diff --git a/src/detect-content.h b/src/detect-content.h index f79dcb6a42..2a5bfb7301 100644 --- a/src/detect-content.h +++ b/src/detect-content.h @@ -45,6 +45,7 @@ #define DETECT_CONTENT_PACKET_MPM 0x0800 #define DETECT_CONTENT_STREAM_MPM 0x1000 #define DETECT_CONTENT_URI_MPM 0x2000 +#define DETECT_CONTENT_HCBD_MPM 0x4000 #define DETECT_CONTENT_IS_SINGLE(c) (!((c)->flags & DETECT_CONTENT_DISTANCE || \ (c)->flags & DETECT_CONTENT_WITHIN || \ diff --git a/src/detect-depth.c b/src/detect-depth.c index cbb9f5b837..c0dd8d0338 100644 --- a/src/detect-depth.c +++ b/src/detect-depth.c @@ -170,6 +170,20 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths case DETECT_AL_HTTP_CLIENT_BODY: cd = (DetectContentData *)pm->ctx; + if (cd->flags & DETECT_CONTENT_NEGATED) { + if (cd->flags & DETECT_CONTENT_FAST_PATTERN) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " + "negated keyword set along with a fast_pattern"); + goto error; + } + } else { + if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " + "keyword set along with a fast_pattern:only;"); + goto error; + } + } + cd->depth = (uint32_t)atoi(str); if (cd->depth < cd->content_len) { cd->depth = cd->content_len; diff --git a/src/detect-distance.c b/src/detect-distance.c index 4c975caae7..6e75bfe0f6 100644 --- a/src/detect-distance.c +++ b/src/detect-distance.c @@ -155,7 +155,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatchTransferSigMatchAcrossLists(pm1, &s->sm_lists[DETECT_SM_LIST_PMATCH], &s->sm_lists_tail[DETECT_SM_LIST_PMATCH], - &s->sm_lists[DETECT_SM_LIST_DMATCH], &s->sm_lists_tail[DETECT_SM_LIST_DMATCH]); + &s->sm_lists[DETECT_SM_LIST_DMATCH], + &s->sm_lists_tail[DETECT_SM_LIST_DMATCH]); pm = pm1; } else { /* within is against pm1, pm = pm1 */ @@ -372,6 +373,20 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, } } + if (cd->flags & DETECT_CONTENT_NEGATED) { + if (cd->flags & DETECT_CONTENT_FAST_PATTERN) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " + "negated keyword set along with a fast_pattern"); + goto error; + } + } else { + if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " + "keyword set along with a fast_pattern:only;"); + goto error; + } + } + cd->flags |= DETECT_CONTENT_DISTANCE; pm = SigMatchGetLastSMFromLists(s, 2, @@ -382,6 +397,14 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, goto error; } + cd = (DetectContentData *)pm->ctx; + if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "Previous keyword " + "has a fast_pattern:only; set. You can't " + "have relative keywords around a fast_pattern " + "only content"); + goto error; + } ((DetectContentData *)pm->ctx)->flags |= DETECT_CONTENT_RELATIVE_NEXT; break; diff --git a/src/detect-engine-hcbd.c b/src/detect-engine-hcbd.c index a8723b9266..d9e618dbca 100644 --- a/src/detect-engine-hcbd.c +++ b/src/detect-engine-hcbd.c @@ -26,6 +26,7 @@ #include "detect.h" #include "detect-engine.h" +#include "detect-engine-mpm.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-uricontent.h" @@ -97,6 +98,9 @@ static int DoInspectHttpClientBody(DetectEngineCtx *de_ctx, DetectContentData *cd = (DetectContentData *)sm->ctx; SCLogDebug("inspecting content %"PRIu32" payload_len %"PRIu32, cd->id, payload_len); + if (cd->flags & DETECT_CONTENT_HCBD_MPM && !(cd->flags & DETECT_CONTENT_NEGATED)) + goto match; + /* rule parsers should take care of this */ BUG_ON(cd->depth != 0 && cd->depth <= cd->offset); @@ -202,7 +206,6 @@ static int DoInspectHttpClientBody(DetectEngineCtx *de_ctx, } BUG_ON(sm->next == NULL); - SCLogDebug("uricontent %"PRIu32, cd->id); /* see if the next payload keywords match. If not, we will * search for another occurence of this uricontent and see @@ -242,6 +245,102 @@ match: } } +/** + * \brief Helps buffer request bodies for different transactions and stores them + * away in detection code. Also calls the mpm on the bodies. + * + * \param det_ctx Detection engine thread ctx. + * \param f Pointer to the flow. + * \param htp_state http state. + * \param call_mpm 1 if we are also to call the mpm no the buffered bodies or + * 0 if we to just buffer the bodies. + * + * \retval cnt The match count from the mpm call. If call_mpm is 0, the retval + * is ignored. + */ +static uint32_t DetectEngineInspectHttpClientBodyMpmInspect(DetectEngineThreadCtx *det_ctx, + Flow *f, HtpState *htp_state, + int call_mpm) { + uint32_t cnt = 0; + size_t idx = 0; + htp_tx_t *tx = NULL; + int i = 0; + + for (idx = AppLayerTransactionGetInspectId(f); + i < det_ctx->hcbd_buffers_list_len; idx++, i++) { + + /* if the buffer already exists, use it */ + if (det_ctx->hcbd_buffers[i] != NULL) { + if (call_mpm) { + cnt += HttpClientBodyPatternSearch(det_ctx, + det_ctx->hcbd_buffers[i], + det_ctx->hcbd_buffers_len[i]); + } + continue; + } + + tx = list_get(htp_state->connp->conn->transactions, idx); + tx = list_get(htp_state->connp->conn->transactions, idx); + if (tx == NULL) + continue; + + SCHtpTxUserData *htud = (SCHtpTxUserData *)htp_tx_get_user_data(tx); + if (htud == NULL) + continue; + + HtpBodyChunk *cur = htud->body.first; + + if (htud->body.nchunks == 0) { + SCLogDebug("No http chunks to inspect for this transacation"); + continue; + } else { + /* no chunks?!! move on to the next transaction */ + if (cur == NULL) { + SCLogDebug("No http chunks to inspect"); + continue; + } + + /* this applies only for the client request body like the keyword name says */ + if (htud->body.operation != HTP_BODY_REQUEST) { + SCLogDebug("htp chunk not a request chunk"); + continue; + } + + if (htud->content_len != htud->content_len_so_far) { + SCLogDebug("we still haven't seen the entire request body. " + "Let's defer body inspection till we see the " + "entire body."); + continue; + } + + uint8_t *chunks_buffer = NULL; + uint32_t chunks_buffer_len = 0; + while (cur != NULL) { + /* \todo Currently we limit the body length we inspect. We + * should change to handling chunks statefully */ + if (chunks_buffer_len > 20000) + break; + chunks_buffer_len += cur->len; + if ( (chunks_buffer = SCRealloc(chunks_buffer, chunks_buffer_len)) == NULL) { + SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); + exit(EXIT_FAILURE); + } + memcpy(chunks_buffer + chunks_buffer_len - cur->len, cur->data, cur->len); + cur = cur->next; + } + /* store the buffers. We will need it for further inspection */ + det_ctx->hcbd_buffers[i] = chunks_buffer; + det_ctx->hcbd_buffers_len[i] = chunks_buffer_len; + + /* carry out the mpm */ + if (call_mpm) + cnt += HttpClientBodyPatternSearch(det_ctx, chunks_buffer, chunks_buffer_len); + } /* else - if (htud->body.nchunks == 0) */ + } /* for (idx = AppLayerTransactionGetInspectId(f); .. */ + + SCReturnUInt(cnt); +} + /** * \brief Do the http_client_body content inspection for a signature. * @@ -263,6 +362,7 @@ int DetectEngineInspectHttpClientBody(DetectEngineCtx *de_ctx, SCEnter(); int r = 0; HtpState *htp_state = NULL; + int i = 0; htp_state = (HtpState *)alstate; if (htp_state == NULL) { @@ -278,59 +378,76 @@ int DetectEngineInspectHttpClientBody(DetectEngineCtx *de_ctx, goto end; } - size_t idx = 0; - for ( ; idx < list_size(htp_state->connp->conn->transactions); idx++) - { - htp_tx_t *tx = list_get(htp_state->connp->conn->transactions, idx); - if (tx == NULL) - continue; + /* it is either the first entry into this function. If it is not, + * then we just don't have any http transactions */ + if (det_ctx->hcbd_buffers_list_len == 0) { + /* get the transaction id */ + int tmp_idx = AppLayerTransactionGetInspectId(f); + /* error! get out of here */ + if (tmp_idx == -1) + goto end; - SCHtpTxUserData *htud = (SCHtpTxUserData *) htp_tx_get_user_data(tx); - if (htud == NULL) - continue; + /* let's get the transaction count. We need this to hold the client body + * buffer for each transaction */ + det_ctx->hcbd_buffers_list_len = list_size(htp_state->connp->conn->transactions) - tmp_idx; + /* no transactions?! cool. get out of here */ + if (det_ctx->hcbd_buffers_list_len == 0) + goto end; - HtpBodyChunk *cur = htud->body.first; + /* assign space to hold buffers. Each per transaction */ + det_ctx->hcbd_buffers = malloc(det_ctx->hcbd_buffers_list_len * sizeof(uint8_t *)); + if (det_ctx->hcbd_buffers == NULL) { + SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); + exit(EXIT_FAILURE); + } + memset(det_ctx->hcbd_buffers, 0, det_ctx->hcbd_buffers_list_len * sizeof(uint8_t *)); - if (htud->body.nchunks == 0) { - SCLogDebug("No http chunks to inspect"); - goto end; - } else { - /* no chunks?!! get out of here */ - if (cur == NULL) { - SCLogDebug("No http chunks to inspect"); - goto end; - } + det_ctx->hcbd_buffers_len = malloc(det_ctx->hcbd_buffers_list_len * sizeof(uint32_t)); + if (det_ctx->hcbd_buffers_len == NULL) { + SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); + exit(EXIT_FAILURE); + } + memset(det_ctx->hcbd_buffers_len, 0, det_ctx->hcbd_buffers_list_len * sizeof(uint32_t)); + } /* if (det_ctx->hcbd_buffers_list_len == 0) */ - /* this applies only for the client request body like the keyword name says */ - if (htud->body.operation != HTP_BODY_REQUEST) { - SCLogDebug("htp chunk not a request chunk"); - goto end; - } + if (s->flags & SIG_FLAG_MPM_HCBDCONTENT) { + if (det_ctx->de_mpm_scanned_hcbd == FALSE) { + uint32_t cnt = DetectEngineInspectHttpClientBodyMpmInspect(det_ctx, f, htp_state, 1); + if (cnt <= 0) + det_ctx->de_have_hcbd = FALSE; - if (htud->content_len != htud->content_len_so_far) - continue; + det_ctx->de_mpm_scanned_hcbd = TRUE; + } + } else { + DetectEngineInspectHttpClientBodyMpmInspect(det_ctx, f, htp_state, 0); + } - uint8_t *chunks_buffer = NULL; - uint32_t total_chunks_len = 0; - while (cur != NULL) { - /* \todo Currently we limit the body length we inspect. We - * should change to handling chunks statefully */ - if (total_chunks_len > 20000) - break; - total_chunks_len += cur->len; - if ( (chunks_buffer = SCRealloc(chunks_buffer, total_chunks_len)) == NULL) { - return 0; - } - memcpy(chunks_buffer + total_chunks_len - cur->len, cur->data, cur->len); - cur = cur->next; - } + if (det_ctx->de_have_hcbd == FALSE && + s->flags & SIG_FLAG_MPM_HCBDCONTENT && + !