aboutsummaryrefslogtreecommitdiffstats
path: root/framework/src/suricata/src/detect-dns-query.c
diff options
context:
space:
mode:
Diffstat (limited to 'framework/src/suricata/src/detect-dns-query.c')
-rw-r--r--framework/src/suricata/src/detect-dns-query.c1180
1 files changed, 0 insertions, 1180 deletions
diff --git a/framework/src/suricata/src/detect-dns-query.c b/framework/src/suricata/src/detect-dns-query.c
deleted file mode 100644
index 55742f89..00000000
--- a/framework/src/suricata/src/detect-dns-query.c
+++ /dev/null
@@ -1,1180 +0,0 @@
-/* Copyright (C) 2013 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/**
- * \ingroup dnslayer
- *
- * @{
- */
-
-
-/**
- * \file
- *
- * \author Victor Julien <victor@inliniac.net>
- */
-
-#include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
-
-#include "detect-parse.h"
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-content.h"
-#include "detect-pcre.h"
-
-#include "flow.h"
-#include "flow-util.h"
-#include "flow-var.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
-
-#include "stream-tcp.h"
-
-#include "app-layer.h"
-#include "app-layer-dns-common.h"
-#include "detect-dns-query.h"
-
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-
-static int DetectDnsQuerySetup (DetectEngineCtx *, Signature *, char *);
-static void DetectDnsQueryRegisterTests(void);
-
-/**
- * \brief Registration function for keyword: http_uri
- */
-void DetectDnsQueryRegister (void)
-{
- sigmatch_table[DETECT_AL_DNS_QUERY].name = "dns_query";
- sigmatch_table[DETECT_AL_DNS_QUERY].desc = "content modifier to match specifically and only on the DNS query-buffer";
- sigmatch_table[DETECT_AL_DNS_QUERY].Match = NULL;
- sigmatch_table[DETECT_AL_DNS_QUERY].AppLayerMatch = NULL;
- sigmatch_table[DETECT_AL_DNS_QUERY].alproto = ALPROTO_DNS;
- sigmatch_table[DETECT_AL_DNS_QUERY].Setup = DetectDnsQuerySetup;
- sigmatch_table[DETECT_AL_DNS_QUERY].Free = NULL;
- sigmatch_table[DETECT_AL_DNS_QUERY].RegisterTests = DetectDnsQueryRegisterTests;
-
- sigmatch_table[DETECT_AL_DNS_QUERY].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_DNS_QUERY].flags |= SIGMATCH_PAYLOAD;
-}
-
-
-/**
- * \brief this function setups the dns_query modifier keyword used in the rule
- *
- * \param de_ctx Pointer to the Detection Engine Context
- * \param s Pointer to the Signature to which the current keyword belongs
- * \param str Should hold an empty string always
- *
- * \retval 0 On success
- * \retval -1 On failure
- */
-
-static int DetectDnsQuerySetup(DetectEngineCtx *de_ctx, Signature *s, char *str)
-{
- s->list = DETECT_SM_LIST_DNSQUERYNAME_MATCH;
- s->alproto = ALPROTO_DNS;
- return 0;
-}
-
-/**
- * \brief Run the pattern matcher against the queries
- *
- * \param f locked flow
- * \param dns_state initialized dns state
- *
- * \warning Make sure the flow/state is locked
- * \todo what should we return? Just the fact that we matched?
