jasonish/suricata | Build 23105300094 | src/detect-engine-state.c | Coveralls

7✔

    if (alstate != NULL) {

7✔

70

        if (alproto == ALPROTO_HTTP1) {

7✔

71

            HtpState *htp_state = (HtpState *)alstate;

5✔

72

            if (htp_state->conn != NULL) {

5✔

73

                return 1;

5✔

74

5✔

75

        } else {

5✔

76

            return 1;

2✔

77

2✔

78

7✔

80

7✔

83

2,960✔

84

    DeStateStore *d = SCCalloc(1, sizeof(DeStateStore));

2,960✔

85

    if (unlikely(d == NULL))

2,960✔

88

    return d;

2,960✔

89

2,960✔

120

3,920✔

121

    SCEnter();

3,920✔

123

    DetectEngineStateDirection *dir_state =

3,920✔

124

            &state->dir_state[(direction & STREAM_TOSERVER) ? 0 : 1];

3,920✔

129

    DeStateStore *store = dir_state->tail;

3,920✔

130

    if (store == NULL) {

3,920✔

131

        store = DeStateStoreAlloc();

2,958✔

132

        dir_state->head = store;

2,958✔

133

        dir_state->cur = store;

2,958✔

134

        dir_state->tail = store;

2,958✔

135

    } else if (dir_state->cur) {

2,958✔

136

        store = dir_state->cur;

961✔

137

    } else {

961✔

138

        store = DeStateStoreAlloc();

1✔

139

        if (store != NULL) {

1✔

140

            dir_state->tail->next = store;

1✔

141

            dir_state->tail = store;

1✔

142

            dir_state->cur = store;

1✔

143

1✔

144

1✔

145

    if (store == NULL)

3,920✔

148

    SigIntId idx = dir_state->cnt % DE_STATE_CHUNK_SIZE;

3,920✔

149

    store->store[idx].sid = s->iid;

3,920✔

150

    store->store[idx].flags = inspect_flags;

3,920✔

151

    dir_state->cnt++;

3,920✔

153

    if (dir_state->cnt % DE_STATE_CHUNK_SIZE == 0) {

3,920✔

154

        dir_state->cur = dir_state->cur->next;

2✔

155

2✔

157

    SCReturn;

3,920✔

158

3,920✔

161

2,421✔

162

    DetectEngineState *d = SCCalloc(1, sizeof(DetectEngineState));

2,421✔

163

    if (unlikely(d == NULL))

2,421✔

166

    return d;

2,421✔

167

2,421✔

170

2,422✔

171

    DeStateStore *store;

2,422✔

172

    DeStateStore *store_next;

2,422✔

173

    int i = 0;

2,422✔

175

    for (i = 0; i < 2; i++) {

7,266✔

176

        store = state->dir_state[i].head;

4,844✔

177

        while (store != NULL) {

7,804✔

178

            store_next = store->next;

2,960✔

179

            SCFree(store);

2,960✔

180

            store = store_next;

2,960✔

181

2,960✔

182

4,844✔

183

    SCFree(state);

2,422✔

184

2,422✔

187

3,873✔

188

    de_state->dir_state[(direction & STREAM_TOSERVER) ? 0 : 1].filestore_cnt += file_no_match;

3,873✔

189

3,873✔

192

3,872✔

193

    if (de_state->dir_state[(direction & STREAM_TOSERVER) ? 0 : 1].filestore_cnt ==

3,872✔

194

            sgh->filestore_cnt)

3,872✔

195

        return true;

3,774✔

196

    else

98✔

197

        return false;

98✔

198

3,872✔

202

3,873✔

203

    SCLogDebug("tx %"PRIu64", file_no_match %u", tx_id, file_no_match);

3,873✔

204

    StoreFileNoMatchCnt(destate, file_no_match, flow_flags);

3,873✔

205

    if (StoreFilestoreSigsCantMatch(sgh, destate, flow_flags)) {

3,873✔

206

        SCLogDebug("filestore sigs can't match");

3,774✔

207

        FileDisableStoringForTransaction(

3,774✔

208

                f, flow_flags & (STREAM_TOCLIENT | STREAM_TOSERVER), tx, tx_id);

3,774✔

209

    } else {

3,774✔

210

        SCLogDebug("filestore sigs can still match");

99✔

211

99✔

212

3,873✔

220

3,870✔

221

    AppLayerTxData *tx_data = AppLayerParserGetTxData(f->proto, f->alproto, tx);

3,870✔

222

    if (tx_data->de_state == NULL) {

3,870✔

223

        tx_data->de_state = DetectEngineStateAlloc();

2,419✔

224

        if (tx_data->de_state == NULL)

2,419✔

226

        SCLogDebug("destate created for %"PRIu64, tx_id);

2,419✔

227

2,419✔

228

    DeStateSignatureAppend(tx_data->de_state, s, inspect_flags, flow_flags);

3,870✔

229

    if (s->flags & SIG_FLAG_TXBOTHDIR) {

3,870✔

231

        DeStateSignatureAppend(tx_data->de_state, s, inspect_flags,

12✔

232

                flow_flags ^ (STREAM_TOSERVER | STREAM_TOCLIENT));

12✔

233

12✔

234

    StoreStateTxHandleFiles(sgh, f, tx_data->de_state, flow_flags, tx, tx_id, file_no_match);

3,870✔

236

    SCLogDebug("Stored for TX %"PRIu64, tx_id);

3,870✔

237

3,870✔

240

7✔

241

    if (s) {

7✔

242

        s->dir_state[0].cnt = 0;

1✔

243

        s->dir_state[0].filestore_cnt = 0;

1✔

244

        s->dir_state[0].flags = 0;

1✔

246

        s->dir_state[0].cur = s->dir_state[0].head;

1✔

248

        s->dir_state[1].cnt = 0;

1✔

249

        s->dir_state[1].filestore_cnt = 0;

1✔

250

        s->dir_state[1].flags = 0;

1✔

252

        s->dir_state[1].cur = s->dir_state[1].head;

1✔

253

1✔

254

7✔

261

7✔

262

    void *alstate = FlowGetAppState(f);

7✔

263

    if (!StateIsValid(f->alproto, alstate)) {

7✔

267

    uint64_t inspect_ts = AppLayerParserGetTransactionInspectId(f->alparser, STREAM_TOCLIENT);

7✔

268

    uint64_t inspect_tc = AppLayerParserGetTransactionInspectId(f->alparser, STREAM_TOSERVER);

7✔

270

    uint64_t inspect_tx_id = MIN(inspect_ts, inspect_tc);

7✔

272

    uint64_t total_txs = AppLayerParserGetTxCnt(f, alstate);

7✔

274

    for ( ; inspect_tx_id < total_txs; inspect_tx_id++) {

13✔

275

        void *inspect_tx = AppLayerParserGetTx(f->proto, f->alproto, alstate, inspect_tx_id);

6✔

276

        if (inspect_tx != NULL) {

6✔

277

            AppLayerTxData *txd = AppLayerParserGetTxData(f->proto, f->alproto, inspect_tx);

