~ubuntu-branches/ubuntu/precise/suricata/precise-proposed

« back to all changes in this revision

Viewing changes to src/detect-asn1.c

Committer: Bazaar Package Importer
Author(s): Pierre Chifflier
Date: 2010-06-19 17:39:14 UTC
mfrom: (1.1.3 upstream)
Revision ID: james.westby@ubuntu.com-20100619173914-5vkjfgz24mbia29z

Tags: 0.9.2-1

Imported Upstream version 0.9.2

files added:
doc/INSTALL.PF_RING

doc/INSTALL.WINDOWS

libhtp/m4

libhtp/m4/libtool.m4

libhtp/m4/ltoptions.m4

libhtp/m4/ltsugar.m4

libhtp/m4/ltversion.m4

libhtp/m4/lt~obsolete.m4

src/detect-engine-dcepayload.c

src/detect-engine-dcepayload.h

src/detect-http-uri.c

src/detect-http-uri.h

src/source-erf-dag.c

src/source-erf-dag.h

src/tmqh-ringbuffer.c

src/tmqh-ringbuffer.h

src/util-atomic.h

src/util-ringbuffer.c

src/util-ringbuffer.h

src/win32-service.c

src/win32-service.h

files modified:
Makefile.am

Makefile.in

configure

configure.in

debian/changelog

debian/rules

doc/INSTALL

libhtp/Makefile.am

libhtp/Makefile.in

libhtp/aclocal.m4

libhtp/configure

libhtp/htp/Makefile.in

libhtp/test/Makefile.in

src/Makefile.am

src/Makefile.in

src/alert-debuglog.c

src/alert-fastlog.c

src/alert-prelude.c

src/alert-unified-alert.c

src/alert-unified-log.c

src/alert-unified2-alert.c

src/app-layer-dcerpc-common.h

src/app-layer-dcerpc.c

src/app-layer-detect-proto.c

src/app-layer-detect-proto.h

src/app-layer-ftp.c

src/app-layer-htp.c

src/app-layer-parser.c

src/app-layer-parser.h

src/app-layer-smb.c

src/app-layer-smb2.c

src/app-layer-ssl.c

src/app-layer-tls.c

src/app-layer.c

src/app-layer.h

src/conf.c

src/conf.h

src/counters.c

src/decode-events.h

src/decode-ipv4.c

src/decode-ipv6.c

src/decode-udp.c

src/decode.c

src/decode.h

src/detect-asn1.c

src/detect-bytejump.c

src/detect-bytejump.h

src/detect-bytetest.c

src/detect-bytetest.h

src/detect-classtype.c

src/detect-content.c

src/detect-dce-iface.c

src/detect-dce-opnum.c

src/detect-dce-stub-data.c

src/detect-decode-event.c

src/detect-depth.c

src/detect-detection-filter.c

src/detect-detection-filter.h

src/detect-distance.c

src/detect-engine-alert.c

src/detect-engine-iponly.c

src/detect-engine-mpm.c

src/detect-engine-mpm.h

src/detect-engine-payload.c

src/detect-engine-payload.h

src/detect-engine-port.c

src/detect-engine-proto.c

src/detect-engine-siggroup.c

src/detect-engine-siggroup.h

src/detect-engine-sigorder.c

src/detect-engine-state.c

src/detect-engine-state.h

src/detect-engine-threshold.c

src/detect-engine-threshold.h

src/detect-engine-uri.c

src/detect-engine-uri.h

src/detect-engine.c

src/detect-fast-pattern.c

src/detect-flags.c

src/detect-flow.c

src/detect-flowbits.c

src/detect-fragbits.c

src/detect-ftpbounce.c

src/detect-http-client-body.c

src/detect-http-cookie.c

src/detect-http-header.c

src/detect-http-method.c

src/detect-isdataat.c

src/detect-offset.c

src/detect-parse.c

src/detect-parse.h

src/detect-pcre.c

src/detect-pcre.h

src/detect-threshold.c

src/detect-threshold.h

src/detect-tls-version.c

src/detect-uricontent.c

src/detect-uricontent.h

src/detect-urilen.c

src/detect-within.c

src/detect.c

src/detect.h

src/flow-bit.c

src/flow-hash.c

src/flow-private.h

src/flow-queue.c

src/flow-queue.h

src/flow-util.c

src/flow-util.h

src/flow.c

src/flow.h

src/host.c

src/log-httplog.c

src/respond-reject.c

src/respond-reject.h

src/runmodes.c

src/runmodes.h

src/source-erf-file.c

src/source-ipfw.c

src/source-nfq.c

src/source-pcap-file.c

src/source-pcap.c

src/source-pfring.c

src/stream-tcp-private.h

src/stream-tcp-reassemble.c

src/stream-tcp-reassemble.h

src/stream-tcp.c

src/stream-tcp.h

src/stream.c

src/stream.h

src/suricata-common.h

src/suricata.c

src/suricata.h

src/threadvars.h

src/tm-modules.h

src/tm-queuehandlers.c

src/tm-queuehandlers.h

src/tm-threads.c

src/tmqh-packetpool.c

src/tmqh-simple.c

src/util-classification-config.c

src/util-classification-config.h

src/util-debug.c

src/util-error.c

src/util-error.h

src/util-fmemopen.c

src/util-host-os-info.c

src/util-mpm-b2g.c

src/util-mpm-b2g.h

src/util-mpm.c

src/util-mpm.h

src/util-profiling.c

src/util-profiling.h

src/util-radix-tree.c

src/util-spm-bm.c

src/util-spm-bm.h

src/util-threshold-config.c

src/util-unittest-helper.c

src/util-unittest-helper.h

suricata.yaml

Show diffs side-by-side

added added

removed removed

src/detect-asn1.c

200

char *tok = NULL;