- */
-uint32_t DetectDnsQueryInspectMpm(DetectEngineThreadCtx *det_ctx, Flow *f,
- DNSState *dns_state, uint8_t flags, void *txv,
- uint64_t tx_id)
-{
- SCEnter();
-
- DNSTransaction *tx = (DNSTransaction *)txv;
- DNSQueryEntry *query = NULL;
- uint8_t *buffer;
- uint16_t buffer_len;
- uint32_t cnt = 0;
-
- TAILQ_FOREACH(query, &tx->query_list, next) {
- SCLogDebug("tx %p query %p", tx, query);
-
- buffer = (uint8_t *)((uint8_t *)query + sizeof(DNSQueryEntry));
- buffer_len = query->len;
-
- cnt += DnsQueryPatternSearch(det_ctx,
- buffer, buffer_len,
- flags);
- }
-
- SCReturnUInt(cnt);
-}
-
-#ifdef UNITTESTS
-/** \test simple google.com query matching */
-static int DetectDnsQueryTest01(void)
-{
- /* google.com */
- uint8_t buf[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
- 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
- 0x00, 0x10, 0x00, 0x01, };
- int result = 0;
- Flow f;
- DNSState *dns_state = NULL;
- Packet *p = NULL;
- Signature *s = NULL;
- ThreadVars tv;
- DetectEngineThreadCtx *det_ctx = NULL;
- AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
-
- memset(&tv, 0, sizeof(ThreadVars));
- memset(&f, 0, sizeof(Flow));
-
- p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_UDP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
-
- FLOW_INITIALIZE(&f);
- f.flags |= FLOW_IPV4;
- f.proto = IPPROTO_UDP;
- f.protomap = FlowGetProtoMapping(f.proto);
-
- p->flow = &f;
- p->flags |= PKT_HAS_FLOW;
- p->flowflags |= FLOW_PKT_TOSERVER;
- f.alproto = ALPROTO_DNS;
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL) {
- goto end;
- }
- de_ctx->mpm_matcher = DEFAULT_MPM;
- de_ctx->flags |= DE_QUIET;
-
- s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
- "(msg:\"Test dns_query option\"; "
- "dns_query; content:\"google\"; nocase; sid:1;)");
- if (s == NULL) {
- goto end;
- }
-
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
-
- SCMutexLock(&f.m);
- int r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf, sizeof(buf));
- if (r != 0) {
- printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- dns_state = f.alstate;
- if (dns_state == NULL) {
- printf("no dns state: ");
- goto end;
- }
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p);
-
- if (!(PacketAlertCheck(p, 1))) {
- printf("sig 1 didn't alert, but it should have: ");
- goto end;
- }
-
- result = 1;
-
-end:
- if (alp_tctx != NULL)
- AppLayerParserThreadCtxFree(alp_tctx);
- if (det_ctx != NULL)
- DetectEngineThreadCtxDeinit(&tv, det_ctx);
- if (de_ctx != NULL)
- SigGroupCleanup(de_ctx);
- if (de_ctx != NULL)
- DetectEngineCtxFree(de_ctx);
-
- FLOW_DESTROY(&f);
- UTHFreePacket(p);
- return result;
-}
-
-/** \test multi tx google.(com|net) query matching */
-static int DetectDnsQueryTest02(void)
-{
- /* google.com */
- uint8_t buf1[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
- 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
- 0x00, 0x01, 0x00, 0x01, };
-
- uint8_t buf2[] = { 0x10, 0x32, /* tx id */
- 0x81, 0x80, /* flags: resp, recursion desired, recusion available */
- 0x00, 0x01, /* 1 query */
- 0x00, 0x01, /* 1 answer */
- 0x00, 0x00, 0x00, 0x00, /* no auth rr, additional rr */
- /* query record */
- 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, /* name */
- 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00, /* name cont */
- 0x00, 0x01, 0x00, 0x01, /* type a, class in */
- /* answer */
- 0xc0, 0x0c, /* ref to name in query above */
- 0x00, 0x01, 0x00, 0x01, /* type a, class in */
- 0x00, 0x01, 0x40, 0xef, /* ttl */
- 0x00, 0x04, /* data len */
- 0x01, 0x02, 0x03, 0x04 }; /* addr */
-
- /* google.net */
- uint8_t buf3[] = { 0x11, 0x33, 0x01, 0x00, 0x00, 0x01,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