6✔

278

            ResetTxState(txd->de_state);

6✔

279

6✔

280

6✔

281

7✔

289

1✔

290

    SCLogDebug("sizeof(DetectEngineState)\t\t%"PRIuMAX,

1✔

291

            (uintmax_t)sizeof(DetectEngineState));

1✔

292

    SCLogDebug("sizeof(DeStateStore)\t\t\t%"PRIuMAX,

1✔

293

            (uintmax_t)sizeof(DeStateStore));

1✔

294

    SCLogDebug("sizeof(DeStateStoreItem)\t\t%"PRIuMAX"",

1✔

295

            (uintmax_t)sizeof(DeStateStoreItem));

1✔

297

    return 1;

1✔

298

1✔

301

1✔

302

    uint8_t direction = STREAM_TOSERVER;

1✔

303

    DetectEngineState *state = DetectEngineStateAlloc();

1✔

304

    FAIL_IF_NULL(state);

1✔

305

    FAIL_IF_NOT_NULL(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head);

1✔

307

    Signature s;

1✔

308

    memset(&s, 0x00, sizeof(s));

1✔

310

    s.iid = 0;

1✔

311

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

312

    s.iid = 11;

1✔

313

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

314

    s.iid = 22;

1✔

315

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

316

    s.iid = 33;

1✔

317

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

318

    s.iid = 44;

1✔

319

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

320

    s.iid = 55;

1✔

321

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

322

    s.iid = 66;

1✔

323

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

324

    s.iid = 77;

1✔

325

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

326

    s.iid = 88;

1✔

327

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

328

    s.iid = 99;

1✔

329

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

330

    s.iid = 100;

1✔

331

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

332

    s.iid = 111;

1✔

333

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

334

    s.iid = 122;

1✔

335

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

336

    s.iid = 133;

1✔

337

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

338

    FAIL_IF_NOT(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head ==

1✔

339

                state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur);

1✔

341

    s.iid = 144;

1✔

342

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

344

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[14].sid != 144);

1✔

345

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head ==

1✔

346

            state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur);

1✔

347

    FAIL_IF_NOT(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur == NULL);

1✔

349

    s.iid = 155;

1✔

350

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

352

    FAIL_IF_NOT(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].tail ==

1✔

353

                state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur);

1✔

355

    s.iid = 166;

1✔

356

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

358

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head == NULL);

1✔

359

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[1].sid != 11);

1✔

360

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next == NULL);

1✔

361

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[14].sid != 144);

1✔

362

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next->store[0].sid != 155);

1✔

363

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next->store[1].sid != 166);

1✔

365

    ResetTxState(state);

1✔

367

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head == NULL);

1✔

368

    FAIL_IF_NOT(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head ==

1✔

369

                state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur);

1✔

371

    s.iid = 0;

1✔

372

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

373

    s.iid = 11;

1✔

374

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

375

    s.iid = 22;

1✔

376

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

377

    s.iid = 33;

1✔

378

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

379

    s.iid = 44;

1✔

380

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

381

    s.iid = 55;

1✔

382

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

383

    s.iid = 66;

1✔

384

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

385

    s.iid = 77;

1✔

386

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

387

    s.iid = 88;

1✔

388

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

389

    s.iid = 99;

1✔

390

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

391

    s.iid = 100;

1✔

392

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

393

    s.iid = 111;

1✔

394

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

395

    s.iid = 122;

1✔

396

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

397

    s.iid = 133;

1✔

398

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

399

    FAIL_IF_NOT(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head ==

1✔

400

                state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur);

1✔

401

    s.iid = 144;

1✔

402

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

403

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[14].sid != 144);

1✔

404

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head ==

1✔

405

            state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur);

1✔

406

    FAIL_IF_NOT(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].tail ==

1✔

407

                state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].cur);

1✔

408

    s.iid = 155;

1✔

409

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

410

    s.iid = 166;

1✔

411

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

413

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head == NULL);

1✔

414

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[1].sid != 11);

1✔

415

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next == NULL);

1✔

416

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[14].sid != 144);

1✔

417

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next->store[0].sid != 155);

1✔

418

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next->store[1].sid != 166);

1✔

420

    SCDetectEngineStateFree(state);

1✔

422

    PASS;

1✔

423

1✔

426

1✔

427

    DetectEngineState *state = DetectEngineStateAlloc();

1✔

428

    FAIL_IF_NULL(state);

1✔

430

    Signature s;

1✔

431

    memset(&s, 0x00, sizeof(s));

1✔

433

    uint8_t direction = STREAM_TOSERVER;

1✔

435

    s.iid = 11;

1✔

436

    DeStateSignatureAppend(state, &s, 0, direction);

1✔

437

    s.iid = 22;

1✔

438

    DeStateSignatureAppend(state, &s, BIT_U32(DE_STATE_FLAG_BASE), direction);

1✔

440

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head == NULL);

1✔

441

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[0].sid != 11);

1✔

442

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[0].flags & BIT_U32(DE_STATE_FLAG_BASE));

1✔

443

    FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[1].sid != 22);

1✔

444

    FAIL_IF(!(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[1].flags & BIT_U32(DE_STATE_FLAG_BASE)));

1✔

446

    SCDetectEngineStateFree(state);

1✔

447

    PASS;

1✔

448

1✔

451

1✔

452

    DetectEngineThreadCtx *det_ctx = NULL;

1✔

453

    ThreadVars th_v;

1✔

454

    Flow f;

1✔

455

    TcpSession ssn;

1✔

456

    Packet *p = NULL;

1✔

457

    uint8_t httpbuf1[] = "POST / HTTP/1.0\r\n";

1✔

458

    uint8_t httpbuf2[] = "User-Agent: Mozilla/1.0\r\n";

1✔

459

    uint8_t httpbuf3[] = "Cookie: dummy\r\nContent-Length: 10\r\n\r\n";

1✔

460

    uint8_t httpbuf4[] = "Http Body!";

1✔

461

    uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */

1✔

462

    uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */

1✔

463

    uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */

1✔

464

    uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */

1✔

466

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

1✔

467

    FAIL_IF_NULL(alp_tctx);

1✔

469

    memset(&th_v, 0, sizeof(th_v));

1✔

470

    StatsThreadInit(&th_v.stats);

1✔

471

    memset(&f, 0, sizeof(f));

1✔

472

    memset(&ssn, 0, sizeof(ssn));

1✔

474

    p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

1✔

475

    FAIL_IF_NULL(p);

1✔

477

    FLOW_INITIALIZE(&f);

1✔

478

    f.protoctx = (void *)&ssn;

1✔

479

    f.proto = IPPROTO_TCP;

1✔

480

    f.flags |= FLOW_IPV4;

1✔

481

    f.alproto = ALPROTO_HTTP1;

1✔

483

    p->flow = &f;

1✔

484

    p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;

1✔

485

    p->flowflags |= FLOW_PKT_TOSERVER;

1✔

486

    p->flowflags |= FLOW_PKT_ESTABLISHED;

1✔

488

    StreamTcpInitConfig(true);

