60 if (inet_pton(AF_INET, str, &in) != 1) {
61 printf(
"invalid IPv6 address %s\n", str);
64 return (uint32_t)in.s_addr;
82 uint8_t ipproto,
const char *
src,
const char *
dst,
83 uint16_t sport, uint16_t dport)
103 p->
ip6h->s_ip6_nxt = ipproto;
104 p->
ip6h->s_ip6_plen = htons(payload_len +
sizeof(TCPHdr));
106 if (inet_pton(AF_INET6, src, &in) != 1)
108 p->
src.addr_data32[0] = in[0];
109 p->
src.addr_data32[1] = in[1];
110 p->
src.addr_data32[2] = in[2];
111 p->
src.addr_data32[3] = in[3];
113 p->
ip6h->s_ip6_src[0] = in[0];
114 p->
ip6h->s_ip6_src[1] = in[1];
115 p->
ip6h->s_ip6_src[2] = in[2];
116 p->
ip6h->s_ip6_src[3] = in[3];
118 if (inet_pton(AF_INET6, dst, &in) != 1)
120 p->
dst.addr_data32[0] = in[0];
121 p->
dst.addr_data32[1] = in[1];
122 p->
dst.addr_data32[2] = in[2];
123 p->
dst.addr_data32[3] = in[3];
125 p->
ip6h->s_ip6_dst[0] = in[0];
126 p->
ip6h->s_ip6_dst[1] = in[1];
127 p->
ip6h->s_ip6_dst[2] = in[2];
128 p->
ip6h->s_ip6_dst[3] = in[3];
133 memset(p->
tcph, 0,
sizeof(TCPHdr));
134 p->
tcph->th_sport = htons(sport);
135 p->
tcph->th_dport = htons(dport);
142 if (p->
ip6h != NULL) {
145 if (p->
tcph != NULL) {
168 uint8_t ipproto,
const char *
src,
const char *
dst,
169 uint16_t sport, uint16_t dport)
181 p->src.family = AF_INET;
182 p->dst.family = AF_INET;
183 p->payload = payload;
187 if (inet_pton(AF_INET, src, &in) != 1)
189 p->src.addr_data32[0] = in.s_addr;
192 if (inet_pton(AF_INET, dst, &in) != 1)
194 p->dst.addr_data32[0] = in.s_addr;
201 p->ip4h->s_ip_src.s_addr = p->src.addr_data32[0];
202 p->ip4h->s_ip_dst.s_addr = p->dst.addr_data32[0];
203 p->ip4h->ip_proto = ipproto;
204 p->ip4h->ip_verhl =
sizeof(
IPV4Hdr);
207 int hdr_offset =
sizeof(
IPV4Hdr);
214 p->udph->uh_sport = sport;
215 p->udph->uh_dport = dport;
216 hdr_offset +=
sizeof(UDPHdr);
223 p->tcph->th_sport = htons(sport);
224 p->tcph->th_dport = htons(dport);
225 hdr_offset +=
sizeof(TCPHdr);
229 if (p->icmpv4h == NULL)
232 hdr_offset +=
sizeof(ICMPV4Hdr);
239 if (payload && payload_len) {
266 "192.168.1.5",
"192.168.1.1",
285 if (raw_eth == NULL || pktsize == NULL || numpkts <= 0) {
287 " of packets should be grater thatn zero");
296 memset(&th_v, 0,
sizeof(th_v));
299 for (; i < numpkts; i++) {
327 memset(&th_v, 0,
sizeof(th_v));
344 uint8_t ipproto,
const char *
src,
const char *
dst)
362 uint8_t ipproto,
const char *
src,
const char *
dst)
380 uint8_t ipproto, uint16_t sport, uint16_t dport)
383 "192.168.1.5",
"192.168.1.1",
399 for (; i < numpkts; i++) {
414 #if 0 // VJ we now use one buffer 452 printf(
"FlowAlloc failed\n");
456 memset(f, 0x00,
sizeof(
Flow));
460 if (family == AF_INET) {
462 }
else if (family == AF_INET6) {
467 if (family == AF_INET) {
468 if (inet_pton(AF_INET, src, &in) != 1) {
469 printf(
"invalid address %s\n", src);
473 f->src.addr_data32[0] = in.s_addr;
479 if (family == AF_INET) {
480 if (inet_pton(AF_INET, dst, &in) != 1) {
481 printf(
"invalid address %s\n", dst);
485 f->dst.addr_data32[0] = in.s_addr;
505 uint8_t *data, uint32_t data_len)
512 StreamingBufferSegment seg;
575 int UTHGenericTest(
Packet **pkt,
int numpkts,
const char *sigs[], uint32_t sids[], uint32_t *results,
int numsigs)
579 if (pkt == NULL || sigs == NULL || numpkts == 0
580 || sids == NULL || results == NULL || numsigs == 0) {
585 if (de_ctx == NULL) {
596 if (de_ctx != NULL) {
619 uint32_t results[],
int numsids)
621 if (p == NULL || sids == NULL) {
623 "packet is NULL, and if the array contain sids is set");
