aboutsummaryrefslogtreecommitdiffstats
path: root/framework/src/suricata/src/util-action.c
diff options
context:
space:
mode:
Diffstat (limited to 'framework/src/suricata/src/util-action.c')
-rw-r--r--framework/src/suricata/src/util-action.c1627
1 files changed, 0 insertions, 1627 deletions
diff --git a/framework/src/suricata/src/util-action.c b/framework/src/suricata/src/util-action.c
deleted file mode 100644
index 2b349748..00000000
--- a/framework/src/suricata/src/util-action.c
+++ /dev/null
@@ -1,1627 +0,0 @@
-/* Copyright (C) 2007-2013 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/**
- * \file
- *
- * \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
- */
-
-#include "suricata-common.h"
-
-#include "action-globals.h"
-#include "conf.h"
-#include "conf-yaml-loader.h"
-
-#include "detect.h"
-#include "detect-engine.h"
-#include "detect-engine-sigorder.h"
-
-#include "util-unittest.h"
-#include "util-action.h"
-#include "util-unittest-helper.h"
-#include "util-debug.h"
-
-/* Default order: */
-uint8_t action_order_sigs[4] = {ACTION_PASS, ACTION_DROP, ACTION_REJECT, ACTION_ALERT};
-/* This order can be changed from config */
-
-/**
- * \brief Return the priority associated to an action (to order sigs
- * as specified at config)
- * action_order_sigs has this priority by index val
- * so action_order_sigs[0] has to be inspected first.
- * This function is called from detect-engine-sigorder
- * \param action can be one of ACTION_PASS, ACTION_DROP,
- * ACTION_REJECT or ACTION_ALERT
- * \retval uint8_t the priority (order of this actions)
- */
-uint8_t ActionOrderVal(uint8_t action)
-{
- /* reject_both and reject_dst have the same prio as reject */
- if( (action & ACTION_REJECT) ||
- (action & ACTION_REJECT_BOTH) ||
- (action & ACTION_REJECT_DST)) {
- action = ACTION_REJECT;
- }
- uint8_t i = 0;
- for (; i < 4; i++) {
- if (action_order_sigs[i] == action)
- return i;
- }
- /* Unknown action, set just a low prio (high val) */
- return 10;
-}
-
-/**
- * \brief Return the ACTION_* bit from their ascii value
- * \param action can be one of "pass", "drop",
- * "reject" or "alert"
- * \retval uint8_t can be one of ACTION_PASS, ACTION_DROP,
- * ACTION_REJECT or ACTION_ALERT
- */
-uint8_t ActionAsciiToFlag(char *action)
-{
- if (strcmp(action,"pass") == 0)
- return ACTION_PASS;
- if (strcmp(action,"drop") == 0)
- return ACTION_DROP;
- if (strcmp(action,"reject") == 0)
- return ACTION_REJECT;
- if (strcmp(action,"alert") == 0)
- return ACTION_ALERT;
-
- return 0;
-}
-
-/**
- * \brief Load the action order from config. If none is provided,
- * it will be default to ACTION_PASS, ACTION_DROP,
- * ACTION_REJECT, ACTION_ALERT (pass has the highest prio)
- *
- * \retval 0 on success; -1 on fatal error;
- */
-int ActionInitConfig()
-{
- uint8_t actions_used = 0;
- uint8_t action_flag = 0;
- uint8_t actions_config[4] = {0, 0, 0, 0};
- int order = 0;
-
- ConfNode *action_order;
- ConfNode *action = NULL;
-
- /* Let's load the order of actions from the general config */
- action_order = ConfGetNode("action-order");
- if (action_order == NULL) {
- /* No configuration, use defaults. */
- return 0;
- }
- else {
- TAILQ_FOREACH(action, &action_order->head, next) {
- SCLogDebug("Loading action order : %s", action->val);
- action_flag = ActionAsciiToFlag(action->val);
- if (action_flag == 0) {
- SCLogError(SC_ERR_ACTION_ORDER, "action-order, invalid action: \"%s\". Please, use"
- " \"pass\",\"drop\",\"alert\",\"reject\". You have"
- " to specify all of them, without quotes and without"
- " capital letters", action->val);
- goto error;
- }
-
- if (actions_used & action_flag) {
- SCLogError(SC_ERR_ACTION_ORDER, "action-order, action already set: \"%s\". Please,"
