|
|
@ -133,7 +133,6 @@ static int DetectDnsQueryTest01(void)
|
|
|
|
0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
|
|
|
|
0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
|
|
|
|
0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
|
|
|
|
0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
|
|
|
|
0x00, 0x10, 0x00, 0x01, };
|
|
|
|
0x00, 0x10, 0x00, 0x01, };
|
|
|
|
int result = 0;
|
|
|
|
|
|
|
|
Flow f;
|
|
|
|
Flow f;
|
|
|
|
DNSState *dns_state = NULL;
|
|
|
|
DNSState *dns_state = NULL;
|
|
|
|
Packet *p = NULL;
|
|
|
|
Packet *p = NULL;
|
|
|
@ -160,18 +159,14 @@ static int DetectDnsQueryTest01(void)
|
|
|
|
f.alproto = ALPROTO_DNS;
|
|
|
|
f.alproto = ALPROTO_DNS;
|
|
|
|
|
|
|
|
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
if (de_ctx == NULL) {
|
|
|
|
FAIL_IF_NULL(de_ctx);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
|
|
|
|
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"dns_query; content:\"google\"; nocase; sid:1;)");
|
|
|
|
"dns_query; content:\"google\"; nocase; sid:1;)");
|
|
|
|
if (s == NULL) {
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
@ -182,27 +177,21 @@ static int DetectDnsQueryTest01(void)
|
|
|
|
if (r != 0) {
|
|
|
|
if (r != 0) {
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
|
dns_state = f.alstate;
|
|
|
|
dns_state = f.alstate;
|
|
|
|
if (dns_state == NULL) {
|
|
|
|
FAIL_IF_NULL(dns_state);
|
|
|
|
printf("no dns state: ");
|
|
|
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* do detect */
|
|
|
|
/* do detect */
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
|
|
|
|
|
|
|
|
|
|
|
|
if (!(PacketAlertCheck(p, 1))) {
|
|
|
|
if (!(PacketAlertCheck(p, 1))) {
|
|
|
|
printf("sig 1 didn't alert, but it should have: ");
|
|
|
|
printf("sig 1 didn't alert, but it should have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
result = 1;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
|
|
|
|
if (alp_tctx != NULL)
|
|
|
|
if (alp_tctx != NULL)
|
|
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
|
|
if (det_ctx != NULL)
|
|
|
|
if (det_ctx != NULL)
|
|
|
@ -214,7 +203,7 @@ end:
|
|
|
|
|
|
|
|
|
|
|
|
FLOW_DESTROY(&f);
|
|
|
|
FLOW_DESTROY(&f);
|
|
|
|
UTHFreePacket(p);
|
|
|
|
UTHFreePacket(p);
|
|
|
|
return result;
|
|
|
|
PASS;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/** \test multi tx google.(com|net) query matching */
|
|
|
|
/** \test multi tx google.(com|net) query matching */
|
|
|
@ -249,7 +238,6 @@ static int DetectDnsQueryTest02(void)
|
|
|
|
0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
|
|
|
|
0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
|
|
|
|
0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
|
|
|
|
0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
|
|
|
|
0x00, 0x10, 0x00, 0x01, };
|
|
|
|
0x00, 0x10, 0x00, 0x01, };
|
|
|
|
int result = 0;
|
|
|
|
|
|
|
|
Flow f;
|
|
|
|
Flow f;
|
|
|
|
DNSState *dns_state = NULL;
|
|
|
|
DNSState *dns_state = NULL;
|
|
|
|
Packet *p1 = NULL, *p2 = NULL, *p3 = NULL;
|
|
|
|
Packet *p1 = NULL, *p2 = NULL, *p3 = NULL;
|
|
|
@ -293,24 +281,18 @@ static int DetectDnsQueryTest02(void)
|
|
|
|
p3->pcap_cnt = 3;
|
|
|
|
p3->pcap_cnt = 3;
|
|
|
|
|
|
|
|
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
if (de_ctx == NULL) {
|
|
|
|
