/src/suricata8/src/detect-engine-address-ipv4.c
Line | Count | Source |
1 | | /* Copyright (C) 2007-2010 Open Information Security Foundation |
2 | | * |
3 | | * You can copy, redistribute or modify this Program under the terms of |
4 | | * the GNU General Public License version 2 as published by the Free |
5 | | * Software Foundation. |
6 | | * |
7 | | * This program is distributed in the hope that it will be useful, |
8 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
9 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
10 | | * GNU General Public License for more details. |
11 | | * |
12 | | * You should have received a copy of the GNU General Public License |
13 | | * version 2 along with this program; if not, write to the Free Software |
14 | | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
15 | | * 02110-1301, USA. |
16 | | */ |
17 | | |
18 | | /** |
19 | | * \file |
20 | | * |
21 | | * \author Victor Julien <victor@inliniac.net> |
22 | | * |
23 | | * IPV4 Address part of the detection engine. |
24 | | */ |
25 | | |
26 | | #include "suricata-common.h" |
27 | | |
28 | | #include "decode.h" |
29 | | #include "detect.h" |
30 | | #include "flow-var.h" |
31 | | |
32 | | #include "util-cidr.h" |
33 | | #include "util-unittest.h" |
34 | | |
35 | | #include "detect-engine-address.h" |
36 | | #include "detect-engine-address-ipv4.h" |
37 | | #include "detect-engine-siggroup.h" |
38 | | #include "detect-engine-port.h" |
39 | | |
40 | | #include "util-error.h" |
41 | | #include "util-debug.h" |
42 | | |
43 | | /** |
44 | | * \brief Compares 2 addresses(address ranges) and returns the relationship |
45 | | * between the 2 addresses. |
46 | | * |
47 | | * \param a Pointer to the first address instance to be compared. |
48 | | * \param b Pointer to the second address instance to be compared. |
49 | | * |
50 | | * \retval ADDRESS_EQ If the 2 address ranges a and b, are equal. |
51 | | * \retval ADDRESS_ES b encapsulates a. b_ip1[...a_ip1...a_ip2...]b_ip2. |
52 | | * \retval ADDRESS_EB a encapsulates b. a_ip1[...b_ip1....b_ip2...]a_ip2. |
53 | | * \retval ADDRESS_LE a_ip1(...b_ip1==a_ip2...)b_ip2 |
54 | | * \retval ADDRESS_LT a_ip1(...b_ip1...a_ip2...)b_ip2 |
55 | | * \retval ADDRESS_GE b_ip1(...a_ip1==b_ip2...)a_ip2 |
56 | | * \retval ADDRESS_GT a_ip1 > b_ip2, i.e. the address range for 'a' starts only |
57 | | * after the end of the address range for 'b' |
58 | | */ |
59 | | int DetectAddressCmpIPv4(DetectAddress *a, DetectAddress *b) |
60 | 686k | { |
61 | 686k | uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]); |
62 | 686k | uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]); |
63 | 686k | uint32_t b_ip1 = SCNtohl(b->ip.addr_data32[0]); |
64 | 686k | uint32_t b_ip2 = SCNtohl(b->ip2.addr_data32[0]); |
65 | | |
66 | 686k | if (a_ip1 == b_ip1 && a_ip2 == b_ip2) { |
67 | 25.2k | SCLogDebug("ADDRESS_EQ"); |
68 | 25.2k | return ADDRESS_EQ; |
69 | 661k | } else if (a_ip1 >= b_ip1 && a_ip1 <= b_ip2 && a_ip2 <= b_ip2) { |
70 | 26.6k | SCLogDebug("ADDRESS_ES"); |
71 | 26.6k | return ADDRESS_ES; |
72 | 635k | } else if (a_ip1 <= b_ip1 && a_ip2 >= b_ip2) { |
73 | 36.9k | SCLogDebug("ADDRESS_EB"); |
74 | 36.9k | return ADDRESS_EB; |
75 | 598k | } else if (a_ip1 < b_ip1 && a_ip2 < b_ip2 && a_ip2 >= b_ip1) { |
76 | 985 | SCLogDebug("ADDRESS_LE"); |
77 | 985 | return ADDRESS_LE; |
78 | 597k | } else if (a_ip1 < b_ip1 && a_ip2 < b_ip2) { |
79 | 113k | SCLogDebug("ADDRESS_LT"); |
80 | 113k | return ADDRESS_LT; |
81 | 483k | } else if (a_ip1 > b_ip1 && a_ip1 <= b_ip2 && a_ip2 > b_ip2) { |
82 | 985 | SCLogDebug("ADDRESS_GE"); |
83 | 985 | return ADDRESS_GE; |
84 | 482k | } else if (a_ip1 > b_ip2) { |
85 | 482k | SCLogDebug("ADDRESS_GT"); |
86 | 482k | return ADDRESS_GT; |
87 | 482k | } else { |
88 | | /* should be unreachable */ |
89 | 0 | SCLogDebug("Internal Error: should be unreachable"); |
90 | 0 | } |
91 | | |
92 | 0 | return ADDRESS_ER; |
93 | 686k | } |
94 | | |
95 | | /** |
96 | | * \brief Cut groups and merge sigs |
97 | | * |
98 | | * a = 1.2.3.4, b = 1.2.3.4-1.2.3.5 |
99 | | * must result in: a == 1.2.3.4, b == 1.2.3.5, c == NULL |
100 | | * |
101 | | * a = 1.2.3.4, b = 1.2.3.3-1.2.3.5 |
102 | | * must result in: a == 1.2.3.3, b == 1.2.3.4, c == 1.2.3.5 |
103 | | * |
104 | | * a = 1.2.3.0/24 b = 1.2.3.128-1.2.4.10 |
105 | | * must result in: a == 1.2.3.0/24, b == 1.2.4.0-1.2.4.10, c == NULL |
106 | | * |
107 | | * a = 1.2.3.4, b = 1.2.3.0/24 |
108 | | * must result in: a == 1.2.3.0-1.2.3.3, b == 1.2.3.4, c == 1.2.3.5-1.2.3.255 |
109 | | * |
110 | | * \retval 0 On success. |
111 | | * \retval -1 On failure. |
112 | | */ |
113 | | int DetectAddressCutIPv4(DetectEngineCtx *de_ctx, DetectAddress *a, |
114 | | DetectAddress *b, DetectAddress **c) |
115 | 27.6k | { |
116 | 27.6k | uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]); |
117 | 27.6k | uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]); |
118 | 27.6k | uint32_t b_ip1 = SCNtohl(b->ip.addr_data32[0]); |
119 | 27.6k | uint32_t b_ip2 = SCNtohl(b->ip2.addr_data32[0]); |
120 | 27.6k | DetectAddress *tmp = NULL; |
121 | 27.6k | DetectAddress *tmp_c = NULL; |
122 | 27.6k | int r = 0; |
123 | | |
124 | | /* default to NULL */ |
125 | 27.6k | *c = NULL; |
126 | | |
127 | 27.6k | r = DetectAddressCmpIPv4(a, b); |