1✔

490

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

1✔

491

    FAIL_IF_NULL(de_ctx);

1✔

492

    de_ctx->flags |= DE_QUIET;

1✔

494

    Signature *s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (content:\"POST\"; http_method; content:\"dummy\"; http_cookie; sid:1; rev:1;)");

1✔

495

    FAIL_IF_NULL(s);

1✔

497

    SigGroupBuild(de_ctx);

1✔

498

    DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);

1✔

499

    FAIL_IF_NULL(det_ctx);

1✔

501

    int r = AppLayerParserParse(

1✔

502

            NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf1, httplen1);

1✔

503

    FAIL_IF_NOT(r == 0);

1✔

504

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

505

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

507

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf2, httplen2);

1✔

508

    FAIL_IF_NOT(r == 0);

1✔

509

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

510

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

512

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf3, httplen3);

1✔

513

    FAIL_IF_NOT(r == 0);

1✔

514

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

515

    FAIL_IF_NOT(PacketAlertCheck(p, 1));

1✔

517

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf4, httplen4);

1✔

518

    FAIL_IF_NOT(r == 0);

1✔

519

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

520

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

522

    UTHFreePacket(p);

1✔

523

    FLOW_DESTROY(&f);

1✔

524

    AppLayerParserThreadCtxFree(alp_tctx);

1✔

525

    DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);

1✔

526

    DetectEngineCtxFree(de_ctx);

1✔

527

    StreamTcpFreeConfig(true);

1✔

528

    StatsThreadCleanup(&th_v.stats);

1✔

529

    PASS;

1✔

530

1✔

534

1✔

535

    DetectEngineThreadCtx *det_ctx = NULL;

1✔

536

    ThreadVars th_v;

1✔

537

    Flow f;

1✔

538

    TcpSession ssn;

1✔

539

    Packet *p = NULL;

1✔

540

    uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n";

1✔

541

    uint8_t httpbuf2[] = "User-Agent: Mozilla/1.0\r\nContent-Length: 10\r\n";

1✔

542

    uint8_t httpbuf3[] = "Cookie: dummy\r\n\r\n";

1✔

543

    uint8_t httpbuf4[] = "Http Body!";

1✔

544

    uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */

1✔

545

    uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */

1✔

546

    uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */

1✔

547

    uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */

1✔

548

    uint8_t httpbuf5[] = "GET /?var=val HTTP/1.1\r\n";

1✔

549

    uint8_t httpbuf6[] = "User-Agent: Firefox/1.0\r\n";

1✔

550

    uint8_t httpbuf7[] = "Cookie: dummy2\r\nContent-Length: 10\r\n\r\nHttp Body!";

1✔

551

    uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */

1✔

552

    uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */

1✔

553

    uint32_t httplen7 = sizeof(httpbuf7) - 1; /* minus the \0 */

1✔

554

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

1✔

555

    FAIL_IF_NULL(alp_tctx);

1✔

557

    memset(&th_v, 0, sizeof(th_v));

1✔

558

    StatsThreadInit(&th_v.stats);

1✔

559

    memset(&f, 0, sizeof(f));

1✔

560

    memset(&ssn, 0, sizeof(ssn));

1✔

562

    p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

1✔

564

    FLOW_INITIALIZE(&f);

1✔

565

    f.protoctx = (void *)&ssn;

1✔

566

    f.proto = IPPROTO_TCP;

1✔

567

    f.flags |= FLOW_IPV4;

1✔

569

    p->flow = &f;

1✔

570

    p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;

1✔

571

    p->flowflags |= FLOW_PKT_TOSERVER;

1✔

572

    p->flowflags |= FLOW_PKT_ESTABLISHED;

1✔

573

    f.alproto = ALPROTO_HTTP1;

1✔

575

    StreamTcpInitConfig(true);

1✔

577

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

1✔

578

    FAIL_IF_NULL(de_ctx);

1✔

580

    de_ctx->flags |= DE_QUIET;

1✔

582

    Signature *s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:to_server; content:\"POST\"; http_method; content:\"/\"; http_uri; content:\"Mozilla\"; http_header; content:\"dummy\"; http_cookie; content:\"body\"; nocase; http_client_body; sid:1; rev:1;)");

1✔

583

    FAIL_IF_NULL(s);

1✔

584

    s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:to_server; content:\"GET\"; http_method; content:\"Firefox\"; http_header; content:\"dummy2\"; http_cookie; sid:2; rev:1;)");

1✔

585

    FAIL_IF_NULL(s);

1✔

587

    SigGroupBuild(de_ctx);

1✔

588

    DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);

1✔

589

    FAIL_IF_NULL(det_ctx);

1✔

591

    int r = AppLayerParserParse(

1✔

592

            NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf1, httplen1);

1✔

593

    FAIL_IF(r != 0);

1✔

594

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

595

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

597

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf2, httplen2);

1✔

598

    FAIL_IF(r != 0);

1✔

599

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

600

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

602

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf3, httplen3);

1✔

603

    FAIL_IF(r != 0);

1✔

604

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

605

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

607

    void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f.alstate, 0);

1✔

608

    FAIL_IF_NULL(tx);

1✔

610

    AppLayerTxData *tx_data = AppLayerParserGetTxData(IPPROTO_TCP, ALPROTO_HTTP1, tx);

1✔

611

    FAIL_IF_NULL(tx_data);

1✔

612

    DetectEngineState *tx_de_state = tx_data->de_state;

1✔

613

    FAIL_IF_NULL(tx_de_state);

1✔

614

    FAIL_IF(tx_de_state->dir_state[0].cnt != 1);

1✔

616

    uint32_t expected_flags = (BIT_U32(5) | BIT_U32(3) | BIT_U32(6) | BIT_U32(4));

1✔

617

    FAIL_IF(tx_de_state->dir_state[0].head->store[0].flags != expected_flags);

1✔

619

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf4, httplen4);

1✔

620

    FAIL_IF(r != 0);

1✔

621

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

622

    FAIL_IF(!(PacketAlertCheck(p, 1)));

1✔

624

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf5, httplen5);

1✔

625

    FAIL_IF(r != 0);

1✔

626

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

627

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

629

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf6, httplen6);

1✔

630

    FAIL_IF(r != 0);

1✔

631

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

632

    FAIL_IF((PacketAlertCheck(p, 1)) || (PacketAlertCheck(p, 2)));

1✔

634

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf7, httplen7);

1✔

635

    FAIL_IF(r != 0);

1✔

636

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

637

    FAIL_IF(!(PacketAlertCheck(p, 2)));

1✔

639

    UTHFreePacket(p);

1✔

640

    FLOW_DESTROY(&f);

1✔

641

    AppLayerParserThreadCtxFree(alp_tctx);

1✔

642

    DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);

1✔

643

    DetectEngineCtxFree(de_ctx);

1✔

644

    StreamTcpFreeConfig(true);

1✔

645

    StatsThreadCleanup(&th_v.stats);

1✔

646

    PASS;

1✔

647

1✔

650

1✔

651

    uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"

