all of them, without quotes and without capital" 139 " letters", action->
val);
142 actions_used |= action_flag;
143 actions_config[order++] = action_flag;
148 "actions. Please, use \"pass\",\"drop\",\"alert\"," 149 "\"reject\". You have to specify all of them, without" 150 " quotes and without capital letters");
155 for (order = 0; order < 4; order++) {
171 static int UtilActionTest01(
void)
209 static int UtilActionTest02(
void)
247 static int UtilActionTest03(
void)
284 static int UtilActionTest04(
void)
319 static int UtilActionTest05(
void)
357 static int UtilActionTest06(
void)
394 static int UtilActionTest07(
void)
432 static int UtilActionTest08(
void)
435 uint8_t *buf = (uint8_t *)
"Hi all!";
436 uint16_t buflen = strlen((
char *)buf);
439 "192.168.1.5",
"192.168.1.1",
442 "192.168.1.1",
"192.168.1.5",
445 "192.168.1.5",
"192.168.1.1",
448 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
452 sigs[0]=
"alert ip any any -> any any (msg:\"sig 1\"; sid:1;)";
453 sigs[1]=
"pass ip 192.168.1.1 80 -> any any (msg:\"sig 2\"; sid:2;)";
454 sigs[2]=
"alert ip any any -> any any (msg:\"sig 3\"; sid:3;)";
456 uint32_t sid[3] = {1, 2, 3};
458 uint32_t results[3][3] = {
482 if (de_ctx != NULL) {
497 static int UtilActionTest09(
void)
500 uint8_t *buf = (uint8_t *)
"Hi all!";
501 uint16_t buflen = strlen((
char *)buf);
510 "192.168.1.5",
"192.168.1.1",
513 "192.168.1.1",
"192.168.1.5",
516 "192.168.1.5",
"192.168.1.1",
519 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
523 sigs[0]=
"alert ip any any -> any any (msg:\"sig 1\"; sid:1;)";
524 sigs[1]=
"pass ip 192.168.1.1 80 -> any any (msg:\"sig 2\"; sid:2;)";
525 sigs[2]=
"drop ip any any -> any any (msg:\"sig 3\"; sid:3;)";
527 uint32_t sid[3] = {1, 2, 3};
529 uint32_t results[3][3] = {
554 if (de_ctx != NULL) {
573 static int UtilActionTest10(
void)
576 uint8_t *buf = (uint8_t *)
"Hi all!";
577 uint16_t buflen = strlen((
char *)buf);
578 uint8_t *buf2 = (uint8_t *)
"wo!";
579 uint16_t buflen2 = strlen((
char *)buf2);
582 "192.168.1.5",
"192.168.1.1",
585 "192.168.1.1",
"192.168.1.5",
588 "192.168.1.5",
"192.168.1.1",
591 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
595 sigs[0]=
"alert ip any any -> any any (msg:\"sig 1\"; content:\"Hi all\"; sid:1;)";
596 sigs[1]=
"pass ip any any -> any any (msg:\"sig 2\"; content:\"wo\"; sid:2;)";
597 sigs[2]=
"alert ip any any -> any any (msg:\"sig 3\"; content:\"Hi all\"; sid:3;)";
599 uint32_t sid[3] = {1, 2, 3};
601 uint32_t results[3][3] = {
625 if (de_ctx != NULL) {
640 static int UtilActionTest11(
void)
643 uint8_t *buf = (uint8_t *)
"Hi all!";
644 uint16_t buflen = strlen((
char *)buf);
645 uint8_t *buf2 = (uint8_t *)
"Hi all wo!";
646 uint16_t buflen2 = strlen((
char *)buf2);
655 "192.168.1.5",
"192.168.1.1",
658 "192.168.1.1",
"192.168.1.5",
661 "192.168.1.5",
"192.168.1.1",
664 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
668 sigs[0]=
"alert tcp any any -> any any (msg:\"sig 1\"; content:\"Hi all\"; sid:1;)";
669 sigs[1]=
"pass tcp any any -> any any (msg:\"sig 2\"; content:\"wo\"; sid:2;)";
670 sigs[2]=
"drop tcp any any -> any any (msg:\"sig 3\"; content:\"Hi all\"; sid:3;)";
672 uint32_t sid[3] = {1, 2, 3};
674 uint32_t results[3][3] = {
699 if (de_ctx != NULL) {
718 static int UtilActionTest12(
void)
721 uint8_t *buf = (uint8_t *)
"Hi all!";
722 uint16_t buflen = strlen((
char *)buf);
725 "192.168.1.5",
"192.168.1.1",
728 "192.168.1.1",
"192.168.1.5",
731 "192.168.1.5",
"192.168.1.1",
734 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
738 sigs[0]=
"alert ip any any -> any any (msg:\"sig 1\"; sid:1;)";
739 sigs[1]=
"pass ip any any -> any any (msg:\"Testing normal 2\"; sid:2;)";
740 sigs[2]=
"alert ip any any -> any any (msg:\"sig 3\"; sid:3;)";
742 uint32_t sid[3] = {1, 2, 3};
744 uint32_t results[3][3] = {
766 if (de_ctx != NULL) {
781 static int UtilActionTest13(
void)
784 uint8_t *buf = (uint8_t *)
"Hi all!";
785 uint16_t buflen = strlen((
char *)buf);
794 "192.168.1.5",
"192.168.1.1",
797 "192.168.1.1",
"192.168.1.5",
800 "192.168.1.5",
"192.168.1.1",
803 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
807 sigs[0]=
"alert tcp any any -> any any (msg:\"sig 1\"; content:\"Hi all\"; sid:1;)";
808 sigs[1]=
"pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
809 sigs[2]=