FAIL_IF_NULL(de_ctx);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
|
|
|
|
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"dns_query; content:\"google.com\"; nocase; sid:1;)");
|
|
|
|
"dns_query; content:\"google.com\"; nocase; sid:1;)");
|
|
|
|
if (s == NULL) {
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"dns_query; content:\"google.net\"; nocase; sid:2;)");
|
|
|
|
"dns_query; content:\"google.net\"; nocase; sid:2;)");
|
|
|
|
if (s == NULL) {
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
@ -321,26 +303,23 @@ static int DetectDnsQueryTest02(void)
|
|
|
|
if (r != 0) {
|
|
|
|
if (r != 0) {
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
|
dns_state = f.alstate;
|
|
|
|
dns_state = f.alstate;
|
|
|
|
if (dns_state == NULL) {
|
|
|
|
FAIL_IF_NULL(dns_state);
|
|
|
|
printf("no dns state: ");
|
|
|
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* do detect */
|
|
|
|
/* do detect */
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
|
|
|
|
|
|
|
|
|
|
|
|
if (!(PacketAlertCheck(p1, 1))) {
|
|
|
|
if (!(PacketAlertCheck(p1, 1))) {
|
|
|
|
printf("(p1) sig 1 didn't alert, but it should have: ");
|
|
|
|
printf("(p1) sig 1 didn't alert, but it should have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (PacketAlertCheck(p1, 2)) {
|
|
|
|
if (PacketAlertCheck(p1, 2)) {
|
|
|
|
printf("(p1) sig 2 did alert, but it should not have: ");
|
|
|
|
printf("(p1) sig 2 did alert, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
@ -349,7 +328,7 @@ static int DetectDnsQueryTest02(void)
|
|
|
|
if (r != 0) {
|
|
|
|
if (r != 0) {
|
|
|
|
printf("toserver client 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toserver client 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
@ -358,11 +337,11 @@ static int DetectDnsQueryTest02(void)
|
|
|
|
|
|
|
|
|
|
|
|
if (PacketAlertCheck(p2, 1)) {
|
|
|
|
if (PacketAlertCheck(p2, 1)) {
|
|
|
|
printf("(p2) sig 1 alerted, but it should not have: ");
|
|
|
|
printf("(p2) sig 1 alerted, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (PacketAlertCheck(p2, 2)) {
|
|
|
|
if (PacketAlertCheck(p2, 2)) {
|
|
|
|
printf("(p2) sig 2 alerted, but it should not have: ");
|
|
|
|
printf("(p2) sig 2 alerted, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
@ -371,7 +350,7 @@ static int DetectDnsQueryTest02(void)
|
|
|
|
if (r != 0) {
|
|
|
|
if (r != 0) {
|
|
|
|
printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
@ -380,16 +359,13 @@ static int DetectDnsQueryTest02(void)
|
|
|
|
|
|
|
|
|
|
|
|
if (PacketAlertCheck(p3, 1)) {
|
|
|
|
if (PacketAlertCheck(p3, 1)) {
|
|
|
|
printf("(p3) sig 1 alerted, but it should not have: ");
|
|
|
|
printf("(p3) sig 1 alerted, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (!(PacketAlertCheck(p3, 2))) {
|
|
|
|
if (!(PacketAlertCheck(p3, 2))) {
|
|
|
|
printf("(p3) sig 2 didn't alert, but it should have: ");
|
|
|
|
printf("(p3) sig 2 didn't alert, but it should have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
result = 1;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
|
|
|
|
if (alp_tctx != NULL)
|
|
|
|
if (alp_tctx != NULL)
|
|
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
|
|
if (det_ctx != NULL)
|
|
|
|
if (det_ctx != NULL)
|
|
|
@ -403,7 +379,7 @@ end:
|
|
|
|
UTHFreePacket(p1);
|
|
|
|
UTHFreePacket(p1);
