suricata checkin based on commit id a4bce14770beee46a537eda3c3f6e8e8565d5d0a

Change-Id: I9a214fa0ee95e58fc640e50bd604dac7f42db48f

1 files changed, 1127 insertions, 0 deletions

diff --git a/framework/src/suricata/src/detect-flow.c b/framework/src/suricata/src/detect-flow.c
new file mode 100644
index 00000000..9c2db944
--- /dev/null
+++ b/framework/src/suricata/src/detect-flow.c
@@ -0,0 +1,1127 @@
+/* Copyright (C) 2007-2010 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * \author Victor Julien <victor@inliniac.net>
+ *
+ * FLOW part of the detection engine.
+ */
+
+#include "suricata-common.h"
+#include "debug.h"
+#include "decode.h"
+
+#include "detect.h"
+#include "detect-parse.h"
+#include "detect-engine.h"
+
+#include "flow.h"
+#include "flow-var.h"
+
+#include "detect-flow.h"
+
+#include "util-unittest.h"
+#include "util-unittest-helper.h"
+#include "util-debug.h"
+
+/**
+ * \brief Regex for parsing our flow options
+ */
+#define PARSE_REGEX  "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$"
+
+static pcre *parse_regex;
+static pcre_extra *parse_regex_study;
+
+int DetectFlowMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *);
+static int DetectFlowSetup (DetectEngineCtx *, Signature *, char *);
+void DetectFlowRegisterTests(void);
+void DetectFlowFree(void *);
+
+/**
+ * \brief Registration function for flow: keyword
+ */
+void DetectFlowRegister (void)
+{
+    sigmatch_table[DETECT_FLOW].name = "flow";
+    sigmatch_table[DETECT_FLOW].desc = "match on direction and state of the flow";
+    sigmatch_table[DETECT_FLOW].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Flow-keywords#Flow";
+    sigmatch_table[DETECT_FLOW].Match = DetectFlowMatch;
+    sigmatch_table[DETECT_FLOW].Setup = DetectFlowSetup;
+    sigmatch_table[DETECT_FLOW].Free  = DetectFlowFree;
+    sigmatch_table[DETECT_FLOW].RegisterTests = DetectFlowRegisterTests;
+
+    const char *eb;
+    int eo;
+    int opts = 0;
+
+    parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL);
+    if(parse_regex == NULL)
+    {
+        SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", PARSE_REGEX, eo, eb);
+        goto error;
+    }
+
+    parse_regex_study = pcre_study(parse_regex, 0, &eb);
+    if(eb != NULL)
+    {
+        SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
+        goto error;
+    }
+    return;
+
+error:
+    /* XXX */
+    return;
+}
+
+/*
+ * returns 0: no match
+ *         1: match
+ *        -1: error
+ */
+
+/**
+ * \brief This function is used to match flow flags set on a packet with those passed via flow:
+ *
+ * \param t pointer to thread vars
+ * \param det_ctx pointer to the pattern matcher thread
+ * \param p pointer to the current packet
+ * \param m pointer to the sigmatch that we will cast into DetectFlowData
+ *
+ * \retval 0 no match
+ * \retval 1 match
+ */
+int DetectFlowMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx)
+{
+    SCEnter();
+
+    SCLogDebug("pkt %p", p);
+
+    if (p->flowflags & FLOW_PKT_TOSERVER) {
+        SCLogDebug("FLOW_PKT_TOSERVER");
+    } else if (p->flowflags & FLOW_PKT_TOCLIENT) {
+        SCLogDebug("FLOW_PKT_TOCLIENT");
+    }
+
+    if (p->flowflags & FLOW_PKT_ESTABLISHED) {
+        SCLogDebug("FLOW_PKT_ESTABLISHED");
+    }
+
+    uint8_t cnt = 0;
+    const DetectFlowData *fd = (const DetectFlowData *)ctx;
+
+    if ((fd->flags & DETECT_FLOW_FLAG_TOSERVER) && (p->flowflags & FLOW_PKT_TOSERVER)) {
+        cnt++;
+    } else if ((fd->flags & DETECT_FLOW_FLAG_TOCLIENT) && (p->flowflags & FLOW_PKT_TOCLIENT)) {
+        cnt++;
+    }
+
+    if ((fd->flags & DETECT_FLOW_FLAG_ESTABLISHED) && (p->flowflags & FLOW_PKT_ESTABLISHED)) {
+        cnt++;
+    } else if (fd->flags & DETECT_FLOW_FLAG_STATELESS) {
+        cnt++;
+    }
+
+    if (det_ctx->flags & DETECT_ENGINE_THREAD_CTX_STREAM_CONTENT_MATCH) {
+        if (fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM)
+            cnt++;
+    } else {
+        if (fd->flags & DETECT_FLOW_FLAG_NOSTREAM)
+            cnt++;
+    }
+
+    int ret = (fd->match_cnt == cnt) ? 1 : 0;
+    SCLogDebug("returning %" PRId32 " cnt %" PRIu8 " fd->match_cnt %" PRId32 " fd->flags 0x%02X p->flowflags 0x%02X",
+        ret, cnt, fd->match_cnt, fd->flags, p->flowflags);
+    SCReturnInt(ret);
+}
+
+/**
+ * \brief This function is used to parse flow options passed via flow: keyword
