/* Copyright (C) 2007-2024 Open Information Security Foundation

 *

 * You can copy, redistribute or modify this Program under the terms of

 * the GNU General Public License version 2 as published by the Free

 * Software Foundation.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * version 2 along with this program; if not, write to the Free Software

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA

 * 02110-1301, USA.

 */

/**

 * \file

 *

 * \author Anoop Saldanha <anoopsaldanha@gmail.com>

 */

#include "suricata-common.h"

#include "decode.h"

#include "detect.h"

#include "detect-engine.h"

#include "detect-content.h"

#include "detect-pcre.h"

#include "detect-bytejump.h"

#include "detect-bytetest.h"

#include "detect-byte-extract.h"

#include "detect-isdataat.h"

#include "detect-engine-build.h"

#include "rust.h"

#include "app-layer-protos.h"

#include "util-byte.h"

#include "util-debug.h"

#include "util-unittest.h"

#include "util-unittest-helper.h"

/* the base to be used if string mode is specified.  These options would be

 * specified in DetectByteParseData->base */

#define DETECT_BYTE_EXTRACT_BASE_HEX BaseHex

#define DETECT_BYTE_EXTRACT_BASE_DEC BaseDec

#define DETECT_BYTE_EXTRACT_BASE_OCT BaseOct

/* the max no of bytes that can be extracted in string mode - (string, hex)

 * (string, oct) or (string, dec) */

#define STRING_MAX_BYTES_TO_EXTRACT_FOR_OCT 23

#define STRING_MAX_BYTES_TO_EXTRACT_FOR_DEC 20

#define STRING_MAX_BYTES_TO_EXTRACT_FOR_HEX 14

/* the max no of bytes that can be extracted in non-string mode */

#define NO_STRING_MAX_BYTES_TO_EXTRACT 8

static int DetectByteExtractSetup(DetectEngineCtx *, Signature *, const char *);

#ifdef UNITTESTS

static void DetectByteExtractRegisterTests(void);

#endif

static void DetectByteExtractFree(DetectEngineCtx *, void *);

/**

 * \brief Registers the keyword handlers for the "byte_extract" keyword.

 */

void DetectByteExtractRegister(void)

{

    sigmatch_table[DETECT_BYTE_EXTRACT].name = "byte_extract";

    sigmatch_table[DETECT_BYTE_EXTRACT].desc = "extract <num of bytes> at a particular <offset> and store it in <var_name>";

    sigmatch_table[DETECT_BYTE_EXTRACT].url = "/rules/payload-keywords.html#byte-extract";

    sigmatch_table[DETECT_BYTE_EXTRACT].Match = NULL;

    sigmatch_table[DETECT_BYTE_EXTRACT].Setup = DetectByteExtractSetup;

    sigmatch_table[DETECT_BYTE_EXTRACT].Free = DetectByteExtractFree;

#ifdef UNITTESTS

    sigmatch_table[DETECT_BYTE_EXTRACT].RegisterTests = DetectByteExtractRegisterTests;

#endif

}

int DetectByteExtractDoMatch(DetectEngineThreadCtx *det_ctx, const SigMatchData *smd,

        const Signature *s, const uint8_t *payload, uint32_t payload_len, uint64_t *value,

        uint8_t endian)

{

    if (payload_len == 0) {

        return 0;

    }

    /* Calculate the ptr value for the bytetest and length remaining in

     * the packet from that point.

     */

    const uint8_t *ptr;

    int32_t len;

    SCDetectByteExtractData *data = (SCDetectByteExtractData *)smd->ctx;

    if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {

        SCLogDebug("relative, working with det_ctx->buffer_offset %"PRIu32", "

                   "data->offset %"PRIu32"", det_ctx->buffer_offset, data->offset);

        ptr = payload + det_ctx->buffer_offset;

        len = payload_len - det_ctx->buffer_offset;

        ptr += data->offset;

        len -= data->offset;

        /* No match if there is no relative base */

        if (len <= 0) {

            return 0;

        }

        //PrintRawDataFp(stdout,ptr,len);

    } else {

        SCLogDebug("absolute, data->offset %"PRIu32"", data->offset);

        ptr = payload + data->offset;

        len = payload_len - data->offset;

    }

    /* Validate that the to-be-extracted is within the packet */

    if (ptr < payload || data->nbytes > len) {

        SCLogDebug("Data not within payload pkt=%p, ptr=%p, len=%"PRIu32", nbytes=%d",

                    payload, ptr, len, data->nbytes);

        return 0;