(s->flags & SIG_FLAG_MPM_HCBDCONTENT_NEG)) { + SCLogDebug("mpm results failure for client_body. Get out of here"); + goto end; + } - r = DoInspectHttpClientBody(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HCBDMATCH], - chunks_buffer, total_chunks_len); - SCFree(chunks_buffer); - if (r == 1) { - break; - } + if ((s->flags & SIG_FLAG_MPM_HCBDCONTENT) && (det_ctx->de_mpm_scanned_hcbd == TRUE)) { + /* filter out the sig that needs a match, but have no matches */ + if (!(det_ctx->pmq.pattern_id_bitarray[(s->mpm_hcbdpattern_id / 8)] & (1 << (s->mpm_hcbdpattern_id % 8))) && + !(s->flags & SIG_FLAG_MPM_HCBDCONTENT_NEG)) { + goto end; + } + } + + for (i = 0; i < det_ctx->hcbd_buffers_list_len; i++) { + uint8_t *hcbd_buffer = det_ctx->hcbd_buffers[i]; + uint32_t hcbd_buffer_len = det_ctx->hcbd_buffers_len[i]; + + if (hcbd_buffer == NULL) + continue; + + r = DoInspectHttpClientBody(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HCBDMATCH], + hcbd_buffer, hcbd_buffer_len); + if (r == 1) { + break; } } @@ -2241,6 +2358,302 @@ end: return result; } +static int DetectEngineHttpClientBodyTest17(void) +{ + TcpSession ssn; + Packet *p1 = NULL; + ThreadVars th_v; + DetectEngineCtx *de_ctx = NULL; + DetectEngineThreadCtx *det_ctx = NULL; + Flow f; + uint8_t http1_buf[] = "This is dummy body1"; + uint32_t http1_len = sizeof(http1_buf) - 1; + int result = 0; + + memset(&th_v, 0, sizeof(th_v)); + memset(&f, 0, sizeof(f)); + memset(&ssn, 0, sizeof(ssn)); + + p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); + + FLOW_INITIALIZE(&f); + f.protoctx = (void *)&ssn; + f.src.family = AF_INET; + f.dst.family = AF_INET; + + p1->flow = &f; + p1->flowflags |= FLOW_PKT_TOSERVER; + p1->flowflags |= FLOW_PKT_ESTABLISHED; + p1->flags |= PKT_HAS_FLOW; + f.alproto = ALPROTO_HTTP; + + StreamTcpInitConfig(TRUE); + FlowL7DataPtrInit(&f); + + de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + + de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + "(msg:\"http client body test\"; " + "content:body1; http_client_body; " + "content:bambu; http_client_body; " + "sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + + SigGroupBuild(de_ctx); + DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + + /* start the search phase */ + det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p1); + uint32_t r = HttpClientBodyPatternSearch(det_ctx, http1_buf, http1_len); + if (r != 1) { + printf("expected 1 result, got %"PRIu32": ", r); + goto end; + } + + result = 1; + +end: + if (de_ctx != NULL) + SigGroupCleanup(de_ctx); + if (de_ctx != NULL) + SigCleanSignatures(de_ctx); + if (de_ctx != NULL) + DetectEngineCtxFree(de_ctx); + + FlowL7DataPtrFree(&f); + StreamTcpFreeConfig(TRUE); + FLOW_DESTROY(&f); + UTHFreePackets(&p1, 1); + return result; +} + +static int DetectEngineHttpClientBodyTest18(void) +{ + TcpSession ssn; + Packet *p1 = NULL; + ThreadVars th_v; + DetectEngineCtx *de_ctx = NULL; + DetectEngineThreadCtx *det_ctx = NULL; + Flow f; + uint8_t http1_buf[] = "This is dummy body1"; + uint32_t http1_len = sizeof(http1_buf) - 1; + int result = 0; + + memset(&th_v, 0, sizeof(th_v)); + memset(&f, 0, sizeof(f)); + memset(&ssn, 0, sizeof(ssn)); + + p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); + + FLOW_INITIALIZE(&f); + f.protoctx = (void *)&ssn; + f.src.family = AF_INET; + f.dst.family = AF_INET; + + p1->flow = &f; + p1->flowflags |= FLOW_PKT_TOSERVER; + p1->flowflags |= FLOW_PKT_ESTABLISHED; + p1->flags |= PKT_HAS_FLOW; + f.alproto = ALPROTO_HTTP; + + StreamTcpInitConfig(TRUE); + FlowL7DataPtrInit(&f); + + de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + + de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + "(msg:\"http client body test\"; " + "content:body1; http_client_body; " + "content:bambu; http_client_body; fast_pattern; " + "sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + + SigGroupBuild(de_ctx); + DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + + /* start the search phase */ + det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p1); + uint32_t r = HttpClientBodyPatternSearch(det_ctx, http1_buf, http1_len); + if (r != 0) { + printf("expected 1 result, got %"PRIu32": ", r); + goto end; + } + + result = 1; + +end: + if (de_ctx != NULL) + SigGroupCleanup(de_ctx); + if (de_ctx != NULL) + SigCleanSignatures(de_ctx); + if (de_ctx != NULL) + DetectEngineCtxFree(de_ctx); + + FlowL7DataPtrFree(&f); + StreamTcpFreeConfig(TRUE); + FLOW_DESTROY(&f); + UTHFreePackets(&p1, 1); + return result; +} + +static int DetectEngineHttpClientBodyTest19(void) +{ + TcpSession ssn; + Packet *p1 = NULL; + ThreadVars th_v; + DetectEngineCtx *de_ctx = NULL; + DetectEngineThreadCtx *det_ctx = NULL; + Flow f; + uint8_t http1_buf[] = "This is dummy body1"; + uint32_t http1_len = sizeof(http1_buf) - 1; + int result = 0; + + memset(&th_v, 0, sizeof(th_v)); + memset(&f, 0, sizeof(f)); + memset(&ssn, 0, sizeof(ssn)); + + p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); + + FLOW_INITIALIZE(&f); + f.protoctx = (void *)&ssn; + f.src.family = AF_INET; + f.dst.family = AF_INET; + + p1->flow = &f; + p1->flowflags |= FLOW_PKT_TOSERVER; + p1->flowflags |= FLOW_PKT_ESTABLISHED; + p1->flags |= PKT_HAS_FLOW; + f.alproto = ALPROTO_HTTP; + + StreamTcpInitConfig(TRUE); + FlowL7DataPtrInit(&f); + + de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + + de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + "(msg:\"http client body test\"; " + "content:bambu; http_client_body; " + "content:is; http_client_body; " + "sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + + SigGroupBuild(de_ctx); + DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + + /* start the search phase */ + det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p1); + uint32_t r = HttpClientBodyPatternSearch(det_ctx, http1_buf, http1_len); + if (r != 0) { + printf("expected 1 result, got %"PRIu32": ", r); + goto end; + } + + result = 1; + +end: + if (de_ctx != NULL) + SigGroupCleanup(de_ctx); + if (de_ctx != NULL) + SigCleanSignatures(de_ctx); + if (de_ctx != NULL) + DetectEngineCtxFree(de_ctx); + + FlowL7DataPtrFree(&f); + StreamTcpFreeConfig(TRUE); + FLOW_DESTROY(&f); + UTHFreePackets(&p1, 1); + return result; +} + +static int DetectEngineHttpClientBodyTest20(void) +{ + TcpSession ssn; + Packet *p1 = NULL; + ThreadVars th_v; + DetectEngineCtx *de_ctx = NULL; + DetectEngineThreadCtx *det_ctx = NULL; + Flow f; + uint8_t http1_buf[] = "This is dummy body1"; + uint32_t http1_len = sizeof(http1_buf) - 1; + int result = 0; + + memset(&th_v, 0, sizeof(th_v)); + memset(&f, 0, sizeof(f)); + memset(&ssn, 0, sizeof(ssn)); + + p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); + + FLOW_INITIALIZE(&f); + f.protoctx = (void *)&ssn; + f.src.family = AF_INET; + f.dst.family = AF_INET; + + p1->flow = &f; + p1->flowflags |= FLOW_PKT_TOSERVER; + p1->flowflags |= FLOW_PKT_ESTABLISHED; + p1->flags |= PKT_HAS_FLOW; + f.alproto = ALPROTO_HTTP; + + StreamTcpInitConfig(TRUE); + FlowL7DataPtrInit(&f); + + de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + + de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " + "(msg:\"http client body test\"; " + "content:bambu; http_client_body; " + "content:is; http_client_body; fast_pattern; " + "sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + + SigGroupBuild(de_ctx); + DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + + /* start the search phase */ + det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p1); + uint32_t r = HttpClientBodyPatternSearch(det_ctx, http1_buf, http1_len); + if (r != 2) { + printf("expected 1 result, got %"PRIu32": ", r); + goto end; + } + + result = 1; + +end: + if (de_ctx != NULL) + SigGroupCleanup(de_ctx); + if (de_ctx != NULL) + SigCleanSignatures(de_ctx); + if (de_ctx != NULL) + DetectEngineCtxFree(de_ctx); + + FlowL7DataPtrFree(&f); + StreamTcpFreeConfig(TRUE); + FLOW_DESTROY(&f); + UTHFreePackets(&p1, 1); + return result; +} + #endif /* UNITTESTS */ void HttpClientBodyRegisterTests(void) @@ -2279,6 +2692,14 @@ void HttpClientBodyRegisterTests(void) DetectEngineHttpClientBodyTest15, 1); UtRegisterTest("DetectEngineHttpClientBodyTest16", DetectEngineHttpClientBodyTest16, 1); + UtRegisterTest("DetectEngineHttpClientBodyTest17", + DetectEngineHttpClientBodyTest17, 1); + UtRegisterTest("DetectEngineHttpClientBodyTest18", + DetectEngineHttpClientBodyTest18, 1); + UtRegisterTest("DetectEngineHttpClientBodyTest19", + DetectEngineHttpClientBodyTest19, 1); + UtRegisterTest("DetectEngineHttpClientBodyTest20", + DetectEngineHttpClientBodyTest20, 1); #endif /* UNITTESTS */ return; diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index c2499a515a..8e0d1e7224 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -263,6 +263,29 @@ uint32_t UriPatternSearch(DetectEngineThreadCtx *det_ctx, SCReturnUInt(ret); } +/** \brief Uri Pattern match -- searches for one pattern per signature. + * + * \param det_ctx detection engine thread ctx + * \param p packet to inspect + * + * \retval ret number of matches + */ +uint32_t HttpClientBodyPatternSearch(DetectEngineThreadCtx *det_ctx, + uint8_t *body, uint32_t body_len) +{ + SCEnter(); + + if (det_ctx->sgh->mpm_hcbd_ctx == NULL) + SCReturnUInt(0); + + uint32_t ret; + ret = mpm_table[det_ctx->sgh->mpm_hcbd_ctx->mpm_type]. + Search(det_ctx->sgh->mpm_hcbd_ctx, &det_ctx->mtcu, + &det_ctx->pmq, body, body_len); + + SCReturnUInt(ret); +} + /** \brief Pattern match -- searches for only one pattern per signature. * * \param tv threadvars @@ -557,6 +580,7 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx, DetectContentData *cd = NULL; DetectContentData *ud = NULL; + DetectContentData *hcbd = NULL; switch (mpm_sm->type) { case DETECT_CONTENT: { @@ -588,14 +612,14 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx, } if (SignatureHasStreamContent(s)) { if (cd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_ctx, + mpm_table[sgh->mpm_stream_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_stream_ctx, cd->content + cd->fp_chop_offset, cd->fp_chop_len, 0, 0, cd->id, s->num, flags); } else { - mpm_table[sgh->mpm_ctx->mpm_type]. - AddPattern(sgh->mpm_ctx, + mpm_table[sgh->mpm_stream_ctx->mpm_type]. + AddPattern(sgh->mpm_stream_ctx, cd->content + cd->fp_chop_offset, cd->fp_chop_len, 0, 0, cd->id, s->num, flags); @@ -611,10 +635,12 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx, } } else { if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { - if (SignatureHasPacketContent(s)) - cd->flags |= DETECT_CONTENT_PACKET_MPM; - if (SignatureHasStreamContent(s)) - cd->flags |= DETECT_CONTENT_STREAM_MPM; + if (DETECT_CONTENT_IS_SINGLE(cd)) { + if (SignatureHasPacketContent(s)) + cd->flags |= DETECT_CONTENT_PACKET_MPM; + if (SignatureHasStreamContent(s)) + cd->flags |= DETECT_CONTENT_STREAM_MPM; + } /* see if we can bypass the match validation for this pattern */ } else { @@ -680,21 +706,23 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx, if (ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { /* add the content to the "uri" mpm */ if (ud->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_ctx, + mpm_table[sgh->mpm_uri_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_uri_ctx, ud->content + ud->fp_chop_offset, ud->fp_chop_len, 0, 0, ud->id, s->num, flags); } else { - mpm_table[sgh->mpm_ctx->mpm_type]. - AddPattern(sgh->mpm_ctx, + mpm_table[sgh->mpm_uri_ctx->mpm_type]. + AddPattern(sgh->mpm_uri_ctx, ud->content + ud->fp_chop_offset, ud->fp_chop_len, 0, 0, ud->id, s->num, flags); } } else { if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { - ud->flags |= DETECT_CONTENT_URI_MPM; + if (DETECT_CONTENT_IS_SINGLE(ud)) { + ud->flags |= DETECT_CONTENT_URI_MPM; + } /* see if we can bypass the match validation for this pattern */ } else { @@ -724,6 +752,60 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx, break; } /* case DETECT_URICONTENT */ + + case DETECT_AL_HTTP_CLIENT_BODY: + { + hcbd = (DetectContentData *)mpm_sm->ctx; + if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { + /* add the content to the "uri" mpm */ + if (hcbd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hcbd_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hcbd_ctx, + hcbd->content + hcbd->fp_chop_offset, + hcbd->fp_chop_len, + 0, 0, hcbd->id, s->num, flags); + } else { + mpm_table[sgh->mpm_hcbd_ctx->mpm_type]. + AddPattern(sgh->mpm_hcbd_ctx, + hcbd->content + hcbd->fp_chop_offset, + hcbd->fp_chop_len, + 0, 0, hcbd->id, s->num, flags); + } + } else { + if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + if (DETECT_CONTENT_IS_SINGLE(hcbd)) { + hcbd->flags |= DETECT_CONTENT_HCBD_MPM; + } + + /* see if we can bypass the match validation for this pattern */ + } else { + if (DETECT_CONTENT_IS_SINGLE(hcbd)) { + hcbd->flags |= DETECT_CONTENT_HCBD_MPM; + } + } /* else - if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ + + /* add the content to the "packet" mpm */ + if (hcbd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hcbd_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hcbd_ctx, + hcbd->content, hcbd->content_len, + 0, 0, hcbd->id, s->num, flags); + } else { + mpm_table[sgh->mpm_hcbd_ctx->mpm_type]. + AddPattern(sgh->mpm_hcbd_ctx, + hcbd->content, hcbd->content_len, + 0, 0, hcbd->id, s->num, flags); + } + } + /* tell matcher we are inspecting uri */ + s->flags |= SIG_FLAG_MPM_HCBDCONTENT; + s->mpm_hcbdpattern_id = hcbd->id; + if (hcbd->flags & DETECT_CONTENT_NEGATED) + s->flags |= SIG_FLAG_MPM_HCBDCONTENT_NEG; + + break; + } /* case DETECT_AL_HTTP_CLIENT_BODY */ + } /* switch (mpm_sm->type) */ SCLogDebug("%"PRIu32" adding co->id %"PRIu32" to the mpm phase " @@ -1770,6 +1852,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) uint32_t has_co_packet = 0; /**< our sgh has packet payload inspecting content */ uint32_t has_co_stream = 0; /**< our sgh has stream inspecting content */ uint32_t has_co_uri = 0; /**< our sgh has uri inspecting content */ + uint32_t has_co_hcbd = 0; //uint32_t cnt = 0; uint32_t sig = 0; @@ -1800,6 +1883,10 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) has_co_uri = 1; } } + + if (s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL) { + has_co_hcbd = 1; + } } if (has_co_packet > 0) { @@ -1811,14 +1898,21 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) if (has_co_uri > 0) { sh->flags |= SIG_GROUP_HAVEURICONTENT; } + if (has_co_hcbd > 0) { + sh->flags |= SIG_GROUP_HAVEHCBDCONTENT; + } /* intialize contexes */ - if (sh->flags & SIG_GROUP_HAVECONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_COPY)) { + if (sh->flags & SIG_GROUP_HAVECONTENT) { if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { sh->mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_packet); } else { sh->mpm_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT); } + if (sh->mpm_ctx == NULL) { + SCLogDebug("sh->mpm_stream_ctx == NULL. This should never happen"); + exit(EXIT_FAILURE); + } #ifndef __SC_CUDA_SUPPORT__ MpmInitCtx(sh->mpm_ctx, de_ctx->mpm_matcher, -1); @@ -1827,12 +1921,16 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) #endif } - if (sh->flags & SIG_GROUP_HAVESTREAMCONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_STREAM_COPY)) { + if (sh->flags & SIG_GROUP_HAVESTREAMCONTENT) { if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { sh->mpm_stream_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_stream); } else { sh->mpm_stream_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT); } + if (sh->mpm_stream_ctx == NULL) { + SCLogDebug("sh->mpm_stream_ctx == NULL. This should never happen"); + exit(EXIT_FAILURE); + } #ifndef __SC_CUDA_SUPPORT__ MpmInitCtx(sh->mpm_stream_ctx, de_ctx->mpm_matcher, -1); @@ -1841,12 +1939,16 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) #endif } - if (sh->flags & SIG_GROUP_HAVEURICONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY)) { + if (sh->flags & SIG_GROUP_HAVEURICONTENT) { if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { sh->mpm_uri_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_uri); } else { sh->mpm_uri_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT); } + if (sh->mpm_uri_ctx == NULL) { + SCLogDebug("sh->mpm_uri_ctx == NULL. This should never happen"); + exit(EXIT_FAILURE); + } #ifndef __SC_CUDA_SUPPORT__ MpmInitCtx(sh->mpm_uri_ctx, de_ctx->mpm_matcher, -1); @@ -1855,6 +1957,24 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) #endif } + if (sh->flags & SIG_GROUP_HAVEHCBDCONTENT) { + if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { + sh->mpm_hcbd_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hcbd); + } else { + sh->mpm_hcbd_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT); + } + if (sh->mpm_hcbd_ctx == NULL) { + SCLogDebug("sh->mpm_stream_ctx == NULL. This should never happen"); + exit(EXIT_FAILURE); + } + +#ifndef __SC_CUDA_SUPPORT__ + MpmInitCtx(sh->mpm_hcbd_ctx, de_ctx->mpm_matcher, -1); +#else + MpmInitCtx(sh->mpm_hcbd_ctx, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle); +#endif + } + /* for each signature in this group do */ //for (sig = 0; sig < sh->sig_cnt; sig++) { // s = sh->match_array[sig]; @@ -1984,9 +2104,10 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) // } //} - if ( (sh->flags & SIG_GROUP_HAVECONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_COPY)) || - (sh->flags & SIG_GROUP_HAVESTREAMCONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_STREAM_COPY)) || - (sh->flags & SIG_GROUP_HAVEURICONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY)) ) { + if (sh->flags & SIG_GROUP_HAVECONTENT || + sh->flags & SIG_GROUP_HAVESTREAMCONTENT || + sh->flags & SIG_GROUP_HAVEURICONTENT || + sh->flags & SIG_GROUP_HAVEHCBDCONTENT) { PatternMatchPreparePopulateMpm(de_ctx, sh); @@ -1996,7 +2117,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) MpmFactoryReClaimMpmCtx(sh->mpm_ctx); sh->mpm_ctx = NULL; } else { - if (sh->flags & SIG_GROUP_HAVECONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_COPY)) { + if (sh->flags & SIG_GROUP_HAVECONTENT) { if (mpm_table[sh->mpm_ctx->mpm_type].Prepare != NULL) mpm_table[sh->mpm_ctx->mpm_type].Prepare(sh->mpm_ctx); } @@ -2007,7 +2128,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) MpmFactoryReClaimMpmCtx(sh->mpm_stream_ctx); sh->mpm_stream_ctx = NULL; } else { - if (sh->flags & SIG_GROUP_HAVESTREAMCONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_STREAM_COPY)) { + if (sh->flags & SIG_GROUP_HAVESTREAMCONTENT) { if (mpm_table[sh->mpm_stream_ctx->mpm_type].Prepare != NULL) mpm_table[sh->mpm_stream_ctx->mpm_type].Prepare(sh->mpm_stream_ctx); } @@ -2018,13 +2139,24 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) MpmFactoryReClaimMpmCtx(sh->mpm_uri_ctx); sh->mpm_uri_ctx = NULL; } else { - if (sh->flags & SIG_GROUP_HAVEURICONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY)) { + if (sh->flags & SIG_GROUP_HAVEURICONTENT) { if (mpm_table[sh->mpm_uri_ctx->mpm_type].Prepare != NULL) mpm_table[sh->mpm_uri_ctx->mpm_type].Prepare(sh->mpm_uri_ctx); } } } - } + if (sh->mpm_hcbd_ctx != NULL) { + if (sh->mpm_hcbd_ctx->pattern_cnt == 0) { + MpmFactoryReClaimMpmCtx(sh->mpm_hcbd_ctx); + sh->mpm_hcbd_ctx = NULL; + } else { + if (sh->flags & SIG_GROUP_HAVEHCBDCONTENT) { + if (mpm_table[sh->mpm_hcbd_ctx->mpm_type].Prepare != NULL) + mpm_table[sh->mpm_hcbd_ctx->mpm_type].Prepare(sh->mpm_hcbd_ctx); + } + } + } + } /* if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) */ } else { MpmFactoryReClaimMpmCtx(sh->mpm_ctx); sh->mpm_ctx = NULL; @@ -2032,6 +2164,8 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) sh->mpm_stream_ctx = NULL; MpmFactoryReClaimMpmCtx(sh->mpm_uri_ctx); sh->mpm_uri_ctx = NULL; + MpmFactoryReClaimMpmCtx(sh->mpm_hcbd_ctx); + sh->mpm_hcbd_ctx = NULL; } ///* uricontent */ diff --git a/src/detect-engine-mpm.h b/src/detect-engine-mpm.h index 2287e1dda7..6b57df8ccb 100644 --- a/src/detect-engine-mpm.h +++ b/src/detect-engine-mpm.h @@ -36,6 +36,7 @@ uint16_t PatternMatchDefaultMatcher(void); uint32_t PacketPatternSearch(ThreadVars *, DetectEngineThreadCtx *, Packet *); uint32_t UriPatternSearch(DetectEngineThreadCtx *, uint8_t *, uint16_t); uint32_t StreamPatternSearch(ThreadVars *, DetectEngineThreadCtx *, Packet *, StreamMsg *, uint8_t); +uint32_t HttpClientBodyPatternSearch(DetectEngineThreadCtx *, uint8_t *, uint32_t); void PacketPatternCleanup(ThreadVars *, DetectEngineThreadCtx *); void StreamPatternCleanup(ThreadVars *t, DetectEngineThreadCtx *det_ctx, StreamMsg *smsg); diff --git a/src/detect-fast-pattern.c b/src/detect-fast-pattern.c index 00b16290b2..936e44e1a2 100644 --- a/src/detect-fast-pattern.c +++ b/src/detect-fast-pattern.c @@ -125,6 +125,9 @@ void SupportFastPatternForSigMatchTypes(void) SupportFastPatternForSigMatchType(DETECT_URICONTENT); SupportFastPatternForSigMatchList(DETECT_SM_LIST_UMATCH); + SupportFastPatternForSigMatchType(DETECT_AL_HTTP_CLIENT_BODY); + SupportFastPatternForSigMatchList(DETECT_SM_LIST_HCBDMATCH); + return; } @@ -188,19 +191,21 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a int ov[MAX_SUBSTRINGS]; const char *arg_substr = NULL; DetectContentData *cd = NULL; - DetectContentData *ud = NULL; - if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL && + s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL && + s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH] == NULL) { SCLogWarning(SC_WARN_COMPATIBILITY, "fast_pattern found inside the " "rule, without a preceding content based keyword. " - "Currently we provide fast_pattern support for content " - "and uricontent"); + "Currently we provide fast_pattern support for content, " + "uricontent and http_client_body"); return -1; } - SigMatch *pm = SigMatchGetLastSMFromLists(s, 4, + SigMatch *pm = SigMatchGetLastSMFromLists(s, 6, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], - DETECT_URICONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH]); + DETECT_URICONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], + DETECT_AL_HTTP_CLIENT_BODY, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]); if (pm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside " "the rule, without a content context. Please use a " @@ -208,83 +213,44 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a return -1; } - if (pm->type == DETECT_CONTENT) { - cd = pm->ctx; - } else if (pm->type == DETECT_URICONTENT) { - ud = pm->ctx; + cd = pm->ctx; + if (cd->flags & DETECT_CONTENT_NEGATED && + (cd->flags & DETECT_CONTENT_DISTANCE || + cd->flags & DETECT_CONTENT_WITHIN || + cd->flags & DETECT_CONTENT_OFFSET || + cd->flags & DETECT_CONTENT_DEPTH)) { + + /* we can't have any of these if we are having "only" */ + SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern; cannot be " + "used with negated content, along with relative modifiers."); + goto error; } if (arg == NULL|| strcmp(arg, "") == 0) { - if (pm->type == DETECT_CONTENT) { - cd->flags |= DETECT_CONTENT_FAST_PATTERN; - } else if (pm->type == DETECT_URICONTENT) { - ud->flags |= DETECT_CONTENT_FAST_PATTERN; - } + cd->flags |= DETECT_CONTENT_FAST_PATTERN; return 0; } - if (pm->type == DETECT_CONTENT) { - if (cd->flags & DETECT_CONTENT_NEGATED && - (cd->flags & DETECT_CONTENT_DISTANCE || - cd->flags & DETECT_CONTENT_WITHIN || - cd->flags & DETECT_CONTENT_OFFSET || - cd->flags & DETECT_CONTENT_DEPTH)) { - - /* we can't have any of these if we are having "only" */ - SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern; cannot be " - "used with negated content, along with relative modifiers."); - goto error; - } - } else if (pm->type == DETECT_URICONTENT) { - if (ud->flags & DETECT_CONTENT_NEGATED && - (ud->flags & DETECT_CONTENT_DISTANCE || - ud->flags & DETECT_CONTENT_WITHIN || - ud->flags & DETECT_CONTENT_OFFSET || - ud->flags & DETECT_CONTENT_DEPTH)) { - - /* we can't have any of these if we are having "only" */ - SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern; cannot be " - "used with negated uricontent, along with relative modifiers."); - goto error; - } - } else { - printf("we will never hit else"); - } - /* Execute the regex and populate args with captures. */ ret = pcre_exec(parse_regex, parse_regex_study, arg, strlen(arg), 0, 0, ov, MAX_SUBSTRINGS); + /* fast pattern only */ if (ret == 2) { - if (pm->type == DETECT_CONTENT) { - if (cd->flags & DETECT_CONTENT_NEGATED || - cd->flags & DETECT_CONTENT_DISTANCE || - cd->flags & DETECT_CONTENT_WITHIN || - cd->flags & DETECT_CONTENT_OFFSET || - cd->flags & DETECT_CONTENT_DEPTH) { - - /* we can't have any of these if we are having "only" */ - SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern: only; cannot be " - "used with negated content or with any of the relative " - "modifiers like distance, within, offset, depth"); - goto error; - } - cd->flags |= DETECT_CONTENT_FAST_PATTERN_ONLY; - } else if (pm->type == DETECT_URICONTENT) { - if (ud->flags & DETECT_CONTENT_NEGATED || - ud->flags & DETECT_CONTENT_DISTANCE || - ud->flags & DETECT_CONTENT_WITHIN || - ud->flags & DETECT_CONTENT_OFFSET || - ud->flags & DETECT_CONTENT_DEPTH) { - - /* we can't have any of these if we are having "only" */ - SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern: only; cannot be " - "used with negated uricontent"); - goto error; - } - ud->flags |= DETECT_CONTENT_FAST_PATTERN_ONLY; - } else { - printf("we will never hit else"); + if (cd->flags & DETECT_CONTENT_NEGATED || + cd->flags & DETECT_CONTENT_DISTANCE || + cd->flags & DETECT_CONTENT_WITHIN || + cd->flags & DETECT_CONTENT_OFFSET || + cd->flags & DETECT_CONTENT_DEPTH) { + + /* we can't have any of these if we are having "only" */ + SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern: only; cannot be " + "used with negated content or with any of the relative " + "modifiers like distance, within, offset, depth"); + goto error; } + cd->flags |= DETECT_CONTENT_FAST_PATTERN_ONLY; + + /* fast pattern chop */ } else if (ret == 4) { res = pcre_get_substring((char *)arg, ov, MAX_SUBSTRINGS, 2, &arg_substr); @@ -320,15 +286,10 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a goto error; } - if (pm->type == DETECT_CONTENT) { - cd->fp_chop_offset = offset; - cd->fp_chop_len = length; - cd->flags |= DETECT_CONTENT_FAST_PATTERN_CHOP; - } else if (pm->type == DETECT_URICONTENT) { - ud->fp_chop_offset = offset; - ud->fp_chop_len = length; - ud->flags |= DETECT_CONTENT_FAST_PATTERN_CHOP; - } + cd->fp_chop_offset = offset; + cd->fp_chop_len = length; + cd->flags |= DETECT_CONTENT_FAST_PATTERN_CHOP; + } else { SCLogError(SC_ERR_PCRE_PARSE, "parse error, ret %" PRId32 ", string %s", ret, arg); @@ -349,11 +310,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a // printf("%d-%s\n", args, arg_substr); //} - if (pm->type == DETECT_CONTENT) { - cd->flags |= DETECT_CONTENT_FAST_PATTERN; - } else if (pm->type == DETECT_URICONTENT) { - ud->flags |= DETECT_CONTENT_FAST_PATTERN; - } + cd->flags |= DETECT_CONTENT_FAST_PATTERN; return 0; @@ -4269,149 +4226,1390 @@ int DetectFastPatternTest133(void) return result; } -#endif +int DetectFastPatternTest134(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; -void DetectFastPatternRegisterTests(void) + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:!two; fast_pattern:3,4; http_client_body; content:three; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_NEGATED && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && + ud->fp_chop_offset == 3 && + ud->fp_chop_len == 4) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +/** + * \test Checks if a fast_pattern is registered in a Signature for uricontent. + */ +int DetectFastPatternTest135(void) { + SigMatch *sm = NULL; + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:\"/one/\"; fast_pattern:only; http_client_body; " + "msg:\"Testing fast_pattern\"; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + + result = 0; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH]; + if (sm != NULL) { + if ( ((DetectContentData *)sm->ctx)->flags & + DETECT_CONTENT_FAST_PATTERN) { + result = 1; + } else { + result = 0; + } + } + + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +/** + * \test Checks if a fast_pattern is registered in a Signature for uricontent. + */ +int DetectFastPatternTest136(void) +{ + SigMatch *sm = NULL; + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:\"/one/\"; fast_pattern:3,4; http_client_body; " + "msg:\"Testing fast_pattern\"; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + + result = 0; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH]; + if (sm != NULL) { + if ( ((DetectContentData *)sm->ctx)->flags & + DETECT_CONTENT_FAST_PATTERN) { + result = 1; + } else { + result = 0; + } + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest137(void) +{ + SigMatch *sm = NULL; + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; fast_pattern:only; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + + result = 0; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH]; + DetectContentData *ud = sm->ctx; + if (sm != NULL) { + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && + ud->fp_chop_offset == 0 && + ud->fp_chop_len == 0) { + result = 1; + } else { + result = 0; + } + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest138(void) +{ + SigMatch *sm = NULL; + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; fast_pattern:3,4; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + + result = 0; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH]; + DetectContentData *ud = sm->ctx; + if (sm != NULL) { + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && + ud->fp_chop_offset == 3 && + ud->fp_chop_len == 4) { + result = 1; + } else { + result = 0; + } + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest139(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; fast_pattern:only; http_client_body; distance:10; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest140(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; distance:10; fast_pattern:only; http_client_body; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest141(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; fast_pattern:only; http_client_body; within:10; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest142(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; within:10; fast_pattern:only; http_client_body; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest143(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; fast_pattern:only; http_client_body; offset:10; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest144(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; offset:10; fast_pattern:only; http_client_body; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest145(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; fast_pattern:only; http_client_body; depth:10; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest146(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; depth:10; fast_pattern:only; http_client_body; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest147(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:!two; fast_pattern:only; http_client_body; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest148(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content: one; http_client_body; content:two; http_client_body; distance:30; content:two; fast_pattern:only; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && + ud->fp_chop_offset == 0 && + ud->fp_chop_len == 0) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest149(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; http_client_body; within:30; content:two; fast_pattern:only; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && + ud->fp_chop_offset == 0 && + ud->fp_chop_len == 0) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest150(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; http_client_body; offset:30; content:two; fast_pattern:only; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && + ud->fp_chop_offset == 0 && + ud->fp_chop_len == 0) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest151(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; http_client_body; depth:30; content:two; fast_pattern:only; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && + ud->fp_chop_offset == 0 && + ud->fp_chop_len == 0) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest152(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:!one; fast_pattern; http_client_body; content:two; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_NEGATED && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && + ud->fp_chop_offset == 0 && + ud->fp_chop_len == 0) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest153(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:two; http_client_body; content:!one; fast_pattern; http_client_body; distance:20; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest154(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:two; http_client_body; content:!one; fast_pattern; http_client_body; within:20; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest155(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:two; http_client_body; content:!one; fast_pattern; http_client_body; offset:20; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest156(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:two; http_client_body; content:!one; fast_pattern; http_client_body; depth:20; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest157(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; fast_pattern:3,4; http_client_body; content:three; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && + ud->fp_chop_offset == 3 && + ud->fp_chop_len == 4) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest158(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; fast_pattern:3,4; http_client_body; content:three; http_client_body; distance:30; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && + ud->fp_chop_offset == 3 && + ud->fp_chop_len == 4) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest159(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; fast_pattern:3,4; http_client_body; content:three; http_client_body; within:30; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && + ud->fp_chop_offset == 3 && + ud->fp_chop_len == 4) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest160(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; fast_pattern:3,4; http_client_body; content:three; http_client_body; offset:30; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && + ud->fp_chop_offset == 3 && + ud->fp_chop_len == 4) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest161(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; fast_pattern:3,4; http_client_body; content:three; http_client_body; depth:30; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && + ud->fp_chop_offset == 3 && + ud->fp_chop_len == 4) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest162(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; http_client_body; distance:10; content:three; fast_pattern:3,4; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && + ud->fp_chop_offset == 3 && + ud->fp_chop_len == 4) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest163(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; http_client_body; within:10; content:three; fast_pattern:3,4; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && + ud->fp_chop_offset == 3 && + ud->fp_chop_len == 4) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest164(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; http_client_body; offset:10; content:three; fast_pattern:3,4; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && + ud->fp_chop_offset == 3 && + ud->fp_chop_len == 4) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest165(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; http_client_body; depth:10; content:three; fast_pattern:3,4; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && + ud->fp_chop_offset == 3 && + ud->fp_chop_len == 4) { + result = 1; + } else { + result = 0; + } + + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest166(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; fast_pattern:65977,4; http_client_body; content:three; http_client_body; distance:10; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest167(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; fast_pattern:3,65977; http_client_body; content:three; distance:10; http_client_body; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest168(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:two; fast_pattern:65534,4; http_client_body; content:three; http_client_body; distance:10; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest169(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:!two; fast_pattern:3,4; http_client_body; content:three; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_NEGATED && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && + ud->fp_chop_offset == 3 && + ud->fp_chop_len == 4) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest170(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:!two; fast_pattern:3,4; http_client_body; distance:10; content:three; http_client_body; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest171(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:!two; fast_pattern:3,4; http_client_body; within:10; content:three; http_client_body; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest172(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:!two; fast_pattern:3,4; http_client_body; offset:10; content:three; http_client_body; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest173(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:!two; fast_pattern:3,4; http_client_body; depth:10; content:three; http_client_body; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest174(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:one; http_client_body; content:!two; fast_pattern:3,4; http_client_body; content:three; http_client_body; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_NEGATED && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && + ud->fp_chop_offset == 3 && + ud->fp_chop_len == 4) { + result = 1; + } else { + result = 0; + } + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest175(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:two; content:!one; distance:20; fast_pattern; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest176(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:two; content:!one; within:20; fast_pattern; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest177(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:two; content:!one; offset:20; fast_pattern; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +int DetectFastPatternTest178(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " + "(content:two; content:!one; depth:20; fast_pattern; sid:1;)"); + if (de_ctx->sig_list != NULL) + goto end; + + result = 1; + + end: + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +} + +#endif + +void DetectFastPatternRegisterTests(void) +{ + +#ifdef UNITTESTS + UtRegisterTest("DetectFastPatternTest01", DetectFastPatternTest01, 1); + UtRegisterTest("DetectFastPatternTest02", DetectFastPatternTest02, 1); + UtRegisterTest("DetectFastPatternTest03", DetectFastPatternTest03, 1); + UtRegisterTest("DetectFastPatternTest04", DetectFastPatternTest04, 1); + UtRegisterTest("DetectFastPatternTest05", DetectFastPatternTest05, 1); + UtRegisterTest("DetectFastPatternTest06", DetectFastPatternTest06, 1); + UtRegisterTest("DetectFastPatternTest07", DetectFastPatternTest07, 1); + UtRegisterTest("DetectFastPatternTest08", DetectFastPatternTest08, 1); + UtRegisterTest("DetectFastPatternTest09", DetectFastPatternTest09, 1); + UtRegisterTest("DetectFastPatternTest10", DetectFastPatternTest10, 1); + UtRegisterTest("DetectFastPatternTest11", DetectFastPatternTest11, 