128 | 27.6k | if (r != ADDRESS_ES && r != ADDRESS_EB && r != ADDRESS_LE && r != ADDRESS_GE) { |
129 | 0 | SCLogDebug("we shouldn't be here"); |
130 | 0 | goto error; |
131 | 0 | } |
132 | | |
133 | | /* get a place to temporary put sigs lists */ |
134 | 27.6k | tmp = DetectAddressInit(); |
135 | 27.6k | if (tmp == NULL) |
136 | 0 | goto error; |
137 | | |
138 | | /* we have 3 parts: [aaa[abab)bbb] |
139 | | * part a: a_ip1 <-> b_ip1 - 1 |
140 | | * part b: b_ip1 <-> a_ip2 |
141 | | * part c: a_ip2 + 1 <-> b_ip2 |
142 | | */ |
143 | 27.6k | if (r == ADDRESS_LE) { |
144 | 628 | SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_LE"); |
145 | | |
146 | 628 | a->ip.addr_data32[0] = htonl(a_ip1); |
147 | 628 | a->ip2.addr_data32[0] = htonl(b_ip1 - 1); |
148 | | |
149 | 628 | b->ip.addr_data32[0] = htonl(b_ip1); |
150 | 628 | b->ip2.addr_data32[0] = htonl(a_ip2); |
151 | | |
152 | 628 | tmp_c = DetectAddressInit(); |
153 | 628 | if (tmp_c == NULL) |
154 | 0 | goto error; |
155 | | |
156 | 628 | tmp_c->ip.family = AF_INET; |
157 | 628 | tmp_c->ip.addr_data32[0] = htonl(a_ip2 + 1); |
158 | 628 | tmp_c->ip2.addr_data32[0] = htonl(b_ip2); |
159 | 628 | *c = tmp_c; |
160 | | |
161 | | /* we have 3 parts: [bbb[baba]aaa] |
162 | | * part a: b_ip1 <-> a_ip1 - 1 |
163 | | * part b: a_ip1 <-> b_ip2 |
164 | | * part c: b_ip2 + 1 <-> a_ip2 |
165 | | */ |
166 | 27.0k | } else if (r == ADDRESS_GE) { |
167 | 356 | SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_GE"); |
168 | | |
169 | 356 | a->ip.addr_data32[0] = htonl(b_ip1); |
170 | 356 | a->ip2.addr_data32[0] = htonl(a_ip1 - 1); |
171 | | |
172 | 356 | b->ip.addr_data32[0] = htonl(a_ip1); |
173 | 356 | b->ip2.addr_data32[0] = htonl(b_ip2); |
174 | | |
175 | 356 | tmp_c = DetectAddressInit(); |
176 | 356 | if (tmp_c == NULL) |
177 | 0 | goto error; |
178 | | |
179 | 356 | tmp_c->ip.family = AF_INET; |
180 | 356 | tmp_c->ip.addr_data32[0] = htonl(b_ip2 + 1); |
181 | 356 | tmp_c->ip2.addr_data32[0] = htonl(a_ip2); |
182 | 356 | *c = tmp_c; |
183 | | |
184 | | /* we have 2 or three parts: |
185 | | * |
186 | | * 2 part: [[abab]bbb] or [bbb[baba]] |
187 | | * part a: a_ip1 <-> a_ip2 |
188 | | * part b: a_ip2 + 1 <-> b_ip2 |
189 | | * |
190 | | * part a: b_ip1 <-> a_ip1 - 1 |
191 | | * part b: a_ip1 <-> a_ip2 |
192 | | * |
193 | | * 3 part [bbb[aaa]bbb] |
194 | | * becomes[aaa[bbb]ccc] |
195 | | * |
196 | | * part a: b_ip1 <-> a_ip1 - 1 |
197 | | * part b: a_ip1 <-> a_ip2 |
198 | | * part c: a_ip2 + 1 <-> b_ip2 |
199 | | */ |
200 | 26.6k | } else if (r == ADDRESS_ES) { |
201 | 16.0k | SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_ES"); |
202 | | |
203 | 16.0k | if (a_ip1 == b_ip1) { |
204 | 10.0k | SCLogDebug("DetectAddressCutIPv4: 1"); |
205 | | |
206 | 10.0k | a->ip.addr_data32[0] = htonl(a_ip1); |
207 | 10.0k | a->ip2.addr_data32[0] = htonl(a_ip2); |
208 | | |
209 | 10.0k | b->ip.addr_data32[0] = htonl(a_ip2 + 1); |
210 | 10.0k | b->ip2.addr_data32[0] = htonl(b_ip2); |
211 | | |
212 | 10.0k | } else if (a_ip2 == b_ip2) { |
213 | 1.29k | SCLogDebug("DetectAddressCutIPv4: 2"); |
214 | | |
215 | 1.29k | a->ip.addr_data32[0] = htonl(b_ip1); |
216 | 1.29k | a->ip2.addr_data32[0] = htonl(a_ip1 - 1); |
217 | | |
218 | 1.29k | b->ip.addr_data32[0] = htonl(a_ip1); |
219 | 1.29k | b->ip2.addr_data32[0] = htonl(a_ip2); |
220 | | |
221 | 4.72k | } else { |
222 | 4.72k | SCLogDebug("3"); |
223 | | |
224 | 4.72k | a->ip.addr_data32[0] = htonl(b_ip1); |
225 | 4.72k | a->ip2.addr_data32[0] = htonl(a_ip1 - 1); |
226 | | |
227 | 4.72k | b->ip.addr_data32[0] = htonl(a_ip1); |
228 | 4.72k | b->ip2.addr_data32[0] = htonl(a_ip2); |
229 | | |
230 | 4.72k | tmp_c = DetectAddressInit(); |
231 | 4.72k | if (tmp_c == NULL) |
232 | 0 | goto error; |
233 | | |
234 | 4.72k | tmp_c->ip.family = AF_INET; |
235 | 4.72k | tmp_c->ip.addr_data32[0] = htonl(a_ip2 + 1); |
236 | 4.72k | tmp_c->ip2.addr_data32[0] = htonl(b_ip2); |
237 | 4.72k | *c = tmp_c; |
238 | 4.72k | } |
239 | | /* we have 2 or three parts: |
240 | | * |
241 | | * 2 part: [[baba]aaa] or [aaa[abab]] |
242 | | * part a: b_ip1 <-> b_ip2 |
243 | | * part b: b_ip2 + 1 <-> a_ip2 |
244 | | * |
245 | | * part a: a_ip1 <-> b_ip1 - 1 |
246 | | * part b: b_ip1 <-> b_ip2 |
247 | | * |
248 | | * 3 part [aaa[bbb]aaa] |
249 | | * becomes[aaa[bbb]ccc] |
250 | | * |
251 | | * part a: a_ip1 <-> b_ip2 - 1 |
252 | | * part b: b_ip1 <-> b_ip2 |
253 | | * part c: b_ip2 + 1 <-> a_ip2 |
254 | | */ |
255 | 16.0k | } else if (r == ADDRESS_EB) { |
256 | 10.5k | SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_EB"); |
257 | | |
258 | 10.5k | if (a_ip1 == b_ip1) { |
259 | 4.16k | SCLogDebug("DetectAddressCutIPv4: 1"); |
260 | | |
261 | 4.16k | a->ip.addr_data32[0] = htonl(b_ip1); |
262 | 4.16k | a->ip2.addr_data32[0] = htonl(b_ip2); |
263 | | |
264 | 4.16k | b->ip.addr_data32[0] = htonl(b_ip2 + 1); |
265 | 4.16k | b->ip2.addr_data32[0] = htonl(a_ip2); |
266 | 6.41k | } else if (a_ip2 == b_ip2) { |
267 | 664 | SCLogDebug("DetectAddressCutIPv4: 2"); |
268 | | |
269 | 664 | a->ip.addr_data32[0] = htonl(a_ip1); |
270 | 664 | a->ip2.addr_data32[0] = htonl(b_ip1 - 1); |
271 | | |
272 | 664 | b->ip.addr_data32[0] = htonl(b_ip1); |
273 | 664 | b->ip2.addr_data32[0] = htonl(b_ip2); |
274 | 5.74k | } else { |
275 | 5.74k | SCLogDebug("DetectAddressCutIPv4: 3"); |
276 | | |