|
|
|
|
UTHFreePacket(p2);
|
|
|
|
UTHFreePacket(p2);
|
|
|
|
UTHFreePacket(p3);
|
|
|
|
UTHFreePacket(p3);
|
|
|
|
return result;
|
|
|
|
PASS;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/** \test simple google.com query matching (TCP) */
|
|
|
|
/** \test simple google.com query matching (TCP) */
|
|
|
@ -416,7 +392,6 @@ static int DetectDnsQueryTest03(void)
|
|
|
|
0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
|
|
|
|
0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
|
|
|
|
0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
|
|
|
|
0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
|
|
|
|
0x00, 0x10, 0x00, 0x01, };
|
|
|
|
0x00, 0x10, 0x00, 0x01, };
|
|
|
|
int result = 0;
|
|
|
|
|
|
|
|
Flow f;
|
|
|
|
Flow f;
|
|
|
|
DNSState *dns_state = NULL;
|
|
|
|
DNSState *dns_state = NULL;
|
|
|
|
Packet *p = NULL;
|
|
|
|
Packet *p = NULL;
|
|
|
@ -448,18 +423,14 @@ static int DetectDnsQueryTest03(void)
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
|
|
|
|
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
if (de_ctx == NULL) {
|
|
|
|
FAIL_IF_NULL(de_ctx);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
|
|
|
|
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"content:\"google\"; nocase; dns_query; sid:1;)");
|
|
|
|
"content:\"google\"; nocase; dns_query; sid:1;)");
|
|
|
|
if (s == NULL) {
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
@ -470,27 +441,21 @@ static int DetectDnsQueryTest03(void)
|
|
|
|
if (r != 0) {
|
|
|
|
if (r != 0) {
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
|
dns_state = f.alstate;
|
|
|
|
dns_state = f.alstate;
|
|
|
|
if (dns_state == NULL) {
|
|
|
|
FAIL_IF_NULL(dns_state);
|
|
|
|
printf("no dns state: ");
|
|
|
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* do detect */
|
|
|
|
/* do detect */
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
|
|
|
|
|
|
|
|
|
|
|
|
if (!(PacketAlertCheck(p, 1))) {
|
|
|
|
if (!(PacketAlertCheck(p, 1))) {
|
|
|
|
printf("sig 1 didn't alert, but it should have: ");
|
|
|
|
printf("sig 1 didn't alert, but it should have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
result = 1;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
|
|
|
|
if (alp_tctx != NULL)
|
|
|
|
if (alp_tctx != NULL)
|
|
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
|
|
if (det_ctx != NULL)
|
|
|
|
if (det_ctx != NULL)
|
|
|
@ -503,7 +468,7 @@ end:
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
|
|
StreamTcpFreeConfig(TRUE);
|
|
|
|
FLOW_DESTROY(&f);
|
|
|
|
FLOW_DESTROY(&f);
|
|
|
|
UTHFreePacket(p);
|
|
|
|
UTHFreePacket(p);
|
|
|
|
return result;
|
|
|
|
PASS;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/** \test simple google.com query matching (TCP splicing) */
|
|
|
|
/** \test simple google.com query matching (TCP splicing) */
|
|
|
@ -516,7 +481,6 @@ static int DetectDnsQueryTest04(void)
|
|
|
|
uint8_t buf2[] = { 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
|
|
|
|
uint8_t buf2[] = { 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
|
|
|
|
0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
|
|
|
|
0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
|
|
|
|
0x00, 0x10, 0x00, 0x01, };
|
|
|
|
0x00, 0x10, 0x00, 0x01, };
|
|
|
|
int result = 0;
|
|
|
|
|
|
|
|
Flow f;
|
|