629 for (; i < numsids; i++) {
631 if (r != results[i]) {
632 SCLogInfo(
"Sid %"PRIu32
" matched %"PRIu16
" times, and not %"PRIu32
633 " as expected", sids[i], r, results[i]);
636 SCLogInfo(
"Sid %"PRIu32
" matched %"PRIu16
" times, as expected", sids[i], r);
654 if (de_ctx == NULL || numsigs <= 0 || sigs == NULL) {
663 for ( ; i < numsigs; i++) {
664 if (sigs[i] == NULL) {
666 " at position %d", i);
672 " position %d (%s)", i, sigs[i]);
695 if (de_ctx == NULL || p == NULL) {
705 memset(&th_v, 0,
sizeof(th_v));
713 for (; i < num_packets; i++) {
745 if (de_ctx == NULL || p == NULL) {
755 memset(&th_v, 0,
sizeof(th_v));
766 for (; i < num_packets; i++)
773 if (det_ctx != NULL) {
803 memset(&th_v, 0,
sizeof(th_v));
806 if (de_ctx == NULL) {
807 printf(
"de_ctx == NULL: ");
816 printf(
"signature == NULL: ");
825 printf(
"signature didn't alert: ");
863 memset(&th_v, 0,
sizeof(th_v));
866 if (de_ctx == NULL) {
905 uint8_t payload[] =
"Payload";
906 for (; i < end; i++) {
909 p->
src.addr_data32[0] = i;
910 p->
dst.addr_data32[0] = i + 1;
912 p->
src.addr_data32[0] = i + 1;
913 p->
dst.addr_data32[0] = i;
916 if (p->
flow != NULL) {
953 static int CheckUTHTestPacket(
Packet *p, uint8_t ipproto)
955 uint16_t sport = 41424;
957 uint8_t payload[] =
"Payload";
959 uint8_t
len =
sizeof(payload);
967 if (strncmp((
char *)payload, (
char *)p->
payload, len) != 0)
974 if (p->
proto != ipproto)
981 if (p->
udph->uh_sport != sport)
983 if (p->
udph->uh_dport != dport)
1001 static int UTHBuildPacketRealTest01(
void)
1003 uint8_t payload[] =
"Payload";
1006 "192.168.1.5",
"192.168.1.1", 41424, 80);
1008 int ret = CheckUTHTestPacket(p, IPPROTO_TCP);
1017 static int UTHBuildPacketRealTest02(
void)
1019 uint8_t payload[] =
"Payload";
1022 "192.168.1.5",
"192.168.1.1", 41424, 80);
1024 int ret = CheckUTHTestPacket(p, IPPROTO_UDP);
1032 static int UTHBuildPacketTest01(
void)
1034 uint8_t payload[] =
"Payload";
1038 int ret = CheckUTHTestPacket(p, IPPROTO_TCP);
1047 static int UTHBuildPacketTest02(
void)
1049 uint8_t payload[] =
"Payload";
1053 int ret = CheckUTHTestPacket(p, IPPROTO_UDP);
1062 static int UTHBuildPacketOfFlowsTest01(
void)
1084 static int UTHBuildPacketSrcDstTest01(
void)
1086 uint8_t payload[] =
"Payload";
1089 "192.168.1.5",
"192.168.1.1");
1091 int ret = CheckUTHTestPacket(p, IPPROTO_TCP);
1100 static int UTHBuildPacketSrcDstTest02(
void)
1102 uint8_t payload[] =
"Payload";
1105 "192.168.1.5",
"192.168.1.1");
1107 int ret = CheckUTHTestPacket(p, IPPROTO_UDP);
1116 static int UTHBuildPacketSrcDstPortsTest01(
void)
1118 uint8_t payload[] =
"Payload";
1123 int ret = CheckUTHTestPacket(p, IPPROTO_TCP);
1132 static int UTHBuildPacketSrcDstPortsTest02(
void)
1134 uint8_t payload[] =
"Payload";
1139 int ret = CheckUTHTestPacket(p, IPPROTO_UDP);
1150 UtRegisterTest(
"UTHBuildPacketRealTest01", UTHBuildPacketRealTest01);
1151 UtRegisterTest(
"UTHBuildPacketRealTest02", UTHBuildPacketRealTest02);
1154 UtRegisterTest(
"UTHBuildPacketSrcDstTest01", UTHBuildPacketSrcDstTest01);
1155 UtRegisterTest(
"UTHBuildPacketSrcDstTest02", UTHBuildPacketSrcDstTest02);
1157 UTHBuildPacketSrcDstPortsTest01);
1159 UTHBuildPacketSrcDstPortsTest02);
1160 UtRegisterTest(
"UTHBuildPacketOfFlowsTest01", UTHBuildPacketOfFlowsTest01);
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
#define STREAMING_BUFFER_INITIALIZER(cfg)
void UTHAssignFlow(Packet *p, Flow *f)
void StreamTcpSessionCleanup(TcpSession *ssn)
Session cleanup function. Does not free the ssn.