    }

    /* Extract the byte data */

    uint64_t val = 0;

    int extbytes;

    if (data->flags & DETECT_BYTE_EXTRACT_FLAG_STRING) {

        extbytes = ByteExtractStringUint64(&val, data->base,

                                           data->nbytes, (const char *)ptr);

        if (extbytes <= 0) {

            /* ByteExtractStringUint64() set val to 0 if there is no numeric value in data string */

            if (val == 0) {

                SCLogDebug("No Numeric value");

                return 0;

            } else {

                SCLogDebug("error extracting %d bytes of string data: %d",

                        data->nbytes, extbytes);

                return -1;

            }

        }

    } else {

        int endianness = (endian == BigEndian) ? BYTE_BIG_ENDIAN : BYTE_LITTLE_ENDIAN;

        extbytes = ByteExtractUint64(&val, endianness, data->nbytes, ptr);

        if (extbytes != data->nbytes) {

            SCLogDebug("error extracting %d bytes of numeric data: %d",

                    data->nbytes, extbytes);

            return 0;

        }

    }

    /* Adjust the jump value based on flags */

    val *= data->multiplier_value;

    if (data->flags & DETECT_BYTE_EXTRACT_FLAG_ALIGN) {

        if ((val % data->align_value) != 0) {

            val += data->align_value - (val % data->align_value);

        }

    }

    ptr += extbytes;

    det_ctx->buffer_offset = (uint32_t)(ptr - payload);

    *value = val;

    SCLogDebug("extracted value is %"PRIu64, val);

    return 1;

}

/**

 * \internal

 * \brief Used to parse byte_extract arg.

 *

 * \param de_ctx Pointer to the detection engine context

 * \arg The argument to parse.

 *

 * \param bed On success an instance containing the parsed data.

 *            On failure, NULL.

 */

static inline SCDetectByteExtractData *DetectByteExtractParse(

        DetectEngineCtx *de_ctx, const char *arg)

{

    SCDetectByteExtractData *bed = SCByteExtractParse(arg);

    if (bed == NULL) {

        SCLogError("invalid byte_extract values");

        goto error;

    }

    if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_SLICE) {

        SCLogError("byte_extract slice not yet supported; see issue #6831");

        goto error;

    }

    if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_STRING) {

        if (bed->base == DETECT_BYTE_EXTRACT_BASE_OCT) {

            /* if are dealing with octal nos, the max no that can fit in a 8

             * byte value is 01777777777777777777777 */

            if (bed->nbytes > STRING_MAX_BYTES_TO_EXTRACT_FOR_OCT) {

                SCLogError("byte_extract can't process "

                           "more than %d bytes in \"string\" extraction",

                        STRING_MAX_BYTES_TO_EXTRACT_FOR_OCT);

                goto error;

            }

        } else if (bed->base == DETECT_BYTE_EXTRACT_BASE_DEC) {

            /* if are dealing with decimal nos, the max no that can fit in a 8

             * byte value is 18446744073709551615 */

            if (bed->nbytes > STRING_MAX_BYTES_TO_EXTRACT_FOR_DEC) {

                SCLogError("byte_extract can't process "

                           "more than %d bytes in \"string\" extraction",

                        STRING_MAX_BYTES_TO_EXTRACT_FOR_DEC);

                goto error;

            }

        } else if (bed->base == DETECT_BYTE_EXTRACT_BASE_HEX) {

            /* if are dealing with hex nos, the max no that can fit in a 8

             * byte value is 0xFFFFFFFFFFFFFFFF */

            if (bed->nbytes > STRING_MAX_BYTES_TO_EXTRACT_FOR_HEX) {

                SCLogError("byte_extract can't process "

                           "more than %d bytes in \"string\" extraction",

                        STRING_MAX_BYTES_TO_EXTRACT_FOR_HEX);

                goto error;

            }

        } else {

            ; // just a placeholder.  we won't reach here.

        }

    } else {

        if (bed->nbytes > NO_STRING_MAX_BYTES_TO_EXTRACT) {

            SCLogError("byte_extract can't process "

                       "more than %d bytes in \"non-string\" extraction",

                    NO_STRING_MAX_BYTES_TO_EXTRACT);

            goto error;

        }

        /* if string has not been specified and no endian option has been

         * specified, then set the default endian level of BIG */

        if (!(bed->flags & DETECT_BYTE_EXTRACT_FLAG_ENDIAN))

            bed->endian = BigEndian;

    }

    return bed;

 error:

    if (bed != NULL)

        DetectByteExtractFree(de_ctx, bed);

    return NULL;

}

/**

 * \brief The setup function for the byte_extract keyword for a signature.