277 | 5.74k | a->ip.addr_data32[0] = htonl(a_ip1); |
278 | 5.74k | a->ip2.addr_data32[0] = htonl(b_ip1 - 1); |
279 | | |
280 | 5.74k | b->ip.addr_data32[0] = htonl(b_ip1); |
281 | 5.74k | b->ip2.addr_data32[0] = htonl(b_ip2); |
282 | | |
283 | 5.74k | tmp_c = DetectAddressInit(); |
284 | 5.74k | if (tmp_c == NULL) |
285 | 0 | goto error; |
286 | | |
287 | 5.74k | tmp_c->ip.family = AF_INET; |
288 | 5.74k | tmp_c->ip.addr_data32[0] = htonl(b_ip2 + 1); |
289 | 5.74k | tmp_c->ip2.addr_data32[0] = htonl(a_ip2); |
290 | 5.74k | *c = tmp_c; |
291 | 5.74k | } |
292 | 10.5k | } |
293 | | |
294 | 27.6k | if (tmp != NULL) |
295 | 27.6k | DetectAddressFree(tmp); |
296 | | |
297 | 27.6k | return 0; |
298 | | |
299 | 0 | error: |
300 | 0 | if (tmp != NULL) |
301 | 0 | DetectAddressFree(tmp); |
302 | 0 | return -1; |
303 | 27.6k | } |
304 | | |
305 | | /** |
306 | | * \brief Check if the address group list covers the complete IPv4 IP space. |
307 | | * |
308 | | * \param ag Pointer to a DetectAddress list head, which has to be checked to |
309 | | * see if the address ranges in it, cover the entire IPv4 IP space. |
310 | | * |
311 | | * \retval 1 Yes, it covers the entire IPv4 address range. |
312 | | * \retval 0 No, it doesn't cover the entire IPv4 address range. |
313 | | */ |
314 | | int DetectAddressIsCompleteIPSpaceIPv4(DetectAddress *ag) |
315 | 101k | { |
316 | 101k | uint32_t next_ip = 0; |
317 | | |
318 | 101k | if (ag == NULL) |
319 | 97.2k | return 0; |
320 | | |
321 | | /* if we don't start with 0.0.0.0 we know we're good */ |
322 | 4.11k | if (SCNtohl(ag->ip.addr_data32[0]) != 0x00000000) |
323 | 2.69k | return 0; |
324 | | |
325 | | /* if we're ending with 255.255.255.255 while we know we started with |
326 | | * 0.0.0.0 it's the complete space */ |
327 | 1.42k | if (SCNtohl(ag->ip2.addr_data32[0]) == 0xFFFFFFFF) |
328 | 200 | return 1; |
329 | | |
330 | 1.22k | next_ip = htonl(SCNtohl(ag->ip2.addr_data32[0]) + 1); |
331 | 1.22k | ag = ag->next; |
332 | | |
333 | 2.67k | for ( ; ag != NULL; ag = ag->next) { |
334 | | |
335 | 2.57k | if (ag->ip.addr_data32[0] != next_ip) |
336 | 1.05k | return 0; |
337 | | |
338 | 1.52k | if (SCNtohl(ag->ip2.addr_data32[0]) == 0xFFFFFFFF) |
339 | 64 | return 1; |
340 | | |
341 | 1.45k | next_ip = htonl(SCNtohl(ag->ip2.addr_data32[0]) + 1); |
342 | 1.45k | } |
343 | | |
344 | 104 | return 0; |
345 | 1.22k | } |
346 | | |
347 | | /** |
348 | | * \brief Cuts and returns an address range, which is the complement of the |
349 | | * address range that is supplied as the argument. |
350 | | * |
351 | | * For example: |
352 | | * |
353 | | * If a = 0.0.0.0-1.2.3.4, |
354 | | * then a = 1.2.3.4-255.255.255.255 and b = NULL |
355 | | * If a = 1.2.3.4-255.255.255.255, |
356 | | * then a = 0.0.0.0-1.2.3.4 and b = NULL |
357 | | * If a = 1.2.3.4-192.168.1.1, |
358 | | * then a = 0.0.0.0-1.2.3.3 and b = 192.168.1.2-255.255.255.255 |
359 | | * |
360 | | * \param a Pointer to an address range (DetectAddress) instance whose complement |
361 | | * has to be returned in a and b. |
362 | | * \param b Pointer to DetectAddress pointer, that will be supplied back with a |
363 | | * new DetectAddress instance, if the complement demands so. |
364 | | * |
365 | | * \retval 0 On success. |
366 | | * \retval -1 On failure. |
367 | | */ |
368 | | int DetectAddressCutNotIPv4(DetectAddress *a, DetectAddress **b) |
369 | 1.02k | { |
370 | 1.02k | uint32_t a_ip1 = SCNtohl(a->ip.addr_data32[0]); |
371 | 1.02k | uint32_t a_ip2 = SCNtohl(a->ip2.addr_data32[0]); |
372 | 1.02k | DetectAddress *tmp_b = NULL; |
373 | | |
374 | | /* default to NULL */ |
375 | 1.02k | *b = NULL; |
376 | | |
377 | 1.02k | if (a_ip1 != 0x00000000 && a_ip2 != 0xFFFFFFFF) { |
378 | 949 | a->ip.addr_data32[0] = htonl(0x00000000); |
379 | 949 | a->ip2.addr_data32[0] = htonl(a_ip1 - 1); |
380 | | |
381 | 949 | tmp_b = DetectAddressInit(); |
382 | 949 | if (tmp_b == NULL) |
383 | 0 | goto error; |
384 | | |
385 | 949 | tmp_b->ip.family = AF_INET; |
386 | 949 | tmp_b->ip.addr_data32[0] = htonl(a_ip2 + 1); |
387 | 949 | tmp_b->ip2.addr_data32[0] = htonl(0xFFFFFFFF); |
388 | 949 | *b = tmp_b; |
389 | 949 | } else if (a_ip1 == 0x00000000 && a_ip2 != 0xFFFFFFFF) { |
390 | 34 | a->ip.addr_data32[0] = htonl(a_ip2 + 1); |
391 | 34 | a->ip2.addr_data32[0] = htonl(0xFFFFFFFF); |
392 | 42 | } else if (a_ip1 != 0x00000000 && a_ip2 == 0xFFFFFFFF) { |
393 | 41 | a->ip.addr_data32[0] = htonl(0x00000000); |
394 | 41 | a->ip2.addr_data32[0] = htonl(a_ip1 - 1); |
395 | 41 | } else { |
396 | 1 | goto error; |
397 | 1 | } |
398 | | |
399 | 1.02k | return 0; |
400 | | |
401 | 1 | error: |
402 | 1 | return -1; |
403 | 1.02k | } |
404 | | |
405 | | /********************************Unittests*************************************/ |
406 | | |
407 | | #ifdef UNITTESTS |
408 | | |
409 | | static int DetectAddressIPv4TestAddressCmp01(void) |
410 | | { |
411 | | struct in_addr in; |
412 | | |
413 | | DetectAddress *a = DetectAddressInit(); |
414 | | FAIL_IF_NULL(a); |
415 | | |
416 | | DetectAddress *b = DetectAddressInit(); |
417 | | FAIL_IF_NULL(b); |
418 | | |
419 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
420 | | a->ip.addr_data32[0] = in.s_addr; |
421 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
422 | | a->ip2.addr_data32[0] = in.s_addr; |