- 0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
- 0x00, 0x10, 0x00, 0x01, };
- int result = 0;
- Flow f;
- DNSState *dns_state = NULL;
- Packet *p1 = NULL, *p2 = NULL, *p3 = NULL;
- Signature *s = NULL;
- ThreadVars tv;
- DetectEngineThreadCtx *det_ctx = NULL;
- AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
-
- memset(&tv, 0, sizeof(ThreadVars));
- memset(&f, 0, sizeof(Flow));
-
- p1 = UTHBuildPacketReal(buf1, sizeof(buf1), IPPROTO_UDP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
- p2 = UTHBuildPacketReal(buf1, sizeof(buf1), IPPROTO_UDP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
- p3 = UTHBuildPacketReal(buf1, sizeof(buf1), IPPROTO_UDP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
-
- FLOW_INITIALIZE(&f);
- f.flags |= FLOW_IPV4;
- f.proto = IPPROTO_UDP;
- f.protomap = FlowGetProtoMapping(f.proto);
- f.alproto = ALPROTO_DNS;
-
- p1->flow = &f;
- p1->flags |= PKT_HAS_FLOW;
- p1->flowflags |= FLOW_PKT_TOSERVER;
- p1->pcap_cnt = 1;
-
- p2->flow = &f;
- p2->flags |= PKT_HAS_FLOW;
- p2->flowflags |= FLOW_PKT_TOCLIENT;
- p2->pcap_cnt = 2;
-
- p3->flow = &f;
- p3->flags |= PKT_HAS_FLOW;
- p3->flowflags |= FLOW_PKT_TOSERVER;
- p3->pcap_cnt = 3;
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL) {
- goto end;
- }
- de_ctx->mpm_matcher = DEFAULT_MPM;
- de_ctx->flags |= DE_QUIET;
-
- s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
- "(msg:\"Test dns_query option\"; "
- "dns_query; content:\"google.com\"; nocase; sid:1;)");
- if (s == NULL) {
- goto end;
- }
- s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
- "(msg:\"Test dns_query option\"; "
- "dns_query; content:\"google.net\"; nocase; sid:2;)");
- if (s == NULL) {
- goto end;
- }
-
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
-
- SCMutexLock(&f.m);
- int r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf1, sizeof(buf1));
- if (r != 0) {
- printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- dns_state = f.alstate;
- if (dns_state == NULL) {
- printf("no dns state: ");
- goto end;
- }
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
-
- if (!(PacketAlertCheck(p1, 1))) {
- printf("(p1) sig 1 didn't alert, but it should have: ");
- goto end;
- }
- if (PacketAlertCheck(p1, 2)) {
- printf("(p1) sig 2 did alert, but it should not have: ");
- goto end;
- }
-
- SCMutexLock(&f.m);
- r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOCLIENT, buf2, sizeof(buf2));
- if (r != 0) {
- printf("toserver client 1 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
-
- if (PacketAlertCheck(p2, 1)) {
- printf("(p2) sig 1 alerted, but it should not have: ");
- goto end;
- }
- if (PacketAlertCheck(p2, 2)) {
- printf("(p2) sig 2 alerted, but it should not have: ");
- goto end;
- }
-
- SCMutexLock(&f.m);
- r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf3, sizeof(buf3));
- if (r != 0) {
- printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
-
- if (PacketAlertCheck(p3, 1)) {
- printf("(p3) sig 1 alerted, but it should not have: ");
- goto end;
- }
- if (!(PacketAlertCheck(p3, 2))) {
- printf("(p3) sig 2 didn't alert, but it should have: ");
- goto end;
- }
-
- result = 1;
-
-end:
- if (alp_tctx != NULL)
- AppLayerParserThreadCtxFree(alp_tctx);
- if (det_ctx != NULL)
- DetectEngineThreadCtxDeinit(&tv, det_ctx);
- if (de_ctx != NULL)
- SigGroupCleanup(de_ctx);
- if (de_ctx != NULL)
- DetectEngineCtxFree(de_ctx);
-
- FLOW_DESTROY(&f);
- UTHFreePacket(p1);
- UTHFreePacket(p2);
- UTHFreePacket(p3);
- return result;
-}
-
-/** \test simple google.com query matching (TCP) */
-static int DetectDnsQueryTest03(void)
-{
- /* google.com */
- uint8_t buf[] = { 0x00, 28,
- 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
- 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