- " use \"pass\",\"drop\",\"alert\",\"reject\". You"
- " have to specify all of them, without quotes and"
- " without capital letters", action->val);
- goto error;
- }
-
- if (order >= 4) {
- SCLogError(SC_ERR_ACTION_ORDER, "action-order, you have already specified all the "
- "possible actions plus \"%s\". Please, use \"pass\","
- "\"drop\",\"alert\",\"reject\". You have to specify"
- " all of them, without quotes and without capital"
- " letters", action->val);
- goto error;
- }
- actions_used |= action_flag;
- actions_config[order++] = action_flag;
- }
- }
- if (order < 4) {
- SCLogError(SC_ERR_ACTION_ORDER, "action-order, the config didn't specify all of the "
- "actions. Please, use \"pass\",\"drop\",\"alert\","
- "\"reject\". You have to specify all of them, without"
- " quotes and without capital letters");
- goto error;
- }
-
- /* Now, it's a valid config. Override the default preset */
- for (order = 0; order < 4; order++) {
- action_order_sigs[order] = actions_config[order];
- }
-
- return 0;
-
- error:
- return -1;
-}
-
-#ifdef UNITTESTS
-#include "util-unittest.h"
-
-/**
- * \test Check that we invalidate duplicated actions
- * (It should default to pass, drop, reject, alert)
- */
-int UtilActionTest01(void)
-{
- int res = 1;
- char config[] = "\
-%YAML 1.1\n\
----\n\
-action-order:\n\
- - alert\n\
- - drop\n\
- - reject\n\
- - alert\n";
-
- ConfCreateContextBackup();
- ConfInit();
- ConfYamlLoadString(config, strlen(config));
-
- ActionInitConfig();
- if (action_order_sigs[0] != ACTION_PASS ||
- action_order_sigs[1] != ACTION_DROP ||
- action_order_sigs[2] != ACTION_REJECT ||
- action_order_sigs[3] != ACTION_ALERT)
- {
- res = 0;
- }
- ConfRestoreContextBackup();
-
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
- return res;
-}
-
-/**
- * \test Check that we invalidate with unknown keywords
- * (It should default to pass, drop, reject, alert)
- */
-int UtilActionTest02(void)
-{
- int res = 1;
- char config[] = "\
-%YAML 1.1\n\
----\n\
-action-order:\n\
- - alert\n\
- - drop\n\
- - reject\n\
- - ftw\n";
-
- ConfCreateContextBackup();
- ConfInit();
- ConfYamlLoadString(config, strlen(config));
-
- ActionInitConfig();
- if (action_order_sigs[0] != ACTION_PASS ||
- action_order_sigs[1] != ACTION_DROP ||
- action_order_sigs[2] != ACTION_REJECT ||
- action_order_sigs[3] != ACTION_ALERT)
- {
- res = 0;
- }
- ConfRestoreContextBackup();
-
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
- return res;
-}
-
-/**
- * \test Check that we invalidate if any action is missing
- * (It should default to pass, drop, reject, alert)
- */
-int UtilActionTest03(void)
-{
- int res = 1;
- char config[] = "\
-%YAML 1.1\n\
----\n\
-action-order:\n\
- - alert\n\
- - drop\n\
- - reject\n";
-
- ConfCreateContextBackup();
- ConfInit();
- ConfYamlLoadString(config, strlen(config));
-
- ActionInitConfig();
- if (action_order_sigs[0] != ACTION_PASS ||
- action_order_sigs[1] != ACTION_DROP ||
- action_order_sigs[2] != ACTION_REJECT ||
- action_order_sigs[3] != ACTION_ALERT)
- {
- res = 0;
- }
- ConfRestoreContextBackup();
-
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
- return res;
-}
-
-/**
- * \test Check that we invalidate if any action is missing
- * (It should default to pass, drop, reject, alert)
- */
-int UtilActionTest04(void)
-{
- int res = 1;
- char config[] = "\
-%YAML 1.1\n\
----\n\
-action-order:\n";
-
- ConfCreateContextBackup();
- ConfInit();
- ConfYamlLoadString(config, strlen(config));
-
- ActionInitConfig();
- if (action_order_sigs[0] != ACTION_PASS ||
- action_order_sigs[1] != ACTION_DROP ||
- action_order_sigs[2] != ACTION_REJECT ||
- action_order_sigs[3] != ACTION_ALERT)