423 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
424 | | b->ip.addr_data32[0] = in.s_addr; |
425 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
426 | | b->ip2.addr_data32[0] = in.s_addr; |
427 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_EQ); |
428 | | |
429 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
430 | | a->ip.addr_data32[0] = in.s_addr; |
431 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
432 | | a->ip2.addr_data32[0] = in.s_addr; |
433 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0); |
434 | | b->ip.addr_data32[0] = in.s_addr; |
435 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
436 | | b->ip2.addr_data32[0] = in.s_addr; |
437 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_ES); |
438 | | |
439 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
440 | | a->ip.addr_data32[0] = in.s_addr; |
441 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
442 | | a->ip2.addr_data32[0] = in.s_addr; |
443 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
444 | | b->ip.addr_data32[0] = in.s_addr; |
445 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
446 | | b->ip2.addr_data32[0] = in.s_addr; |
447 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_ES); |
448 | | |
449 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
450 | | a->ip.addr_data32[0] = in.s_addr; |
451 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
452 | | a->ip2.addr_data32[0] = in.s_addr; |
453 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0); |
454 | | b->ip.addr_data32[0] = in.s_addr; |
455 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
456 | | b->ip2.addr_data32[0] = in.s_addr; |
457 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_ES); |
458 | | |
459 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
460 | | a->ip.addr_data32[0] = in.s_addr; |
461 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
462 | | a->ip2.addr_data32[0] = in.s_addr; |
463 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0); |
464 | | b->ip.addr_data32[0] = in.s_addr; |
465 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
466 | | b->ip2.addr_data32[0] = in.s_addr; |
467 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_ES); |
468 | | |
469 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
470 | | a->ip.addr_data32[0] = in.s_addr; |
471 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
472 | | a->ip2.addr_data32[0] = in.s_addr; |
473 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
474 | | b->ip.addr_data32[0] = in.s_addr; |
475 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
476 | | b->ip2.addr_data32[0] = in.s_addr; |
477 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_ES); |
478 | | |
479 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
480 | | a->ip.addr_data32[0] = in.s_addr; |
481 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
482 | | a->ip2.addr_data32[0] = in.s_addr; |
483 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
484 | | b->ip.addr_data32[0] = in.s_addr; |
485 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
486 | | b->ip2.addr_data32[0] = in.s_addr; |
487 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_EB); |
488 | | |
489 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0); |
490 | | a->ip.addr_data32[0] = in.s_addr; |
491 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
492 | | a->ip2.addr_data32[0] = in.s_addr; |
493 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
494 | | b->ip.addr_data32[0] = in.s_addr; |
495 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
496 | | b->ip2.addr_data32[0] = in.s_addr; |
497 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_EB); |
498 | | |
499 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0); |
500 | | a->ip.addr_data32[0] = in.s_addr; |
501 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
502 | | a->ip2.addr_data32[0] = in.s_addr; |
503 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
504 | | b->ip.addr_data32[0] = in.s_addr; |
505 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
506 | | b->ip2.addr_data32[0] = in.s_addr; |
507 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_EB); |
508 | | |
509 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.5", &in) < 0); |
510 | | a->ip.addr_data32[0] = in.s_addr; |
511 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
512 | | a->ip2.addr_data32[0] = in.s_addr; |
513 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
514 | | b->ip.addr_data32[0] = in.s_addr; |
515 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
516 | | b->ip2.addr_data32[0] = in.s_addr; |
517 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_EB); |
518 | | |
519 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0); |
520 | | a->ip.addr_data32[0] = in.s_addr; |
521 | | FAIL_IF(inet_pton(AF_INET, "128.128.128.128", &in) < 0); |
522 | | a->ip2.addr_data32[0] = in.s_addr; |
523 | | FAIL_IF(inet_pton(AF_INET, "128.128.128.128", &in) < 0); |
524 | | b->ip.addr_data32[0] = in.s_addr; |
525 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
526 | | b->ip2.addr_data32[0] = in.s_addr; |
527 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_LE); |
528 | | |
529 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0); |
530 | | a->ip.addr_data32[0] = in.s_addr; |
531 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