201

uint32_t ov_len = 0;

202

uint32_t abs_off = 0;

203

uint32_t rel_off = 0;

203

int32_t rel_off = 0;

204

uint8_t flags = 0;

205

206

tok = strtok(asn1str, ASN_DELIM);

244

/* get the param */

245

tok = strtok(NULL, ASN_DELIM);

246

if (tok == NULL ||

247

ByteExtractStringUint32(&rel_off, 10, 0, tok) <= 0)

247

ByteExtractStringInt32(&rel_off, 10, 0, tok) <= 0)

248

{

249

SCLogError(SC_ERR_INVALID_VALUE, "Malformed value for "

250

"relative_offset: %s", tok);

1217

return result;

1218

}

1219

1220

/**

1221

* \test DetectAsn1TestReal04 like the real test 02, but modified the

1222

* relative offset to check negative offset values, in this case

1223

* start decoding from -7 bytes respect the content match "John"

1224

1225

int DetectAsn1TestReal04(void) {

1226

int result = 0;

1227

uint8_t *buf = (uint8_t *) "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01"

1228

"P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"

1229

"\x42\x01\x33\xA1\x0A\x43\x08""19710917"

1230

"\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"

1231

"Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"

1232

"T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111"

1233

"\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05"

1234

"Jones""\xA0\x0A\x43\x08""19590717"

1235

"\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P"

1236

"\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"

1237

"\x42\x01\x33\xA1\x0A\x43\x08""19710917"

1238

"\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"

1239

"Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"

1240

"T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F"

1241

"\x61\x11\x1A\x05""Pablo""\x1A\x01""B""\x1A\x05""Jones"

1242

"\xA0\x0A\x43\x08""19590717";

1243

1244

uint16_t buflen = strlen((char *)buf) - 1;

1245

1246

/* Check the start with AA (this is to test the relative_offset keyword) */

1247

uint8_t *buf2 = (uint8_t *) "AA\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01"

1248

"P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"

1249

"\x42\x01\x33\xA1\x0A\x43\x08""19710917"

1250

"\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"

1251

"Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"

1252

"T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111"

1253

"\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05"

1254

"Jones""\xA0\x0A\x43\x08""19590717"

1255

"\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P"

1256

"\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director"

1257

"\x42\x01\x33\xA1\x0A\x43\x08""19710917"

1258

"\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05"

1259

"Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01"

1260

"T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F"

1261

"\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05""Jones"

1262

"\xA0\x0A\x43\x08""19590717";

1263

1264

uint16_t buflen2 = strlen((char *)buf2) - 1;

1265

1266

Packet *p[2];

1267

1268

p[0] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);

1269

p[1] = UTHBuildPacket((uint8_t *)buf2, buflen2, IPPROTO_TCP);

1270

1271

if (p[0] == NULL || p[1] == NULL)

1272

goto end;

1273

1274

char *sigs[3];

1275

sigs[0]= "alert ip any any -> any any (msg:\"Testing id 1\"; "

1276

"content:\"Pablo\"; asn1:absolute_offset 0, "

1277

"oversize_length 140; sid:1;)";

1278

sigs[1]= "alert ip any any -> any any (msg:\"Testing id 2\"; "

1279

"content:\"John\"; asn1:relative_offset -7, "

1280

"oversize_length 140; sid:2;)";

1281

sigs[2]= "alert ip any any -> any any (msg:\"Testing id 3\"; "

1282

"content:\"lalala\"; asn1: oversize_length 2000; sid:3;)";

1283

1284

uint32_t sid[3] = {1, 2, 3};

1285

1286

uint32_t results[2][3] = {

1287

{0, 0, 0},

1288

{0, 0, 0}};

1289

/* None of the packets should match */

1290

1291

result = UTHGenericTest(p, 2, sigs, sid, (uint32_t *) results, 3);

1292

1293

UTHFreePackets(p, 2);

1294

end:

1295

return result;

1296

}

1297

1220

1298

#endif /* UNITTESTS */

1221

1299

1222

1300

/**

1251

1329

UtRegisterTest("DetectAsn1TestReal01", DetectAsn1TestReal01, 1);

1252

1330

UtRegisterTest("DetectAsn1TestReal02", DetectAsn1TestReal02, 1);

1253

1331

UtRegisterTest("DetectAsn1TestReal03", DetectAsn1TestReal03, 1);

1332

UtRegisterTest("DetectAsn1TestReal04", DetectAsn1TestReal04, 1);

1254

1333

1255

1334

#endif /* UNITTESTS */

1256

1335

}

Older »