1); + UtRegisterTest("DetectFastPatternTest12", DetectFastPatternTest12, 1); + UtRegisterTest("DetectFastPatternTest13", DetectFastPatternTest13, 1); + UtRegisterTest("DetectFastPatternTest14", DetectFastPatternTest14, 1); + UtRegisterTest("DetectFastPatternTest15", DetectFastPatternTest15, 1); + UtRegisterTest("DetectFastPatternTest16", DetectFastPatternTest16, 1); + UtRegisterTest("DetectFastPatternTest17", DetectFastPatternTest17, 1); + UtRegisterTest("DetectFastPatternTest18", DetectFastPatternTest18, 1); + UtRegisterTest("DetectFastPatternTest19", DetectFastPatternTest19, 1); + UtRegisterTest("DetectFastPatternTest20", DetectFastPatternTest20, 1); + UtRegisterTest("DetectFastPatternTest21", DetectFastPatternTest21, 1); + UtRegisterTest("DetectFastPatternTest22", DetectFastPatternTest22, 1); + UtRegisterTest("DetectFastPatternTest23", DetectFastPatternTest23, 1); + UtRegisterTest("DetectFastPatternTest24", DetectFastPatternTest24, 1); + UtRegisterTest("DetectFastPatternTest25", DetectFastPatternTest25, 1); + UtRegisterTest("DetectFastPatternTest26", DetectFastPatternTest26, 1); + UtRegisterTest("DetectFastPatternTest27", DetectFastPatternTest27, 1); + UtRegisterTest("DetectFastPatternTest28", DetectFastPatternTest28, 1); + UtRegisterTest("DetectFastPatternTest29", DetectFastPatternTest29, 1); + UtRegisterTest("DetectFastPatternTest30", DetectFastPatternTest30, 1); + UtRegisterTest("DetectFastPatternTest31", DetectFastPatternTest31, 1); + UtRegisterTest("DetectFastPatternTest32", DetectFastPatternTest32, 1); + UtRegisterTest("DetectFastPatternTest33", DetectFastPatternTest33, 1); + UtRegisterTest("DetectFastPatternTest34", DetectFastPatternTest34, 1); + UtRegisterTest("DetectFastPatternTest35", DetectFastPatternTest35, 1); + UtRegisterTest("DetectFastPatternTest36", DetectFastPatternTest36, 1); + UtRegisterTest("DetectFastPatternTest37", DetectFastPatternTest37, 1); + UtRegisterTest("DetectFastPatternTest38", DetectFastPatternTest38, 1); + UtRegisterTest("DetectFastPatternTest39", DetectFastPatternTest39, 1); + UtRegisterTest("DetectFastPatternTest40", DetectFastPatternTest40, 1); + UtRegisterTest("DetectFastPatternTest41", DetectFastPatternTest41, 1); + UtRegisterTest("DetectFastPatternTest42", DetectFastPatternTest42, 1); + UtRegisterTest("DetectFastPatternTest43", DetectFastPatternTest43, 1); + UtRegisterTest("DetectFastPatternTest44", DetectFastPatternTest44, 1); + UtRegisterTest("DetectFastPatternTest45", DetectFastPatternTest45, 1); + UtRegisterTest("DetectFastPatternTest46", DetectFastPatternTest46, 1); + UtRegisterTest("DetectFastPatternTest47", DetectFastPatternTest47, 1); + UtRegisterTest("DetectFastPatternTest48", DetectFastPatternTest48, 1); + UtRegisterTest("DetectFastPatternTest49", DetectFastPatternTest49, 1); + UtRegisterTest("DetectFastPatternTest50", DetectFastPatternTest50, 1); + UtRegisterTest("DetectFastPatternTest51", DetectFastPatternTest51, 1); + UtRegisterTest("DetectFastPatternTest52", DetectFastPatternTest52, 1); + UtRegisterTest("DetectFastPatternTest53", DetectFastPatternTest53, 1); + /* content fast_pattern tests ^ */ + /* uricontent fast_pattern tests v */ + UtRegisterTest("DetectFastPatternTest54", DetectFastPatternTest54, 1); + UtRegisterTest("DetectFastPatternTest55", DetectFastPatternTest55, 1); + UtRegisterTest("DetectFastPatternTest56", DetectFastPatternTest56, 1); + UtRegisterTest("DetectFastPatternTest57", DetectFastPatternTest57, 1); + UtRegisterTest("DetectFastPatternTest58", DetectFastPatternTest58, 1); + UtRegisterTest("DetectFastPatternTest59", DetectFastPatternTest59, 1); + UtRegisterTest("DetectFastPatternTest60", DetectFastPatternTest60, 1); + UtRegisterTest("DetectFastPatternTest61", DetectFastPatternTest61, 1); + UtRegisterTest("DetectFastPatternTest62", DetectFastPatternTest62, 1); + UtRegisterTest("DetectFastPatternTest63", DetectFastPatternTest63, 1); + UtRegisterTest("DetectFastPatternTest64", DetectFastPatternTest64, 1); + UtRegisterTest("DetectFastPatternTest65", DetectFastPatternTest65, 1); + UtRegisterTest("DetectFastPatternTest66", DetectFastPatternTest66, 1); + UtRegisterTest("DetectFastPatternTest67", DetectFastPatternTest67, 1); + UtRegisterTest("DetectFastPatternTest68", DetectFastPatternTest68, 1); + UtRegisterTest("DetectFastPatternTest69", DetectFastPatternTest69, 1); + UtRegisterTest("DetectFastPatternTest70", DetectFastPatternTest70, 1); + UtRegisterTest("DetectFastPatternTest71", DetectFastPatternTest71, 1); + UtRegisterTest("DetectFastPatternTest72", DetectFastPatternTest72, 1); + UtRegisterTest("DetectFastPatternTest73", DetectFastPatternTest73, 1); + UtRegisterTest("DetectFastPatternTest74", DetectFastPatternTest74, 1); + UtRegisterTest("DetectFastPatternTest75", DetectFastPatternTest75, 1); + UtRegisterTest("DetectFastPatternTest76", DetectFastPatternTest76, 1); + UtRegisterTest("DetectFastPatternTest77", DetectFastPatternTest77, 1); + UtRegisterTest("DetectFastPatternTest78", DetectFastPatternTest78, 1); + UtRegisterTest("DetectFastPatternTest79", DetectFastPatternTest79, 1); + UtRegisterTest("DetectFastPatternTest80", DetectFastPatternTest80, 1); + UtRegisterTest("DetectFastPatternTest81", DetectFastPatternTest81, 1); + UtRegisterTest("DetectFastPatternTest82", DetectFastPatternTest82, 1); + UtRegisterTest("DetectFastPatternTest83", DetectFastPatternTest83, 1); + UtRegisterTest("DetectFastPatternTest84", DetectFastPatternTest84, 1); + UtRegisterTest("DetectFastPatternTest85", DetectFastPatternTest85, 1); + UtRegisterTest("DetectFastPatternTest86", DetectFastPatternTest86, 1); + UtRegisterTest("DetectFastPatternTest87", DetectFastPatternTest87, 1); + UtRegisterTest("DetectFastPatternTest88", DetectFastPatternTest88, 1); + UtRegisterTest("DetectFastPatternTest89", DetectFastPatternTest89, 1); + UtRegisterTest("DetectFastPatternTest90", DetectFastPatternTest90, 1); + UtRegisterTest("DetectFastPatternTest91", DetectFastPatternTest91, 1); + UtRegisterTest("DetectFastPatternTest92", DetectFastPatternTest92, 1); + /* uricontent fast_pattern tests ^ */ + /* http_uri fast_pattern tests v */ + UtRegisterTest("DetectFastPatternTest93", DetectFastPatternTest93, 1); + UtRegisterTest("DetectFastPatternTest94", DetectFastPatternTest94, 1); + UtRegisterTest("DetectFastPatternTest95", DetectFastPatternTest95, 1); + UtRegisterTest("DetectFastPatternTest96", DetectFastPatternTest96, 1); + UtRegisterTest("DetectFastPatternTest97", DetectFastPatternTest97, 1); + UtRegisterTest("DetectFastPatternTest98", DetectFastPatternTest98, 1); + UtRegisterTest("DetectFastPatternTest99", DetectFastPatternTest99, 1); + UtRegisterTest("DetectFastPatternTest100", DetectFastPatternTest100, 1); + UtRegisterTest("DetectFastPatternTest101", DetectFastPatternTest101, 1); + UtRegisterTest("DetectFastPatternTest102", DetectFastPatternTest102, 1); + UtRegisterTest("DetectFastPatternTest103", DetectFastPatternTest103, 1); + UtRegisterTest("DetectFastPatternTest104", DetectFastPatternTest104, 1); + UtRegisterTest("DetectFastPatternTest105", DetectFastPatternTest105, 1); + UtRegisterTest("DetectFastPatternTest106", DetectFastPatternTest106, 1); + UtRegisterTest("DetectFastPatternTest107", DetectFastPatternTest107, 1); + UtRegisterTest("DetectFastPatternTest108", DetectFastPatternTest108, 1); + UtRegisterTest("DetectFastPatternTest109", DetectFastPatternTest109, 1); + UtRegisterTest("DetectFastPatternTest110", DetectFastPatternTest110, 1); + UtRegisterTest("DetectFastPatternTest111", DetectFastPatternTest111, 1); + UtRegisterTest("DetectFastPatternTest112", DetectFastPatternTest112, 1); + UtRegisterTest("DetectFastPatternTest113", DetectFastPatternTest113, 1); + UtRegisterTest("DetectFastPatternTest114", DetectFastPatternTest114, 1); + UtRegisterTest("DetectFastPatternTest115", DetectFastPatternTest115, 1); + UtRegisterTest("DetectFastPatternTest116", DetectFastPatternTest116, 1); + UtRegisterTest("DetectFastPatternTest117", DetectFastPatternTest117, 1); + UtRegisterTest("DetectFastPatternTest118", DetectFastPatternTest118, 1); + UtRegisterTest("DetectFastPatternTest119", DetectFastPatternTest119, 1); + UtRegisterTest("DetectFastPatternTest120", DetectFastPatternTest120, 1); + UtRegisterTest("DetectFastPatternTest121", DetectFastPatternTest121, 1); + UtRegisterTest("DetectFastPatternTest122", DetectFastPatternTest122, 1); + UtRegisterTest("DetectFastPatternTest123", DetectFastPatternTest123, 1); + UtRegisterTest("DetectFastPatternTest124", DetectFastPatternTest124, 1); + UtRegisterTest("DetectFastPatternTest125", DetectFastPatternTest125, 1); + UtRegisterTest("DetectFastPatternTest126", DetectFastPatternTest126, 1); + UtRegisterTest("DetectFastPatternTest127", DetectFastPatternTest127, 1); + UtRegisterTest("DetectFastPatternTest128", DetectFastPatternTest128, 1); + UtRegisterTest("DetectFastPatternTest129", DetectFastPatternTest129, 1); + UtRegisterTest("DetectFastPatternTest130", DetectFastPatternTest130, 1); + UtRegisterTest("DetectFastPatternTest131", DetectFastPatternTest131, 1); + UtRegisterTest("DetectFastPatternTest132", DetectFastPatternTest132, 1); + UtRegisterTest("DetectFastPatternTest133", DetectFastPatternTest133, 1); + /* http_uri fast_pattern tests ^ */ + /* http_client_body fast_pattern tests v */ + UtRegisterTest("DetectFastPatternTest134", DetectFastPatternTest134, 1); + UtRegisterTest("DetectFastPatternTest135", DetectFastPatternTest135, 1); + UtRegisterTest("DetectFastPatternTest136", DetectFastPatternTest136, 1); + UtRegisterTest("DetectFastPatternTest137", DetectFastPatternTest137, 1); + UtRegisterTest("DetectFastPatternTest138", DetectFastPatternTest138, 1); + UtRegisterTest("DetectFastPatternTest139", DetectFastPatternTest139, 1); + UtRegisterTest("DetectFastPatternTest140", DetectFastPatternTest140, 1); + UtRegisterTest("DetectFastPatternTest141", DetectFastPatternTest141, 1); + UtRegisterTest("DetectFastPatternTest142", DetectFastPatternTest142, 1); + UtRegisterTest("DetectFastPatternTest143", DetectFastPatternTest143, 