532 | | a->ip2.addr_data32[0] = in.s_addr; |
533 | | FAIL_IF(inet_pton(AF_INET, "128.128.128.128", &in) < 0); |
534 | | b->ip.addr_data32[0] = in.s_addr; |
535 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
536 | | b->ip2.addr_data32[0] = in.s_addr; |
537 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_LE); |
538 | | |
539 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
540 | | a->ip.addr_data32[0] = in.s_addr; |
541 | | FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0); |
542 | | a->ip2.addr_data32[0] = in.s_addr; |
543 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
544 | | b->ip.addr_data32[0] = in.s_addr; |
545 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
546 | | b->ip2.addr_data32[0] = in.s_addr; |
547 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_LE); |
548 | | |
549 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.169", &in) < 0); |
550 | | a->ip.addr_data32[0] = in.s_addr; |
551 | | FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0); |
552 | | a->ip2.addr_data32[0] = in.s_addr; |
553 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
554 | | b->ip.addr_data32[0] = in.s_addr; |
555 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
556 | | b->ip2.addr_data32[0] = in.s_addr; |
557 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_LE); |
558 | | |
559 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.169", &in) < 0); |
560 | | a->ip.addr_data32[0] = in.s_addr; |
561 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
562 | | a->ip2.addr_data32[0] = in.s_addr; |
563 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
564 | | b->ip.addr_data32[0] = in.s_addr; |
565 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
566 | | b->ip2.addr_data32[0] = in.s_addr; |
567 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_LE); |
568 | | |
569 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
570 | | a->ip.addr_data32[0] = in.s_addr; |
571 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
572 | | a->ip2.addr_data32[0] = in.s_addr; |
573 | | FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0); |
574 | | b->ip.addr_data32[0] = in.s_addr; |
575 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
576 | | b->ip2.addr_data32[0] = in.s_addr; |
577 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_LT); |
578 | | |
579 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
580 | | a->ip.addr_data32[0] = in.s_addr; |
581 | | FAIL_IF(inet_pton(AF_INET, "185.185.185.185", &in) < 0); |
582 | | a->ip2.addr_data32[0] = in.s_addr; |
583 | | FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0); |
584 | | b->ip.addr_data32[0] = in.s_addr; |
585 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
586 | | b->ip2.addr_data32[0] = in.s_addr; |
587 | | /* we could get a LE */ |
588 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_LT); |
589 | | |
590 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
591 | | a->ip.addr_data32[0] = in.s_addr; |
592 | | FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0); |
593 | | a->ip2.addr_data32[0] = in.s_addr; |
594 | | FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0); |
595 | | b->ip.addr_data32[0] = in.s_addr; |
596 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
597 | | b->ip2.addr_data32[0] = in.s_addr; |
598 | | /* we could get a LE */ |
599 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_LT); |
600 | | |
601 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
602 | | a->ip.addr_data32[0] = in.s_addr; |
603 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
604 | | a->ip2.addr_data32[0] = in.s_addr; |
605 | | FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0); |
606 | | b->ip.addr_data32[0] = in.s_addr; |
607 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
608 | | b->ip2.addr_data32[0] = in.s_addr; |
609 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_LT); |
610 | | |
611 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
612 | | a->ip.addr_data32[0] = in.s_addr; |
613 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
614 | | a->ip2.addr_data32[0] = in.s_addr; |
615 | | FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0); |
616 | | b->ip.addr_data32[0] = in.s_addr; |
617 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
618 | | b->ip2.addr_data32[0] = in.s_addr; |
619 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_LT); |
620 | | |
621 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
622 | | a->ip.addr_data32[0] = in.s_addr; |
623 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
624 | | a->ip2.addr_data32[0] = in.s_addr; |
625 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
626 | | b->ip.addr_data32[0] = in.s_addr; |
627 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
628 | | b->ip2.addr_data32[0] = in.s_addr; |
629 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_LT); |
630 | | |
631 | | FAIL_IF(inet_pton(AF_INET, "128.128.128.128", &in) < 0); |
632 | | a->ip.addr_data32[0] = in.s_addr; |
633 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
634 | | a->ip2.addr_data32[0] = in.s_addr; |
635 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0); |
636 | | b->ip.addr_data32[0] = in.s_addr; |
637 | | FAIL_IF(inet_pton(AF_INET, "128.128.128.128", &in) < 0); |