|
|
Flow f;
|
|
|
|
DNSState *dns_state = NULL;
|
|
|
|
DNSState *dns_state = NULL;
|
|
|
|
Packet *p1 = NULL, *p2 = NULL;
|
|
|
|
Packet *p1 = NULL, *p2 = NULL;
|
|
|
@ -555,18 +519,14 @@ static int DetectDnsQueryTest04(void)
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
|
|
|
|
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
if (de_ctx == NULL) {
|
|
|
|
FAIL_IF_NULL(de_ctx);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
|
|
|
|
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"dns_query; content:\"google\"; nocase; sid:1;)");
|
|
|
|
"dns_query; content:\"google\"; nocase; sid:1;)");
|
|
|
|
if (s == NULL) {
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
@ -577,31 +537,28 @@ static int DetectDnsQueryTest04(void)
|
|
|
|
if (r != 0) {
|
|
|
|
if (r != 0) {
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
|
dns_state = f.alstate;
|
|
|
|
dns_state = f.alstate;
|
|
|
|
if (dns_state == NULL) {
|
|
|
|
FAIL_IF_NULL(dns_state);
|
|
|
|
printf("no dns state: ");
|
|
|
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* do detect */
|
|
|
|
/* do detect */
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
|
|
|
|
|
|
|
|
|
|
|
|
if (PacketAlertCheck(p1, 1)) {
|
|
|
|
if (PacketAlertCheck(p1, 1)) {
|
|
|
|
printf("sig 1 alerted, but it should not have: ");
|
|
|
|
printf("sig 1 alerted, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER,
|
|
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER,
|
|
|
|
buf2, sizeof(buf2));
|
|
|
|
buf2, sizeof(buf2));
|
|
|
|
if (r != 0) {
|
|
|
|
if (r != 0) {
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0\n", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
@ -610,12 +567,9 @@ static int DetectDnsQueryTest04(void)
|
|
|
|
|
|
|
|
|
|
|
|
if (!(PacketAlertCheck(p2, 1))) {
|
|
|
|
if (!(PacketAlertCheck(p2, 1))) {
|
|
|
|
printf("sig 1 didn't alert, but it should have: ");
|
|
|
|
printf("sig 1 didn't alert, but it should have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
result = 1;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
|
|
|
|
if (alp_tctx != NULL)
|
|
|
|
if (alp_tctx != NULL)
|
|
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
|
|
if (det_ctx != NULL)
|
|
|
|
if (det_ctx != NULL)
|
|
|
@ -629,7 +583,7 @@ end:
|
|
|
|
FLOW_DESTROY(&f);
|
|
|
|
FLOW_DESTROY(&f);
|
|
|
|
UTHFreePacket(p1);
|
|
|
|
UTHFreePacket(p1);
|
|
|
|
UTHFreePacket(p2);
|
|
|
|
UTHFreePacket(p2);
|
|
|
|
return result;
|
|
|
|
PASS;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/** \test simple google.com query matching (TCP splicing) */
|
|
|
|
/** \test simple google.com query matching (TCP splicing) */
|
|
|
@ -668,7 +622,6 @@ static int DetectDnsQueryTest05(void)
|
|
|
|
0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
|
|
|
|
0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
|
|
|
|
0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
|
|
|
|
0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
|
|
|
|
0x00, 0x10, 0x00, 0x01, };
|
|
|
|
0x00, 0x10, 0x00, 0x01, };
|
|
|
|
int result = 0;
|
|
|
|
|
|
|
|
Flow f;
|
|
|
|
Flow f;
|
|
|
|
DNSState *dns_state = NULL;
|
|
|
|
DNSState *dns_state = NULL;
|
|
|
|
Packet *p1 = NULL, *p2 = NULL, *p3 = NULL, *p4 = NULL;
|
|
|
|
Packet *p1 = NULL, *p2 = NULL, *p3 = NULL, *p4 = NULL;
|
|
|