1); + UtRegisterTest("DetectFastPatternTest144", DetectFastPatternTest144, 1); + UtRegisterTest("DetectFastPatternTest145", DetectFastPatternTest145, 1); + UtRegisterTest("DetectFastPatternTest146", DetectFastPatternTest146, 1); + UtRegisterTest("DetectFastPatternTest147", DetectFastPatternTest147, 1); + UtRegisterTest("DetectFastPatternTest148", DetectFastPatternTest148, 1); + UtRegisterTest("DetectFastPatternTest149", DetectFastPatternTest149, 1); + UtRegisterTest("DetectFastPatternTest150", DetectFastPatternTest150, 1); + UtRegisterTest("DetectFastPatternTest151", DetectFastPatternTest151, 1); + UtRegisterTest("DetectFastPatternTest152", DetectFastPatternTest152, 1); + UtRegisterTest("DetectFastPatternTest153", DetectFastPatternTest153, 1); + UtRegisterTest("DetectFastPatternTest154", DetectFastPatternTest154, 1); + UtRegisterTest("DetectFastPatternTest155", DetectFastPatternTest155, 1); + UtRegisterTest("DetectFastPatternTest156", DetectFastPatternTest156, 1); + UtRegisterTest("DetectFastPatternTest157", DetectFastPatternTest157, 1); + UtRegisterTest("DetectFastPatternTest158", DetectFastPatternTest158, 1); + UtRegisterTest("DetectFastPatternTest159", DetectFastPatternTest159, 1); + UtRegisterTest("DetectFastPatternTest160", DetectFastPatternTest160, 1); + UtRegisterTest("DetectFastPatternTest161", DetectFastPatternTest161, 1); + UtRegisterTest("DetectFastPatternTest162", DetectFastPatternTest162, 1); + UtRegisterTest("DetectFastPatternTest163", DetectFastPatternTest163, 1); + UtRegisterTest("DetectFastPatternTest164", DetectFastPatternTest164, 1); + UtRegisterTest("DetectFastPatternTest165", DetectFastPatternTest165, 1); + UtRegisterTest("DetectFastPatternTest166", DetectFastPatternTest166, 1); + UtRegisterTest("DetectFastPatternTest167", DetectFastPatternTest167, 1); + UtRegisterTest("DetectFastPatternTest168", DetectFastPatternTest168, 1); + UtRegisterTest("DetectFastPatternTest169", DetectFastPatternTest169, 1); + UtRegisterTest("DetectFastPatternTest170", DetectFastPatternTest170, 1); + UtRegisterTest("DetectFastPatternTest171", DetectFastPatternTest171, 1); + UtRegisterTest("DetectFastPatternTest172", DetectFastPatternTest172, 1); + UtRegisterTest("DetectFastPatternTest173", DetectFastPatternTest173, 1); + UtRegisterTest("DetectFastPatternTest174", DetectFastPatternTest174, 1); + /* http_client_body fast_pattern tests ^ */ + /* content fast_pattern tests v */ + UtRegisterTest("DetectFastPatternTest175", DetectFastPatternTest175, 1); + UtRegisterTest("DetectFastPatternTest176", DetectFastPatternTest176, 1); + UtRegisterTest("DetectFastPatternTest177", DetectFastPatternTest177, 1); + UtRegisterTest("DetectFastPatternTest178", DetectFastPatternTest178, 1); -#ifdef UNITTESTS - UtRegisterTest("DetectFastPatternTest01", DetectFastPatternTest01, 1); - UtRegisterTest("DetectFastPatternTest02", DetectFastPatternTest02, 1); - UtRegisterTest("DetectFastPatternTest03", DetectFastPatternTest03, 1); - UtRegisterTest("DetectFastPatternTest04", DetectFastPatternTest04, 1); - UtRegisterTest("DetectFastPatternTest05", DetectFastPatternTest05, 1); - UtRegisterTest("DetectFastPatternTest06", DetectFastPatternTest06, 1); - UtRegisterTest("DetectFastPatternTest07", DetectFastPatternTest07, 1); - UtRegisterTest("DetectFastPatternTest08", DetectFastPatternTest08, 1); - UtRegisterTest("DetectFastPatternTest09", DetectFastPatternTest09, 1); - UtRegisterTest("DetectFastPatternTest10", DetectFastPatternTest10, 1); - UtRegisterTest("DetectFastPatternTest11", DetectFastPatternTest11, 1); - UtRegisterTest("DetectFastPatternTest12", DetectFastPatternTest12, 1); - UtRegisterTest("DetectFastPatternTest13", DetectFastPatternTest13, 1); - UtRegisterTest("DetectFastPatternTest14", DetectFastPatternTest14, 1); - UtRegisterTest("DetectFastPatternTest15", DetectFastPatternTest15, 1); - UtRegisterTest("DetectFastPatternTest16", DetectFastPatternTest16, 1); - UtRegisterTest("DetectFastPatternTest17", DetectFastPatternTest17, 1); - UtRegisterTest("DetectFastPatternTest18", DetectFastPatternTest18, 1); - UtRegisterTest("DetectFastPatternTest19", DetectFastPatternTest19, 1); - UtRegisterTest("DetectFastPatternTest20", DetectFastPatternTest20, 1); - UtRegisterTest("DetectFastPatternTest21", DetectFastPatternTest21, 1); - UtRegisterTest("DetectFastPatternTest22", DetectFastPatternTest22, 1); - UtRegisterTest("DetectFastPatternTest23", DetectFastPatternTest23, 1); - UtRegisterTest("DetectFastPatternTest24", DetectFastPatternTest24, 1); - UtRegisterTest("DetectFastPatternTest25", DetectFastPatternTest25, 1); - UtRegisterTest("DetectFastPatternTest26", DetectFastPatternTest26, 1); - UtRegisterTest("DetectFastPatternTest27", DetectFastPatternTest27, 1); - UtRegisterTest("DetectFastPatternTest28", DetectFastPatternTest28, 1); - UtRegisterTest("DetectFastPatternTest29", DetectFastPatternTest29, 1); - UtRegisterTest("DetectFastPatternTest30", DetectFastPatternTest30, 1); - UtRegisterTest("DetectFastPatternTest31", DetectFastPatternTest31, 1); - UtRegisterTest("DetectFastPatternTest32", DetectFastPatternTest32, 1); - UtRegisterTest("DetectFastPatternTest33", DetectFastPatternTest33, 1); - UtRegisterTest("DetectFastPatternTest34", DetectFastPatternTest34, 1); - UtRegisterTest("DetectFastPatternTest35", DetectFastPatternTest35, 1); - UtRegisterTest("DetectFastPatternTest36", DetectFastPatternTest36, 1); - UtRegisterTest("DetectFastPatternTest37", DetectFastPatternTest37, 1); - UtRegisterTest("DetectFastPatternTest38", DetectFastPatternTest38, 1); - UtRegisterTest("DetectFastPatternTest39", DetectFastPatternTest39, 1); - UtRegisterTest("DetectFastPatternTest40", DetectFastPatternTest40, 1); - UtRegisterTest("DetectFastPatternTest41", DetectFastPatternTest41, 1); - UtRegisterTest("DetectFastPatternTest42", DetectFastPatternTest42, 1); - UtRegisterTest("DetectFastPatternTest43", DetectFastPatternTest43, 1); - UtRegisterTest("DetectFastPatternTest44", DetectFastPatternTest44, 1); - UtRegisterTest("DetectFastPatternTest45", DetectFastPatternTest45, 1); - UtRegisterTest("DetectFastPatternTest46", DetectFastPatternTest46, 1); - UtRegisterTest("DetectFastPatternTest47", DetectFastPatternTest47, 1); - UtRegisterTest("DetectFastPatternTest48", DetectFastPatternTest48, 1); - UtRegisterTest("DetectFastPatternTest49", DetectFastPatternTest49, 1); - UtRegisterTest("DetectFastPatternTest50", DetectFastPatternTest50, 1); - UtRegisterTest("DetectFastPatternTest51", DetectFastPatternTest51, 1); - UtRegisterTest("DetectFastPatternTest52", DetectFastPatternTest52, 1); - UtRegisterTest("DetectFastPatternTest53", DetectFastPatternTest53, 1); - /* content fast_pattern tests ^ */ - /* uricontent fast_pattern tests v */ - UtRegisterTest("DetectFastPatternTest54", DetectFastPatternTest54, 1); - UtRegisterTest("DetectFastPatternTest55", DetectFastPatternTest55, 1); - UtRegisterTest("DetectFastPatternTest56", DetectFastPatternTest56, 1); - UtRegisterTest("DetectFastPatternTest57", DetectFastPatternTest57, 1); - UtRegisterTest("DetectFastPatternTest58", DetectFastPatternTest58, 1); - UtRegisterTest("DetectFastPatternTest59", DetectFastPatternTest59, 1); - UtRegisterTest("DetectFastPatternTest60", DetectFastPatternTest60, 1); - UtRegisterTest("DetectFastPatternTest61", DetectFastPatternTest61, 1); - UtRegisterTest("DetectFastPatternTest62", DetectFastPatternTest62, 1); - UtRegisterTest("DetectFastPatternTest63", DetectFastPatternTest63, 1); - UtRegisterTest("DetectFastPatternTest64", DetectFastPatternTest64, 1); - UtRegisterTest("DetectFastPatternTest65", DetectFastPatternTest65, 1); - UtRegisterTest("DetectFastPatternTest66", DetectFastPatternTest66, 1); - UtRegisterTest("DetectFastPatternTest67", DetectFastPatternTest67, 1); - UtRegisterTest("DetectFastPatternTest68", DetectFastPatternTest68, 1); - UtRegisterTest("DetectFastPatternTest69", DetectFastPatternTest69, 1); - UtRegisterTest("DetectFastPatternTest70", DetectFastPatternTest70, 1); - UtRegisterTest("DetectFastPatternTest71", DetectFastPatternTest71, 1); - UtRegisterTest("DetectFastPatternTest72", DetectFastPatternTest72, 1); - UtRegisterTest("DetectFastPatternTest73", DetectFastPatternTest73, 1); - UtRegisterTest("DetectFastPatternTest74", DetectFastPatternTest74, 1); - UtRegisterTest("DetectFastPatternTest75", DetectFastPatternTest75, 1); - UtRegisterTest("DetectFastPatternTest76", DetectFastPatternTest76, 1); - UtRegisterTest("DetectFastPatternTest77", DetectFastPatternTest77, 1); - UtRegisterTest("DetectFastPatternTest78", DetectFastPatternTest78, 1); - UtRegisterTest("DetectFastPatternTest79", DetectFastPatternTest79, 1); - UtRegisterTest("DetectFastPatternTest80", DetectFastPatternTest80, 1); - UtRegisterTest("DetectFastPatternTest81", DetectFastPatternTest81, 1); - UtRegisterTest("DetectFastPatternTest82", DetectFastPatternTest82, 1); - UtRegisterTest("DetectFastPatternTest83", DetectFastPatternTest83, 1); - UtRegisterTest("DetectFastPatternTest84", DetectFastPatternTest84, 1); - UtRegisterTest("DetectFastPatternTest85", DetectFastPatternTest85, 1); - UtRegisterTest("DetectFastPatternTest86", DetectFastPatternTest86, 1); - UtRegisterTest("DetectFastPatternTest87", DetectFastPatternTest87, 1); - UtRegisterTest("DetectFastPatternTest88", DetectFastPatternTest88, 1); - UtRegisterTest("DetectFastPatternTest89", DetectFastPatternTest89, 1); - UtRegisterTest("DetectFastPatternTest90", DetectFastPatternTest90, 1); - UtRegisterTest("DetectFastPatternTest91", DetectFastPatternTest91, 1); - UtRegisterTest("DetectFastPatternTest92", DetectFastPatternTest92, 1); - /* uricontent fast_pattern tests ^ */ - /* http_uri fast_pattern tests v */ - UtRegisterTest("DetectFastPatternTest93", DetectFastPatternTest93, 1); - UtRegisterTest("DetectFastPatternTest94", DetectFastPatternTest94, 1); - UtRegisterTest("DetectFastPatternTest95", DetectFastPatternTest95, 1); - UtRegisterTest("DetectFastPatternTest96", DetectFastPatternTest96, 1); - UtRegisterTest("DetectFastPatternTest97", DetectFastPatternTest97, 1); - UtRegisterTest("DetectFastPatternTest98", DetectFastPatternTest98, 