1✔

652

                         "Host: www.server.lan\r\n"

1✔

653

                         "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"

1✔

654

                         "Content-Length: 215\r\n"

1✔

655

                         "\r\n"

1✔

656

                         "-----------------------------277531038314945\r\n"

1✔

657

                         "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n"

1✔

658

                         "Content-Type: image/jpeg\r\n"

1✔

659

                         "\r\n"

1✔

660

                         "filecontent\r\n"

1✔

661

                         "-----------------------------277531038314945--";

1✔

662

    uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */

1✔

663

    ThreadVars th_v;

1✔

664

    TcpSession ssn;

1✔

665

    Flow *f = NULL;

1✔

666

    Packet *p = NULL;

1✔

667

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

1✔

668

    FAIL_IF_NULL(alp_tctx);

1✔

670

    memset(&th_v, 0, sizeof(th_v));

1✔

671

    StatsThreadInit(&th_v.stats);

1✔

672

    memset(&ssn, 0, sizeof(ssn));

1✔

674

    DetectEngineThreadCtx *det_ctx = NULL;

1✔

675

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

1✔

676

    FAIL_IF_NULL(de_ctx);

1✔

678

    de_ctx->flags |= DE_QUIET;

1✔

680

    Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (flow:to_server; content:\"POST\"; http_method; content:\"upload.cgi\"; http_uri; filestore; sid:1; rev:1;)");

1✔

681

    FAIL_IF_NULL(s);

1✔

683

    SigGroupBuild(de_ctx);

1✔

684

    DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);

1✔

686

    f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);

1✔

687

    FAIL_IF_NULL(f);

1✔

688

    f->protoctx = &ssn;

1✔

689

    f->proto = IPPROTO_TCP;

1✔

690

    f->alproto = ALPROTO_HTTP1;

1✔

692

    p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

1✔

693

    FAIL_IF_NULL(p);

1✔

695

    p->flow = f;

1✔

696

    p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;

1✔

697

    p->flowflags |= FLOW_PKT_TOSERVER;

1✔

698

    p->flowflags |= FLOW_PKT_ESTABLISHED;

1✔

700

    StreamTcpInitConfig(true);

1✔

702

    int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1,

1✔

703

            STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1);

1✔

704

    FAIL_IF(r != 0);

1✔

706

    HtpState *http_state = f->alstate;

1✔

707

    FAIL_IF_NULL(http_state);

1✔

708

    void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);

1✔

709

    FAIL_IF_NULL(tx);

1✔

710

    HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);

1✔

711

    FAIL_IF_NULL(tx_ud);

1✔

713

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

714

    FAIL_IF(!(PacketAlertCheck(p, 1)));

1✔

716

    AppLayerGetFileState files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);

1✔

717

    FileContainer *fc = files.fc;

1✔

718

    FAIL_IF_NULL(fc);

1✔

720

    File *file = fc->head;

1✔

721

    FAIL_IF_NULL(file);

1✔

723

    FAIL_IF(!(file->flags & FILE_STORE));

1✔

725

    UTHFreePacket(p);

1✔

726

    UTHFreeFlow(f);

1✔

728

    AppLayerParserThreadCtxFree(alp_tctx);

1✔

729

    DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);

1✔

730

    DetectEngineCtxFree(de_ctx);

1✔

731

    StreamTcpFreeConfig(true);

1✔

732

    StatsThreadCleanup(&th_v.stats);

1✔

733

    PASS;

1✔

734

1✔

737

1✔

738

    uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"

1✔

739

                         "Host: www.server.lan\r\n"

1✔

740

                         "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"

1✔

741

                         "Content-Length: 215\r\n"

1✔

742

                         "\r\n"

1✔

743

                         "-----------------------------277531038314945\r\n"

1✔

744

                         "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n"

1✔

745

                         "Content-Type: image/jpeg\r\n"

1✔

746

                         "\r\n"

1✔

747

                         "filecontent\r\n"

1✔

748

                         "-----------------------------277531038314945--";

1✔

749

    uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */

1✔

750

    ThreadVars th_v;

1✔

751

    TcpSession ssn;

1✔

752

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

1✔

753

    FAIL_IF_NULL(alp_tctx);

1✔

755

    memset(&th_v, 0, sizeof(th_v));

1✔

756

    StatsThreadInit(&th_v.stats);

1✔

757

    memset(&ssn, 0, sizeof(ssn));

1✔

759

    DetectEngineThreadCtx *det_ctx = NULL;

1✔

760

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

1✔

761

    FAIL_IF_NULL(de_ctx);

1✔

762

    de_ctx->flags |= DE_QUIET;

1✔

764

    Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"GET\"; http_method; content:\"upload.cgi\"; http_uri; filestore; sid:1; rev:1;)");

1✔

765

    FAIL_IF_NULL(s);

1✔

767

    SigGroupBuild(de_ctx);

1✔

768

    DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);

1✔

769

    FAIL_IF_NULL(det_ctx);

1✔

771

    Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);

1✔

772

    FAIL_IF_NULL(f);

1✔

773

    f->protoctx = &ssn;

1✔

774

    f->proto = IPPROTO_TCP;

1✔

775

    f->alproto = ALPROTO_HTTP1;

1✔

777

    Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

1✔

778

    FAIL_IF_NULL(p);

1✔

779

    p->flow = f;

1✔

780

    p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;

1✔

781

    p->flowflags |= FLOW_PKT_TOSERVER;

1✔

782

    p->flowflags |= FLOW_PKT_ESTABLISHED;

1✔

784

    StreamTcpInitConfig(true);

1✔

786

    int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1,

1✔

787

            STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1);

1✔

788

    FAIL_IF(r != 0);

1✔

789

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

790

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

792

    HtpState *http_state = f->alstate;

1✔

793

    FAIL_IF_NULL(http_state);

1✔

794

    void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);

1✔

795

    FAIL_IF_NULL(tx);

1✔

796

    HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);

1✔

797

    FAIL_IF_NULL(tx_ud);

1✔

799

    AppLayerGetFileState files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);

1✔

800

    FileContainer *fc = files.fc;

1✔

801

    FAIL_IF_NULL(fc);

1✔

802

    File *file = fc->head;

1✔

803

    FAIL_IF_NULL(file);

1✔

805

    FAIL_IF(file->flags & FILE_STORE);

1✔

807

    UTHFreePacket(p);

1✔

808

    UTHFreeFlow(f);

1✔

809

    AppLayerParserThreadCtxFree(alp_tctx);

1✔

810

    DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);

1✔

811

    DetectEngineCtxFree(de_ctx);

1✔

812

    StreamTcpFreeConfig(true);

1✔

813

    StatsThreadCleanup(&th_v.stats);

1✔

814

    PASS;

1✔

815

1✔

818

1✔

819

    uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"

1✔

820

                         "Host: www.server.lan\r\n"

1✔

821

                         "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"

1✔

822

                         "Content-Length: 215\r\n"

1✔

823

                         "\r\n"

1✔

824

                         "-----------------------------277531038314945\r\n"

1✔

825

                         "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n"