+ *
+ * \param flowstr Pointer to the user provided flow options
+ *
+ * \retval fd pointer to DetectFlowData on success
+ * \retval NULL on failure
+ */
+DetectFlowData *DetectFlowParse (char *flowstr)
+{
+    DetectFlowData *fd = NULL;
+    char *args[3] = {NULL,NULL,NULL};
+#define MAX_SUBSTRINGS 30
+    int ret = 0, res = 0;
+    int ov[MAX_SUBSTRINGS];
+    char str1[16] = "", str2[16] = "", str3[16] = "";
+
+    ret = pcre_exec(parse_regex, parse_regex_study, flowstr, strlen(flowstr), 0, 0, ov, MAX_SUBSTRINGS);
+    if (ret < 1 || ret > 4) {
+        SCLogError(SC_ERR_PCRE_MATCH, "parse error, ret %" PRId32 ", string %s", ret, flowstr);
+        goto error;
+    }
+
+    if (ret > 1) {
+        res = pcre_copy_substring((char *)flowstr, ov, MAX_SUBSTRINGS, 1, str1, sizeof(str1));
+        if (res < 0) {
+            SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed");
+            goto error;
+        }
+        args[0] = (char *)str1;
+
+        if (ret > 2) {
+            res = pcre_copy_substring((char *)flowstr, ov, MAX_SUBSTRINGS, 2, str2, sizeof(str2));
+            if (res < 0) {
+                SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed");
+                goto error;
+            }
+            args[1] = (char *)str2;
+        }
+        if (ret > 3) {
+            res = pcre_copy_substring((char *)flowstr, ov, MAX_SUBSTRINGS, 3, str3, sizeof(str3));
+            if (res < 0) {
+                SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed");
+                goto error;
+            }
+            args[2] = (char *)str3;
+        }
+    }
+
+    fd = SCMalloc(sizeof(DetectFlowData));
+    if (unlikely(fd == NULL))
+        goto error;
+    fd->flags = 0;
+    fd->match_cnt = 0;
+
+    int i;
+    for (i = 0; i < (ret - 1); i++) {
+        if (args[i]) {
+            /* inspect our options and set the flags */
+            if (strcasecmp(args[i], "established") == 0) {
+                if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED) {
+                    SCLogError(SC_ERR_FLAGS_MODIFIER, "DETECT_FLOW_FLAG_ESTABLISHED flag is already set");
+                    goto error;
+                } else if (fd->flags & DETECT_FLOW_FLAG_STATELESS) {
+                    SCLogError(SC_ERR_FLAGS_MODIFIER, "DETECT_FLOW_FLAG_STATELESS already set");
+                    goto error;
+                }
+                fd->flags |= DETECT_FLOW_FLAG_ESTABLISHED;
+            } else if (strcasecmp(args[i], "stateless") == 0) {
+                if (fd->flags & DETECT_FLOW_FLAG_STATELESS) {
+                    SCLogError(SC_ERR_FLAGS_MODIFIER, "DETECT_FLOW_FLAG_STATELESS flag is already set");
+                    goto error;
+                } else if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED) {
+                    SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set DETECT_FLOW_FLAG_STATELESS, DETECT_FLOW_FLAG_ESTABLISHED already set");
+                    goto error;
+                }
+                fd->flags |= DETECT_FLOW_FLAG_STATELESS;
+            } else if (strcasecmp(args[i], "to_client") == 0 || strcasecmp(args[i], "from_server") == 0) {
+                if (fd->flags & DETECT_FLOW_FLAG_TOCLIENT) {
+                    SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set DETECT_FLOW_FLAG_TOCLIENT flag is already set");
+                    goto error;
+                } else if (fd->flags & DETECT_FLOW_FLAG_TOSERVER) {
+                    SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set to_client, DETECT_FLOW_FLAG_TOSERVER already set");
+                    goto error;
+                }
+                fd->flags |= DETECT_FLOW_FLAG_TOCLIENT;
+            } else if (strcasecmp(args[i], "to_server") == 0 || strcasecmp(args[i], "from_client") == 0){
+                if (fd->flags & DETECT_FLOW_FLAG_TOSERVER) {
+                    SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set DETECT_FLOW_FLAG_TOSERVER flag is already set");
+                    goto error;
+                } else if (fd->flags & DETECT_FLOW_FLAG_TOCLIENT) {
+                    SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set to_server, DETECT_FLOW_FLAG_TO_CLIENT flag already set");
+                    goto error;
+                }
+                fd->flags |= DETECT_FLOW_FLAG_TOSERVER;