"drop tcp any any -> any any (msg:\"sig 3\"; content:\"Hi all\"; sid:3;)";
811 uint32_t sid[3] = {1, 2, 3};
813 uint32_t results[3][3] = {
836 if (de_ctx != NULL) {
856 static int UtilActionTest14(
void)
859 uint8_t *buf = (uint8_t *)
"Hi all!";
860 uint16_t buflen = strlen((
char *)buf);
869 "192.168.1.5",
"192.168.1.1",
872 "192.168.1.1",
"192.168.1.5",
875 "192.168.1.5",
"192.168.1.1",
878 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
882 sigs[0]=
"alert tcp any any -> any any (msg:\"sig 1\"; content:\"Hi all\"; sid:1;)";
883 sigs[1]=
"pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
884 sigs[2]=
"drop tcp any any -> any any (msg:\"sig 3\"; content:\"Hi all\"; sid:3;)";
886 uint32_t sid[3] = {1, 2, 3};
888 uint32_t results[3][3] = {
912 if (de_ctx != NULL) {
930 static int UtilActionTest15(
void)
933 uint8_t *buf = (uint8_t *)
"Hi all!";
934 uint16_t buflen = strlen((
char *)buf);
938 "192.168.1.5",
"192.168.1.1",
941 "192.168.1.1",
"192.168.1.5",
944 "192.168.1.5",
"192.168.1.1",
947 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
951 sigs[0]=
"alert tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
952 sigs[1]=
"pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
953 sigs[2]=
"drop tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
955 uint32_t sid[3] = {1, 2, 3};
957 uint32_t results[3][3] = {
981 if (de_ctx != NULL) {
994 static int UtilActionTest16(
void)
997 uint8_t *buf = (uint8_t *)
"Hi all!";
998 uint16_t buflen = strlen((
char *)buf);
1002 "192.168.1.5",
"192.168.1.1",
1005 "192.168.1.1",
"192.168.1.5",
1008 "192.168.1.5",
"192.168.1.1",
1011 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
1014 const char *sigs[3];
1015 sigs[0]=
"drop tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
1016 sigs[1]=
"alert tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
1017 sigs[2]=
"pass tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
1019 uint32_t sid[3] = {1, 2, 3};
1021 uint32_t results[3][3] = {
1045 if (de_ctx != NULL) {
1058 static int UtilActionTest17(
void)
1061 uint8_t *buf = (uint8_t *)
"Hi all!";
1062 uint16_t buflen = strlen((
char *)buf);
1066 "192.168.1.5",
"192.168.1.1",
1069 "192.168.1.1",
"192.168.1.5",
1072 "192.168.1.5",
"192.168.1.1",
1075 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
1078 const char *sigs[3];
1079 sigs[0]=
"pass tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
1080 sigs[1]=
"drop tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
1081 sigs[2]=
"alert tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
1083 uint32_t sid[3] = {1, 2, 3};
1085 uint32_t results[3][3] = {
1109 if (de_ctx != NULL) {
1122 static int UtilActionTest18(
void)
1125 uint8_t *buf = (uint8_t *)
"Hi all!";
1126 uint16_t buflen = strlen((
char *)buf);
1135 "192.168.1.5",
"192.168.1.1",
1138 "192.168.1.1",
"192.168.1.5",
1141 "192.168.1.5",
"192.168.1.1",
1144 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
1147 const char *sigs[3];
1148 sigs[0]=
"alert tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
1149 sigs[1]=
"pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
1150 sigs[2]=
"drop tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
1152 uint32_t sid[3] = {1, 2, 3};
1154 uint32_t results[3][3] = {
1178 if (de_ctx != NULL) {
1197 static int UtilActionTest19(
void)
1200 uint8_t *buf = (uint8_t *)
"Hi all!";
1201 uint16_t buflen = strlen((
char *)buf);
1210 "192.168.1.5",
"192.168.1.1",
1213 "192.168.1.1",
"192.168.1.5",
1216 "192.168.1.5",
"192.168.1.1",
1219 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
1222 const char *sigs[3];
1223 sigs[0]=
"drop tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
1224 sigs[1]=
"alert tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
1225 sigs[2]=
"pass tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
1227 uint32_t sid[3] = {1, 2, 3};
1229 uint32_t results[3][3] = {
1253 if (de_ctx != NULL) {
1272 static int UtilActionTest20(
void)
1275 uint8_t *buf = (uint8_t *)
"Hi all!";
1276 uint16_t buflen = strlen((
char *)buf);
1285 "192.168.1.5",
"192.168.1.1",
1288 "192.168.1.1",
"192.168.1.5",
1291 "192.168.1.5",
"192.168.1.1",
1294 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
1297 const char *sigs[3];
1298 sigs[0]=
"pass tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