- 0x00, 0x10, 0x00, 0x01, };
- int result = 0;
- Flow f;
- DNSState *dns_state = NULL;
- Packet *p = NULL;
- Signature *s = NULL;
- ThreadVars tv;
- DetectEngineThreadCtx *det_ctx = NULL;
- TcpSession ssn;
- AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
-
- memset(&tv, 0, sizeof(ThreadVars));
- memset(&f, 0, sizeof(Flow));
- memset(&ssn, 0, sizeof(TcpSession));
-
- p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
-
- FLOW_INITIALIZE(&f);
- f.protoctx = (void *)&ssn;
- f.flags |= FLOW_IPV4;
- f.proto = IPPROTO_TCP;
- f.protomap = FlowGetProtoMapping(f.proto);
-
- p->flow = &f;
- p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
- p->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED;
- f.alproto = ALPROTO_DNS;
-
- StreamTcpInitConfig(TRUE);
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL) {
- goto end;
- }
- de_ctx->mpm_matcher = DEFAULT_MPM;
- de_ctx->flags |= DE_QUIET;
-
- s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
- "(msg:\"Test dns_query option\"; "
- "content:\"google\"; nocase; dns_query; sid:1;)");
- if (s == NULL) {
- goto end;
- }
-
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
-
- SCMutexLock(&f.m);
- int r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf, sizeof(buf));
- if (r != 0) {
- printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- dns_state = f.alstate;
- if (dns_state == NULL) {
- printf("no dns state: ");
- goto end;
- }
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p);
-
- if (!(PacketAlertCheck(p, 1))) {
- printf("sig 1 didn't alert, but it should have: ");
- goto end;
- }
-
- result = 1;
-
-end:
- if (alp_tctx != NULL)
- AppLayerParserThreadCtxFree(alp_tctx);
- if (det_ctx != NULL)
- DetectEngineThreadCtxDeinit(&tv, det_ctx);
- if (de_ctx != NULL)
- SigGroupCleanup(de_ctx);
- if (de_ctx != NULL)
- DetectEngineCtxFree(de_ctx);
-
- StreamTcpFreeConfig(TRUE);
- FLOW_DESTROY(&f);
- UTHFreePacket(p);
- return result;
-}
-
-/** \test simple google.com query matching (TCP splicing) */
-static int DetectDnsQueryTest04(void)
-{
- /* google.com */
- uint8_t buf1[] = { 0x00, 28,
- 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, };
- uint8_t buf2[] = { 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
- 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
- 0x00, 0x10, 0x00, 0x01, };
- int result = 0;
- Flow f;
- DNSState *dns_state = NULL;
- Packet *p1 = NULL, *p2 = NULL;
- Signature *s = NULL;
- ThreadVars tv;
- DetectEngineThreadCtx *det_ctx = NULL;
- TcpSession ssn;
- AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
-
- memset(&tv, 0, sizeof(ThreadVars));
- memset(&f, 0, sizeof(Flow));
- memset(&ssn, 0, sizeof(TcpSession));
-
- p1 = UTHBuildPacketReal(buf1, sizeof(buf1), IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
- p2 = UTHBuildPacketReal(buf2, sizeof(buf2), IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
-
- FLOW_INITIALIZE(&f);
- f.protoctx = (void *)&ssn;
- f.flags |= FLOW_IPV4;
- f.proto = IPPROTO_TCP;
- f.protomap = FlowGetProtoMapping(f.proto);
- f.alproto = ALPROTO_DNS;
-
- p1->flow = &f;
- p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
- p1->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED;
-
- p2->flow = &f;
- p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
- p2->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED;
-
- StreamTcpInitConfig(TRUE);
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL) {
- goto end;
- }
- de_ctx->mpm_matcher = DEFAULT_MPM;
- de_ctx->flags |= DE_QUIET;
-
- s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
- "(msg:\"Test dns_query option\"; "
- "dns_query; content:\"google\"; nocase; sid:1;)");
- if (s == NULL) {
- goto end;
- }
-
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
