|
|
|
@ -1896,8 +1896,6 @@ static int DetectIPProtoTestSig1(void)
|
|
|
|
|
|
|
|
|
|
|
|
static int DetectIPProtoTestSig2(void)
|
|
|
|
static int DetectIPProtoTestSig2(void)
|
|
|
|
{
|
|
|
|
{
|
|
|
|
int result = 0;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
uint8_t raw_eth[] = {
|
|
|
|
uint8_t raw_eth[] = {
|
|
|
|
0x01, 0x00, 0x5e, 0x00, 0x00, 0x0d, 0x00, 0x26,
|
|
|
|
0x01, 0x00, 0x5e, 0x00, 0x00, 0x0d, 0x00, 0x26,
|
|
|
|
0x88, 0x61, 0x3a, 0x80, 0x08, 0x00, 0x45, 0xc0,
|
|
|
|
0x88, 0x61, 0x3a, 0x80, 0x08, 0x00, 0x45, 0xc0,
|
|
|
|
@ -1911,8 +1909,7 @@ static int DetectIPProtoTestSig2(void)
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
Packet *p = PacketGetFromAlloc();
|
|
|
|
Packet *p = PacketGetFromAlloc();
|
|
|
|
if (unlikely(p == NULL))
|
|
|
|
FAIL_IF_NULL(p);
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
DecodeThreadVars dtv;
|
|
|
|
DecodeThreadVars dtv;
|
|
|
|
ThreadVars th_v;
|
|
|
|
ThreadVars th_v;
|
|
|
|
@ -1926,57 +1923,27 @@ static int DetectIPProtoTestSig2(void)
|
|
|
|
DecodeEthernet(&th_v, &dtv, p, raw_eth, sizeof(raw_eth));
|
|
|
|
DecodeEthernet(&th_v, &dtv, p, raw_eth, sizeof(raw_eth));
|
|
|
|
|
|
|
|
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
if (de_ctx == NULL) {
|
|
|
|
FAIL_IF_NULL(de_ctx);
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->mpm_matcher = mpm_default_matcher;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
|
|
|
|
|
|
|
|
de_ctx->sig_list = SigInit(de_ctx,
|
|
|
|
Signature *s = DetectEngineAppendSig(de_ctx,
|
|
|
|
"alert ip any any -> any any (msg:\"Check ipproto usage\"; "
|
|
|
|
"alert ip any any -> any any (msg:\"Check ipproto usage\"; "
|
|
|
|
"ip_proto:!103; sid:1;)");
|
|
|
|
"ip_proto:!103; sid:1;)");
|
|
|
|
if (de_ctx->sig_list == NULL) {
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
result = 0;
|
|
|
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
|
|
|
|
|
|
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
|
|
|
if (PacketAlertCheck(p, 1) == 0) {
|
|
|
|
FAIL_IF(PacketAlertCheck(p, 1));
|
|
|
|
result = 1;
|
|
|
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
} else {
|
|
|
|
|
|
|
|
result = 0;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SigGroupCleanup(de_ctx);
|
|
|
|
|
|
|
|
SigCleanSignatures(de_ctx);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
|
|
|
|
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
|
|
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
|
|
|
|
PacketFree(p);
|
|
|
|
FlowShutdown();
|
|
|
|
FlowShutdown();
|
|
|
|
|
|
|
|
StatsThreadCleanup(&th_v);
|
|
|
|
SCFree(p);
|
|
|
|
PASS;
|
|
|
|
return result;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
|
|
|
|
if (de_ctx) {
|
|
|
|
|
|
|
|
SigGroupCleanup(de_ctx);
|
|
|
|
|
|
|
|
SigCleanSignatures(de_ctx);
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (det_ctx)
|
|
|
|
|
|
|
|
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
|
|
|
|
|
|
|
|
if (de_ctx)
|
|
|
|
|
|
|
|
DetectEngineCtxFree(de_ctx);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
FlowShutdown();
|
|
|
|
|
|
|
|
SCFree(p);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
return result;
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static int DetectIPProtoTestSig3(void)
|
|
|
|
static int DetectIPProtoTestSig3(void)
|
|
|
|
@ -2027,6 +1994,7 @@ static int DetectIPProtoTestSig3(void)
|
|
|
|
FlowShutdown();
|
|
|
|
FlowShutdown();
|
|
|
|
|
|
|
|
|
|
|
|
PacketFree(p);
|
|
|
|
PacketFree(p);
|
|
|
|
|
|
|
|
StatsThreadCleanup(&th_v);
|
|
|
|
PASS;
|
|
|
|
PASS;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|