1299 sigs[1]=
"drop tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
1300 sigs[2]=
"alert tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
1302 uint32_t sid[3] = {1, 2, 3};
1304 uint32_t results[3][3] = {
1328 if (de_ctx != NULL) {
1341 static int UtilActionTest21(
void)
1344 uint8_t *buf = (uint8_t *)
"Hi all!";
1345 uint16_t buflen = strlen((
char *)buf);
1354 "192.168.1.5",
"192.168.1.1",
1357 "192.168.1.1",
"192.168.1.5",
1360 "192.168.1.5",
"192.168.1.1",
1363 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
1366 const char *sigs[3];
1367 sigs[0]=
"alert tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
1368 sigs[1]=
"pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
1369 sigs[2]=
"drop tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
1371 uint32_t sid[3] = {1, 2, 3};
1373 uint32_t results[3][3] = {
1397 if (de_ctx != NULL) {
1416 static int UtilActionTest22(
void)
1419 uint8_t *buf = (uint8_t *)
"Hi all!";
1420 uint16_t buflen = strlen((
char *)buf);
1429 "192.168.1.5",
"192.168.1.1",
1432 "192.168.1.1",
"192.168.1.5",
1435 "192.168.1.5",
"192.168.1.1",
1438 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
1441 const char *sigs[3];
1442 sigs[0]=
"drop tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
1443 sigs[1]=
"alert tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
1444 sigs[2]=
"pass tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
1446 uint32_t sid[3] = {1, 2, 3};
1448 uint32_t results[3][3] = {
1472 if (de_ctx != NULL) {
1491 static int UtilActionTest23(
void)
1494 uint8_t *buf = (uint8_t *)
"Hi all!";
1495 uint16_t buflen = strlen((
char *)buf);
1504 "192.168.1.5",
"192.168.1.1",
1507 "192.168.1.1",
"192.168.1.5",
1510 "192.168.1.5",
"192.168.1.1",
1513 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
1516 const char *sigs[3];
1517 sigs[0]=
"pass tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
1518 sigs[1]=
"drop tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
1519 sigs[2]=
"alert tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
1521 uint32_t sid[3] = {1, 2, 3};
1523 uint32_t results[3][3] = {
1547 if (de_ctx != NULL) {
1567 static int UtilActionTest24(
void)
1570 char config[] =
"%YAML 1.1\n"
#define TAILQ_FOREACH(var, head, field)
struct HtpBodyChunk_ * next
int UTHAppendSigs(DetectEngineCtx *de_ctx, const char *sigs[], int numsigs)
UTHAppendSigs: Add sigs to the detection_engine checking for errors.
#define ACTION_REJECT_DST
int ConfYamlLoadString(const char *string, size_t len)
Load configuration from a YAML string.
void UtilActionRegisterTests(void)
void SigCleanSignatures(DetectEngineCtx *de_ctx)
void SCSigOrderSignatures(DetectEngineCtx *de_ctx)
Orders the signatures.
main detection engine ctx
void SCSigRegisterSignatureOrderingFuncs(DetectEngineCtx *de_ctx)
Lets you register the Signature ordering functions. The order in which the functions are registered...
void ConfCreateContextBackup(void)
Creates a backup of the conf_hash hash_table used by the conf API.
uint8_t action_order_sigs[4]
#define ACTION_REJECT_BOTH
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
void ConfInit(void)
Initialize the configuration system.
int UTHMatchPacketsWithResults(DetectEngineCtx *de_ctx, Packet **p, int num_packets, uint32_t sids[], uint32_t *results, int numsigs)
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Packet * UTHBuildPacketReal(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, const char *src, const char *dst, uint16_t sport, uint16_t dport)
UTHBuildPacketReal is a function that create tcp/udp packets for unittests specifying ip and port sou...
void ConfRestoreContextBackup(void)
Restores the backup of the hash_table present in backup_conf_hash back to conf_hash.
int ActionInitConfig()
Load the action order from config. If none is provided, it will be default to ACTION_PASS, ACTION_DROP, ACTION_REJECT, ACTION_ALERT (pass has the highest prio)
int SigGroupCleanup(DetectEngineCtx *de_ctx)
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
uint8_t ActionOrderVal(uint8_t action)
Return the priority associated to an action (to order sigs as specified at config) action_order_sigs ...
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself...
DetectEngineCtx * DetectEngineCtxInit(void)