@ -721,24 +674,18 @@ static int DetectDnsQueryTest05(void)
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
StreamTcpInitConfig(TRUE);
|
|
|
|
|
|
|
|
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
if (de_ctx == NULL) {
|
|
|
|
FAIL_IF_NULL(de_ctx);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
|
|
|
|
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"dns_query; content:\"google.com\"; nocase; sid:1;)");
|
|
|
|
"dns_query; content:\"google.com\"; nocase; sid:1;)");
|
|
|
|
if (s == NULL) {
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"dns_query; content:\"google.net\"; nocase; sid:2;)");
|
|
|
|
"dns_query; content:\"google.net\"; nocase; sid:2;)");
|
|
|
|
if (s == NULL) {
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
@ -749,26 +696,23 @@ static int DetectDnsQueryTest05(void)
|
|
|
|
if (r != 0) {
|
|
|
|
if (r != 0) {
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
|
dns_state = f.alstate;
|
|
|
|
dns_state = f.alstate;
|
|
|
|
if (dns_state == NULL) {
|
|
|
|
FAIL_IF_NULL(dns_state);
|
|
|
|
printf("no dns state: ");
|
|
|
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* do detect */
|
|
|
|
/* do detect */
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
|
|
|
|
|
|
|
|
|
|
|
|
if (PacketAlertCheck(p1, 1)) {
|
|
|
|
if (PacketAlertCheck(p1, 1)) {
|
|
|
|
printf("(p1) sig 1 alerted, but it should not have: ");
|
|
|
|
printf("(p1) sig 1 alerted, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (PacketAlertCheck(p1, 2)) {
|
|
|
|
if (PacketAlertCheck(p1, 2)) {
|
|
|
|
printf("(p1) sig 2 did alert, but it should not have: ");
|
|
|
|
printf("(p1) sig 2 did alert, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
@ -777,7 +721,7 @@ static int DetectDnsQueryTest05(void)
|
|
|
|
if (r != 0) {
|
|
|
|
if (r != 0) {
|
|
|
|
printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
@ -786,11 +730,11 @@ static int DetectDnsQueryTest05(void)
|
|
|
|
|
|
|
|
|
|
|
|
if (!(PacketAlertCheck(p2, 1))) {
|
|
|
|
if (!(PacketAlertCheck(p2, 1))) {
|
|
|
|
printf("sig 1 didn't alert, but it should have: ");
|
|
|
|
printf("sig 1 didn't alert, but it should have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (PacketAlertCheck(p2, 2)) {
|
|
|
|
if (PacketAlertCheck(p2, 2)) {
|
|
|
|
printf("(p2) sig 2 did alert, but it should not have: ");
|
|
|
|
printf("(p2) sig 2 did alert, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
@ -799,7 +743,7 @@ static int DetectDnsQueryTest05(void)
|
|
|
|
if (r != 0) {
|
|
|
|
if (r != 0) {
|
|
|
|
printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
@ -808,11 +752,11 @@ static int DetectDnsQueryTest05(void)
|
|
|
|
|
|
|
|
|
|
|
|
if (PacketAlertCheck(p3, 1)) {
|
|
|
|
if (PacketAlertCheck(p3, 1)) {
|
|
|
|
printf("sig 1 did alert, but it should not have: ");
|
|
|
|
printf("sig 1 did alert, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (PacketAlertCheck(p3, 2)) {
|
|
|
|
if (PacketAlertCheck(p3, 2)) {
|
|
|
|
printf("(p3) sig 2 did alert, but it should not have: ");
|
|
|
|
printf("(p3) sig 2 did alert, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
@ -821,7 +765,7 @@ static int DetectDnsQueryTest05(void)
|
|
|
|
if (r != 0) {
|
|
|
|
if (r != 0) {
|
|
|
|
printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