+            } else if (strcasecmp(args[i], "only_stream") == 0) {
+                if (fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM) {
+                    SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set only_stream flag is already set");
+                    goto error;
+                } else if (fd->flags & DETECT_FLOW_FLAG_NOSTREAM) {
+                    SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set only_stream flag, DETECT_FLOW_FLAG_NOSTREAM already set");
+                    goto error;
+                }
+                fd->flags |= DETECT_FLOW_FLAG_ONLYSTREAM;
+            } else if (strcasecmp(args[i], "no_stream") == 0) {
+                if (fd->flags & DETECT_FLOW_FLAG_NOSTREAM) {
+                    SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set no_stream flag is already set");
+                    goto error;
+                } else if (fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM) {
+                    SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set no_stream flag, DETECT_FLOW_FLAG_ONLYSTREAM already set");
+                    goto error;
+                }
+                fd->flags |= DETECT_FLOW_FLAG_NOSTREAM;
+            } else {
+                SCLogError(SC_ERR_INVALID_VALUE, "invalid flow option \"%s\"", args[i]);
+                goto error;
+            }
+
+            fd->match_cnt++;
+            //printf("args[%" PRId32 "]: %s match_cnt: %" PRId32 " flags: 0x%02X\n", i, args[i], fd->match_cnt, fd->flags);
+        }
+    }
+    return fd;
+
+error:
+    if (fd != NULL)
+        DetectFlowFree(fd);
+    return NULL;
+
+}
+
+/**
+ * \brief this function is used to add the parsed flowdata into the current signature
+ *
+ * \param de_ctx pointer to the Detection Engine Context
+ * \param s pointer to the Current Signature
+ * \param flowstr pointer to the user provided flow options
+ *
+ * \retval 0 on Success
+ * \retval -1 on Failure
+ */
+int DetectFlowSetup (DetectEngineCtx *de_ctx, Signature *s, char *flowstr)
+{
+    DetectFlowData *fd = NULL;
+    SigMatch *sm = NULL;
+
+    fd = DetectFlowParse(flowstr);
+    if (fd == NULL)
+        goto error;
+
+    /*ensure only one flow option*/
+    if (s->init_flags & SIG_FLAG_INIT_FLOW) {
+        SCLogError (SC_ERR_INVALID_SIGNATURE, "A signature may have only one flow option.");
+        goto error;
+    }
+
+    /* Okay so far so good, lets get this into a SigMatch
+     * and put it in the Signature. */
+    sm = SigMatchAlloc();
+    if (sm == NULL)
+        goto error;
+
+    sm->type = DETECT_FLOW;
+    sm->ctx = (SigMatchCtx *)fd;
+
+    SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH);
+
+    /* set the signature direction flags */
+    if (fd->flags & DETECT_FLOW_FLAG_TOSERVER) {
+        s->flags |= SIG_FLAG_TOSERVER;
+    } else if (fd->flags & DETECT_FLOW_FLAG_TOCLIENT) {
+        s->flags |= SIG_FLAG_TOCLIENT;
+    } else {
+        s->flags |= SIG_FLAG_TOSERVER;
+        s->flags |= SIG_FLAG_TOCLIENT;
+    }
+    if (fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM) {
+        s->flags |= SIG_FLAG_REQUIRE_STREAM;
+    }
+    if (fd->flags & DETECT_FLOW_FLAG_NOSTREAM) {
+        s->flags |= SIG_FLAG_REQUIRE_PACKET;
+    } else {
+        s->init_flags |= SIG_FLAG_INIT_FLOW;
+    }
+
+    return 0;
+
+error:
+    if (fd != NULL)
+        DetectFlowFree(fd);
+    if (sm != NULL)
+        SCFree(sm);
+    return -1;
+
+}
+
+/**
+ * \brief this function will free memory associated with DetectFlowData
+ *
+ * \param fd pointer to DetectFlowData
+ */
+void DetectFlowFree(void *ptr)
+{
+    DetectFlowData *fd = (DetectFlowData *)ptr;
+    SCFree(fd);
+}
+
+#ifdef UNITTESTS
+
+/**
+ * \test DetectFlowTestParse01 is a test to make sure that we return "something"
+ *  when given valid flow opt
+ */
+int DetectFlowTestParse01 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("established");
+    if (fd != NULL) {
+        DetectFlowFree(fd);
+        result = 1;
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse02 is a test for setting the established flow opt
+ */
+int DetectFlowTestParse02 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("established");
+    if (fd != NULL) {
+        if (fd->flags == DETECT_FLOW_FLAG_ESTABLISHED && fd->match_cnt == 1) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED, 1, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse03 is a test for setting the stateless flow opt
+ */
+int DetectFlowTestParse03 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("stateless");
+    if (fd != NULL) {
+        if (fd->flags == DETECT_FLOW_FLAG_STATELESS && fd->match_cnt == 1) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS, 1, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse04 is a test for setting the to_client flow opt
+ */
+int DetectFlowTestParse04 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("to_client");
+    if (fd != NULL) {
+        if (fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOCLIENT, 1, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse05 is a test for setting the to_server flow opt
+ */
+int DetectFlowTestParse05 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("to_server");
+    if (fd != NULL) {
+        if (fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOSERVER, 1, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse06 is a test for setting the from_server flow opt
+ */
+int DetectFlowTestParse06 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("from_server");
+    if (fd != NULL) {
+        if (fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOCLIENT, 1, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse07 is a test for setting the from_client flow opt
+ */
+int DetectFlowTestParse07 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("from_client");
+    if (fd != NULL) {
+        if (fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOSERVER, 1, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse08 is a test for setting the established,to_client flow opts
+ */
+int DetectFlowTestParse08 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("established,to_client");
+    if (fd != NULL) {
+        if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2) {
+            result = 1;
+        } else {
+            printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse09 is a test for setting the to_client,stateless flow opts (order of state,dir reversed)
+ */
+int DetectFlowTestParse09 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("to_client,stateless");
+    if (fd != NULL) {
+        if (fd->flags & DETECT_FLOW_FLAG_STATELESS && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2) {
+            result = 1;
+        } else {
+            printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse10 is a test for setting the from_server,stateless flow opts (order of state,dir reversed)
+ */
+int DetectFlowTestParse10 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("from_server,stateless");
+    if (fd != NULL) {
+        if (fd->flags & DETECT_FLOW_FLAG_STATELESS  && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2){
+            result = 1;
+        } else {
+            printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse11 is a test for setting the from_server,stateless flow opts with spaces all around
+ */
+int DetectFlowTestParse11 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse(" from_server , stateless ");
+    if (fd != NULL) {
+        if (fd->flags & DETECT_FLOW_FLAG_STATELESS  && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2){
+            result = 1;
+        } else {
+            printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParseNocase01 is a test to make sure that we return "something"
+ *  when given valid flow opt
+ */
+int DetectFlowTestParseNocase01 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("ESTABLISHED");
+    if (fd != NULL) {
+        DetectFlowFree(fd);
+        result = 1;
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParseNocase02 is a test for setting the established flow opt
+ */
+int DetectFlowTestParseNocase02 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("ESTABLISHED");
+    if (fd != NULL) {
+        if (fd->flags == DETECT_FLOW_FLAG_ESTABLISHED && fd->match_cnt == 1) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED, 1, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParseNocase03 is a test for setting the stateless flow opt
+ */
+int DetectFlowTestParseNocase03 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("STATELESS");
+    if (fd != NULL) {