638 | | b->ip2.addr_data32[0] = in.s_addr; |
639 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_GE); |
640 | | |
641 | | FAIL_IF(inet_pton(AF_INET, "128.128.128.128", &in) < 0); |
642 | | a->ip.addr_data32[0] = in.s_addr; |
643 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
644 | | a->ip2.addr_data32[0] = in.s_addr; |
645 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0); |
646 | | b->ip.addr_data32[0] = in.s_addr; |
647 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
648 | | b->ip2.addr_data32[0] = in.s_addr; |
649 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_GE); |
650 | | |
651 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
652 | | a->ip.addr_data32[0] = in.s_addr; |
653 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
654 | | a->ip2.addr_data32[0] = in.s_addr; |
655 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
656 | | b->ip.addr_data32[0] = in.s_addr; |
657 | | FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0); |
658 | | b->ip2.addr_data32[0] = in.s_addr; |
659 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_GE); |
660 | | |
661 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
662 | | a->ip.addr_data32[0] = in.s_addr; |
663 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
664 | | a->ip2.addr_data32[0] = in.s_addr; |
665 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.169", &in) < 0); |
666 | | b->ip.addr_data32[0] = in.s_addr; |
667 | | FAIL_IF(inet_pton(AF_INET, "180.180.180.180", &in) < 0); |
668 | | b->ip2.addr_data32[0] = in.s_addr; |
669 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_GE); |
670 | | |
671 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.169", &in) < 0); |
672 | | a->ip.addr_data32[0] = in.s_addr; |
673 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
674 | | a->ip2.addr_data32[0] = in.s_addr; |
675 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
676 | | b->ip.addr_data32[0] = in.s_addr; |
677 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
678 | | b->ip2.addr_data32[0] = in.s_addr; |
679 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_GE); |
680 | | |
681 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
682 | | a->ip.addr_data32[0] = in.s_addr; |
683 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
684 | | a->ip2.addr_data32[0] = in.s_addr; |
685 | | FAIL_IF(inet_pton(AF_INET, "170.170.169.170", &in) < 0); |
686 | | b->ip.addr_data32[0] = in.s_addr; |
687 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.1", &in) < 0); |
688 | | b->ip2.addr_data32[0] = in.s_addr; |
689 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_GE); |
690 | | |
691 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
692 | | a->ip.addr_data32[0] = in.s_addr; |
693 | | FAIL_IF(inet_pton(AF_INET, "200.200.200.200", &in) < 0); |
694 | | a->ip2.addr_data32[0] = in.s_addr; |
695 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
696 | | b->ip.addr_data32[0] = in.s_addr; |
697 | | FAIL_IF(inet_pton(AF_INET, "185.185.185.185", &in) < 0); |
698 | | b->ip2.addr_data32[0] = in.s_addr; |
699 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) == ADDRESS_GT); |
700 | | |
701 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
702 | | a->ip.addr_data32[0] = in.s_addr; |
703 | | FAIL_IF(inet_pton(AF_INET, "200.200.200.200", &in) < 0); |
704 | | a->ip2.addr_data32[0] = in.s_addr; |
705 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
706 | | b->ip.addr_data32[0] = in.s_addr; |
707 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
708 | | b->ip2.addr_data32[0] = in.s_addr; |
709 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_GT); |
710 | | |
711 | | FAIL_IF(inet_pton(AF_INET, "182.168.1.2", &in) < 0); |
712 | | a->ip.addr_data32[0] = in.s_addr; |
713 | | FAIL_IF(inet_pton(AF_INET, "200.200.200.200", &in) < 0); |
714 | | a->ip2.addr_data32[0] = in.s_addr; |
715 | | FAIL_IF(inet_pton(AF_INET, "170.170.170.170", &in) < 0); |
716 | | b->ip.addr_data32[0] = in.s_addr; |
717 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
718 | | b->ip2.addr_data32[0] = in.s_addr; |
719 | | FAIL_IF_NOT(DetectAddressCmpIPv4(a, b) != ADDRESS_GT); |
720 | | |
721 | | DetectAddressFree(a); |
722 | | DetectAddressFree(b); |
723 | | PASS; |
724 | | } |
725 | | |
726 | | static int DetectAddressIPv4IsCompleteIPSpace02(void) |
727 | | { |
728 | | struct in_addr in; |
729 | | |
730 | | DetectAddress *a = DetectAddressInit(); |
731 | | FAIL_IF_NULL(a); |
732 | | |
733 | | FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0); |
734 | | a->ip.addr_data32[0] = in.s_addr; |
735 | | FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0); |
736 | | a->ip2.addr_data32[0] = in.s_addr; |
737 | | FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 1); |
738 | | |
739 | | FAIL_IF(inet_pton(AF_INET, "0.0.0.1", &in) < 0); |
740 | | a->ip.addr_data32[0] = in.s_addr; |
741 | | FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0); |
742 | | a->ip2.addr_data32[0] = in.s_addr; |
743 | | FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0); |
744 | | |
745 | | DetectAddressFree(a); |
746 | | |
747 | | a = DetectAddressInit(); |
748 | | FAIL_IF_NULL(a); |
749 | | |
750 | | FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0); |
751 | | a->ip.addr_data32[0] = in.s_addr; |