1✔

826

                         "Content-Type: image/jpeg\r\n"

1✔

827

                         "\r\n"

1✔

828

                         "filecontent\r\n"

1✔

829

                         "-----------------------------277531038314945--";

1✔

830

    uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */

1✔

831

    ThreadVars th_v;

1✔

832

    TcpSession ssn;

1✔

834

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

1✔

835

    FAIL_IF_NULL(alp_tctx);

1✔

837

    memset(&th_v, 0, sizeof(th_v));

1✔

838

    StatsThreadInit(&th_v.stats);

1✔

839

    memset(&ssn, 0, sizeof(ssn));

1✔

841

    DetectEngineThreadCtx *det_ctx = NULL;

1✔

842

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

1✔

843

    FAIL_IF_NULL(de_ctx);

1✔

844

    de_ctx->flags |= DE_QUIET;

1✔

846

    Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"GET\"; http_method; content:\"upload.cgi\"; http_uri; filename:\"nomatch\"; sid:1; rev:1;)");

1✔

847

    FAIL_IF_NULL(s);

1✔

849

    SigGroupBuild(de_ctx);

1✔

850

    DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);

1✔

852

    Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);

1✔

853

    FAIL_IF_NULL(f);

1✔

854

    f->protoctx = &ssn;

1✔

855

    f->proto = IPPROTO_TCP;

1✔

856

    f->alproto = ALPROTO_HTTP1;

1✔

858

    Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

1✔

859

    FAIL_IF_NULL(p);

1✔

860

    p->flow = f;

1✔

861

    p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;

1✔

862

    p->flowflags |= FLOW_PKT_TOSERVER;

1✔

863

    p->flowflags |= FLOW_PKT_ESTABLISHED;

1✔

865

    StreamTcpInitConfig(true);

1✔

867

    int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1,

1✔

868

            STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1);

1✔

869

    FAIL_IF_NOT(r == 0);

1✔

870

    HtpState *http_state = f->alstate;

1✔

871

    FAIL_IF_NULL(http_state);

1✔

872

    void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);

1✔

873

    FAIL_IF_NULL(tx);

1✔

874

    HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);

1✔

875

    FAIL_IF_NULL(tx_ud);

1✔

877

    AppLayerGetFileState files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);

1✔

878

    FileContainer *fc = files.fc;

1✔

879

    FAIL_IF_NULL(fc);

1✔

880

    File *file = fc->head;

1✔

881

    FAIL_IF_NULL(file);

1✔

882

    FAIL_IF(http_state->state_data.file_flags & FLOWFILE_NO_STORE_TS);

1✔

884

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

885

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

889

    FAIL_IF_NOT(http_state->state_data.file_flags & FLOWFILE_NO_STORE_TS);

1✔

890

    FAIL_IF(file->flags & FILE_NOSTORE);

1✔

892

    UTHFreePacket(p);

1✔

893

    UTHFreeFlow(f);

1✔

894

    AppLayerParserThreadCtxFree(alp_tctx);

1✔

895

    DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);

1✔

896

    DetectEngineCtxFree(de_ctx);

1✔

897

    StreamTcpFreeConfig(true);

1✔

898

    StatsThreadCleanup(&th_v.stats);

1✔

899

    PASS;

1✔

900

1✔

903

1✔

904

    uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"

1✔

905

                         "Host: www.server.lan\r\n"

1✔

906

                         "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"

1✔

907

                         "Content-Length: 215\r\n"

1✔

908

                         "\r\n"

1✔

909

                         "-----------------------------277531038314945\r\n"

1✔

910

                         "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n"

1✔

911

                         "Content-Type: image/jpeg\r\n"

1✔

912

                         "\r\n"

1✔

913

                         "filecontent\r\n"

1✔

914

                         "-----------------------------277531038314945--";

1✔

915

    uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */

1✔

916

    ThreadVars th_v;

1✔

917

    TcpSession ssn;

1✔

919

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

1✔

920

    FAIL_IF_NULL(alp_tctx);

1✔

922

    memset(&th_v, 0, sizeof(th_v));

1✔

923

    StatsThreadInit(&th_v.stats);

1✔

924

    memset(&ssn, 0, sizeof(ssn));

1✔

926

    DetectEngineThreadCtx *det_ctx = NULL;

1✔

927

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

1✔

928

    FAIL_IF_NULL(de_ctx);

1✔

929

    de_ctx->flags |= DE_QUIET;

1✔

931

    Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"POST\"; http_method; content:\"upload.cgi\"; http_uri; filename:\"nomatch\"; filestore; sid:1; rev:1;)");

1✔

932

    FAIL_IF_NULL(s);

1✔

934

    SigGroupBuild(de_ctx);

1✔

935

    DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);

1✔

936

    FAIL_IF_NULL(det_ctx);

1✔

938

    Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);

1✔

939

    FAIL_IF_NULL(f);

1✔

940

    f->protoctx = &ssn;

1✔

941

    f->proto = IPPROTO_TCP;

1✔

942

    f->alproto = ALPROTO_HTTP1;

1✔

944

    Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

1✔

945

    FAIL_IF_NULL(p);

1✔

946

    p->flow = f;

1✔

947

    p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;

1✔

948

    p->flowflags |= FLOW_PKT_TOSERVER;

1✔

949

    p->flowflags |= FLOW_PKT_ESTABLISHED;

1✔

951

    StreamTcpInitConfig(true);

1✔

953

    int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1,

1✔

954

            STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1);

1✔

955

    FAIL_IF(r != 0);

1✔

956

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

957

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

959

    HtpState *http_state = f->alstate;

1✔

960

    FAIL_IF_NULL(http_state);

1✔

961

    void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);

1✔

962

    FAIL_IF_NULL(tx);

1✔

963

    HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);

1✔

964

    FAIL_IF_NULL(tx_ud);

1✔

966

    AppLayerGetFileState files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);

1✔

967

    FileContainer *fc = files.fc;

1✔

968

    FAIL_IF_NULL(fc);

1✔

969

    File *file = fc->head;

1✔

970

    FAIL_IF_NULL(file);

1✔

973

    FAIL_IF_NOT(tx_ud->tx_data.file_flags & FLOWFILE_NO_STORE_TS);

1✔

974

    FAIL_IF(file->flags & FILE_NOSTORE);

1✔

976

    UTHFreePacket(p);

1✔

977

    UTHFreeFlow(f);

1✔

978

    AppLayerParserThreadCtxFree(alp_tctx);

1✔

979

    DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);

1✔

980

    DetectEngineCtxFree(de_ctx);

1✔

981

    StreamTcpFreeConfig(true);

1✔

982

    StatsThreadCleanup(&th_v.stats);

1✔

983

    PASS;

1✔

984

1✔

987

1✔

988

    uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"

1✔

989

                         "Host: www.server.lan\r\n"

1✔

990

                         "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"

1✔

991

                         "Content-Length: 215\r\n"

1✔

992

                         "\r\n"

1✔

993

                         "-----------------------------277531038314945\r\n"

1✔

994

                         "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n"

1✔

995

                         "Content-Type: image/jpeg\r\n"