@ -830,16 +774,13 @@ static int DetectDnsQueryTest05(void)
|
|
|
|
|
|
|
|
|
|
|
|
if (PacketAlertCheck(p4, 1)) {
|
|
|
|
if (PacketAlertCheck(p4, 1)) {
|
|
|
|
printf("(p4) sig 1 did alert, but it should not have: ");
|
|
|
|
printf("(p4) sig 1 did alert, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (!(PacketAlertCheck(p4, 2))) {
|
|
|
|
if (!(PacketAlertCheck(p4, 2))) {
|
|
|
|
printf("sig 1 didn't alert, but it should have: ");
|
|
|
|
printf("sig 1 didn't alert, but it should have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
result = 1;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
|
|
|
|
if (alp_tctx != NULL)
|
|
|
|
if (alp_tctx != NULL)
|
|
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
|
|
if (det_ctx != NULL)
|
|
|
|
if (det_ctx != NULL)
|
|
|
@ -855,7 +796,7 @@ end:
|
|
|
|
UTHFreePacket(p2);
|
|
|
|
UTHFreePacket(p2);
|
|
|
|
UTHFreePacket(p3);
|
|
|
|
UTHFreePacket(p3);
|
|
|
|
UTHFreePacket(p4);
|
|
|
|
UTHFreePacket(p4);
|
|
|
|
return result;
|
|
|
|
PASS;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/** \test simple google.com query matching, pcre */
|
|
|
|
/** \test simple google.com query matching, pcre */
|
|
|
@ -867,7 +808,6 @@ static int DetectDnsQueryTest06(void)
|
|
|
|
0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
|
|
|
|
0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
|
|
|
|
0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
|
|
|
|
0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
|
|
|
|
0x00, 0x10, 0x00, 0x01, };
|
|
|
|
0x00, 0x10, 0x00, 0x01, };
|
|
|
|
int result = 0;
|
|
|
|
|
|
|
|
Flow f;
|
|
|
|
Flow f;
|
|
|
|
DNSState *dns_state = NULL;
|
|
|
|
DNSState *dns_state = NULL;
|
|
|
|
Packet *p = NULL;
|
|
|
|
Packet *p = NULL;
|
|
|
@ -894,9 +834,7 @@ static int DetectDnsQueryTest06(void)
|
|
|
|
f.alproto = ALPROTO_DNS;
|
|
|
|
f.alproto = ALPROTO_DNS;
|
|
|
|
|
|
|
|
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
if (de_ctx == NULL) {
|
|
|
|
FAIL_IF_NULL(de_ctx);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
|
|
|
|
|
|
|
@ -904,17 +842,12 @@ static int DetectDnsQueryTest06(void)
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"dns_query; content:\"google\"; nocase; "
|
|
|
|
"dns_query; content:\"google\"; nocase; "
|
|
|
|
"pcre:\"/google\\.com$/i\"; sid:1;)");
|
|
|
|
"pcre:\"/google\\.com$/i\"; sid:1;)");
|
|
|
|
if (s == NULL) {
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"dns_query; content:\"google\"; nocase; "
|
|
|
|
"dns_query; content:\"google\"; nocase; "
|
|
|
|
"pcre:\"/^\\.[a-z]{2,3}$/iR\"; sid:2;)");
|
|
|
|
"pcre:\"/^\\.[a-z]{2,3}$/iR\"; sid:2;)");
|
|
|
|
if (s == NULL) {
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
@ -925,31 +858,25 @@ static int DetectDnsQueryTest06(void)
|
|
|
|
if (r != 0) {
|
|
|
|
if (r != 0) {
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
|
dns_state = f.alstate;
|
|
|
|
dns_state = f.alstate;
|
|
|
|
if (dns_state == NULL) {
|
|
|
|
FAIL_IF_NULL(dns_state);
|
|
|
|
printf("no dns state: ");
|
|
|
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* do detect */
|
|
|
|
/* do detect */
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
|
|
|
|
|
|
|
|
|
|
|
|
if (!(PacketAlertCheck(p, 1))) {
|
|
|
|
if (!(PacketAlertCheck(p, 1))) {
|
|
|
|
printf("sig 1 didn't alert, but it should have: ");