+        if (fd->flags == DETECT_FLOW_FLAG_STATELESS && fd->match_cnt == 1) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS, 1, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParseNocase04 is a test for setting the to_client flow opt
+ */
+int DetectFlowTestParseNocase04 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("TO_CLIENT");
+    if (fd != NULL) {
+        if (fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOCLIENT, 1, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParseNocase05 is a test for setting the to_server flow opt
+ */
+int DetectFlowTestParseNocase05 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("TO_SERVER");
+    if (fd != NULL) {
+        if (fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOSERVER, 1, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParseNocase06 is a test for setting the from_server flow opt
+ */
+int DetectFlowTestParseNocase06 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("FROM_SERVER");
+    if (fd != NULL) {
+        if (fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOCLIENT, 1, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParseNocase07 is a test for setting the from_client flow opt
+ */
+int DetectFlowTestParseNocase07 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("FROM_CLIENT");
+    if (fd != NULL) {
+        if (fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_TOSERVER, 1, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParseNocase08 is a test for setting the established,to_client flow opts
+ */
+int DetectFlowTestParseNocase08 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("ESTABLISHED,TO_CLIENT");
+    if (fd != NULL) {
+        if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2) {
+            result = 1;
+        } else {
+            printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParseNocase09 is a test for setting the to_client,stateless flow opts (order of state,dir reversed)
+ */
+int DetectFlowTestParseNocase09 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("TO_CLIENT,STATELESS");
+    if (fd != NULL) {
+        if (fd->flags & DETECT_FLOW_FLAG_STATELESS && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2) {
+            result = 1;
+        } else {
+            printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParseNocase10 is a test for setting the from_server,stateless flow opts (order of state,dir reversed)
+ */
+int DetectFlowTestParseNocase10 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("FROM_SERVER,STATELESS");
+    if (fd != NULL) {
+        if (fd->flags & DETECT_FLOW_FLAG_STATELESS  && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2){
+            result = 1;
+        } else {
+            printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParseNocase11 is a test for setting the from_server,stateless flow opts with spaces all around
+ */
+int DetectFlowTestParseNocase11 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse(" FROM_SERVER , STATELESS ");
+    if (fd != NULL) {
+        if (fd->flags & DETECT_FLOW_FLAG_STATELESS  && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2){
+            result = 1;
+        } else {
+            printf("expected: 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_STATELESS + DETECT_FLOW_FLAG_TOCLIENT, 2, fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+
+/**
+ * \test DetectFlowTestParse12 is a test for setting an invalid seperator :
+ */
+int DetectFlowTestParse12 (void)
+{
+    int result = 1;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("from_server:stateless");
+    if (fd != NULL) {
+        printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
+        result = 0;
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse13 is a test for an invalid option
+ */
+int DetectFlowTestParse13 (void)
+{
+    int result = 1;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("invalidoptiontest");
+    if (fd != NULL) {
+        printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
+        result = 0;
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+/**
+ * \test DetectFlowTestParse14 is a test for a empty option
+ */
+int DetectFlowTestParse14 (void)
+{
+    int result = 1;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("");
+    if (fd != NULL) {
+        printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
+        result = 0;
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse15 is a test for an invalid combo of options established,stateless
+ */
+int DetectFlowTestParse15 (void)
+{
+    int result = 1;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("established,stateless");
+    if (fd != NULL) {
+        printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
+        result = 0;
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse16 is a test for an invalid combo of options to_client,to_server
+ */
+int DetectFlowTestParse16 (void)
+{
+    int result = 1;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("to_client,to_server");
+    if (fd != NULL) {
+        printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
+        result = 0;
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse16 is a test for an invalid combo of options to_client,from_server
+ * flowbit flags are the same
+ */
+int DetectFlowTestParse17 (void)
+{
+    int result = 1;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("to_client,from_server");
+    if (fd != NULL) {
+        printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
+        result = 0;
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse18 is a test for setting the from_server,stateless,only_stream flow opts (order of state,dir reversed)
+ */
+int DetectFlowTestParse18 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("from_server,established,only_stream");
+    if (fd != NULL) {
+        if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM && fd->match_cnt == 3) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED + DETECT_FLOW_FLAG_TOCLIENT + DETECT_FLOW_FLAG_ONLYSTREAM, 3,
+                    fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParseNocase18 is a test for setting the from_server,stateless,only_stream flow opts (order of state,dir reversed)
+ */
+int DetectFlowTestParseNocase18 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("FROM_SERVER,ESTABLISHED,ONLY_STREAM");
+    if (fd != NULL) {
+        if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM && fd->match_cnt == 3) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED + DETECT_FLOW_FLAG_TOCLIENT + DETECT_FLOW_FLAG_ONLYSTREAM, 3,
+                    fd->flags, fd->match_cnt);
+        }
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+
+/**
+ * \test DetectFlowTestParse19 is a test for one to many options passed to DetectFlowParse
+ */
+int DetectFlowTestParse19 (void)
+{
+    int result = 1;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("from_server,established,only_stream,a");
+    if (fd != NULL) {
+        printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
+        result = 0;
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse20 is a test for setting from_server, established, no_stream
+ */
+int DetectFlowTestParse20 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("from_server,established,no_stream");
+    if (fd != NULL) {
+        if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->flags & DETECT_FLOW_FLAG_NOSTREAM && fd->match_cnt == 3) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED + DETECT_FLOW_FLAG_TOCLIENT + DETECT_FLOW_FLAG_NOSTREAM, 3,
+                    fd->flags, fd->match_cnt);
+        }
+
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse20 is a test for setting from_server, established, no_stream
+ */
+int DetectFlowTestParseNocase20 (void)
+{
+    int result = 0;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("FROM_SERVER,ESTABLISHED,NO_STREAM");
+    if (fd != NULL) {
+        if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->flags & DETECT_FLOW_FLAG_NOSTREAM && fd->match_cnt == 3) {
+            result = 1;
+        } else {
+            printf("expected 0x%02X cnt %" PRId32 " got 0x%02X cnt %" PRId32 ": ", DETECT_FLOW_FLAG_ESTABLISHED + DETECT_FLOW_FLAG_TOCLIENT + DETECT_FLOW_FLAG_NOSTREAM, 3,
+                    fd->flags, fd->match_cnt);
+        }
+
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+/**
+ * \test DetectFlowTestParse21 is a test for an invalid opt between to valid opts
+ */
+int DetectFlowTestParse21 (void)
+{
+    int result = 1;
+    DetectFlowData *fd = NULL;
+    fd = DetectFlowParse("from_server,a,no_stream");
+    if (fd != NULL) {
+        printf("expected: NULL got 0x%02X %" PRId32 ": ",fd->flags, fd->match_cnt);
+        result = 0;
+        DetectFlowFree(fd);
+    }
+
+    return result;
+}
+