-
- SCMutexLock(&f.m);
- int r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf1, sizeof(buf1));
- if (r != 0) {
- printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- dns_state = f.alstate;
- if (dns_state == NULL) {
- printf("no dns state: ");
- goto end;
- }
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
-
- if (PacketAlertCheck(p1, 1)) {
- printf("sig 1 alerted, but it should not have: ");
- goto end;
- }
-
- SCMutexLock(&f.m);
- r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf2, sizeof(buf2));
- if (r != 0) {
- printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
-
- if (!(PacketAlertCheck(p2, 1))) {
- printf("sig 1 didn't alert, but it should have: ");
- goto end;
- }
-
- result = 1;
-
-end:
- if (alp_tctx != NULL)
- AppLayerParserThreadCtxFree(alp_tctx);
- if (det_ctx != NULL)
- DetectEngineThreadCtxDeinit(&tv, det_ctx);
- if (de_ctx != NULL)
- SigGroupCleanup(de_ctx);
- if (de_ctx != NULL)
- DetectEngineCtxFree(de_ctx);
-
- StreamTcpFreeConfig(TRUE);
- FLOW_DESTROY(&f);
- UTHFreePacket(p1);
- UTHFreePacket(p2);
- return result;
-}
-
-/** \test simple google.com query matching (TCP splicing) */
-static int DetectDnsQueryTest05(void)
-{
- /* google.com in 2 chunks (buf1 and buf2) */
- uint8_t buf1[] = { 0x00, 28, /* len 28 */
- 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, };
-
- uint8_t buf2[] = { 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
- 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
- 0x00, 0x10, 0x00, 0x01, };
-
- uint8_t buf3[] = { 0x00, 44, /* len 44 */
- 0x10, 0x32, /* tx id */
- 0x81, 0x80, /* flags: resp, recursion desired, recusion available */
- 0x00, 0x01, /* 1 query */
- 0x00, 0x01, /* 1 answer */
- 0x00, 0x00, 0x00, 0x00, /* no auth rr, additional rr */
- /* query record */
- 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, /* name */
- 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00, /* name cont */
- 0x00, 0x01, 0x00, 0x01, /* type a, class in */
- /* answer */
- 0xc0, 0x0c, /* ref to name in query above */
- 0x00, 0x01, 0x00, 0x01, /* type a, class in */
- 0x00, 0x01, 0x40, 0xef, /* ttl */
- 0x00, 0x04, /* data len */
- 0x01, 0x02, 0x03, 0x04 }; /* addr */
-
- /* google.net */
- uint8_t buf4[] = { 0x00, 28, /* len 28 */
- 0x11, 0x33, 0x01, 0x00, 0x00, 0x01,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
- 0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
- 0x00, 0x10, 0x00, 0x01, };
- int result = 0;
- Flow f;
- DNSState *dns_state = NULL;
- Packet *p1 = NULL, *p2 = NULL, *p3 = NULL, *p4 = NULL;
- Signature *s = NULL;
- ThreadVars tv;
- DetectEngineThreadCtx *det_ctx = NULL;
- TcpSession ssn;
- AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
-
- memset(&tv, 0, sizeof(ThreadVars));
- memset(&f, 0, sizeof(Flow));
- memset(&ssn, 0, sizeof(TcpSession));
-
- p1 = UTHBuildPacketReal(buf1, sizeof(buf1), IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
- p2 = UTHBuildPacketReal(buf2, sizeof(buf2), IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
- p3 = UTHBuildPacketReal(buf3, sizeof(buf3), IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
- p4 = UTHBuildPacketReal(buf4, sizeof(buf4), IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
-
- FLOW_INITIALIZE(&f);
- f.protoctx = (void *)&ssn;
- f.flags |= FLOW_IPV4;
- f.proto = IPPROTO_TCP;
- f.protomap = FlowGetProtoMapping(f.proto);
- f.alproto = ALPROTO_DNS;
-
- p1->flow = &f;
- p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
- p1->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED;
-
- p2->flow = &f;
- p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
- p2->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED;
-
- p3->flow = &f;