|
|
|
|
printf("sig 1 didn't alert, but it should have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (!(PacketAlertCheck(p, 2))) {
|
|
|
|
if (!(PacketAlertCheck(p, 2))) {
|
|
|
|
printf("sig 2 didn't alert, but it should have: ");
|
|
|
|
printf("sig 2 didn't alert, but it should have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
result = 1;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
|
|
|
|
if (alp_tctx != NULL)
|
|
|
|
if (alp_tctx != NULL)
|
|
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
|
|
if (det_ctx != NULL)
|
|
|
|
if (det_ctx != NULL)
|
|
|
@ -961,7 +888,7 @@ end:
|
|
|
|
|
|
|
|
|
|
|
|
FLOW_DESTROY(&f);
|
|
|
|
FLOW_DESTROY(&f);
|
|
|
|
UTHFreePacket(p);
|
|
|
|
UTHFreePacket(p);
|
|
|
|
return result;
|
|
|
|
PASS;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/** \test multi tx google.(com|net) query matching +
|
|
|
|
/** \test multi tx google.(com|net) query matching +
|
|
|
@ -997,7 +924,6 @@ static int DetectDnsQueryTest07(void)
|
|
|
|
0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
|
|
|
|
0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
|
|
|
|
0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
|
|
|
|
0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
|
|
|
|
0x00, 0x10, 0x00, 0x01, };
|
|
|
|
0x00, 0x10, 0x00, 0x01, };
|
|
|
|
int result = 0;
|
|
|
|
|
|
|
|
Flow f;
|
|
|
|
Flow f;
|
|
|
|
DNSState *dns_state = NULL;
|
|
|
|
DNSState *dns_state = NULL;
|
|
|
|
Packet *p1 = NULL, *p2 = NULL, *p3 = NULL;
|
|
|
|
Packet *p1 = NULL, *p2 = NULL, *p3 = NULL;
|
|
|
@ -1041,30 +967,22 @@ static int DetectDnsQueryTest07(void)
|
|
|
|
p3->pcap_cnt = 3;
|
|
|
|
p3->pcap_cnt = 3;
|
|
|
|
|
|
|
|
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
if (de_ctx == NULL) {
|
|
|
|
FAIL_IF_NULL(de_ctx);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
|
|
|
|
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"dns_query; content:\"google.com\"; nocase; sid:1;)");
|
|
|
|
"dns_query; content:\"google.com\"; nocase; sid:1;)");
|
|
|
|
if (s == NULL) {
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"(msg:\"Test dns_query option\"; "
|
|
|
|
"dns_query; content:\"google.net\"; nocase; sid:2;)");
|
|
|
|
"dns_query; content:\"google.net\"; nocase; sid:2;)");
|
|
|
|
if (s == NULL) {
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any "
|
|
|
|
"(msg:\"Test Z flag event\"; "
|
|
|
|
"(msg:\"Test Z flag event\"; "
|
|
|
|
"app-layer-event:dns.z_flag_set; sid:3;)");
|
|
|
|
"app-layer-event:dns.z_flag_set; sid:3;)");
|
|
|
|
if (s == NULL) {
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
@ -1075,35 +993,32 @@ static int DetectDnsQueryTest07(void)
|
|
|
|
if (r != 0) {
|
|
|
|
if (r != 0) {
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
|
dns_state = f.alstate;
|
|
|
|
dns_state = f.alstate;
|
|
|
|
if (dns_state == NULL) {
|
|
|
|
FAIL_IF_NULL(dns_state);
|
|
|
|
printf("no dns state: ");
|
|
|
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* do detect */
|
|
|
|
/* do detect */
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
|
|
|
|
|
|
|
|
|
|
|
|
if (!(PacketAlertCheck(p1, 1))) {
|
|
|
|
if (!(PacketAlertCheck(p1, 1))) {
|
|
|
|
printf("(p1) sig 1 didn't alert, but it should have: ");
|
|
|
|