 *

 * \param de_ctx Pointer to the detection engine context.

 * \param s      Pointer to signature for the current Signature being parsed

 *               from the rules.

 * \param m      Pointer to the head of the SigMatch for the current rule

 *               being parsed.

 * \param arg    Pointer to the string holding the keyword value.

 *

 * \retval  0 On success.

 * \retval -1 On failure.

 */

static int DetectByteExtractSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)

{

    SigMatch *prev_pm = NULL;

    SCDetectByteExtractData *data = NULL;

    int ret = -1;

    data = DetectByteExtractParse(de_ctx, arg);

    if (data == NULL)

        goto error;

    int sm_list;

    if (s->init_data->list != DETECT_SM_LIST_NOTSET) {

        sm_list = s->init_data->list;

        if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {

            prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);

        }

    } else if (data->endian == EndianDCE) {

        if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {

            prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE,

                    DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,

                    DETECT_BYTEMATH, DETECT_ISDATAAT, -1);

            if (prev_pm == NULL) {

                sm_list = DETECT_SM_LIST_PMATCH;

            } else {

                sm_list = SigMatchListSMBelongsTo(s, prev_pm);

                if (sm_list < 0)

                    goto error;

            }

        } else {

            sm_list = DETECT_SM_LIST_PMATCH;

        }

        if (SCDetectSignatureSetAppProto(s, ALPROTO_DCERPC) < 0)

            goto error;

    } else if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {

        prev_pm = DetectGetLastSMFromLists(s,

                DETECT_CONTENT, DETECT_PCRE,

                DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,

                DETECT_BYTEMATH, DETECT_ISDATAAT, -1);

        if (prev_pm == NULL) {

            sm_list = DETECT_SM_LIST_PMATCH;

        } else {

            sm_list = SigMatchListSMBelongsTo(s, prev_pm);

            if (sm_list < 0)

                goto error;

        }

    } else {

        sm_list = DETECT_SM_LIST_PMATCH;

    }

    if (data->endian == EndianDCE) {

        if (SCDetectSignatureSetAppProto(s, ALPROTO_DCERPC) != 0)

            goto error;

        if ((DETECT_BYTE_EXTRACT_FLAG_BASE | DETECT_BYTE_EXTRACT_FLAG_STRING) ==

                (data->flags & (DETECT_BYTE_EXTRACT_FLAG_BASE | DETECT_BYTE_EXTRACT_FLAG_STRING))) {

            SCLogError("Invalid option. "

                       "A byte_jump keyword with dce holds other invalid modifiers.");

            goto error;

        }

    }

    SigMatch *prev_bed_sm = DetectGetLastSMByListId(s, sm_list,

            DETECT_BYTE_EXTRACT, -1);

    if (prev_bed_sm == NULL)

        data->local_id = 0;

    else

        data->local_id = ((SCDetectByteExtractData *)prev_bed_sm->ctx)->local_id + 1;

    if (data->local_id > de_ctx->byte_extract_max_local_id)

        de_ctx->byte_extract_max_local_id = data->local_id;

    if (SCSigMatchAppendSMToList(de_ctx, s, DETECT_BYTE_EXTRACT, (SigMatchCtx *)data, sm_list) ==

            NULL) {

        goto error;

    }

    if (!(data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE))

        goto okay;

    if (prev_pm == NULL)

        goto okay;

    if (prev_pm->type == DETECT_CONTENT) {

        DetectContentData *cd = (DetectContentData *)prev_pm->ctx;

        cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;

    } else if (prev_pm->type == DETECT_PCRE) {

        DetectPcreData *pd = (DetectPcreData *)prev_pm->ctx;

        pd->flags |= DETECT_PCRE_RELATIVE_NEXT;

    }

 okay:

    ret = 0;

    return ret;

 error:

    DetectByteExtractFree(de_ctx, data);

    return ret;

}

/**

 * \brief Used to free instances of SCDetectByteExtractData.

 *

 * \param ptr Instance of SCDetectByteExtractData to be freed.

 */

static void DetectByteExtractFree(DetectEngineCtx *de_ctx, void *ptr)

{

    SCByteExtractFree(ptr);

}

/**

 * \brief Lookup the SigMatch for a named byte_extract variable.

 *

 * \param arg The name of the byte_extract variable to lookup.

 * \param s Pointer the signature to look in.

 *

 * \retval A pointer to the SigMatch if found, otherwise NULL.