752 | | FAIL_IF(inet_pton(AF_INET, "255.255.255.254", &in) < 0); |
753 | | a->ip2.addr_data32[0] = in.s_addr; |
754 | | FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0); |
755 | | |
756 | | DetectAddressFree(a); |
757 | | |
758 | | PASS; |
759 | | } |
760 | | |
761 | | static int DetectAddressIPv4IsCompleteIPSpace03(void) |
762 | | { |
763 | | struct in_addr in; |
764 | | |
765 | | DetectAddress *a = DetectAddressInit(); |
766 | | FAIL_IF_NULL(a); |
767 | | DetectAddress *temp = a; |
768 | | |
769 | | FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0); |
770 | | a->ip.addr_data32[0] = in.s_addr; |
771 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
772 | | a->ip2.addr_data32[0] = in.s_addr; |
773 | | FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0); |
774 | | |
775 | | temp->next = DetectAddressInit(); |
776 | | FAIL_IF_NULL(temp->next); |
777 | | temp = temp->next; |
778 | | |
779 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.5", &in) < 0); |
780 | | temp->ip.addr_data32[0] = in.s_addr; |
781 | | FAIL_IF(inet_pton(AF_INET, "126.36.62.61", &in) < 0); |
782 | | temp->ip2.addr_data32[0] = in.s_addr; |
783 | | FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0); |
784 | | |
785 | | temp->next = DetectAddressInit(); |
786 | | FAIL_IF_NULL(temp->next); |
787 | | temp = temp->next; |
788 | | |
789 | | FAIL_IF(inet_pton(AF_INET, "126.36.62.62", &in) < 0); |
790 | | temp->ip.addr_data32[0] = in.s_addr; |
791 | | FAIL_IF(inet_pton(AF_INET, "222.52.21.62", &in) < 0); |
792 | | temp->ip2.addr_data32[0] = in.s_addr; |
793 | | FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0); |
794 | | |
795 | | temp->next = DetectAddressInit(); |
796 | | FAIL_IF_NULL(temp->next); |
797 | | temp = temp->next; |
798 | | |
799 | | FAIL_IF(inet_pton(AF_INET, "222.52.21.63", &in) < 0); |
800 | | temp->ip.addr_data32[0] = in.s_addr; |
801 | | FAIL_IF(inet_pton(AF_INET, "255.255.255.254", &in) < 0); |
802 | | temp->ip2.addr_data32[0] = in.s_addr; |
803 | | FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0); |
804 | | |
805 | | temp->next = DetectAddressInit(); |
806 | | FAIL_IF_NULL(temp->next); |
807 | | temp = temp->next; |
808 | | |
809 | | FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0); |
810 | | temp->ip.addr_data32[0] = in.s_addr; |
811 | | FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0); |
812 | | temp->ip2.addr_data32[0] = in.s_addr; |
813 | | FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 1); |
814 | | |
815 | | DetectAddressFree(a); |
816 | | |
817 | | PASS; |
818 | | } |
819 | | |
820 | | static int DetectAddressIPv4IsCompleteIPSpace04(void) |
821 | | { |
822 | | struct in_addr in; |
823 | | |
824 | | DetectAddress *a = DetectAddressInit(); |
825 | | FAIL_IF_NULL(a); |
826 | | DetectAddress *temp = a; |
827 | | |
828 | | FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0); |
829 | | a->ip.addr_data32[0] = in.s_addr; |
830 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
831 | | a->ip2.addr_data32[0] = in.s_addr; |
832 | | FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0); |
833 | | |
834 | | temp->next = DetectAddressInit(); |
835 | | FAIL_IF_NULL(temp->next); |
836 | | temp = temp->next; |
837 | | |
838 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.5", &in) < 0); |
839 | | temp->ip.addr_data32[0] = in.s_addr; |
840 | | FAIL_IF(inet_pton(AF_INET, "126.36.62.61", &in) < 0); |
841 | | temp->ip2.addr_data32[0] = in.s_addr; |
842 | | FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0); |
843 | | |
844 | | temp->next = DetectAddressInit(); |
845 | | FAIL_IF_NULL(temp->next); |
846 | | temp = temp->next; |
847 | | |
848 | | FAIL_IF(inet_pton(AF_INET, "126.36.62.62", &in) < 0); |
849 | | temp->ip.addr_data32[0] = in.s_addr; |
850 | | FAIL_IF(inet_pton(AF_INET, "222.52.21.62", &in) < 0); |
851 | | temp->ip2.addr_data32[0] = in.s_addr; |
852 | | FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0); |
853 | | |
854 | | temp->next = DetectAddressInit(); |
855 | | FAIL_IF_NULL(temp->next); |
856 | | temp = temp->next; |
857 | | |
858 | | FAIL_IF(inet_pton(AF_INET, "222.52.21.64", &in) < 0); |
859 | | temp->ip.addr_data32[0] = in.s_addr; |
860 | | FAIL_IF(inet_pton(AF_INET, "255.255.255.254", &in) < 0); |
861 | | temp->ip2.addr_data32[0] = in.s_addr; |
862 | | FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0); |
863 | | |
864 | | temp->next = DetectAddressInit(); |
865 | | FAIL_IF_NULL(temp->next); |
866 | | temp = temp->next; |
867 | | |
868 | | FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0); |
869 | | temp->ip.addr_data32[0] = in.s_addr; |
870 | | FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0); |
871 | | temp->ip2.addr_data32[0] = in.s_addr; |
872 | | FAIL_IF_NOT(DetectAddressIsCompleteIPSpaceIPv4(a) == 0); |
873 | | |
874 | | DetectAddressFree(a); |
875 | | |
876 | | PASS; |
877 | | } |
878 | | |
879 | | static int DetectAddressIPv4CutNot05(void) |
880 | | { |
881 | | DetectAddress *b = NULL; |
882 | | struct in_addr in; |
883 | | |
884 | | DetectAddress *a = DetectAddressInit(); |
885 | | FAIL_IF_NULL(a); |
886 | | |
887 | | FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0); |
888 | | a->ip.addr_data32[0] = in.s_addr; |
889 | | FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0); |
890 | | a->ip2.addr_data32[0] = in.s_addr; |