- p3->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
- p3->flowflags |= FLOW_PKT_TOCLIENT|FLOW_PKT_ESTABLISHED;
-
- p4->flow = &f;
- p4->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
- p4->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED;
-
- StreamTcpInitConfig(TRUE);
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL) {
- goto end;
- }
- de_ctx->mpm_matcher = DEFAULT_MPM;
- de_ctx->flags |= DE_QUIET;
-
- s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
- "(msg:\"Test dns_query option\"; "
- "dns_query; content:\"google.com\"; nocase; sid:1;)");
- if (s == NULL) {
- goto end;
- }
- s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
- "(msg:\"Test dns_query option\"; "
- "dns_query; content:\"google.net\"; nocase; sid:2;)");
- if (s == NULL) {
- goto end;
- }
-
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
-
- SCMutexLock(&f.m);
- int r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf1, sizeof(buf1));
- if (r != 0) {
- printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- dns_state = f.alstate;
- if (dns_state == NULL) {
- printf("no dns state: ");
- goto end;
- }
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
-
- if (PacketAlertCheck(p1, 1)) {
- printf("(p1) sig 1 alerted, but it should not have: ");
- goto end;
- }
- if (PacketAlertCheck(p1, 2)) {
- printf("(p1) sig 2 did alert, but it should not have: ");
- goto end;
- }
-
- SCMutexLock(&f.m);
- r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf2, sizeof(buf2));
- if (r != 0) {
- printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
-
- if (!(PacketAlertCheck(p2, 1))) {
- printf("sig 1 didn't alert, but it should have: ");
- goto end;
- }
- if (PacketAlertCheck(p2, 2)) {
- printf("(p2) sig 2 did alert, but it should not have: ");
- goto end;
- }
-
- SCMutexLock(&f.m);
- r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOCLIENT, buf3, sizeof(buf3));
- if (r != 0) {
- printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
-
- if (PacketAlertCheck(p3, 1)) {
- printf("sig 1 did alert, but it should not have: ");
- goto end;
- }
- if (PacketAlertCheck(p3, 2)) {
- printf("(p3) sig 2 did alert, but it should not have: ");
- goto end;
- }
-
- SCMutexLock(&f.m);
- r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf4, sizeof(buf4));
- if (r != 0) {
- printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p4);
-
- if (PacketAlertCheck(p4, 1)) {
- printf("(p4) sig 1 did alert, but it should not have: ");
- goto end;
- }
- if (!(PacketAlertCheck(p4, 2))) {
- printf("sig 1 didn't alert, but it should have: ");
- goto end;
- }
-
- result = 1;
-
-end:
- if (alp_tctx != NULL)
- AppLayerParserThreadCtxFree(alp_tctx);
- if (det_ctx != NULL)
- DetectEngineThreadCtxDeinit(&tv, det_ctx);
- if (de_ctx != NULL)
- SigGroupCleanup(de_ctx);
- if (de_ctx != NULL)
- DetectEngineCtxFree(de_ctx);
-
- StreamTcpFreeConfig(TRUE);
- FLOW_DESTROY(&f);
- UTHFreePacket(p1);
- UTHFreePacket(p2);
- UTHFreePacket(p3);
- UTHFreePacket(p4);
- return result;
-}
-
-/** \test simple google.com query matching, pcre */
-static int DetectDnsQueryTest06(void)
-{
- /* google.com */
- uint8_t buf[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
- 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
- 0x00, 0x10, 0x00, 0x01, };
- int result = 0;
- Flow f;
- DNSState *dns_state = NULL;
- Packet *p = NULL;
- Signature *s = NULL;
- ThreadVars tv;
- DetectEngineThreadCtx *det_ctx = NULL;
- AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
-
- memset(&tv, 0, sizeof(ThreadVars));
- memset(&f, 0, sizeof(Flow));
-
- p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_UDP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
-
- FLOW_INITIALIZE(&f);
- f.flags |= FLOW_IPV4;
- f.proto = IPPROTO_UDP;
- f.protomap = FlowGetProtoMapping(f.proto);
-
- p->flow = &f;
- p->flags |= PKT_HAS_FLOW;
- p->flowflags |= FLOW_PKT_TOSERVER;
- f.alproto = ALPROTO_DNS;
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL) {
- goto end;
- }
- de_ctx->mpm_matcher = DEFAULT_MPM;
- de_ctx->flags |= DE_QUIET;
-
- s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
- "(msg:\"Test dns_query option\"; "
- "dns_query; content:\"google\"; nocase; "
- "pcre:\"/google\\.com$/i\"; sid:1;)");
- if (s == NULL) {
- goto end;
- }
- s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
- "(msg:\"Test dns_query option\"; "
- "dns_query; content:\"google\"; nocase; "
- "pcre:\"/^\\.[a-z]{2,3}$/iR\"; sid:2;)");
- if (s == NULL) {
- goto end;
- }
-
-
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
-
- SCMutexLock(&f.m);
- int r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf, sizeof(buf));
- if (r != 0) {
- printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- dns_state = f.alstate;
- if (dns_state == NULL) {
- printf("no dns state: ");
- goto end;
- }
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p);
-
- if (!(PacketAlertCheck(p, 1))) {
- printf("sig 1 didn't alert, but it should have: ");
- goto end;
- }
- if (!(PacketAlertCheck(p, 2))) {
- printf("sig 2 didn't alert, but it should have: ");
- goto end;
- }
-
- result = 1;
-
-end:
- if (alp_tctx != NULL)
- AppLayerParserThreadCtxFree(alp_tctx);
- if (det_ctx != NULL)
- DetectEngineThreadCtxDeinit(&tv, det_ctx);
- if (de_ctx != NULL)
- SigGroupCleanup(de_ctx);
- if (de_ctx != NULL)
- DetectEngineCtxFree(de_ctx);
-
- FLOW_DESTROY(&f);
- UTHFreePacket(p);
- return result;
-}
-
-/** \test multi tx google.(com|net) query matching +
- * app layer event */
-static int DetectDnsQueryTest07(void)
-{
- /* google.com */
- uint8_t buf1[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
- 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
- 0x00, 0x01, 0x00, 0x01, };
-
- uint8_t buf2[] = { 0x10, 0x32, /* tx id */
- 0x81, 0x80|0x40, /* flags: resp, recursion desired, recusion available */
- 0x00, 0x01, /* 1 query */
- 0x00, 0x01, /* 1 answer */
- 0x00, 0x00, 0x00, 0x00, /* no auth rr, additional rr */
- /* query record */
- 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, /* name */
- 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00, /* name cont */
- 0x00, 0x01, 0x00, 0x01, /* type a, class in */
- /* answer */
- 0xc0, 0x0c, /* ref to name in query above */
- 0x00, 0x01, 0x00, 0x01, /* type a, class in */
- 0x00, 0x01, 0x40, 0xef, /* ttl */
- 0x00, 0x04, /* data len */
- 0x01, 0x02, 0x03, 0x04 }; /* addr */
-
- /* google.net */
- uint8_t buf3[] = { 0x11, 0x33, 0x01, 0x00, 0x00, 0x01,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
- 0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
- 0x00, 0x10, 0x00, 0x01, };
- int result = 0;
- Flow f;
- DNSState *dns_state = NULL;
- Packet *p1 = NULL, *p2 = NULL, *p3 = NULL;
- Signature *s = NULL;
- ThreadVars tv;
- DetectEngineThreadCtx *det_ctx = NULL;
- AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
-
- memset(&tv, 0, sizeof(ThreadVars));
- memset(&f, 0, sizeof(Flow));
-
- p1 = UTHBuildPacketReal(buf1, sizeof(buf1), IPPROTO_UDP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
- p2 = UTHBuildPacketReal(buf2, sizeof(buf2), IPPROTO_UDP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
- p3 = UTHBuildPacketReal(buf3, sizeof(buf3), IPPROTO_UDP,
- "192.168.1.5", "192.168.1.1",
- 41424, 53);
-
- FLOW_INITIALIZE(&f);
- f.flags |= FLOW_IPV4;
- f.proto = IPPROTO_UDP;
- f.protomap = FlowGetProtoMapping(f.proto);
- f.alproto = ALPROTO_DNS;
-
- p1->flow = &f;
- p1->flags |= PKT_HAS_FLOW;
- p1->flowflags |= FLOW_PKT_TOSERVER;
- p1->pcap_cnt = 1;