1✔

996

                         "\r\n";

1✔

998

    uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */

1✔

999

    uint8_t httpbuf2[] = "filecontent\r\n"

1✔

1000

                         "-----------------------------277531038314945--";

1✔

1001

    uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */

1✔

1002

    ThreadVars th_v;

1✔

1003

    TcpSession ssn;

1✔

1005

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

1✔

1006

    FAIL_IF_NULL(alp_tctx);

1✔

1008

    memset(&th_v, 0, sizeof(th_v));

1✔

1009

    StatsThreadInit(&th_v.stats);

1✔

1010

    memset(&ssn, 0, sizeof(ssn));

1✔

1012

    DetectEngineThreadCtx *det_ctx = NULL;

1✔

1013

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

1✔

1014

    FAIL_IF_NULL(de_ctx);

1✔

1015

    de_ctx->flags |= DE_QUIET;

1✔

1017

    Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"GET\"; http_method; content:\"upload.cgi\"; http_uri; filestore; sid:1; rev:1;)");

1✔

1018

    FAIL_IF_NULL(s);

1✔

1020

    SigGroupBuild(de_ctx);

1✔

1021

    DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);

1✔

1023

    Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);

1✔

1024

    FAIL_IF_NULL(f);

1✔

1025

    f->protoctx = &ssn;

1✔

1026

    f->proto = IPPROTO_TCP;

1✔

1027

    f->alproto = ALPROTO_HTTP1;

1✔

1029

    Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

1✔

1030

    FAIL_IF_NULL(p);

1✔

1031

    p->flow = f;

1✔

1032

    p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;

1✔

1033

    p->flowflags |= FLOW_PKT_TOSERVER;

1✔

1034

    p->flowflags |= FLOW_PKT_ESTABLISHED;

1✔

1036

    StreamTcpInitConfig(true);

1✔

1038

    int r = AppLayerParserParse(

1✔

1039

            NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1);

1✔

1040

    FAIL_IF(r != 0);

1✔

1041

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

1042

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

1044

    r = AppLayerParserParse(

1✔

1045

            NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_EOF, httpbuf2, httplen2);

1✔

1046

    FAIL_IF(r != 0);

1✔

1047

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

1048

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

1050

    HtpState *http_state = f->alstate;

1✔

1051

    FAIL_IF_NULL(http_state);

1✔

1052

    void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);

1✔

1053

    FAIL_IF_NULL(tx);

1✔

1054

    HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);

1✔

1055

    FAIL_IF_NULL(tx_ud);

1✔

1057

    AppLayerGetFileState files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);

1✔

1058

    FileContainer *fc = files.fc;

1✔

1059

    FAIL_IF_NULL(fc);

1✔

1060

    File *file = fc->head;

1✔

1061

    FAIL_IF_NULL(file);

1✔

1062

    FAIL_IF(file->flags & FILE_STORE);

1✔

1064

    UTHFreePacket(p);

1✔

1065

    UTHFreeFlow(f);

1✔

1066

    AppLayerParserThreadCtxFree(alp_tctx);

1✔

1067

    DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);

1✔

1068

    DetectEngineCtxFree(de_ctx);

1✔

1069

    StreamTcpFreeConfig(true);

1✔

1070

    StatsThreadCleanup(&th_v.stats);

1✔

1071

    PASS;

1✔

1072

1✔

1078

1✔

1079

    uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"

1✔

1080

                         "Host: www.server.lan\r\n"

1✔

1081

                         "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"

1✔

1082

                         "Content-Length: 440\r\n"

1✔

1083

                         "\r\n"

1✔

1084

                         "-----------------------------277531038314945\r\n"

1✔

1085

                         "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"AAAApicture1.jpg\"\r\n"

1✔

1086

                         "Content-Type: image/jpeg\r\n"

1✔

1087

                         "\r\n";

1✔

1089

    uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */

1✔

1090

    uint8_t httpbuf2[] = "file";

1✔

1091

    uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */

1✔

1092

    uint8_t httpbuf3[] = "content\r\n"

1✔

1093

                         "-----------------------------277531038314945\r\n";

1✔

1094

    uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */

1✔

1096

    uint8_t httpbuf4[] = "Content-Disposition: form-data; name=\"uploadfile_1\"; filename=\"BBBBpicture2.jpg\"\r\n"

1✔

1097

                         "Content-Type: image/jpeg\r\n"

1✔

1098

                         "\r\n"

1✔

1099

                         "filecontent2\r\n"

1✔

1100

                         "-----------------------------277531038314945--";

1✔

1101

    uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */

1✔

1103

    ThreadVars th_v;

1✔

1104

    TcpSession ssn;

1✔

1106

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

1✔

1107

    FAIL_IF_NULL(alp_tctx);

1✔

1109

    memset(&th_v, 0, sizeof(th_v));

1✔

1110

    StatsThreadInit(&th_v.stats);

1✔

1111

    memset(&ssn, 0, sizeof(ssn));

1✔

1113

    DetectEngineThreadCtx *det_ctx = NULL;

1✔

1114

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

1✔

1115

    FAIL_IF_NULL(de_ctx);

1✔

1116

    de_ctx->flags |= DE_QUIET;

1✔

1118

    Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"POST\"; http_method; content:\"upload.cgi\"; http_uri; filename:\"BBBBpicture\"; filestore; sid:1; rev:1;)");

1✔

1119

    FAIL_IF_NULL(s);

1✔

1121

    SigGroupBuild(de_ctx);

1✔

1122

    DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);

1✔

1124

    Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);

1✔

1125

    FAIL_IF_NULL(f);

1✔

1126

    f->protoctx = &ssn;

1✔

1127

    f->proto = IPPROTO_TCP;

1✔

1128

    f->alproto = ALPROTO_HTTP1;

1✔

1130

    Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

1✔

1131

    FAIL_IF_NULL(p);

1✔

1132

    p->flow = f;

1✔

1133

    p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;

1✔

1134

    p->flowflags |= FLOW_PKT_TOSERVER;

1✔

1135

    p->flowflags |= FLOW_PKT_ESTABLISHED;

1✔

1137

    StreamTcpInitConfig(true);

1✔

1141

    int r = AppLayerParserParse(

1✔

1142

            NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1);

1✔

1143

    FAIL_IF(r != 0);

1✔

1144

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

1145

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

1147

    r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf2, httplen2);

1✔

1148

    FAIL_IF(r != 0);

1✔

1149

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

1150

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

1152

    HtpState *http_state = f->alstate;

1✔

1153

    FAIL_IF_NULL(http_state);

1✔

1154

    void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);

1✔

1155

    FAIL_IF_NULL(tx);

1✔

1156

    HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);

1✔

1157

    FAIL_IF_NULL(tx_ud);

1✔

1159

    AppLayerGetFileState files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);

1✔

1160

    FileContainer *fc = files.fc;

1✔

1161

    FAIL_IF_NULL(fc);

1✔

1162

    File *file = fc->head;

1✔

1163

    FAIL_IF_NULL(file);

1✔

1164

    FAIL_IF(file->flags & FILE_STORE);