- {
- res = 0;
- }
- ConfRestoreContextBackup();
-
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
- return res;
-}
-
-/**
- * \test Check that we invalidate with unknown keywords
- * and/or more than the expected
- * (It should default to pass, drop, reject, alert)
- */
-int UtilActionTest05(void)
-{
- int res = 1;
- char config[] = "\
-%YAML 1.1\n\
----\n\
-action-order:\n\
- - alert\n\
- - drop\n\
- - reject\n\
- - pass\n\
- - whatever\n";
-
- ConfCreateContextBackup();
- ConfInit();
- ConfYamlLoadString(config, strlen(config));
-
- ActionInitConfig();
- if (action_order_sigs[0] != ACTION_PASS ||
- action_order_sigs[1] != ACTION_DROP ||
- action_order_sigs[2] != ACTION_REJECT ||
- action_order_sigs[3] != ACTION_ALERT)
- {
- res = 0;
- }
- ConfRestoreContextBackup();
-
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
- return res;
-}
-
-/**
- * \test Check that we load a valid config
- */
-int UtilActionTest06(void)
-{
- int res = 1;
- char config[] = "\
-%YAML 1.1\n\
----\n\
-action-order:\n\
- - alert\n\
- - drop\n\
- - reject\n\
- - pass\n";
-
- ConfCreateContextBackup();
- ConfInit();
- ConfYamlLoadString(config, strlen(config));
-
- ActionInitConfig();
- if (action_order_sigs[0] != ACTION_ALERT ||
- action_order_sigs[1] != ACTION_DROP ||
- action_order_sigs[2] != ACTION_REJECT ||
- action_order_sigs[3] != ACTION_PASS)
- {
- res = 0;
- }
- ConfRestoreContextBackup();
-
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
- return res;
-}
-
-/**
- * \test Check that we load a valid config
- */
-int UtilActionTest07(void)
-{
- int res = 1;
- char config[] = "\
-%YAML 1.1\n\
----\n\
-action-order:\n\
- - pass\n\
- - alert\n\
- - drop\n\
- - reject\n";
-
- ConfCreateContextBackup();
- ConfInit();
- ConfYamlLoadString(config, strlen(config));
-
- ActionInitConfig();
- if (action_order_sigs[0] != ACTION_PASS ||
- action_order_sigs[1] != ACTION_ALERT ||
- action_order_sigs[2] != ACTION_DROP ||
- action_order_sigs[3] != ACTION_REJECT)
- {
- res = 0;
- }
- ConfRestoreContextBackup();
-
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
- return res;
-}
-
-/**
- * \test Check that we handle the "pass" action
- * correctly at the IP Only engine in the default case
- */
-int UtilActionTest08(void)
-{
- int res = 0;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- Packet *p[3];
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "alert ip any any -> any any (msg:\"sig 1\"; sid:1;)";
- sigs[1]= "pass ip 192.168.1.1 80 -> any any (msg:\"sig 2\"; sid:2;)";
- sigs[2]= "alert ip any any -> any any (msg:\"sig 3\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {1, 0, 1},
- {0, 0, 0},
- {1, 0, 1} };
- /* This means that with the second packet, the results will be
- * all ({0,0,0}) since, we should match the "pass" rule first
- */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- return res;
-}
-
-/**
- * \test Check that we handle the "pass" action
- * correctly at the IP Only engine with more
- * prio to drop
- */
-int UtilActionTest09(void)
-{
- int res = 1;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- Packet *p[3];
-
- action_order_sigs[0] = ACTION_DROP;
- action_order_sigs[1] = ACTION_PASS;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
-
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "alert ip any any -> any any (msg:\"sig 1\"; sid:1;)";
- sigs[1]= "pass ip 192.168.1.1 80 -> any any (msg:\"sig 2\"; sid:2;)";
- sigs[2]= "drop ip any any -> any any (msg:\"sig 3\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {1, 0, 1},
- {0, 0, 1},
- {1, 0, 1} };
- /* This means that with the second packet, the results will be
- * all ({0,0,1}) since, we should match the "drop" rule first.
- * Later the "pass" rule will avoid the "alert" rule match
- */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
- return res;
-}
-
-/**
- * \test Check that we handle the "pass" action
- * correctly at the detection engine in the default case
- */
-int UtilActionTest10(void)
-{
- int res = 0;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- uint8_t *buf2 = (uint8_t *)"wo!";
- uint16_t buflen2 = strlen((char *)buf2);
- Packet *p[3];
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf2, buflen2, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "alert ip any any -> any any (msg:\"sig 1\"; content:\"Hi all\"; sid:1;)";
- sigs[1]= "pass ip any any -> any any (msg:\"sig 2\"; content:\"wo\"; sid:2;)";
- sigs[2]= "alert ip any any -> any any (msg:\"sig 3\"; content:\"Hi all\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {1, 0, 1},
- {0, 0, 0},
- {1, 0, 1} };
- /* This means that with the second packet, the results will be
- * all ({0,0,0}) since, we should match the "pass" rule first
- */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- return res;
-}
-
-/**
- * \test Check that we handle the "pass" action
- * correctly at the detection engine with more
- * prio to drop
- */
-int UtilActionTest11(void)
-{
- int res = 1;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- uint8_t *buf2 = (uint8_t *)"Hi all wo!";
- uint16_t buflen2 = strlen((char *)buf2);
- Packet *p[3];
-
- action_order_sigs[0] = ACTION_DROP;
- action_order_sigs[1] = ACTION_PASS;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
-
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf2, buflen2, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "alert tcp any any -> any any (msg:\"sig 1\"; content:\"Hi all\"; sid:1;)";
- sigs[1]= "pass tcp any any -> any any (msg:\"sig 2\"; content:\"wo\"; sid:2;)";
- sigs[2]= "drop tcp any any -> any any (msg:\"sig 3\"; content:\"Hi all\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {1, 0, 1},
- {0, 0, 1},
- {1, 0, 1} };
- /* This means that with the second packet, the results will be
- * all ({0,0,1}) since, we should match the "drop" rule first.
- * Later the "pass" rule will avoid the "alert" rule match
- */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
- return res;
-}
-
-/**
- * \test Check that we handle the "pass" action
- * correctly at the detection engine in the default case
- */
-int UtilActionTest12(void)
-{
- int res = 0;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- Packet *p[3];
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "alert ip any any -> any any (msg:\"sig 1\"; sid:1;)";
- sigs[1]= "pass ip any any -> any any (msg:\"Testing normal 2\"; sid:2;)";
- sigs[2]= "alert ip any any -> any any (msg:\"sig 3\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {0, 0, 0},
- {0, 0, 0},
- {0, 0, 0} };
- /* All should match the 3 sigs, but the action pass has prio */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- return res;
-}
-
-/**
- * \test Check that we handle the "pass" action
- * correctly at the detection engine with more
- * prio to drop
- */
-int UtilActionTest13(void)
-{
- int res = 1;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- Packet *p[3];
-
- action_order_sigs[0] = ACTION_DROP;
- action_order_sigs[1] = ACTION_PASS;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
-
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "alert tcp any any -> any any (msg:\"sig 1\"; content:\"Hi all\"; sid:1;)";
- sigs[1]= "pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
- sigs[2]= "drop tcp any any -> any any (msg:\"sig 3\"; content:\"Hi all\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {0, 0, 1},
- {0, 0, 1},
- {0, 0, 1} };
- /* All the patckets should match the 3 sigs. As drop has more
- * priority than pass, it should alert on each packet */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
- return res;
-}
-
-/**
- * \test Check that we handle the "pass" action
- * correctly at the detection engine with more
- * prio to drop and alert
- */
-int UtilActionTest14(void)
-{
- int res = 1;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- Packet *p[3];
-
- action_order_sigs[0] = ACTION_DROP;
- action_order_sigs[1] = ACTION_ALERT;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_PASS;
-
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "alert tcp any any -> any any (msg:\"sig 1\"; content:\"Hi all\"; sid:1;)";
- sigs[1]= "pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
- sigs[2]= "drop tcp any any -> any any (msg:\"sig 3\"; content:\"Hi all\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {1, 0, 1},
- {1, 0, 1},
- {1, 0, 1} };
- /* All the patckets should match the 3 sigs. As drop
- * and alert have more priority than pass, both should
- * alert on each packet */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
- return res;
-}
-
-/**
- * \test Check mixed sigs (iponly and normal)
- */
-int UtilActionTest15(void)
-{
- int res = 1;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- Packet *p[3];
-
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "alert tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
- sigs[1]= "pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
- sigs[2]= "drop tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {0, 0, 0},
- {0, 0, 0},
- {0, 0, 0} };
- /* All the patckets should match the 3 sigs. As drop
- * and alert have more priority than pass, both should
- * alert on each packet */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- return res;
-}
-
-/**
- * \test Check mixed sigs (iponly and normal)
- */
-int UtilActionTest16(void)
-{
- int res = 1;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- Packet *p[3];
-
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "drop tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
- sigs[1]= "alert tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
- sigs[2]= "pass tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {0, 0, 0},
- {0, 0, 0},
- {0, 0, 0} };
- /* All the patckets should match the 3 sigs. As drop
- * and alert have more priority than pass, both should
- * alert on each packet */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- return res;
-}
-
-/**
- * \test Check mixed sigs (iponly and normal)
- */
-int UtilActionTest17(void)
-{
- int res = 1;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- Packet *p[3];
-
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "pass tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
- sigs[1]= "drop tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
- sigs[2]= "alert tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {0, 0, 0},
- {0, 0, 0},
- {0, 0, 0} };
- /* All the patckets should match the 3 sigs. As drop
- * and alert have more priority than pass, both should
- * alert on each packet */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- return res;
-}
-
-/**
- * \test Check mixed sigs (iponly and normal) with more prio for drop
- */
-int UtilActionTest18(void)
-{
- int res = 1;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- Packet *p[3];
-
- action_order_sigs[0] = ACTION_DROP;
- action_order_sigs[1] = ACTION_PASS;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
-
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "alert tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
- sigs[1]= "pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
- sigs[2]= "drop tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {0, 0, 1},
- {0, 0, 1},
- {0, 0, 1} };
- /* All the patckets should match the 3 sigs. As drop
- * and alert have more priority than pass, both should
- * alert on each packet */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
-
- return res;
-}
-
-/**
- * \test Check mixed sigs (iponly and normal) with more prio for drop
- */
-int UtilActionTest19(void)
-{
- int res = 1;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- Packet *p[3];
-
- action_order_sigs[0] = ACTION_DROP;
- action_order_sigs[1] = ACTION_PASS;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
-
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "drop tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
- sigs[1]= "alert tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
- sigs[2]= "pass tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {1, 0, 0},
- {1, 0, 0},
- {1, 0, 0} };
- /* All the patckets should match the 3 sigs. As drop
- * and alert have more priority than pass, both should
- * alert on each packet */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
-
- return res;
-}
-
-/**
- * \test Check mixed sigs (iponly and normal) with more prio for drop
- */
-int UtilActionTest20(void)
-{
- int res = 1;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- Packet *p[3];
-
- action_order_sigs[0] = ACTION_DROP;
- action_order_sigs[1] = ACTION_PASS;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
-
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "pass tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
- sigs[1]= "drop tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
- sigs[2]= "alert tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {0, 1, 0},
- {0, 1, 0},
- {0, 1, 0} };
- /* All the patckets should match the 3 sigs. As drop
- * and alert have more priority than pass, both should
- * alert on each packet */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- return res;
-}
-
-/**
- * \test Check mixed sigs (iponly and normal) with more prio for alert and drop
- */
-int UtilActionTest21(void)
-{
- int res = 1;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- Packet *p[3];
-
- action_order_sigs[0] = ACTION_DROP;
- action_order_sigs[1] = ACTION_ALERT;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_PASS;
-
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "alert tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
- sigs[1]= "pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
- sigs[2]= "drop tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {1, 0, 1},
- {1, 0, 1},
- {1, 0, 1} };
- /* All the patckets should match the 3 sigs. As drop
- * and alert have more priority than pass, both should
- * alert on each packet */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
-
- return res;
-}
-
-/**
- * \test Check mixed sigs (iponly and normal) with more prio for alert and drop
- */
-int UtilActionTest22(void)
-{
- int res = 1;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- Packet *p[3];
-
- action_order_sigs[0] = ACTION_DROP;
- action_order_sigs[1] = ACTION_ALERT;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_PASS;
-
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "drop tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
- sigs[1]= "alert tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
- sigs[2]= "pass tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {1, 1, 0},
- {1, 1, 0},
- {1, 1, 0} };
- /* All the patckets should match the 3 sigs. As drop
- * and alert have more priority than pass, both should
- * alert on each packet */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
-end:
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
-
- return res;
-}
-
-/**
- * \test Check mixed sigs (iponly and normal) with more prio for alert and drop
- */
-int UtilActionTest23(void)
-{
- int res = 1;
- uint8_t *buf = (uint8_t *)"Hi all!";
- uint16_t buflen = strlen((char *)buf);
- Packet *p[3];
-
- action_order_sigs[0] = ACTION_DROP;
- action_order_sigs[1] = ACTION_ALERT;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_PASS;
-
- p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
- p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.1", "192.168.1.5",
- 80, 41424);
- p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP,
- "192.168.1.5", "192.168.1.1",
- 41424, 80);
-
- if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
- goto end;
-
- char *sigs[3];
- sigs[0]= "pass tcp any any -> any any (msg:\"sig 1\"; sid:1;)";
- sigs[1]= "drop tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)";
- sigs[2]= "alert tcp any any -> any any (msg:\"sig 3\"; sid:3;)";
-
- uint32_t sid[3] = {1, 2, 3};
-
- uint32_t results[3][3] = {
- {0, 1, 1},
- {0, 1, 1},
- {0, 1, 1} };
- /* All the patckets should match the 3 sigs. As drop
- * and alert have more priority than pass, both should
- * alert on each packet */
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- if (de_ctx == NULL)
- goto cleanup;
- de_ctx->flags |= DE_QUIET;
-
- if (UTHAppendSigs(de_ctx, sigs, 3) == 0)
- goto cleanup;
-
- SCSigRegisterSignatureOrderingFuncs(de_ctx);
- SCSigOrderSignatures(de_ctx);
-
- res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
-
-cleanup:
- UTHFreePackets(p, 3);
-
- if (de_ctx != NULL) {
- SigGroupCleanup(de_ctx);
- SigCleanSignatures(de_ctx);
- DetectEngineCtxFree(de_ctx);
- }
-
- /* Restore default values */
- action_order_sigs[0] = ACTION_PASS;
- action_order_sigs[1] = ACTION_DROP;
- action_order_sigs[2] = ACTION_REJECT;
- action_order_sigs[3] = ACTION_ALERT;
-
-end:
- return res;
-}
-
-/**
- * \test Check that the expected defaults are loaded if the
- * action-order configuration is not present.
- */
-int UtilActionTest24(void)
-{
- int res = 1;
- char config[] = "%YAML 1.1\n"
- "---\n";
-
- ConfCreateContextBackup();
- ConfInit();
- ConfYamlLoadString(config, strlen(config));
-
- if (ActionInitConfig() != 0) {
- res = 0;
- goto done;
- }
- if (action_order_sigs[0] != ACTION_PASS ||
- action_order_sigs[1] != ACTION_DROP ||
- action_order_sigs[2] != ACTION_REJECT ||
- action_order_sigs[3] != ACTION_ALERT) {
- res = 0;
- }
-
-done:
- ConfRestoreContextBackup();
- return res;
-}
-
-#endif
-
-/* Register unittests */
-void UtilActionRegisterTests(void)
-{
-#ifdef UNITTESTS
- /* Generic tests */
- UtRegisterTest("UtilActionTest01", UtilActionTest01, 1);
- UtRegisterTest("UtilActionTest02", UtilActionTest02, 1);
- UtRegisterTest("UtilActionTest02", UtilActionTest02, 1);
- UtRegisterTest("UtilActionTest03", UtilActionTest03, 1);
- UtRegisterTest("UtilActionTest04", UtilActionTest04, 1);
- UtRegisterTest("UtilActionTest05", UtilActionTest05, 1);
- UtRegisterTest("UtilActionTest06", UtilActionTest06, 1);
- UtRegisterTest("UtilActionTest07", UtilActionTest07, 1);
- UtRegisterTest("UtilActionTest08", UtilActionTest08, 1);
- UtRegisterTest("UtilActionTest09", UtilActionTest09, 1);
- UtRegisterTest("UtilActionTest10", UtilActionTest10, 1);
- UtRegisterTest("UtilActionTest11", UtilActionTest11, 1);
- UtRegisterTest("UtilActionTest12", UtilActionTest12, 1);
- UtRegisterTest("UtilActionTest13", UtilActionTest13, 1);
- UtRegisterTest("UtilActionTest14", UtilActionTest14, 1);
- UtRegisterTest("UtilActionTest15", UtilActionTest15, 1);
- UtRegisterTest("UtilActionTest16", UtilActionTest16, 1);
- UtRegisterTest("UtilActionTest17", UtilActionTest17, 1);
- UtRegisterTest("UtilActionTest18", UtilActionTest18, 1);
- UtRegisterTest("UtilActionTest19", UtilActionTest19, 1);
- UtRegisterTest("UtilActionTest20", UtilActionTest20, 1);
- UtRegisterTest("UtilActionTest21", UtilActionTest21, 1);
- UtRegisterTest("UtilActionTest22", UtilActionTest22, 1);
- UtRegisterTest("UtilActionTest23", UtilActionTest23, 1);
- UtRegisterTest("UtilActionTest24", UtilActionTest24, 1);
-#endif
-}