+static int DetectFlowSigTest01(void)
+{
+    int result = 0;
+    ThreadVars th_v;
+    DecodeThreadVars dtv;
+    DetectEngineCtx *de_ctx = NULL;
+    DetectEngineThreadCtx *det_ctx = NULL;
+    uint8_t *buf = (uint8_t *)"supernovaduper";
+    uint16_t buflen = strlen((char *)buf);
+
+    Packet *p = UTHBuildPacket(buf, buflen, IPPROTO_TCP);
+    if (p->flow != NULL) {
+        printf("packet has flow set\n");
+        goto end;
+    }
+
+    char *sig1 = "alert tcp any any -> any any (msg:\"dummy\"; "
+        "content:\"nova\"; flow:no_stream; sid:1;)";
+
+    memset(&dtv, 0, sizeof(DecodeThreadVars));
+    memset(&th_v, 0, sizeof(th_v));
+
+    de_ctx = DetectEngineCtxInit();
+    if (de_ctx == NULL) {
+        printf("de_ctx == NULL: ");
+        goto end;
+    }
+    de_ctx->flags |= DE_QUIET;
+
+    de_ctx->sig_list = SigInit(de_ctx, sig1);
+    if (de_ctx->sig_list == NULL) {
+        printf("signature == NULL: ");
+        goto end;
+    }
+
+    SigGroupBuild(de_ctx);
+    DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
+
+    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
+    if (PacketAlertCheck(p, 1) != 1) {
+        goto end;
+    }
+
+    result = 1;
+
+ end:
+    if (det_ctx != NULL)
+        DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
+
+    if (de_ctx != NULL) {
+        SigGroupCleanup(de_ctx);
+        SigCleanSignatures(de_ctx);
+        DetectEngineCtxFree(de_ctx);
+    }
+
+    if (p != NULL)
+        UTHFreePacket(p);
+
+    return result;
+}
+#endif /* UNITTESTS */
+
+/**
+ * \brief this function registers unit tests for DetectFlow
+ */
+void DetectFlowRegisterTests(void)
+{
+#ifdef UNITTESTS
+    UtRegisterTest("DetectFlowTestParse01", DetectFlowTestParse01, 1);
+    UtRegisterTest("DetectFlowTestParse02", DetectFlowTestParse02, 1);
+    UtRegisterTest("DetectFlowTestParse03", DetectFlowTestParse03, 1);
+    UtRegisterTest("DetectFlowTestParse04", DetectFlowTestParse04, 1);
+    UtRegisterTest("DetectFlowTestParse05", DetectFlowTestParse05, 1);
+    UtRegisterTest("DetectFlowTestParse06", DetectFlowTestParse06, 1);
+    UtRegisterTest("DetectFlowTestParse07", DetectFlowTestParse07, 1);
+    UtRegisterTest("DetectFlowTestParse08", DetectFlowTestParse08, 1);
+    UtRegisterTest("DetectFlowTestParse09", DetectFlowTestParse09, 1);
+    UtRegisterTest("DetectFlowTestParse10", DetectFlowTestParse10, 1);
+    UtRegisterTest("DetectFlowTestParse11", DetectFlowTestParse11, 1);
+    UtRegisterTest("DetectFlowTestParseNocase01", DetectFlowTestParseNocase01, 1);
+    UtRegisterTest("DetectFlowTestParseNocase02", DetectFlowTestParseNocase02, 1);
+    UtRegisterTest("DetectFlowTestParseNocase03", DetectFlowTestParseNocase03, 1);
+    UtRegisterTest("DetectFlowTestParseNocase04", DetectFlowTestParseNocase04, 1);
+    UtRegisterTest("DetectFlowTestParseNocase05", DetectFlowTestParseNocase05, 1);
+    UtRegisterTest("DetectFlowTestParseNocase06", DetectFlowTestParseNocase06, 1);
+    UtRegisterTest("DetectFlowTestParseNocase07", DetectFlowTestParseNocase07, 1);
+    UtRegisterTest("DetectFlowTestParseNocase08", DetectFlowTestParseNocase08, 1);
+    UtRegisterTest("DetectFlowTestParseNocase09", DetectFlowTestParseNocase09, 1);
+    UtRegisterTest("DetectFlowTestParseNocase10", DetectFlowTestParseNocase10, 1);
+    UtRegisterTest("DetectFlowTestParseNocase11", DetectFlowTestParseNocase11, 1);
+    UtRegisterTest("DetectFlowTestParse12", DetectFlowTestParse12, 1);
+    UtRegisterTest("DetectFlowTestParse13", DetectFlowTestParse13, 1);
+    UtRegisterTest("DetectFlowTestParse14", DetectFlowTestParse14, 1);
+    UtRegisterTest("DetectFlowTestParse15", DetectFlowTestParse15, 1);
+    UtRegisterTest("DetectFlowTestParse16", DetectFlowTestParse16, 1);
+    UtRegisterTest("DetectFlowTestParse17", DetectFlowTestParse17, 1);
+    UtRegisterTest("DetectFlowTestParse18", DetectFlowTestParse18, 1);
+    UtRegisterTest("DetectFlowTestParseNocase18", DetectFlowTestParseNocase18, 1);
+    UtRegisterTest("DetectFlowTestParse19", DetectFlowTestParse19, 1);
+    UtRegisterTest("DetectFlowTestParse20", DetectFlowTestParse20, 1);
+    UtRegisterTest("DetectFlowTestParseNocase20", DetectFlowTestParseNocase20, 1);
+    UtRegisterTest("DetectFlowTestParse21", DetectFlowTestParse21, 1);
+
+    UtRegisterTest("DetectFlowSigTest01", DetectFlowSigTest01, 1);
+#endif /* UNITTESTS */
+}