printf("(p1) sig 1 didn't alert, but it should have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (PacketAlertCheck(p1, 2)) {
|
|
|
|
if (PacketAlertCheck(p1, 2)) {
|
|
|
|
printf("(p1) sig 2 did alert, but it should not have: ");
|
|
|
|
printf("(p1) sig 2 did alert, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOCLIENT,
|
|
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOCLIENT,
|
|
|
|
buf2, sizeof(buf2));
|
|
|
|
buf2, sizeof(buf2));
|
|
|
|
if (r != -1) {
|
|
|
|
if (r != -1) {
|
|
|
|
printf("toserver client 1 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toserver client 1 returned %" PRId32 ", expected -1\n", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
@ -1112,15 +1027,15 @@ static int DetectDnsQueryTest07(void)
|
|
|
|
|
|
|
|
|
|
|
|
if (PacketAlertCheck(p2, 1)) {
|
|
|
|
if (PacketAlertCheck(p2, 1)) {
|
|
|
|
printf("(p2) sig 1 alerted, but it should not have: ");
|
|
|
|
printf("(p2) sig 1 alerted, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (PacketAlertCheck(p2, 2)) {
|
|
|
|
if (PacketAlertCheck(p2, 2)) {
|
|
|
|
printf("(p2) sig 2 alerted, but it should not have: ");
|
|
|
|
printf("(p2) sig 2 alerted, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (!(PacketAlertCheck(p2, 3))) {
|
|
|
|
if (!(PacketAlertCheck(p2, 3))) {
|
|
|
|
printf("(p2) sig 3 didn't alert, but it should have: ");
|
|
|
|
printf("(p2) sig 3 didn't alert, but it should have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
|
FLOWLOCK_WRLOCK(&f);
|
|
|
@ -1129,7 +1044,7 @@ static int DetectDnsQueryTest07(void)
|
|
|
|
if (r != 0) {
|
|
|
|
if (r != 0) {
|
|
|
|
printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
FLOWLOCK_UNLOCK(&f);
|
|
|
|
|
|
|
|
|
|
|
@ -1138,11 +1053,11 @@ static int DetectDnsQueryTest07(void)
|
|
|
|
|
|
|
|
|
|
|
|
if (PacketAlertCheck(p3, 1)) {
|
|
|
|
if (PacketAlertCheck(p3, 1)) {
|
|
|
|
printf("(p3) sig 1 alerted, but it should not have: ");
|
|
|
|
printf("(p3) sig 1 alerted, but it should not have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (!(PacketAlertCheck(p3, 2))) {
|
|
|
|
if (!(PacketAlertCheck(p3, 2))) {
|
|
|
|
printf("(p3) sig 2 didn't alert, but it should have: ");
|
|
|
|
printf("(p3) sig 2 didn't alert, but it should have: ");
|
|
|
|
goto end;
|
|
|
|
FAIL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/** \todo should not alert, bug #839
|
|
|
|
/** \todo should not alert, bug #839
|
|
|
|
if (PacketAlertCheck(p3, 3)) {
|
|
|
|
if (PacketAlertCheck(p3, 3)) {
|
|
|
@ -1150,9 +1065,7 @@ static int DetectDnsQueryTest07(void)
|
|
|
|
goto end;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
*/
|
|
|
|
*/
|
|
|
|
result = 1;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
|
|
|
|
if (alp_tctx != NULL)
|
|
|
|
if (alp_tctx != NULL)
|
|
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
|
|
AppLayerParserThreadCtxFree(alp_tctx);
|
|
|
|
if (det_ctx != NULL)
|
|
|
|
if (det_ctx != NULL)
|
|
|
@ -1166,7 +1079,7 @@ end:
|
|
|
|
UTHFreePacket(p1);
|
|
|
|
UTHFreePacket(p1);
|
|
|
|
UTHFreePacket(p2);
|
|
|
|
UTHFreePacket(p2);
|
|
|
|
UTHFreePacket(p3);
|
|
|
|
UTHFreePacket(p3);
|
|
|
|
return result;
|
|
|
|
PASS;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static int DetectDnsQueryIsdataatParseTest(void)
|
|
|
|
static int DetectDnsQueryIsdataatParseTest(void)
|
|
|
|