 */

SigMatch *DetectByteExtractRetrieveSMVar(const char *arg, int sm_list, const Signature *s)

{

    for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {

        SigMatch *sm = s->init_data->buffers[x].head;

        while (sm != NULL) {

            if (sm->type == DETECT_BYTE_EXTRACT) {

                const SCDetectByteExtractData *bed = (const SCDetectByteExtractData *)sm->ctx;

                if (strcmp(bed->name, arg) == 0) {

                    return sm;

                }

            }

            sm = sm->next;

        }

    }

    for (int list = 0; list < DETECT_SM_LIST_MAX; list++) {

        SigMatch *sm = s->init_data->smlists[list];

        while (sm != NULL) {

            // Make sure that the linked buffers ore on the same list

            if (sm->type == DETECT_BYTE_EXTRACT && (sm_list == -1 || sm_list == list)) {

                const SCDetectByteExtractData *bed = (const SCDetectByteExtractData *)sm->ctx;

                if (strcmp(bed->name, arg) == 0) {

                    return sm;

                }

            }

            sm = sm->next;

        }

    }

    return NULL;

}

/*************************************Unittests********************************/

#ifdef UNITTESTS

#include "detect-engine-buffer.h"

static int g_file_data_buffer_id = 0;

static int g_http_uri_buffer_id = 0;

static int DetectByteExtractTest01(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != 0 ||

            bed->endian != BigEndian || bed->align_value != 0 ||

            bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest02(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, relative");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->flags != DETECT_BYTE_EXTRACT_FLAG_RELATIVE || bed->endian != BigEndian ||

            bed->align_value != 0 ||

            bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest03(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, multiplier 10");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->flags != DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER || bed->endian != BigEndian ||

            bed->align_value != 0 || bed->multiplier_value != 10) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest04(void)

{

    int result = 0;

    SCDetectByteExtractData *bed =

            DetectByteExtractParse(NULL, "4, 2, one, relative, multiplier 10");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->flags !=

                    (DETECT_BYTE_EXTRACT_FLAG_RELATIVE | DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER) ||

            bed->endian != BigEndian || bed->align_value != 0 || bed->multiplier_value != 10) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest05(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, big");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->flags != DETECT_BYTE_EXTRACT_FLAG_ENDIAN || bed->endian != BigEndian ||

            bed->align_value != 0 ||

            bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest06(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, little");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->flags != DETECT_BYTE_EXTRACT_FLAG_ENDIAN || bed->endian != LittleEndian ||

            bed->align_value != 0 ||

            bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest07(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, dce");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->flags != DETECT_BYTE_EXTRACT_FLAG_ENDIAN || bed->endian != EndianDCE ||

            bed->align_value != 0 ||

            bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest08(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, string, hex");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->flags != (DETECT_BYTE_EXTRACT_FLAG_BASE | DETECT_BYTE_EXTRACT_FLAG_STRING) ||

            bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 ||

            bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest09(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, string, oct");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->flags != (DETECT_BYTE_EXTRACT_FLAG_BASE | DETECT_BYTE_EXTRACT_FLAG_STRING) ||

            bed->base != DETECT_BYTE_EXTRACT_BASE_OCT || bed->align_value != 0 ||

            bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest10(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, string, dec");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->base != DETECT_BYTE_EXTRACT_BASE_DEC || bed->align_value != 0 ||

            bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest11(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->flags != DETECT_BYTE_EXTRACT_FLAG_ALIGN || bed->endian != BigEndian ||

            bed->align_value != 4 ||

            bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest12(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4, relative");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->flags != (DETECT_BYTE_EXTRACT_FLAG_ALIGN | DETECT_BYTE_EXTRACT_FLAG_RELATIVE) ||

            bed->endian != BigEndian || bed->align_value != 4 ||

            bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest13(void)

{

    int result = 0;

    SCDetectByteExtractData *bed =

            DetectByteExtractParse(NULL, "4, 2, one, align 4, relative, big");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->flags != (DETECT_BYTE_EXTRACT_FLAG_ALIGN | DETECT_BYTE_EXTRACT_FLAG_ENDIAN |

                                  DETECT_BYTE_EXTRACT_FLAG_RELATIVE) ||

            bed->endian != BigEndian || bed->align_value != 4 ||

            bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest14(void)

{

    int result = 0;

    SCDetectByteExtractData *bed =

            DetectByteExtractParse(NULL, "4, 2, one, align 4, relative, dce");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->flags != (DETECT_BYTE_EXTRACT_FLAG_ALIGN | DETECT_BYTE_EXTRACT_FLAG_ENDIAN |

                                  DETECT_BYTE_EXTRACT_FLAG_RELATIVE) ||

            bed->endian != EndianDCE || bed->align_value != 4 ||

            bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest15(void)

{

    int result = 0;

    SCDetectByteExtractData *bed =

            DetectByteExtractParse(NULL, "4, 2, one, align 4, relative, little");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->flags != (DETECT_BYTE_EXTRACT_FLAG_ALIGN | DETECT_BYTE_EXTRACT_FLAG_ENDIAN |

                                  DETECT_BYTE_EXTRACT_FLAG_RELATIVE) ||

            bed->endian != LittleEndian || bed->align_value != 4 ||

            bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest16(void)

{

    int result = 0;

    SCDetectByteExtractData *bed =

            DetectByteExtractParse(NULL, "4, 2, one, align 4, relative, little, multiplier 2");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 ||

            bed->flags != (DETECT_BYTE_EXTRACT_FLAG_ALIGN | DETECT_BYTE_EXTRACT_FLAG_RELATIVE |

                                  DETECT_BYTE_EXTRACT_FLAG_ENDIAN |

                                  DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER) ||

            bed->endian != LittleEndian || bed->align_value != 4 || bed->multiplier_value != 2) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest17(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4, "

                                                                "relative, little, "

                                                                "multiplier 2, string hex");

    if (bed != NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest18(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4, "

                                                                "relative, little, "

                                                                "multiplier 2, "

                                                                "relative");

    if (bed != NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest19(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4, "

                                                                "relative, little, "

                                                                "multiplier 2, "

                                                                "little");

    if (bed != NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest20(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4, "

                                                                "relative, "

                                                                "multiplier 2, "

                                                                "align 2");

    if (bed != NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest21(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4, "

                                                                "multiplier 2, "

                                                                "relative, "

                                                                "multiplier 2");

    if (bed != NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest22(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4, "

                                                                "string hex, "

                                                                "relative, "

                                                                "string hex");

    if (bed != NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest23(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4, "

                                                                "string hex, "

                                                                "relative, "

                                                                "string oct");

    if (bed != NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest24(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "24, 2, one, align 4, "

                                                                "string hex, "

                                                                "relative");

    if (bed != NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest25(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "9, 2, one, align 4, "

                                                                "little, "

                                                                "relative");

    if (bed != NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest26(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4, "

                                                                "little, "

                                                                "relative, "

                                                                "multiplier 65536");

    if (bed != NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest27(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4, "

                                                                "little, "

                                                                "relative, "

                                                                "multiplier 0");

    if (bed != NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest28(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "23, 2, one, string, oct");

    if (bed == NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest29(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "24, 2, one, string, oct");

    if (bed != NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest30(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "20, 2, one, string, dec");

    if (bed == NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest31(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "21, 2, one, string, dec");

    if (bed != NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest32(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "14, 2, one, string, hex");

    if (bed == NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest33(void)

{

    int result = 0;

    SCDetectByteExtractData *bed = DetectByteExtractParse(NULL, "15, 2, one, string, hex");

    if (bed != NULL)

        goto end;

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest34(void)

{

    DetectEngineCtx *de_ctx = NULL;

    int result = 0;

    Signature *s = NULL;

    SigMatch *sm = NULL;

    DetectContentData *cd = NULL;

    SCDetectByteExtractData *bed = NULL;

    de_ctx = DetectEngineCtxInit();

    if (de_ctx == NULL)

        goto end;

    de_ctx->flags |= DE_QUIET;

    s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "

                                   "(msg:\"Testing bytejump_body\"; "

                                   "content:\"one\"; "

                                   "byte_extract:4,2,two,relative,string,hex; "

                                   "sid:1;)");

    if (de_ctx->sig_list == NULL) {

        result = 0;

        goto end;

    }

    if (s->init_data->smlists_tail[DETECT_SM_LIST_PMATCH] == NULL) {

        result = 0;

        goto end;

    }

    sm = s->init_data->smlists[DETECT_SM_LIST_PMATCH];

    if (sm->type != DETECT_CONTENT) {

        result = 0;

        goto end;

    }

    cd = (DetectContentData *)sm->ctx;

    if (cd->flags & DETECT_CONTENT_RAWBYTES ||

        strncmp((char *)cd->content, "one", cd->content_len) != 0 ||

        cd->flags & DETECT_CONTENT_NOCASE ||

        cd->flags & DETECT_CONTENT_WITHIN ||

        cd->flags & DETECT_CONTENT_DISTANCE ||

        cd->flags & DETECT_CONTENT_FAST_PATTERN ||

        !(cd->flags & DETECT_CONTENT_RELATIVE_NEXT) ||