891 | | FAIL_IF_NOT(DetectAddressCutNotIPv4(a, &b) == -1); |
892 | | |
893 | | DetectAddressFree(a); |
894 | | DetectAddressFree(b); |
895 | | PASS; |
896 | | } |
897 | | |
898 | | static int DetectAddressIPv4CutNot06(void) |
899 | | { |
900 | | DetectAddress *b = NULL; |
901 | | struct in_addr in; |
902 | | |
903 | | DetectAddress *a = DetectAddressInit(); |
904 | | FAIL_IF_NULL(a); |
905 | | |
906 | | FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0); |
907 | | a->ip.addr_data32[0] = in.s_addr; |
908 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
909 | | a->ip2.addr_data32[0] = in.s_addr; |
910 | | FAIL_IF_NOT(DetectAddressCutNotIPv4(a, &b) == 0); |
911 | | |
912 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.5", &in) < 0); |
913 | | FAIL_IF_NOT(a->ip.addr_data32[0] == in.s_addr); |
914 | | FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0); |
915 | | FAIL_IF_NOT(a->ip2.addr_data32[0] = in.s_addr); |
916 | | |
917 | | DetectAddressFree(a); |
918 | | DetectAddressFree(b); |
919 | | PASS; |
920 | | } |
921 | | |
922 | | static int DetectAddressIPv4CutNot07(void) |
923 | | { |
924 | | DetectAddress *b = NULL; |
925 | | struct in_addr in; |
926 | | |
927 | | DetectAddress *a = DetectAddressInit(); |
928 | | FAIL_IF_NULL(a); |
929 | | |
930 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
931 | | a->ip.addr_data32[0] = in.s_addr; |
932 | | FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0); |
933 | | a->ip2.addr_data32[0] = in.s_addr; |
934 | | FAIL_IF_NOT(DetectAddressCutNotIPv4(a, &b) == 0); |
935 | | |
936 | | FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0); |
937 | | FAIL_IF_NOT(a->ip.addr_data32[0] == in.s_addr); |
938 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0); |
939 | | FAIL_IF_NOT(a->ip2.addr_data32[0] = in.s_addr); |
940 | | |
941 | | DetectAddressFree(a); |
942 | | DetectAddressFree(b); |
943 | | PASS; |
944 | | } |
945 | | |
946 | | static int DetectAddressIPv4CutNot08(void) |
947 | | { |
948 | | DetectAddress *b = NULL; |
949 | | struct in_addr in; |
950 | | |
951 | | DetectAddress *a = DetectAddressInit(); |
952 | | FAIL_IF_NULL(a); |
953 | | |
954 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
955 | | a->ip.addr_data32[0] = in.s_addr; |
956 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
957 | | a->ip2.addr_data32[0] = in.s_addr; |
958 | | FAIL_IF_NOT(DetectAddressCutNotIPv4(a, &b) == 0); |
959 | | |
960 | | FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0); |
961 | | FAIL_IF_NOT(a->ip.addr_data32[0] == in.s_addr); |
962 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0); |
963 | | FAIL_IF_NOT(a->ip2.addr_data32[0] = in.s_addr); |
964 | | |
965 | | FAIL_IF_NULL(b); |
966 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.5", &in) < 0); |
967 | | FAIL_IF_NOT(b->ip.addr_data32[0] == in.s_addr); |
968 | | FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0); |
969 | | FAIL_IF_NOT(b->ip2.addr_data32[0] = in.s_addr); |
970 | | |
971 | | DetectAddressFree(a); |
972 | | DetectAddressFree(b); |
973 | | PASS; |
974 | | } |
975 | | |
976 | | static int DetectAddressIPv4CutNot09(void) |
977 | | { |
978 | | DetectAddress *b = NULL; |
979 | | struct in_addr in; |
980 | | |
981 | | DetectAddress *a = DetectAddressInit(); |
982 | | FAIL_IF_NULL(a); |
983 | | |
984 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.4", &in) < 0); |
985 | | a->ip.addr_data32[0] = in.s_addr; |
986 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.2", &in) < 0); |
987 | | a->ip2.addr_data32[0] = in.s_addr; |
988 | | FAIL_IF_NOT(DetectAddressCutNotIPv4(a, &b) == 0); |
989 | | |
990 | | FAIL_IF(inet_pton(AF_INET, "0.0.0.0", &in) < 0); |
991 | | FAIL_IF_NOT(a->ip.addr_data32[0] == in.s_addr); |
992 | | FAIL_IF(inet_pton(AF_INET, "1.2.3.3", &in) < 0); |
993 | | FAIL_IF_NOT(a->ip2.addr_data32[0] = in.s_addr); |
994 | | |
995 | | FAIL_IF_NULL(b); |
996 | | FAIL_IF(inet_pton(AF_INET, "192.168.1.3", &in) < 0); |
997 | | FAIL_IF_NOT(b->ip.addr_data32[0] == in.s_addr); |
998 | | FAIL_IF(inet_pton(AF_INET, "255.255.255.255", &in) < 0); |
999 | | FAIL_IF_NOT(b->ip2.addr_data32[0] = in.s_addr); |
1000 | | |
1001 | | DetectAddressFree(a); |
1002 | | DetectAddressFree(b); |
1003 | | PASS; |
1004 | | } |
1005 | | |
1006 | | #endif |
1007 | | |
1008 | | void DetectAddressIPv4Tests(void) |
1009 | 0 | { |
1010 | | #ifdef UNITTESTS |
1011 | | UtRegisterTest("DetectAddressIPv4TestAddressCmp01", |
1012 | | DetectAddressIPv4TestAddressCmp01); |
1013 | | UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace02", |
1014 | | DetectAddressIPv4IsCompleteIPSpace02); |
1015 | | UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace03", |
1016 | | DetectAddressIPv4IsCompleteIPSpace03); |
1017 | | UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace04", |
1018 | | DetectAddressIPv4IsCompleteIPSpace04); |
1019 | | UtRegisterTest("DetectAddressIPv4CutNot05", DetectAddressIPv4CutNot05); |
1020 | | UtRegisterTest("DetectAddressIPv4CutNot06", DetectAddressIPv4CutNot06); |
1021 | | UtRegisterTest("DetectAddressIPv4CutNot07", DetectAddressIPv4CutNot07); |
1022 | | UtRegisterTest("DetectAddressIPv4CutNot08", DetectAddressIPv4CutNot08); |
1023 | | UtRegisterTest("DetectAddressIPv4CutNot09", DetectAddressIPv4CutNot09); |
1024 | | #endif |
1025 | 0 | } |