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
int UTHAppendSigs(DetectEngineCtx *de_ctx, const char *sigs[], int numsigs)
UTHAppendSigs: Add sigs to the detection_engine checking for errors.
void FlowHandlePacket(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Entry point for packet flow handling.
TcpStreamCnf stream_config
#define SET_PKT_LEN(p, len)
void UTHRegisterTests(void)
#define FLOWLOCK_UNLOCK(fb)
#define PASS
Pass the test.
Signature * SigInit(DetectEngineCtx *, const char *)
Parses a signature and adds it to the Detection Engine Context.
int UTHMatchPackets(DetectEngineCtx *de_ctx, Packet **p, int num_packets)
void FlowFree(Flow *f)
cleanup & free the memory of a flow
int UTHAddStreamToFlow(Flow *f, int direction, uint8_t *data, uint32_t data_len)
uint32_t UTHSetIPv4Address(const char *str)
return the uint32_t for a ipv4 address string
int UTHParseSignature(const char *str, bool expect)
parser a sig and see if the expected result is correct
#define SC_ATOMIC_RESET(name)
Initialize the previously declared atomic variable and it's lock.
void SigCleanSignatures(DetectEngineCtx *de_ctx)
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
int UTHCheckPacketMatchResults(Packet *p, uint32_t sids[], uint32_t results[], int numsids)
UTHCheckPacketMatches: function to check if a packet match some sids.
void SCSigOrderSignatures(DetectEngineCtx *de_ctx)
Orders the signatures.
main detection engine ctx
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
int UTHPacketMatchSigMpm(Packet *p, char *sig, uint16_t mpm_type)
void SCSigRegisterSignatureOrderingFuncs(DetectEngineCtx *de_ctx)
Lets you register the Signature ordering functions. The order in which the functions are registered...
#define COPY_TIMESTAMP(src, dst)
Flow * UTHBuildFlow(int family, const char *src, const char *dst, Port sp, Port dp)
Packet * UTHBuildPacketIPV6Real(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, const char *src, const char *dst, uint16_t sport, uint16_t dport)
UTHBuildPacketReal is a function that create tcp/udp packets for unittests specifying ip and port sou...
int StreamingBufferAppend(StreamingBuffer *sb, StreamingBufferSegment *seg, const uint8_t *data, uint32_t data_len)
Packet * UTHBuildPacketSrcDstPorts(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, uint16_t sport, uint16_t dport)
UTHBuildPacketSrcDstPorts is a wrapper that build packets specifying src and dst ports and defaulting...
void TimeGet(struct timeval *tv)
Packet ** UTHBuildPacketArrayFromEth(uint8_t *raw_eth[], int *pktsize, int numpkts)
UTHBuildPacketArrayFromEth is a wrapper that build a packets from an array of packets in ethernet raw...
int UTHPacketMatchSig(Packet *p, const char *sig)
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
int UTHMatchPacketsWithResults(DetectEngineCtx *de_ctx, Packet **p, int num_packets, uint32_t sids[], uint32_t *results, int numsigs)
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Structure to hold thread specific data for all decode modules.
void SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
void SCSigSignatureOrderingModuleCleanup(DetectEngineCtx *de_ctx)
De-registers all the signature ordering functions registered.
Packet * UTHBuildPacketReal(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, const char *src, const char *dst, uint16_t sport, uint16_t dport)
UTHBuildPacketReal is a function that create tcp/udp packets for unittests specifying ip and port sou...
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Packet * UTHBuildPacketFromEth(uint8_t *raw_eth, uint16_t pktsize)
UTHBuildPacketFromEth is a wrapper that build a packet for the rawbytes.
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
int SigGroupCleanup(DetectEngineCtx *de_ctx)
uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir)
int UTHRemoveSessionFromFlow(Flow *f)
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
int UTHAddSessionToFlow(Flow *f, uint32_t ts_isn, uint32_t tc_isn)
int UTHGenericTest(Packet **pkt, int numpkts, const char *sigs[], uint32_t sids[], uint32_t *results, int numsigs)
UTHGenericTest: function that perfom a generic check taking care of as maximum common unittest elemen...
void FlowShutdown(void)
shutdown the flow engine
#define FLOW_INITIALIZE(f)
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself...
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
StreamingBufferConfig sbcnf
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len, PacketQueue *pq)
Per thread variable structure.
Packet * UTHBuildPacketIPV6SrcDst(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, const char *src, const char *dst)
UTHBuildPacketSrcDst is a wrapper that build packets specifying IPs and defaulting ports (IPV6) ...
Packet * UTHBuildPacketSrcDst(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, const char *src, const char *dst)
UTHBuildPacketSrcDst is a wrapper that build packets specifying IPs and defaulting ports...
int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen)
Copy data to Packet payload at given offset.
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself...
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
void UTHFreeFlow(Flow *flow)
DetectEngineCtx * DetectEngineCtxInit(void)
void FlowInitConfig(char quiet)
initialize the configuration