1✔

1168

    r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf3, httplen3);

1✔

1169

    FAIL_IF(r != 0);

1✔

1170

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

1171

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

1173

    r = AppLayerParserParse(

1✔

1174

            NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_EOF, httpbuf4, httplen4);

1✔

1175

    FAIL_IF(r != 0);

1✔

1176

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

1177

    FAIL_IF_NOT(PacketAlertCheck(p, 1));

1✔

1179

    http_state = f->alstate;

1✔

1180

    FAIL_IF_NULL(http_state);

1✔

1181

    tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);

1✔

1182

    FAIL_IF_NULL(tx);

1✔

1183

    tx_ud = htp_tx_get_user_data(tx);

1✔

1184

    FAIL_IF_NULL(tx_ud);

1✔

1186

    files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);

1✔

1187

    fc = files.fc;

1✔

1188

    FAIL_IF_NULL(fc);

1✔

1189

    file = fc->head;

1✔

1190

    FAIL_IF_NULL(file);

1✔

1191

    file = file->next;

1✔

1192

    FAIL_IF_NULL(file);

1✔

1193

    FAIL_IF_NOT(file->flags & FILE_STORE);

1✔

1195

    UTHFreePacket(p);

1✔

1196

    UTHFreeFlow(f);

1✔

1197

    AppLayerParserThreadCtxFree(alp_tctx);

1✔

1198

    DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);

1✔

1199

    DetectEngineCtxFree(de_ctx);

1✔

1200

    StreamTcpFreeConfig(true);

1✔

1201

    StatsThreadCleanup(&th_v.stats);

1✔

1202

    PASS;

1✔

1203

1✔

1209

1✔

1210

    uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"

1✔

1211

                         "Host: www.server.lan\r\n"

1✔

1212

                         "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"

1✔

1213

                         "Content-Length: 440\r\n"

1✔

1214

                         "\r\n"

1✔

1215

                         "-----------------------------277531038314945\r\n"

1✔

1216

                         "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n"

1✔

1217

                         "Content-Type: image/jpeg\r\n"

1✔

1218

                         "\r\n";

1✔

1220

    uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */

1✔

1221

    uint8_t httpbuf2[] = "file";

1✔

1222

    uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */

1✔

1223

    uint8_t httpbuf3[] = "content\r\n"

1✔

1224

                         "-----------------------------277531038314945\r\n";

1✔

1225

    uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */

1✔

1227

    uint8_t httpbuf4[] = "Content-Disposition: form-data; name=\"uploadfile_1\"; filename=\"somepicture2.jpg\"\r\n"

1✔

1228

                         "Content-Type: image/jpeg\r\n"

1✔

1229

                         "\r\n"

1✔

1230

                         "filecontent2\r\n"

1✔

1231

                         "-----------------------------277531038314945--";

1✔

1232

    uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */

1✔

1234

    ThreadVars th_v;

1✔

1235

    TcpSession ssn;

1✔

1237

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

1✔

1238

    FAIL_IF_NULL(alp_tctx);

1✔

1240

    memset(&th_v, 0, sizeof(th_v));

1✔

1241

    StatsThreadInit(&th_v.stats);

1✔

1242

    memset(&ssn, 0, sizeof(ssn));

1✔

1244

    DetectEngineThreadCtx *det_ctx = NULL;

1✔

1245

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

1✔

1246

    FAIL_IF_NULL(de_ctx);

1✔

1247

    de_ctx->flags |= DE_QUIET;

1✔

1249

    Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"POST\"; http_method; content:\"upload.cgi\"; http_uri; filename:\"somepicture\"; filestore; sid:1; rev:1;)");

1✔

1250

    FAIL_IF_NULL(s);

1✔

1252

    SigGroupBuild(de_ctx);

1✔

1253

    DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);

1✔

1255

    Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);

1✔

1256

    FAIL_IF_NULL(f);

1✔

1257

    f->protoctx = &ssn;

1✔

1258

    f->proto = IPPROTO_TCP;

1✔

1259

    f->alproto = ALPROTO_HTTP1;

1✔

1261

    Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

1✔

1262

    FAIL_IF_NULL(p);

1✔

1263

    p->flow = f;

1✔

1264

    p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;

1✔

1265

    p->flowflags |= FLOW_PKT_TOSERVER;

1✔

1266

    p->flowflags |= FLOW_PKT_ESTABLISHED;

1✔

1268

    StreamTcpInitConfig(true);

1✔

1272

    int r = AppLayerParserParse(

1✔

1273

            NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1);

1✔

1274

    FAIL_IF(r != 0);

1✔

1275

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

1276

    FAIL_IF_NOT(PacketAlertCheck(p, 1));

1✔

1278

    r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf2, httplen2);

1✔

1279

    FAIL_IF(r != 0);

1✔

1280

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

1281

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

1283

    HtpState *http_state = f->alstate;

1✔

1284

    FAIL_IF_NULL(http_state);

1✔

1285

    void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);

1✔

1286

    FAIL_IF_NULL(tx);

1✔

1287

    HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);

1✔

1288

    FAIL_IF_NULL(tx_ud);

1✔

1290

    AppLayerGetFileState files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);

1✔

1291

    FileContainer *fc = files.fc;

1✔

1292

    FAIL_IF_NULL(fc);

1✔

1293

    File *file = fc->head;

1✔

1294

    FAIL_IF_NULL(file);

1✔

1295

    FAIL_IF_NOT(file->flags & FILE_STORE);

1✔

1299

    r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf3, httplen3);

1✔

1300

    FAIL_IF(r != 0);

1✔

1301

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

1302

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

1304

    r = AppLayerParserParse(

1✔

1305

            NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_EOF, httpbuf4, httplen4);

1✔

1306

    FAIL_IF(r != 0);

1✔

1307

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

1308

    FAIL_IF_NOT(PacketAlertCheck(p, 1));

1✔

1310

    http_state = f->alstate;

1✔

1311

    FAIL_IF_NULL(http_state);

1✔

1312

    tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);

1✔

1313

    FAIL_IF_NULL(tx);

1✔

1314

    tx_ud = htp_tx_get_user_data(tx);

1✔

1315

    FAIL_IF_NULL(tx_ud);

1✔

1317

    files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);

1✔

1318

    fc = files.fc;

1✔

1319

    FAIL_IF_NULL(fc);

1✔

1320

    file = fc->head;

1✔

1321

    FAIL_IF_NULL(file);

1✔

1322

    FAIL_IF_NOT(file->flags & FILE_STORE);

1✔

1324

    UTHFreePacket(p);

1✔

1325

    UTHFreeFlow(f);

1✔

1326

    AppLayerParserThreadCtxFree(alp_tctx);

1✔

1327

    DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);

1✔

1328

    DetectEngineCtxFree(de_ctx);

1✔

1329

    StreamTcpFreeConfig(true);

1✔

1330

    StatsThreadCleanup(&th_v.stats);

1✔

1331

    PASS;

1✔

1332

1✔

1338

1✔

1339

    uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"