-
- p2->flow = &f;
- p2->flags |= PKT_HAS_FLOW;
- p2->flowflags |= FLOW_PKT_TOCLIENT;
- p2->pcap_cnt = 2;
-
- p3->flow = &f;
- p3->flags |= PKT_HAS_FLOW;
- p3->flowflags |= FLOW_PKT_TOSERVER;
- p3->pcap_cnt = 3;
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL) {
- goto end;
- }
- de_ctx->mpm_matcher = DEFAULT_MPM;
- de_ctx->flags |= DE_QUIET;
-
- s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
- "(msg:\"Test dns_query option\"; "
- "dns_query; content:\"google.com\"; nocase; sid:1;)");
- if (s == NULL) {
- goto end;
- }
- s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
- "(msg:\"Test dns_query option\"; "
- "dns_query; content:\"google.net\"; nocase; sid:2;)");
- if (s == NULL) {
- goto end;
- }
- s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
- "(msg:\"Test Z flag event\"; "
- "app-layer-event:dns.z_flag_set; sid:3;)");
- if (s == NULL) {
- goto end;
- }
-
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
-
- SCMutexLock(&f.m);
- int r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf1, sizeof(buf1));
- if (r != 0) {
- printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- dns_state = f.alstate;
- if (dns_state == NULL) {
- printf("no dns state: ");
- goto end;
- }
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
-
- if (!(PacketAlertCheck(p1, 1))) {
- printf("(p1) sig 1 didn't alert, but it should have: ");
- goto end;
- }
- if (PacketAlertCheck(p1, 2)) {
- printf("(p1) sig 2 did alert, but it should not have: ");
- goto end;
- }
-
- SCMutexLock(&f.m);
- r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOCLIENT, buf2, sizeof(buf2));
- if (r != -1) {
- printf("toserver client 1 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
-
- if (PacketAlertCheck(p2, 1)) {
- printf("(p2) sig 1 alerted, but it should not have: ");
- goto end;
- }
- if (PacketAlertCheck(p2, 2)) {
- printf("(p2) sig 2 alerted, but it should not have: ");
- goto end;
- }
- if (!(PacketAlertCheck(p2, 3))) {
- printf("(p2) sig 3 didn't alert, but it should have: ");
- goto end;
- }
-
- SCMutexLock(&f.m);
- r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf3, sizeof(buf3));
- if (r != 0) {
- printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
- SCMutexUnlock(&f.m);
- goto end;
- }
- SCMutexUnlock(&f.m);
-
- /* do detect */
- SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
-
- if (PacketAlertCheck(p3, 1)) {
- printf("(p3) sig 1 alerted, but it should not have: ");
- goto end;
- }
- if (!(PacketAlertCheck(p3, 2))) {
- printf("(p3) sig 2 didn't alert, but it should have: ");
- goto end;
- }
- /** \todo should not alert, bug #839
- if (PacketAlertCheck(p3, 3)) {
- printf("(p3) sig 3 did alert, but it should not have: ");
- goto end;
- }
- */
- result = 1;
-
-end:
- if (alp_tctx != NULL)
- AppLayerParserThreadCtxFree(alp_tctx);
- if (det_ctx != NULL)
- DetectEngineThreadCtxDeinit(&tv, det_ctx);
- if (de_ctx != NULL)
- SigGroupCleanup(de_ctx);
- if (de_ctx != NULL)
- DetectEngineCtxFree(de_ctx);
-
- FLOW_DESTROY(&f);
- UTHFreePacket(p1);
- UTHFreePacket(p2);
- UTHFreePacket(p3);
- return result;
-}
-
-#endif
-
-static void DetectDnsQueryRegisterTests(void)
-{
-#ifdef UNITTESTS
- UtRegisterTest("DetectDnsQueryTest01", DetectDnsQueryTest01, 1);
- UtRegisterTest("DetectDnsQueryTest02", DetectDnsQueryTest02, 1);
- UtRegisterTest("DetectDnsQueryTest03 -- tcp", DetectDnsQueryTest03, 1);
- UtRegisterTest("DetectDnsQueryTest04 -- tcp splicing", DetectDnsQueryTest04, 1);
- UtRegisterTest("DetectDnsQueryTest05 -- tcp splicing/multi tx", DetectDnsQueryTest05, 1);
- UtRegisterTest("DetectDnsQueryTest06 -- pcre", DetectDnsQueryTest06, 1);
- UtRegisterTest("DetectDnsQueryTest07 -- app layer event", DetectDnsQueryTest07, 1);
-#endif
-}