1); - UtRegisterTest("DetectFastPatternTest99", DetectFastPatternTest99, 1); - UtRegisterTest("DetectFastPatternTest100", DetectFastPatternTest100, 1); - UtRegisterTest("DetectFastPatternTest101", DetectFastPatternTest101, 1); - UtRegisterTest("DetectFastPatternTest102", DetectFastPatternTest102, 1); - UtRegisterTest("DetectFastPatternTest103", DetectFastPatternTest103, 1); - UtRegisterTest("DetectFastPatternTest104", DetectFastPatternTest104, 1); - UtRegisterTest("DetectFastPatternTest105", DetectFastPatternTest105, 1); - UtRegisterTest("DetectFastPatternTest106", DetectFastPatternTest106, 1); - UtRegisterTest("DetectFastPatternTest107", DetectFastPatternTest107, 1); - UtRegisterTest("DetectFastPatternTest108", DetectFastPatternTest108, 1); - UtRegisterTest("DetectFastPatternTest109", DetectFastPatternTest109, 1); - UtRegisterTest("DetectFastPatternTest110", DetectFastPatternTest110, 1); - UtRegisterTest("DetectFastPatternTest111", DetectFastPatternTest111, 1); - UtRegisterTest("DetectFastPatternTest112", DetectFastPatternTest112, 1); - UtRegisterTest("DetectFastPatternTest113", DetectFastPatternTest113, 1); - UtRegisterTest("DetectFastPatternTest114", DetectFastPatternTest114, 1); - UtRegisterTest("DetectFastPatternTest115", DetectFastPatternTest115, 1); - UtRegisterTest("DetectFastPatternTest116", DetectFastPatternTest116, 1); - UtRegisterTest("DetectFastPatternTest117", DetectFastPatternTest117, 1); - UtRegisterTest("DetectFastPatternTest118", DetectFastPatternTest118, 1); - UtRegisterTest("DetectFastPatternTest119", DetectFastPatternTest119, 1); - UtRegisterTest("DetectFastPatternTest120", DetectFastPatternTest120, 1); - UtRegisterTest("DetectFastPatternTest121", DetectFastPatternTest121, 1); - UtRegisterTest("DetectFastPatternTest122", DetectFastPatternTest122, 1); - UtRegisterTest("DetectFastPatternTest123", DetectFastPatternTest123, 1); - UtRegisterTest("DetectFastPatternTest124", DetectFastPatternTest124, 1); - UtRegisterTest("DetectFastPatternTest125", DetectFastPatternTest125, 1); - UtRegisterTest("DetectFastPatternTest126", DetectFastPatternTest126, 1); - UtRegisterTest("DetectFastPatternTest127", DetectFastPatternTest127, 1); - UtRegisterTest("DetectFastPatternTest128", DetectFastPatternTest128, 1); - UtRegisterTest("DetectFastPatternTest129", DetectFastPatternTest129, 1); - UtRegisterTest("DetectFastPatternTest130", DetectFastPatternTest130, 1); - UtRegisterTest("DetectFastPatternTest131", DetectFastPatternTest131, 1); - UtRegisterTest("DetectFastPatternTest132", DetectFastPatternTest132, 1); - UtRegisterTest("DetectFastPatternTest133", DetectFastPatternTest133, 1); #endif return; diff --git a/src/detect-http-client-body.c b/src/detect-http-client-body.c index 827b1071d3..d0a5975add 100644 --- a/src/detect-http-client-body.c +++ b/src/detect-http-client-body.c @@ -216,14 +216,6 @@ int DetectHttpClientBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) return -1; } - if (((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) - { - SCLogWarning(SC_WARN_COMPATIBILITY, - "http_client_body cannot be used with \"fast_pattern\" currently." - "Unsetting fast_pattern on this modifier. Signature ==> %s", s->sig_str); - ((DetectContentData *)sm->ctx)->flags &= ~DETECT_CONTENT_FAST_PATTERN; - } - /* http_client_body should not be used with the rawbytes rule */ if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_RAWBYTES) { SCLogError(SC_ERR_INVALID_SIGNATURE, "http_client_body rule can not " diff --git a/src/detect-offset.c b/src/detect-offset.c index bded9abc8e..f986933870 100644 --- a/src/detect-offset.c +++ b/src/detect-offset.c @@ -177,6 +177,20 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) case DETECT_AL_HTTP_CLIENT_BODY: cd = (DetectContentData *)pm->ctx; + if (cd->flags & DETECT_CONTENT_NEGATED) { + if (cd->flags & DETECT_CONTENT_FAST_PATTERN) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " + "negated keyword set along with a fast_pattern"); + goto error; + } + } else { + if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " + "keyword set along with a fast_pattern:only;"); + goto error; + } + } + cd->offset = (uint32_t)atoi(str); if (cd->depth != 0) { if (cd->depth < cd->content_len) { diff --git a/src/detect-within.c b/src/detect-within.c index f6bb73e822..2854157ced 100644 --- a/src/detect-within.c +++ b/src/detect-within.c @@ -396,6 +396,20 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi goto error; } + if (cd->flags & DETECT_CONTENT_NEGATED) { + if (cd->flags & DETECT_CONTENT_FAST_PATTERN) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " + "negated keyword set along with a fast_pattern"); + goto error; + } + } else { + if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " + "keyword set along with a fast_pattern:only;"); + goto error; + } + } + cd->flags |= DETECT_CONTENT_WITHIN; pm = SigMatchGetLastSMFromLists(s, 2, @@ -406,6 +420,14 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi goto error; } + cd = (DetectContentData *)pm->ctx; + if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "Previous keyword " + "has a fast_pattern:only; set. You can't " + "have relative keywords around a fast_pattern " + "only content"); + goto error; + } ((DetectContentData *)pm->ctx)->flags |= DETECT_CONTENT_RELATIVE_NEXT; break; diff --git a/src/detect.c b/src/detect.c index 6c30133f7b..2b1e473c37 100644 --- a/src/detect.c +++ b/src/detect.c @@ -872,6 +872,9 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh Signature *s = NULL; SigMatch *sm = NULL; + det_ctx->de_have_hcbd = TRUE; + det_ctx->de_mpm_scanned_hcbd = FALSE; + SCEnter(); /* No need to perform any detection on this packet, if the the given flag is set.*/ @@ -1306,6 +1309,17 @@ end: PacketPatternCleanup(th_v, det_ctx); //} + if (det_ctx->hcbd_buffers_list_len != 0) { + int i; + for (i = 0; i < det_ctx->hcbd_buffers_list_len; i++) { + if (det_ctx->hcbd_buffers[i] != NULL) + SCFree(det_ctx->hcbd_buffers[i]); + } + SCFree(det_ctx->hcbd_buffers); + det_ctx->hcbd_buffers = NULL; + det_ctx->hcbd_buffers_list_len = 0; + } + /* store the found sgh (or NULL) in the flow to save us from looking it * up again for the next packet. Also return any stream chunk we processed * to the pool. */ @@ -1717,6 +1731,9 @@ static void SigInitStandardMpmFactoryContexts(DetectEngineCtx *de_ctx) de_ctx->sgh_mpm_context_stream = MpmFactoryRegisterMpmCtxProfile("stream", MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); + de_ctx->sgh_mpm_context_hcbd = + MpmFactoryRegisterMpmCtxProfile("hcbd", + MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); de_ctx->sgh_mpm_context_app_proto_detect = MpmFactoryRegisterMpmCtxProfile("app_proto_detect", 0); @@ -3665,6 +3682,12 @@ int SigGroupBuild (DetectEngineCtx *de_ctx) { } //printf("uri- %d\n", mpm_ctx->pattern_cnt); + mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hcbd); + if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { + mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); + } + //printf("hcbd- %d\n", mpm_ctx->pattern_cnt); + mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_stream); if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); diff --git a/src/detect.h b/src/detect.h index aa7f6d0d1d..4bc067a81f 100644 --- a/src/detect.h +++ b/src/detect.h @@ -236,8 +236,10 @@ typedef struct DetectPort_ { #define SIG_FLAG_MPM_STREAM_NEG 0x02000000 #define SIG_FLAG_MPM_URICONTENT 0x04000000 #define SIG_FLAG_MPM_URICONTENT_NEG 0x08000000 +#define SIG_FLAG_MPM_HCBDCONTENT 0x10000000 +#define SIG_FLAG_MPM_HCBDCONTENT_NEG 0x20000000 -#define SIG_FLAG_HAS_NO_PKT_AND_STREAM_CONTENT 0x10000000 +#define SIG_FLAG_HAS_NO_PKT_AND_STREAM_CONTENT 0x40000000 /* signature mask flags */ #define SIG_MASK_REQUIRE_PAYLOAD 0x01 @@ -353,6 +355,7 @@ typedef struct Signature_ { */ /** pattern in the mpm matcher */ PatIntId mpm_uripattern_id; + PatIntId mpm_hcbdpattern_id; /* the fast pattern added from this signature */ SigMatch *mpm_sm; @@ -615,6 +618,7 @@ typedef struct DetectEngineCtx_ { int32_t sgh_mpm_context_packet; int32_t sgh_mpm_context_stream; int32_t sgh_mpm_context_uri; + int32_t sgh_mpm_context_hcbd; int32_t sgh_mpm_context_app_proto_detect; /** sgh for signatures that match against invalid packets. In those cases @@ -658,6 +662,14 @@ typedef struct DetectionEngineThreadCtx_ { char de_have_httpuri; char de_mpm_scanned_uri; + /* detectione engine context for hcbd mpm */ + char de_have_hcbd; + char de_mpm_scanned_hcbd; + + uint8_t **hcbd_buffers; + uint32_t *hcbd_buffers_len; + uint16_t hcbd_buffers_list_len; + /** id for alert counter */ uint16_t counter_alerts; @@ -745,14 +757,15 @@ typedef struct SigTableElmt_ { char *name; } SigTableElmt; -#define SIG_GROUP_HAVECONTENT 0x01 -#define SIG_GROUP_HAVEURICONTENT 0x02 -#define SIG_GROUP_HAVESTREAMCONTENT 0x04 -#define SIG_GROUP_HEAD_MPM_COPY 0x08 -#define SIG_GROUP_HEAD_MPM_URI_COPY 0x10 -#define SIG_GROUP_HEAD_MPM_STREAM_COPY 0x20 -#define SIG_GROUP_HEAD_FREE 0x40 -#define SIG_GROUP_HEAD_REFERENCED 0x80 /**< sgh is being referenced by others, don't clear */ +#define SIG_GROUP_HAVECONTENT 0x0001 +#define SIG_GROUP_HAVEURICONTENT 0x0002 +#define SIG_GROUP_HAVESTREAMCONTENT 0x0004 +#define SIG_GROUP_HAVEHCBDCONTENT 0x0008 +#define SIG_GROUP_HEAD_MPM_COPY 0x0010 +#define SIG_GROUP_HEAD_MPM_URI_COPY 0x0020 +#define SIG_GROUP_HEAD_MPM_STREAM_COPY 0x0040 +#define SIG_GROUP_HEAD_FREE 0x0080 +#define SIG_GROUP_HEAD_REFERENCED 0x0100 /**< sgh is being referenced by others, don't clear */ typedef struct SigGroupHeadInitData_ { /* list of content containers @@ -778,8 +791,7 @@ typedef struct SigGroupHeadInitData_ { /** \brief Container for matching data for a signature group */ typedef struct SigGroupHead_ { - uint8_t flags; - uint8_t pad0; + uint16_t flags; /* number of sigs in this head */ SigIntId sig_cnt; @@ -795,6 +807,7 @@ typedef struct SigGroupHead_ { MpmCtx *mpm_ctx; MpmCtx *mpm_stream_ctx; MpmCtx *mpm_uri_ctx; + MpmCtx *mpm_hcbd_ctx; uint16_t mpm_uricontent_maxlen; uint16_t pad1; #if __WORDSIZE == 64