1✔

1340

                         "Host: www.server.lan\r\n"

1✔

1341

                         "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n"

1✔

1342

                         "Content-Length: 440\r\n"

1✔

1343

                         "\r\n"

1✔

1344

                         "-----------------------------277531038314945\r\n"

1✔

1345

                         "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n"

1✔

1346

                         "Content-Type: image/jpeg\r\n"

1✔

1347

                         "\r\n";

1✔

1349

    uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */

1✔

1350

    uint8_t httpbuf2[] = "file";

1✔

1351

    uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */

1✔

1352

    uint8_t httpbuf3[] = "content\r\n"

1✔

1353

                         "-----------------------------277531038314945\r\n";

1✔

1354

    uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */

1✔

1356

    uint8_t httpbuf4[] = "Content-Disposition: form-data; name=\"uploadfile_1\"; filename=\"somepicture2.jpg\"\r\n"

1✔

1357

                         "Content-Type: image/jpeg\r\n"

1✔

1358

                         "\r\n"

1✔

1359

                         "filecontent2\r\n"

1✔

1360

                         "-----------------------------277531038314945--";

1✔

1361

    uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */

1✔

1363

    ThreadVars th_v;

1✔

1364

    TcpSession ssn;

1✔

1366

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

1✔

1367

    FAIL_IF_NULL(alp_tctx);

1✔

1369

    memset(&th_v, 0, sizeof(th_v));

1✔

1370

    StatsThreadInit(&th_v.stats);

1✔

1371

    memset(&ssn, 0, sizeof(ssn));

1✔

1373

    DetectEngineThreadCtx *det_ctx = NULL;

1✔

1374

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

1✔

1375

    FAIL_IF_NULL(de_ctx);

1✔

1376

    de_ctx->flags |= DE_QUIET;

1✔

1378

    Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (filename:\"somepicture\"; filestore; sid:1; rev:1;)");

1✔

1379

    FAIL_IF_NULL(s);

1✔

1381

    SigGroupBuild(de_ctx);

1✔

1382

    DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);

1✔

1384

    Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);

1✔

1385

    FAIL_IF_NULL(f);

1✔

1386

    f->protoctx = &ssn;

1✔

1387

    f->proto = IPPROTO_TCP;

1✔

1388

    f->alproto = ALPROTO_HTTP1;

1✔

1390

    Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

1✔

1391

    FAIL_IF_NULL(p);

1✔

1392

    p->flow = f;

1✔

1393

    p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;

1✔

1394

    p->flowflags |= FLOW_PKT_TOSERVER;

1✔

1395

    p->flowflags |= FLOW_PKT_ESTABLISHED;

1✔

1397

    StreamTcpInitConfig(true);

1✔

1401

    int r = AppLayerParserParse(

1✔

1402

            NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1);

1✔

1403

    FAIL_IF(r != 0);

1✔

1404

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

1405

    FAIL_IF_NOT(PacketAlertCheck(p, 1));

1✔

1407

    r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf2, httplen2);

1✔

1408

    FAIL_IF(r != 0);

1✔

1409

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

1410

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

1412

    HtpState *http_state = f->alstate;

1✔

1413

    FAIL_IF_NULL(http_state);

1✔

1414

    void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);

1✔

1415

    FAIL_IF_NULL(tx);

1✔

1416

    HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);

1✔

1417

    FAIL_IF_NULL(tx_ud);

1✔

1419

    AppLayerGetFileState files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);

1✔

1420

    FileContainer *fc = files.fc;

1✔

1421

    FAIL_IF_NULL(fc);

1✔

1422

    File *file = fc->head;

1✔

1423

    FAIL_IF_NULL(file);

1✔

1424

    FAIL_IF_NOT(file->flags & FILE_STORE);

1✔

1428

    r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER, httpbuf3, httplen3);

1✔

1429

    FAIL_IF(r != 0);

1✔

1430

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

1431

    FAIL_IF(PacketAlertCheck(p, 1));

1✔

1433

    r = AppLayerParserParse(

1✔

1434

            NULL, alp_tctx, f, ALPROTO_HTTP1, STREAM_TOSERVER | STREAM_EOF, httpbuf4, httplen4);

1✔

1435

    FAIL_IF(r != 0);

1✔

1436

    SigMatchSignatures(&th_v, de_ctx, det_ctx, p);

1✔

1437

    FAIL_IF_NOT(PacketAlertCheck(p, 1));

1✔

1439

    http_state = f->alstate;

1✔

1440

    FAIL_IF_NULL(http_state);

1✔

1441

    tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP1, f->alstate, 0);

1✔

1442

    FAIL_IF_NULL(tx);

1✔

1443

    tx_ud = htp_tx_get_user_data(tx);

1✔

1444

    FAIL_IF_NULL(tx_ud);

1✔

1446

    files = AppLayerParserGetTxFiles(p->flow, tx, STREAM_TOSERVER);

1✔

1447

    fc = files.fc;

1✔

1448

    FAIL_IF_NULL(fc);

1✔

1449

    file = fc->head;

1✔

1450

    FAIL_IF_NULL(file);

1✔

1451

    FAIL_IF_NOT(file->flags & FILE_STORE);

1✔

1453

    UTHFreePacket(p);

1✔

1454

    UTHFreeFlow(f);

1✔

1455

    AppLayerParserThreadCtxFree(alp_tctx);

1✔

1456

    DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);

1✔

1457

    DetectEngineCtxFree(de_ctx);

1✔

1458

    StreamTcpFreeConfig(true);

1✔

1459

    StatsThreadCleanup(&th_v.stats);

1✔

1460

    PASS;

1✔

1461

1✔

1466

1✔

1467

#ifdef UNITTESTS

1✔

1468

    UtRegisterTest("DeStateTest01", DeStateTest01);

1✔

1469

    UtRegisterTest("DeStateTest02", DeStateTest02);

1✔

1470

    UtRegisterTest("DeStateTest03", DeStateTest03);

1✔

1471

    UtRegisterTest("DeStateSigTest01", DeStateSigTest01);

1✔

1472

    UtRegisterTest("DeStateSigTest02", DeStateSigTest02);

1✔

1473

    UtRegisterTest("DeStateSigTest03", DeStateSigTest03);

1✔

1474

    UtRegisterTest("DeStateSigTest04", DeStateSigTest04);

1✔

1475

    UtRegisterTest("DeStateSigTest05", DeStateSigTest05);

1✔

1476

    UtRegisterTest("DeStateSigTest06", DeStateSigTest06);

1✔

1477

    UtRegisterTest("DeStateSigTest07", DeStateSigTest07);

1✔

1478

    UtRegisterTest("DeStateSigTest08", DeStateSigTest08);

1✔

1479

    UtRegisterTest("DeStateSigTest09", DeStateSigTest09);

1✔

1480

    UtRegisterTest("DeStateSigTest10", DeStateSigTest10);

1✔

1481

#endif

1✔

1482

1✔

jasonish / suricata / 23105300094

Source File
Press 'n' to go to next uncovered line, 'b' for previous

jasonish / suricata / 23105300094

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous