]> git.ipfire.org Git - people/ms/suricata.git/blame - src/app-layer-parser.c
projects / people / ms / suricata.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
app layer udp cleanup + update dcerpc udp todo
[people/ms/suricata.git] / src / app-layer-parser.c
CommitLineData
ce019275
WM		 1/* Copyright (C) 2007-2010 Open Information Security Foundation
2 *
3 * You can copy, redistribute or modify this Program under the terms of
4 * the GNU General Public License version 2 as published by the Free
5 * Software Foundation.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * version 2 along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15 * 02110-1301, USA.
16 */
17
18/**
19 * \file
20 *
21 * \author Victor Julien <victor@inliniac.net>
22 *
23 * Generic App-layer parsing functions.
24 */
8e10844f 25
ecf86f9c 26#include "suricata-common.h"
8e10844f 27#include "debug.h"
c1e485cc 28#include "util-unittest.h"
8e10844f
VJ		 29#include "decode.h"
30#include "threads.h"
31
32#include "util-print.h"
33#include "util-pool.h"
34
cc76aa4b
WM		 35#include "flow-util.h"
36
0e4235cc
WM		 37#include "detect-engine-state.h"
38
6a53ab9c 39#include "stream-tcp.h"
8e10844f
VJ		 40#include "stream-tcp-private.h"
41#include "stream.h"
a16e7b74 42#include "stream-tcp-reassemble.h"
8e10844f
VJ		 43
44#include "app-layer-protos.h"
45#include "app-layer-parser.h"
000ce98c
AS		 46#include "app-layer-smb.h"
47#include "app-layer-dcerpc.h"
48#include "app-layer-dcerpc-udp.h"
49#include "app-layer-htp.h"
50#include "app-layer-ftp.h"
51#include "app-layer-ssl.h"
52#include "app-layer-ssh.h"
576ec7da 53#include "app-layer-smtp.h"
8e10844f 54
705471e4 55#include "util-spm.h"
9f78d47c 56
91bc83e5 57#include "util-debug.h"
262a7300 58#include "util-unittest-helper.h"
91bc83e5 59
356a8bf3 60static AppLayerProto al_proto_table[ALPROTO_MAX]; /**< Application layer protocol
06904c90
VJ		 61 table mapped to their
62 corresponding parsers */
cae8e06c
VJ		 63
64#define MAX_PARSERS 100
65static AppLayerParserTableElement al_parser_table[MAX_PARSERS];
66static uint16_t al_max_parsers = 0; /* incremented for every registered parser */
67
5a9a23f9 68static Pool *al_result_pool = NULL;
cae8e06c
VJ		 69static SCMutex al_result_pool_mutex = PTHREAD_MUTEX_INITIALIZER;
70#ifdef DEBUG
71static uint32_t al_result_pool_elmts = 0;
72#endif /* DEBUG */
73
5a9a23f9 74
9f78d47c 75/** \brief Alloc a AppLayerParserResultElmt func for the pool */
c1e485cc
GS		 76static void *AlpResultElmtPoolAlloc(void *null)
77{
25a3a5c6 78 AppLayerParserResultElmt *e = (AppLayerParserResultElmt *)SCMalloc
c1e485cc 79 (sizeof(AppLayerParserResultElmt));
9f4fae5b 80 if (e == NULL)
5a9a23f9 81 return NULL;
5a9a23f9 82
9f78d47c 83 memset(e, 0, sizeof(AppLayerParserResultElmt));
cae8e06c
VJ		 84
85#ifdef DEBUG
86 al_result_pool_elmts++;
87 SCLogDebug("al_result_pool_elmts %"PRIu32"", al_result_pool_elmts);
88#endif /* DEBUG */
5a9a23f9
VJ		 89 return e;
90}
5a9a23f9 91
c1e485cc
GS		 92static void AlpResultElmtPoolFree(void *e)
93{
9f78d47c
VJ		 94 AppLayerParserResultElmt *re = (AppLayerParserResultElmt *)e;
95
96 if (re->flags & ALP_RESULT_ELMT_ALLOC) {
97 if (re->data_ptr != NULL)
25a3a5c6 98 SCFree(re->data_ptr);
9f78d47c 99 }
25a3a5c6 100 SCFree(re);
cae8e06c
VJ		 101
102#ifdef DEBUG
103 al_result_pool_elmts--;
104 SCLogDebug("al_result_pool_elmts %"PRIu32"", al_result_pool_elmts);
105#endif /* DEBUG */
9f78d47c
VJ		 106}
107
c1e485cc
GS		 108static AppLayerParserResultElmt *AlpGetResultElmt(void)
109{
cae8e06c 110 SCMutexLock(&al_result_pool_mutex);
9f78d47c 111 AppLayerParserResultElmt *e = (AppLayerParserResultElmt *)PoolGet(al_result_pool);
cae8e06c
VJ		 112 SCMutexUnlock(&al_result_pool_mutex);
113
4914d8d9 114 if (e == NULL) {
bcc5bbef 115 return NULL;
4914d8d9 116 }
9f78d47c 117 e->next = NULL;
5a9a23f9
VJ		 118 return e;
119}
120
c1e485cc
GS		 121static void AlpReturnResultElmt(AppLayerParserResultElmt *e)
122{
9f78d47c
VJ		 123 if (e->flags & ALP_RESULT_ELMT_ALLOC) {
124 if (e->data_ptr != NULL)
25a3a5c6 125 SCFree(e->data_ptr);
9f78d47c
VJ		 126 }
127 e->flags = 0;
128 e->data_ptr = NULL;
129 e->data_len = 0;
130 e->next = NULL;
131
cae8e06c 132 SCMutexLock(&al_result_pool_mutex);
9f78d47c 133 PoolReturn(al_result_pool, (void *)e);
cae8e06c 134 SCMutexUnlock(&al_result_pool_mutex);
9f78d47c
VJ		 135}
136
c1e485cc
GS		 137static void AlpAppendResultElmt(AppLayerParserResult *r, AppLayerParserResultElmt *e)
138{
9f78d47c
VJ		 139 if (r->head == NULL) {
140 r->head = e;
141 r->tail = e;
142 r->cnt = 1;
143 } else {
144 r->tail->next = e;
145 r->tail = e;
146 r->cnt++;
147 }
148}
149
150/**
151 * \param alloc Is ptr alloc'd (1) or a ptr to static mem (0).
574bcea0
VJ		 152 * \retval -1 error
153 * \retval 0 ok
9f78d47c 154 */
c1e485cc
GS		 155static int AlpStoreField(AppLayerParserResult *output, uint16_t idx,
156 uint8_t *ptr, uint32_t len, uint8_t alloc)
157{
574bcea0
VJ		 158 SCEnter();
159
9f78d47c 160 AppLayerParserResultElmt *e = AlpGetResultElmt();
fc2f7f29 161 if (e == NULL) {
d8433c72 162 SCLogError(SC_ERR_POOL_EMPTY, "App layer \"al_result_pool\" is empty");
574bcea0 163 SCReturnInt(-1);
fc2f7f29 164 }
9f78d47c
VJ		 165
166 if (alloc == 1)
167 e->flags |= ALP_RESULT_ELMT_ALLOC;
168
169 e->name_idx = idx;
170 e->data_ptr = ptr;
171 e->data_len = len;
172 AlpAppendResultElmt(output, e);
173
574bcea0 174 SCReturnInt(0);
9f78d47c
VJ		 175}
176
c13ad8c2
AS		 177void AppLayerSetEOF(Flow *f)
178{
06904c90 179 if (f == NULL)
7e3c15e5
VJ		 180 return;
181
c13ad8c2 182 AppLayerParserStateStore *parser_state_store =
06904c90 183 (AppLayerParserStateStore *)f->alparser;
c13ad8c2
AS		 184 if (parser_state_store != NULL) {
185 parser_state_store->id_flags |= APP_LAYER_TRANSACTION_EOF;
186 parser_state_store->to_client.flags |= APP_LAYER_PARSER_EOF;
187 parser_state_store->to_server.flags |= APP_LAYER_PARSER_EOF;
188 }
189}
190
086ba5f4
VJ		 191/** \brief Parse a field up to we reach the size limit
192 *
193 * \retval 1 Field found and stored.
194 * \retval 0 Field parsing in progress.
195 * \retval -1 error
196 */
c1e485cc
GS		 197int AlpParseFieldBySize(AppLayerParserResult *output, AppLayerParserState *pstate,
198 uint16_t field_idx, uint32_t size, uint8_t *input,
199 uint32_t input_len, uint32_t *offset)
200{
574bcea0
VJ		 201 SCEnter();
202
086ba5f4
VJ		 203 if ((pstate->store_len + input_len) < size) {
204 if (pstate->store_len == 0) {
25a3a5c6 205 pstate->store = SCMalloc(input_len);
9f4fae5b 206 if (pstate->store == NULL)
574bcea0 207 SCReturnInt(-1);
086ba5f4
VJ		 208
209 memcpy(pstate->store, input, input_len);
210 pstate->store_len = input_len;
211 } else {
25a3a5c6 212 pstate->store = SCRealloc(pstate->store, (input_len + pstate->store_len));
9f4fae5b 213 if (pstate->store == NULL)
574bcea0 214 SCReturnInt(-1);
086ba5f4
VJ		 215
216 memcpy(pstate->store+pstate->store_len, input, input_len);
217 pstate->store_len += input_len;
218 }
219 } else {
220 if (pstate->store_len == 0) {
574bcea0
VJ		 221 int r = AlpStoreField(output, field_idx, input, size, /* static mem */0);
222 if (r == -1) {
d0404d84 223 SCLogError(SC_ERR_ALPARSER, "Failed to store field value");
574bcea0
VJ		 224 SCReturnInt(-1);
225 }
086ba5f4 226 (*offset) += size;
574bcea0
VJ		 227
228 SCReturnInt(1);
086ba5f4
VJ		 229 } else {
230 uint32_t diff = size - pstate->store_len;
231
25a3a5c6 232 pstate->store = SCRealloc(pstate->store, (diff + pstate->store_len));
9f4fae5b 233 if (pstate->store == NULL)
574bcea0 234 SCReturnInt(-1);
086ba5f4
VJ		 235
236 memcpy(pstate->store+pstate->store_len, input, diff);
237 pstate->store_len += diff;
238
c1e485cc
GS		 239 int r = AlpStoreField(output, field_idx, pstate->store,
240 pstate->store_len, /* alloc mem */1);
574bcea0 241 if (r == -1) {
d0404d84 242 SCLogError(SC_ERR_ALPARSER, "Failed to store field value");
574bcea0
VJ		 243 SCReturnInt(-1);
244 }
086ba5f4
VJ		 245
246 (*offset) += diff;
247
248 pstate->store = NULL;
249 pstate->store_len = 0;
574bcea0
VJ		 250
251 SCReturnInt(1);
086ba5f4
VJ		 252 }
253 }
254
574bcea0 255 SCReturnInt(0);
086ba5f4
VJ		 256}
257
9f78d47c
VJ		 258/** \brief Parse a field up to the EOF
259 *
260 * \retval 1 Field found and stored.
261 * \retval 0 Field parsing in progress.
262 * \retval -1 error
263 */
c1e485cc
GS		 264int AlpParseFieldByEOF(AppLayerParserResult *output, AppLayerParserState *pstate,
265 uint16_t field_idx, uint8_t *input, uint32_t input_len)
266{
574bcea0
VJ		 267 SCEnter();
268
9f78d47c
VJ		 269 if (pstate->store_len == 0) {
270 if (pstate->flags & APP_LAYER_PARSER_EOF) {
574bcea0
VJ		 271 SCLogDebug("store_len 0 and EOF");
272
273 int r = AlpStoreField(output, field_idx, input, input_len, 0);
274 if (r == -1) {
d0404d84 275 SCLogError(SC_ERR_ALPARSER, "Failed to store field value");
574bcea0
VJ		 276 SCReturnInt(-1);
277 }
278
279 SCReturnInt(1);
9f78d47c 280 } else {
574bcea0
VJ		 281 SCLogDebug("store_len 0 but no EOF");
282
9f78d47c 283 /* delimiter field not found, so store the result for the next run */
25a3a5c6 284 pstate->store = SCMalloc(input_len);
9f4fae5b 285 if (pstate->store == NULL)
574bcea0 286 SCReturnInt(-1);
9f78d47c
VJ		 287
288 memcpy(pstate->store, input, input_len);
289 pstate->store_len = input_len;
290 }
291 } else {
292 if (pstate->flags & APP_LAYER_PARSER_EOF) {
574bcea0
VJ		 293 SCLogDebug("store_len %" PRIu32 " and EOF", pstate->store_len);
294
25a3a5c6 295 pstate->store = SCRealloc(pstate->store, (input_len + pstate->store_len));
9f4fae5b 296 if (pstate->store == NULL)
574bcea0 297 SCReturnInt(-1);
9f78d47c
VJ		 298
299 memcpy(pstate->store+pstate->store_len, input, input_len);
300 pstate->store_len += input_len;
301
574bcea0
VJ		 302 int r = AlpStoreField(output, field_idx, pstate->store, pstate->store_len, 1);
303 if (r == -1) {
d0404d84 304 SCLogError(SC_ERR_ALPARSER, "Failed to store field value");
574bcea0
VJ		 305 SCReturnInt(-1);
306 }
307
9f78d47c
VJ		 308 pstate->store = NULL;
309 pstate->store_len = 0;
574bcea0
VJ		 310
311 SCReturnInt(1);
9f78d47c 312 } else {
574bcea0
VJ		 313 SCLogDebug("store_len %" PRIu32 " but no EOF", pstate->store_len);
314
9f78d47c 315 /* delimiter field not found, so store the result for the next run */
25a3a5c6 316 pstate->store = SCRealloc(pstate->store, (input_len + pstate->store_len));
9f4fae5b 317 if (pstate->store == NULL)
574bcea0 318 SCReturnInt(-1);
9f78d47c
VJ		 319
320 memcpy(pstate->store+pstate->store_len, input, input_len);
321 pstate->store_len += input_len;
322 }
323
324 }
325
574bcea0 326 SCReturnInt(0);
9f78d47c
VJ		 327}
328
329/** \brief Parse a field up to a delimeter.
330 *
331 * \retval 1 Field found and stored.
332 * \retval 0 Field parsing in progress.
333 * \retval -1 error
334 */
c1e485cc
GS		 335int AlpParseFieldByDelimiter(AppLayerParserResult *output, AppLayerParserState *pstate,
336 uint16_t field_idx, const uint8_t *delim, uint8_t delim_len,
337 uint8_t *input, uint32_t input_len, uint32_t *offset)
338{
574bcea0 339 SCEnter();
c1e485cc
GS		 340 SCLogDebug("pstate->store_len %" PRIu32 ", delim_len %" PRIu32 "",
341 pstate->store_len, delim_len);
9f78d47c
VJ		 342
343 if (pstate->store_len == 0) {
705471e4 344 uint8_t *ptr = SpmSearch(input, input_len, (uint8_t*)delim, delim_len);
9f78d47c 345 if (ptr != NULL) {
fa5939ca 346 uint32_t len = ptr - input;
c1e485cc 347 SCLogDebug(" len %" PRIu32 "", len);
9f78d47c 348
574bcea0
VJ		 349 int r = AlpStoreField(output, field_idx, input, len, 0);
350 if (r == -1) {
d0404d84 351 SCLogError(SC_ERR_ALPARSER, "Failed to store field value");
574bcea0
VJ		 352 SCReturnInt(-1);
353 }
9f78d47c 354 (*offset) += (len + delim_len);
574bcea0 355 SCReturnInt(1);
9f78d47c
VJ		 356 } else {
357 if (pstate->flags & APP_LAYER_PARSER_EOF) {
c1e485cc 358 SCLogDebug("delim not found and EOF");
574bcea0 359 SCReturnInt(0);
9f78d47c
VJ		 360 }
361
c1e485cc 362 SCLogDebug("delim not found, continue");
9f78d47c
VJ		 363
364 /* delimiter field not found, so store the result for the next run */
25a3a5c6 365 pstate->store = SCMalloc(input_len);
9f4fae5b 366 if (pstate->store == NULL)
574bcea0 367 SCReturnInt(-1);
9f78d47c
VJ		 368
369 memcpy(pstate->store, input, input_len);
370 pstate->store_len = input_len;
371 }
372 } else {
705471e4 373 uint8_t *ptr = SpmSearch(input, input_len, (uint8_t*)delim, delim_len);
9f78d47c 374 if (ptr != NULL) {
fa5939ca 375 uint32_t len = ptr - input;
c1e485cc
GS		 376 SCLogDebug("len %" PRIu32 " + %" PRIu32 " = %" PRIu32 "", len,
377 pstate->store_len, len + pstate->store_len);
9f78d47c 378
25a3a5c6 379 pstate->store = SCRealloc(pstate->store, (len + pstate->store_len));
9f4fae5b 380 if (pstate->store == NULL)
574bcea0 381 SCReturnInt(-1);
9f78d47c
VJ		 382
383 memcpy(pstate->store+pstate->store_len, input, len);
384 pstate->store_len += len;
385
c1e485cc
GS		 386 int r = AlpStoreField(output, field_idx, pstate->store,
387 pstate->store_len, 1);
574bcea0 388 if (r == -1) {
d0404d84 389 SCLogError(SC_ERR_ALPARSER, "Failed to store field value");
574bcea0
VJ		 390 SCReturnInt(-1);
391 }
9f78d47c
VJ		 392 pstate->store = NULL;
393 pstate->store_len = 0;
394
395 (*offset) += (len + delim_len);
574bcea0 396 SCReturnInt(1);
9f78d47c
VJ		 397 } else {
398 if (pstate->flags & APP_LAYER_PARSER_EOF) {
399 /* if the input len is smaller than the delim len we search the
400 * pstate->store since we may match there. */
401 if (delim_len > input_len) {
c1e485cc
GS		 402 /* delimiter field not found, so store the result for the
403 * next run */
25a3a5c6 404 pstate->store = SCRealloc(pstate->store, (input_len +
c1e485cc 405 pstate->store_len));
9f4fae5b 406 if (pstate->store == NULL)
574bcea0 407 SCReturnInt(-1);
9f78d47c
VJ		 408
409 memcpy(pstate->store+pstate->store_len, input, input_len);
410 pstate->store_len += input_len;
c1e485cc 411 SCLogDebug("input_len < delim_len, checking pstate->store");
9f78d47c
VJ		 412
413 if (pstate->store_len >= delim_len) {
705471e4 414 ptr = SpmSearch(pstate->store, pstate->store_len, (uint8_t*)delim,
c1e485cc 415 delim_len);
9f78d47c 416 if (ptr != NULL) {
c1e485cc 417 SCLogDebug("now we found the delim");
9f78d47c 418
fa5939ca 419 uint32_t len = ptr - pstate->store;
c1e485cc
GS		 420 int r = AlpStoreField(output, field_idx,
421 pstate->store, len, 1);
574bcea0 422 if (r == -1) {
d0404d84 423 SCLogError(SC_ERR_ALPARSER, "Failed to store "
fc2f7f29 424 "field value");
574bcea0
VJ		 425 SCReturnInt(-1);
426 }
427
9f78d47c
VJ		 428 pstate->store = NULL;
429 pstate->store_len = 0;
430
431 (*offset) += (input_len);
432
c1e485cc 433 SCLogDebug("offset %" PRIu32 "", (*offset));
574bcea0 434 SCReturnInt(1);
9f78d47c
VJ		 435 }
436 goto free_and_return;
437 }
438 goto free_and_return;
439 }
440 free_and_return:
c1e485cc 441 SCLogDebug("not found and EOF, so free what we have so far.");
25a3a5c6 442 SCFree(pstate->store);
9f78d47c
VJ		 443 pstate->store = NULL;
444 pstate->store_len = 0;
574bcea0 445 SCReturnInt(0);
9f78d47c
VJ		 446 }
447
448 /* delimiter field not found, so store the result for the next run */
25a3a5c6 449 pstate->store = SCRealloc(pstate->store, (input_len + pstate->store_len));
9f4fae5b 450 if (pstate->store == NULL)
574bcea0 451 SCReturnInt(-1);
9f78d47c
VJ		 452
453 memcpy(pstate->store+pstate->store_len, input, input_len);
454 pstate->store_len += input_len;
455
456 /* if the input len is smaller than the delim len we search the
457 * pstate->store since we may match there. */
458 if (delim_len > input_len && delim_len <= pstate->store_len) {
c1e485cc 459 SCLogDebug("input_len < delim_len, checking pstate->store");
9f78d47c 460
705471e4 461 ptr = SpmSearch(pstate->store, pstate->store_len, (uint8_t*)delim, delim_len);
9f78d47c 462 if (ptr != NULL) {
c1e485cc 463 SCLogDebug("now we found the delim");
9f78d47c 464
fa5939ca 465 uint32_t len = ptr - pstate->store;
574bcea0
VJ		 466 int r = AlpStoreField(output, field_idx, pstate->store, len, 1);
467 if (r == -1) {
d0404d84 468 SCLogError(SC_ERR_ALPARSER, "Failed to store field value");
574bcea0
VJ		 469 SCReturnInt(-1);
470 }
9f78d47c
VJ		 471 pstate->store = NULL;
472 pstate->store_len = 0;
473
474 (*offset) += (input_len);
475
c1e485cc 476 SCLogDebug("ffset %" PRIu32 "", (*offset));
574bcea0 477 SCReturnInt(1);
9f78d47c
VJ		 478 }
479 }
480 }
481
482 }
483
574bcea0 484 SCReturnInt(0);
9f78d47c
VJ		 485}
486
c1e485cc
GS		 487uint16_t AppLayerGetProtoByName(const char *name)
488{
f1f7df07
VJ		 489 uint8_t u = 1;
490 SCLogDebug("looking for name %s", name);
491
492 for ( ; u < ALPROTO_MAX; u++) {
493 if (al_proto_table[u].name == NULL)
494 continue;
495
496 SCLogDebug("name %s proto %"PRIu16"",
497 al_proto_table[u].name, u);
498
499 if (strcasecmp(name,al_proto_table[u].name) == 0) {
500 SCLogDebug("match, returning %"PRIu16"", u);
501 return u;
502 }
503 }
504
505 return ALPROTO_UNKNOWN;
506}
507
8e10844f
VJ		 508/** \brief Description: register a parser.
509 *
510 * \param name full parser name, e.g. "http.request_line"
c1e485cc
GS		 511 * \todo do we need recursive, so a "http" and a "request_line" where the engine
512 * knows it's actually "http.request_line"... same difference maybe.
8e10844f 513 * \param AppLayerParser pointer to the parser function
8e10844f
VJ		 514 *
515 * \retval 0 on success
516 * \retval -1 on error
517 */
c1e485cc 518int AppLayerRegisterParser(char *name, uint16_t proto, uint16_t parser_id,
fc2f7f29 519 int (*AppLayerParser)(Flow *f, void *protocol_state,
c1e485cc 520 AppLayerParserState *parser_state, uint8_t *input,
18fe3818
VJ		 521 uint32_t input_len, AppLayerParserResult *output),
522 char *dependency)
c1e485cc 523{
8e10844f
VJ		 524
525 al_max_parsers++;
526
5fc30051
WM		 527 if(al_max_parsers >= MAX_PARSERS){
528 SCLogInfo("Failed to register %s al_parser_table array full",name);
529 exit(EXIT_FAILURE);
530 }
531
8e10844f 532 al_parser_table[al_max_parsers].name = name;
5a9a23f9
VJ		 533 al_parser_table[al_max_parsers].proto = proto;
534 al_parser_table[al_max_parsers].parser_local_id = parser_id;
8e10844f 535 al_parser_table[al_max_parsers].AppLayerParser = AppLayerParser;
5a9a23f9 536
c1e485cc 537 SCLogDebug("registered %p at proto %" PRIu32 ", al_proto_table idx "
06904c90 538 "%" PRIu32 ", parser_local_id %" PRIu32 "",
c1e485cc 539 AppLayerParser, proto, al_max_parsers,
06904c90 540 parser_id);
8e10844f
VJ		 541 return 0;
542}
543
544/** \brief Description: register a protocol parser.
545 *
546 * \param name full parser name, e.g. "http.request_line"
c1e485cc
GS		 547 * \todo do we need recursive, so a "http" and a "request_line" where the engine
548 * knows it's actually "http.request_line"... same difference maybe.
8e10844f 549 * \param AppLayerParser pointer to the parser function
8e10844f
VJ		 550 *
551 * \retval 0 on success
552 * \retval -1 on error
553 */
c1e485cc 554int AppLayerRegisterProto(char *name, uint8_t proto, uint8_t flags,
fc2f7f29 555 int (*AppLayerParser)(Flow *f, void *protocol_state,
c1e485cc 556 AppLayerParserState *parser_state, uint8_t *input,
18fe3818 557 uint32_t input_len, AppLayerParserResult *output))
c1e485cc 558{
8e10844f
VJ		 559
560 al_max_parsers++;
561
5fc30051
WM		 562 if(al_max_parsers >= MAX_PARSERS){
563 SCLogInfo("Failed to register %s al_parser_table array full",name);
564 exit(EXIT_FAILURE);
565 }
566
8e10844f
VJ		 567 al_parser_table[al_max_parsers].name = name;
568 al_parser_table[al_max_parsers].AppLayerParser = AppLayerParser;
569
f1f7df07
VJ		 570 al_proto_table[proto].name = name;
571
8e10844f
VJ		 572 /* create proto, direction -- parser mapping */
573 if (flags & STREAM_TOSERVER) {
574 al_proto_table[proto].to_server = al_max_parsers;
575 } else if (flags & STREAM_TOCLIENT) {
576 al_proto_table[proto].to_client = al_max_parsers;
577 }
578
c1e485cc 579 SCLogDebug("registered %p at proto %" PRIu32 " flags %02X, al_proto_table "
06904c90
VJ		 580 "idx %" PRIu32 ", %s", AppLayerParser, proto,
581 flags, al_max_parsers, name);
8e10844f
VJ		 582 return 0;
583}
584
c1e485cc
GS		 585void AppLayerRegisterStateFuncs(uint16_t proto, void *(*StateAlloc)(void),
586 void (*StateFree)(void *))
587{
9f78d47c
VJ		 588 al_proto_table[proto].StateAlloc = StateAlloc;
589 al_proto_table[proto].StateFree = StateFree;
590}
591
70b32f73
VJ		 592void AppLayerRegisterTransactionIdFuncs(uint16_t proto,
593 void (*StateUpdateTransactionId)(void *state, uint16_t *), void (*StateTransactionFree)(void *, uint16_t))
594{
595 al_proto_table[proto].StateUpdateTransactionId = StateUpdateTransactionId;
596 al_proto_table[proto].StateTransactionFree = StateTransactionFree;
597}
598
01a35bb6
AS		 599void *AppLayerGetProtocolParserLocalStorage(uint16_t proto)
600{
601 if (al_proto_table[proto].LocalStorageAlloc != NULL) {
602 return al_proto_table[proto].LocalStorageAlloc();
603 }
604
605 return NULL;
606}
607
70b32f73
VJ		 608/** \brief Indicate to the app layer parser that a logger is active
609 * for this protocol.
610 */
611void AppLayerRegisterLogger(uint16_t proto) {
612 al_proto_table[proto].logger = TRUE;
613}
614
615
c1e485cc
GS		 616AppLayerParserStateStore *AppLayerParserStateStoreAlloc(void)
617{
25a3a5c6 618 AppLayerParserStateStore *s = (AppLayerParserStateStore *)SCMalloc
c1e485cc 619 (sizeof(AppLayerParserStateStore));
8e10844f
VJ		 620 if (s == NULL)
621 return NULL;
622
9f78d47c 623 memset(s, 0, sizeof(AppLayerParserStateStore));
70b32f73
VJ		 624
625 /* when we start, we're working with transaction id 1 */
626 s->avail_id = 1;
627
8e10844f
VJ		 628 return s;
629}
630
b102ea21
VJ		 631/** \brief free a AppLayerParserStateStore structure
632 * \param s AppLayerParserStateStore structure to free */
c1e485cc
GS		 633void AppLayerParserStateStoreFree(AppLayerParserStateStore *s)
634{
b102ea21 635 if (s->to_server.store != NULL)
25a3a5c6 636 SCFree(s->to_server.store);
b102ea21 637 if (s->to_client.store != NULL)
25a3a5c6 638 SCFree(s->to_client.store);
b102ea21 639
25a3a5c6 640 SCFree(s);
b102ea21
VJ		 641}
642
c1e485cc
GS		 643static void AppLayerParserResultCleanup(AppLayerParserResult *result)
644{
9f78d47c
VJ		 645 AppLayerParserResultElmt *e = result->head;
646 while (e != NULL) {
647 AppLayerParserResultElmt *next_e = e->next;
648
649 result->head = next_e;
650 if (next_e == NULL)
651 result->tail = NULL;
652 result->cnt--;
653
654 AlpReturnResultElmt(e);
655 e = next_e;
656 }
657}
658
fc2f7f29 659static int AppLayerDoParse(Flow *f, void *app_layer_state, AppLayerParserState *parser_state,
c1e485cc 660 uint8_t *input, uint32_t input_len, uint16_t parser_idx,
c352bff6 661 uint16_t proto)
c1e485cc
GS		 662{
663 SCEnter();
9f78d47c
VJ		 664 int retval = 0;
665 AppLayerParserResult result = { NULL, NULL, 0 };
666
c1e485cc 667 SCLogDebug("parser_idx %" PRIu32 "", parser_idx);
8fa5a2c0 668 //printf("--- (%u)\n", input_len);
9f78d47c 669 //PrintRawDataFp(stdout, input,input_len);
8fa5a2c0 670 //printf("---\n");
9f78d47c
VJ		 671
672 /* invoke the parser */
fc2f7f29 673 int r = al_parser_table[parser_idx].AppLayerParser(f, app_layer_state,
18fe3818 674 parser_state, input, input_len, &result);
c1e485cc
GS		 675 if (r < 0) {
676 if (r == -1) {
677 AppLayerParserResultCleanup(&result);
678 SCReturnInt(-1);
06904c90 679#ifdef DEBUG
c1e485cc
GS		 680 } else {
681 BUG_ON(r); /* this is not supposed to happen!! */
06904c90
VJ		 682#else
683 SCReturnInt(-1);
684#endif
c1e485cc
GS		 685 }
686 }
9f78d47c
VJ		 687
688 /* process the result elements */
689 AppLayerParserResultElmt *e = result.head;
690 for (; e != NULL; e = e->next) {
c1e485cc
GS		 691 SCLogDebug("e %p e->name_idx %" PRIu32 ", e->data_ptr %p, e->data_len "
692 "%" PRIu32 ", map_size %" PRIu32 "", e, e->name_idx,
693 e->data_ptr, e->data_len, al_proto_table[proto].map_size);
9f78d47c
VJ		 694
695 /* no parser defined for this field. */
c1e485cc
GS		 696 if (e->name_idx >= al_proto_table[proto].map_size ||
697 al_proto_table[proto].map[e->name_idx] == NULL)
698 {
699 SCLogDebug("no parser for proto %" PRIu32 ", parser_local_id "
700 "%" PRIu32 "", proto, e->name_idx);
9f78d47c
VJ		 701 continue;
702 }
703
fa5939ca 704 uint16_t idx = al_proto_table[proto].map[e->name_idx]->parser_id;
9f78d47c
VJ		 705
706 /* prepare */
fa5939ca 707 uint16_t tmp = parser_state->parse_field;
9f78d47c
VJ		 708 parser_state->parse_field = 0;
709 parser_state->flags |= APP_LAYER_PARSER_EOF;
710
fc2f7f29 711 r = AppLayerDoParse(f, app_layer_state, parser_state, e->data_ptr,
c352bff6 712 e->data_len, idx, proto);
9f78d47c
VJ		 713
714 /* restore */
715 parser_state->flags &= ~APP_LAYER_PARSER_EOF;
716 parser_state->parse_field = tmp;
717
718 /* bail out on a serious error */
719 if (r < 0) {
c1e485cc
GS		 720 if (r == -1) {
721 retval = -1;
722 break;
06904c90 723#ifdef DEBUG
c1e485cc 724 } else {
06904c90
VJ		 725 BUG_ON(r); /* this is not supposed to happen!! */
726#else
727 SCReturnInt(-1);
728#endif
c1e485cc 729 }
9f78d47c
VJ		 730 }
731 }
732
733 AppLayerParserResultCleanup(&result);
c1e485cc 734 SCReturnInt(retval);
9f78d47c
VJ		 735}
736
70b32f73
VJ		 737/** \brief remove obsolete (inspected and logged) transactions */
738static int AppLayerTransactionsCleanup(AppLayerProto *p, AppLayerParserStateStore *parser_state_store, void *app_layer_state) {
739 SCEnter();
740
741 uint16_t obsolete = 0;
742
743 if (p->StateTransactionFree == NULL) {
744 SCLogDebug("no StateTransactionFree function");
745 goto end;
746 }
747
748 if (p->logger == TRUE) {
749 uint16_t low = (parser_state_store->logged_id < parser_state_store->inspect_id) ?
750 parser_state_store->logged_id : parser_state_store->inspect_id;
751
752 obsolete = low - parser_state_store->base_id;
753
754 SCLogDebug("low %"PRIu16" (logged %"PRIu16", inspect %"PRIu16"), base_id %"PRIu16", obsolete %"PRIu16", avail_id %"PRIu16,
755 low, parser_state_store->logged_id, parser_state_store->inspect_id, parser_state_store->base_id, obsolete, parser_state_store->avail_id);
756 } else {
757 obsolete = parser_state_store->inspect_id - parser_state_store->base_id;
758 }
759
760 SCLogDebug("obsolete transactions: %"PRIu16, obsolete);
761
762 /* call the callback on the obsolete transactions */
763 while ((obsolete--)) {
764 p->StateTransactionFree(app_layer_state, parser_state_store->base_id);
765 parser_state_store->base_id++;
766 }
767
768 SCLogDebug("base_id %"PRIu16, parser_state_store->base_id);
769
770end:
771 SCReturnInt(0);
772}
773
8fa5a2c0 774#ifdef DEBUG
dda6d3e0
VJ		 775uint32_t applayererrors = 0;
776uint32_t applayerhttperrors = 0;
8fa5a2c0 777#endif
dda6d3e0 778
8e10844f
VJ		 779/**
780 * \brief Layer 7 Parsing main entry point.
781 *
9f78d47c
VJ		 782 * \param f Properly initialized and locked flow.
783 * \param proto L7 proto, e.g. ALPROTO_HTTP
784 * \param flags Stream flags
785 * \param input Input L7 data
786 * \param input_len Length of the input data.
787 *
788 * \retval -1 error
789 * \retval 0 ok
8e10844f 790 */
c1e485cc 791int AppLayerParse(Flow *f, uint8_t proto, uint8_t flags, uint8_t *input,
c352bff6 792 uint32_t input_len)
c1e485cc 793{
91bc83e5 794 SCEnter();
8e10844f 795
fa5939ca 796 uint16_t parser_idx = 0;
8e10844f 797 AppLayerProto *p = &al_proto_table[proto];
c3392b7c 798 TcpSession *ssn = NULL;
8e10844f 799
8cc525c9 800 /* Used only if it's TCP */
c3392b7c 801 ssn = f->protoctx;
9676273e 802
8cc525c9 803 /** Do this check before calling AppLayerParse */
38fe2b90 804 if (flags & STREAM_GAP) {
c3392b7c 805 SCLogDebug("stream gap detected (missing packets), this is not yet supported.");
91bc83e5 806 goto error;
8e10844f
VJ		 807 }
808
809 /* Get the parser state (if any) */
06904c90
VJ		 810 AppLayerParserStateStore *parser_state_store = f->alparser;
811 if (parser_state_store == NULL) {
812 parser_state_store = AppLayerParserStateStoreAlloc();
813 if (parser_state_store == NULL)
814 goto error;
8cc525c9 815
06904c90 816 f->alparser = (void *)parser_state_store;
9f78d47c
VJ		 817 }
818
73efb4c7
VJ		 819 parser_state_store->version++;
820 SCLogDebug("app layer state version incremented to %"PRIu16,
821 parser_state_store->version);
822
9f78d47c 823 AppLayerParserState *parser_state = NULL;
38fe2b90 824 if (flags & STREAM_TOSERVER) {
48248687 825 SCLogDebug("to_server msg (flow %p)", f);
ba7e8012 826
9f78d47c
VJ		 827 parser_state = &parser_state_store->to_server;
828 if (!(parser_state->flags & APP_LAYER_PARSER_USE)) {
8e10844f 829 parser_idx = p->to_server;
9f78d47c
VJ		 830 parser_state->cur_parser = parser_idx;
831 parser_state->flags |= APP_LAYER_PARSER_USE;
832 } else {
c1e485cc
GS		 833 SCLogDebug("using parser %" PRIu32 " we stored before (to_server)",
834 parser_state->cur_parser);
9f78d47c 835 parser_idx = parser_state->cur_parser;
8e10844f
VJ		 836 }
837 } else {
48248687 838 SCLogDebug("to_client msg (flow %p)", f);
ba7e8012 839
9f78d47c
VJ		 840 parser_state = &parser_state_store->to_client;
841 if (!(parser_state->flags & APP_LAYER_PARSER_USE)) {
842 parser_idx = p->to_client;
843 parser_state->cur_parser = parser_idx;
844 parser_state->flags |= APP_LAYER_PARSER_USE;
845 } else {
c1e485cc
GS		 846 SCLogDebug("using parser %" PRIu32 " we stored before (to_client)",
847 parser_state->cur_parser);
9f78d47c
VJ		 848 parser_idx = parser_state->cur_parser;
849 }
8e10844f
VJ		 850 }
851
086ba5f4 852 if (parser_idx == 0 || parser_state->flags & APP_LAYER_PARSER_DONE) {
c1e485cc 853 SCLogDebug("no parser for protocol %" PRIu32 "", proto);
91bc83e5 854 SCReturnInt(0);
8e10844f
VJ		 855 }
856
38fe2b90 857 if (flags & STREAM_EOF)
9f78d47c 858 parser_state->flags |= APP_LAYER_PARSER_EOF;
8e10844f 859
9f78d47c 860 /* See if we already have a 'app layer' state */
06904c90 861 void *app_layer_state = f->alstate;
9f78d47c 862 if (app_layer_state == NULL) {
48248687
VJ		 863 /* lock the allocation of state as we may
864 * alloc more than one otherwise */
9f78d47c 865 app_layer_state = p->StateAlloc();
48248687 866 if (app_layer_state == NULL) {
91bc83e5 867 goto error;
48248687 868 }
9f78d47c 869
06904c90
VJ		 870 f->alstate = app_layer_state;
871 SCLogDebug("alloced new app layer state %p (name %s)",
872 app_layer_state, al_proto_table[f->alproto].name);
48248687 873 } else {
06904c90
VJ		 874 SCLogDebug("using existing app layer state %p (name %s))",
875 app_layer_state, al_proto_table[f->alproto].name);
8e10844f
VJ		 876 }
877
70b32f73
VJ		 878 /* invoke the recursive parser, but only on data. We may get empty msgs on EOF */
879 if (input_len > 0) {
880 int r = AppLayerDoParse(f, app_layer_state, parser_state, input, input_len,
881 parser_idx, proto);
882 if (r < 0)
883 goto error;
884 }
8e10844f 885
ba12f3c1 886 /* set the packets to no inspection and reassembly if required */
a16e7b74 887 if (parser_state->flags & APP_LAYER_PARSER_NO_INSPECTION) {
0edf053f 888 AppLayerSetEOF(f);
a16e7b74 889 FlowSetNoPayloadInspectionFlag(f);
8cc525c9 890 FlowSetSessionNoApplayerInspectionFlag(f);
a16e7b74
GS		 891
892 /* Set the no reassembly flag for both the stream in this TcpSession */
893 if (parser_state->flags & APP_LAYER_PARSER_NO_REASSEMBLY) {
8cc525c9
PR		 894 if (ssn != NULL) {
895 StreamTcpSetSessionNoReassemblyFlag(ssn,
38fe2b90 896 flags & STREAM_TOCLIENT ? 1 : 0);
8cc525c9 897 StreamTcpSetSessionNoReassemblyFlag(ssn,
38fe2b90 898 flags & STREAM_TOSERVER ? 1 : 0);
8cc525c9 899 }
a16e7b74
GS		 900 }
901 }
902
70b32f73
VJ		 903 /* update the transaction id */
904 if (p->StateUpdateTransactionId != NULL) {
905 p->StateUpdateTransactionId(app_layer_state, &parser_state_store->avail_id);
906
907 /* next, see if we can get rid of transactions now */
908 AppLayerTransactionsCleanup(p, parser_state_store, app_layer_state);
909 }
910 if (parser_state->flags & APP_LAYER_PARSER_EOF) {
911 SCLogDebug("eof, flag Transaction id's");
912 parser_state_store->id_flags |= APP_LAYER_TRANSACTION_EOF;
913 }
914
91bc83e5
VJ		 915 SCReturnInt(0);
916error:
c1e485cc 917 if (ssn != NULL) {
8fa5a2c0 918#ifdef DEBUG
dda6d3e0
VJ		 919 applayererrors++;
920 if (f->alproto == ALPROTO_HTTP)
921 applayerhttperrors++;
8fa5a2c0 922#endif
8cc525c9
PR		 923 /* Set the no app layer inspection flag for both
924 * the stream in this Flow */
925 FlowSetSessionNoApplayerInspectionFlag(f);
0edf053f 926 AppLayerSetEOF(f);
c1e485cc 927
262a7300 928 if (FLOW_IS_IPV4(f)) {
ba7e8012
VJ		 929 char src[16];
930 char dst[16];
6b9d1012 931 PrintInet(AF_INET, (const void*)&f->src.addr_data32[0], src,
c1e485cc 932 sizeof (src));
6b9d1012 933 PrintInet(AF_INET, (const void*)&f->dst.addr_data32[0], dst,
c1e485cc 934 sizeof (dst));
c1e485cc 935
432c3317
AS		 936 SCLogError(SC_ERR_ALPARSER, "Error occured in parsing "
937 "\"%s\" app layer "
938 "protocol, using network protocol %"PRIu8", source IP "
939 "address %s, destination IP address %s, src port %"PRIu16" and "
940 "dst port %"PRIu16"", al_proto_table[f->alproto].name,
941 f->proto, src, dst, f->sp, f->dp);
942 fflush(stdout);
262a7300 943 } else if (FLOW_IS_IPV6(f)) {
ba7e8012
VJ		 944 char dst6[46];
945 char src6[46];
946
6b9d1012 947 PrintInet(AF_INET6, (const void*)&f->src.addr_data32, src6,
ad3e4639 948 sizeof (src6));
6b9d1012 949 PrintInet(AF_INET6, (const void*)&f->dst.addr_data32, dst6,
ad3e4639
GS		 950 sizeof (dst6));
951
432c3317
AS		 952 SCLogError(SC_ERR_ALPARSER, "Error occured in parsing "
953 "\"%s\" app layer "
954 "protocol, using network protocol %"PRIu8", source IPv6 "
955 "address %s, destination IPv6 address %s, src port %"PRIu16" and "
956 "dst port %"PRIu16"", al_proto_table[f->alproto].name,
957 f->proto, src6, dst6, f->sp, f->dp);
958 fflush(stdout);
ad3e4639 959 }
c1e485cc
GS		 960 }
961
91bc83e5 962 SCReturnInt(-1);
8e10844f
VJ		 963}
964
70b32f73
VJ		 965/** \brief get the base transaction id */
966int AppLayerTransactionGetBaseId(Flow *f) {
967 SCEnter();
968
83b2c8ab 969 AppLayerParserStateStore *parser_state_store =
06904c90 970 (AppLayerParserStateStore *)f->alparser;
83b2c8ab 971
70b32f73
VJ		 972 if (parser_state_store == NULL) {
973 SCLogDebug("no state store");
974 goto error;
975 }
976
977 SCReturnInt((int)parser_state_store->base_id);
978
979error:
980 SCReturnInt(-1);
981}
982
83b2c8ab
VJ		 983/** \brief get the base transaction id */
984int AppLayerTransactionGetInspectId(Flow *f) {
985 SCEnter();
986
83b2c8ab 987 AppLayerParserStateStore *parser_state_store =
06904c90 988 (AppLayerParserStateStore *)f->alparser;
83b2c8ab
VJ		 989
990 if (parser_state_store == NULL) {
991 SCLogDebug("no state store");
992 goto error;
993 }
994
995 SCReturnInt((int)parser_state_store->inspect_id);
996
997error:
998 SCReturnInt(-1);
999}
1000
70b32f73
VJ		 1001/** \brief get the highest loggable transaction id */
1002int AppLayerTransactionGetLoggableId(Flow *f) {
1003 SCEnter();
1004
83b2c8ab 1005 AppLayerParserStateStore *parser_state_store =
06904c90 1006 (AppLayerParserStateStore *)f->alparser;
83b2c8ab 1007
70b32f73
VJ		 1008 if (parser_state_store == NULL) {
1009 SCLogDebug("no state store");
1010 goto error;
1011 }
1012
1013 int id = 0;
1014
1015 if (parser_state_store->id_flags & APP_LAYER_TRANSACTION_EOF) {
1016 SCLogDebug("eof, return current transaction as well");
1017 id = (int)(parser_state_store->avail_id);
1018 } else {
1019 id = (int)(parser_state_store->avail_id - 1);
1020 }
1021
1022 SCReturnInt(id);
1023
1024error:
1025 SCReturnInt(-1);
1026}
1027
1028/** \brief get the highest loggable transaction id */
1029void AppLayerTransactionUpdateLoggedId(Flow *f) {
1030 SCEnter();
1031
83b2c8ab 1032 AppLayerParserStateStore *parser_state_store =
06904c90 1033 (AppLayerParserStateStore *)f->alparser;
83b2c8ab 1034
70b32f73
VJ		 1035 if (parser_state_store == NULL) {
1036 SCLogDebug("no state store");
1037 goto error;
1038 }
1039
1040 parser_state_store->logged_id++;
1041 SCReturn;
1042
1043error:
1044 SCReturn;
1045}
1046/** \brief get the highest loggable transaction id */
1047int AppLayerTransactionGetLoggedId(Flow *f) {
1048 SCEnter();
1049
83b2c8ab 1050 AppLayerParserStateStore *parser_state_store =
06904c90 1051 (AppLayerParserStateStore *)f->alparser;
83b2c8ab 1052
70b32f73
VJ		 1053 if (parser_state_store == NULL) {
1054 SCLogDebug("no state store");
1055 goto error;
1056 }
1057
1058 SCReturnInt((int)parser_state_store->logged_id);
1059
1060error:
1061 SCReturnInt(-1);
1062}
1063
73efb4c7
VJ		 1064/**
1065 * \brief get the version of the state in a direction
1066 *
1067 * \param f LOCKED flow
1068 * \param direction STREAM_TOSERVER or STREAM_TOCLIENT
1069 */
1070uint16_t AppLayerGetStateVersion(Flow *f) {
1071 SCEnter();
1072 uint16_t version = 0;
1073 AppLayerParserStateStore *parser_state_store = NULL;
1074
06904c90
VJ		 1075 parser_state_store = (AppLayerParserStateStore *)f->alparser;
1076 if (parser_state_store != NULL) {
1077 version = parser_state_store->version;
73efb4c7
VJ		 1078 }
1079
1080 SCReturnUInt(version);
1081}
1082
70b32f73
VJ		 1083/**
1084 * \param f LOCKED flow
b8fec77f
VJ		 1085 * \param direction STREAM_TOSERVER or STREAM_TOCLIENT
1086 *
70b32f73
VJ		 1087 * \retval 2 current transaction done, new available
1088 * \retval 1 current transaction done, no new (yet)
1089 * \retval 0 current transaction is not done yet
1090 */
b8fec77f 1091int AppLayerTransactionUpdateInspectId(Flow *f, char direction)
70b32f73
VJ		 1092{
1093 SCEnter();
1094
1095 int r = 0;
70b32f73
VJ		 1096 AppLayerParserStateStore *parser_state_store = NULL;
1097
06904c90
VJ		 1098 parser_state_store = (AppLayerParserStateStore *)f->alparser;
1099 if (parser_state_store != NULL) {
1100 /* update inspect_id and see if it there are other transactions
1101 * as well */
70b32f73 1102
06904c90
VJ		 1103 SCLogDebug("avail_id %"PRIu16", inspect_id %"PRIu16,
1104 parser_state_store->avail_id, parser_state_store->inspect_id);
70b32f73 1105
06904c90
VJ		 1106 if (direction == STREAM_TOSERVER)
1107 parser_state_store->id_flags |= APP_LAYER_TRANSACTION_TOSERVER;
1108 else
1109 parser_state_store->id_flags |= APP_LAYER_TRANSACTION_TOCLIENT;
1110
1111 if ((parser_state_store->inspect_id+1) < parser_state_store->avail_id &&
1112 (parser_state_store->id_flags & APP_LAYER_TRANSACTION_TOCLIENT) &&
1113 (parser_state_store->id_flags & APP_LAYER_TRANSACTION_TOSERVER))
1114 {
1115 parser_state_store->id_flags &=~ APP_LAYER_TRANSACTION_TOCLIENT;
1116 parser_state_store->id_flags &=~ APP_LAYER_TRANSACTION_TOSERVER;
1117
1118 parser_state_store->inspect_id = parser_state_store->avail_id - 1;
1119 if (parser_state_store->inspect_id < parser_state_store->avail_id) {
1120 /* done and more transactions available */
1121 r = 2;
1122
1123 SCLogDebug("inspect_id %"PRIu16", avail_id %"PRIu16,
1124 parser_state_store->inspect_id,
1125 parser_state_store->avail_id);
1126 } else {
1127 /* done but no more transactions available */
1128 r = 1;
1129
1130 SCLogDebug("inspect_id %"PRIu16", avail_id %"PRIu16,
1131 parser_state_store->inspect_id,
1132 parser_state_store->avail_id);
70b32f73
VJ		 1133 }
1134 }
1135 }
e8fce5f7 1136
70b32f73
VJ		 1137 SCReturnInt(r);
1138}
1139
c1e485cc
GS		 1140void RegisterAppLayerParsers(void)
1141{
8e10844f
VJ		 1142 /** \todo move to general init function */
1143 memset(&al_proto_table, 0, sizeof(al_proto_table));
1144 memset(&al_parser_table, 0, sizeof(al_parser_table));
1145
5a9a23f9
VJ		 1146 /** setup result pool
1147 * \todo Per thread pool */
66cc3921 1148 al_result_pool = PoolInit(1000,250,AlpResultElmtPoolAlloc,NULL,AlpResultElmtPoolFree);
000ce98c
AS		 1149
1150 RegisterHTPParsers();
1151 RegisterSSLParsers();
1152 RegisterSMBParsers();
1153 RegisterDCERPCParsers();
1154 RegisterDCERPCUDPParsers();
1155 RegisterFTPParsers();
1156 RegisterSSHParsers();
576ec7da 1157 RegisterSMTPParsers();
000ce98c
AS		 1158
1159 /** IMAP */
de9ad02b 1160 //AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_IMAP, "|2A 20|OK|20|", 5, 0, STREAM_TOCLIENT);
000ce98c
AS		 1161 AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_IMAP, "1|20|capability", 12, 0, STREAM_TOSERVER);
1162
000ce98c 1163 /** MSN Messenger */
de9ad02b 1164 //AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_MSN, "MSNP", 10, 6, STREAM_TOCLIENT);
000ce98c
AS		 1165 AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_MSN, "MSNP", 10, 6, STREAM_TOSERVER);
1166
1167 /** Jabber */
1168 //AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_JABBER, "xmlns='jabber|3A|client'", 74, 53, STREAM_TOCLIENT);
1169 //AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_JABBER, "xmlns='jabber|3A|client'", 74, 53, STREAM_TOSERVER);
1170
1171 return;
5a9a23f9
VJ		 1172}
1173
8cc525c9 1174void AppLayerParserCleanupState(Flow *f)
c1e485cc 1175{
8cc525c9
PR		 1176 if (f == NULL) {
1177 SCLogDebug("no flow");
b102ea21
VJ		 1178 return;
1179 }
8cc525c9 1180 if (f->alproto >= ALPROTO_MAX) {
f862de2e
PR		 1181 SCLogDebug("app layer proto unknown");
1182 return;
1183 }
b102ea21 1184
b102ea21 1185 /* free the parser protocol state */
8cc525c9 1186 AppLayerProto *p = &al_proto_table[f->alproto];
06904c90
VJ		 1187 if (p->StateFree != NULL && f->alstate != NULL) {
1188 SCLogDebug("calling StateFree");
1189 p->StateFree(f->alstate);
1190 f->alstate = NULL;
b102ea21
VJ		 1191 }
1192
3d7b882b 1193 /* free the app layer parser api state */
06904c90
VJ		 1194 if (f->alparser != NULL) {
1195 SCLogDebug("calling AppLayerParserStateStoreFree");
1196 AppLayerParserStateStoreFree(f->alparser);
1197 f->alparser = NULL;
b102ea21
VJ		 1198 }
1199}
1200
9f78d47c
VJ		 1201/** \brief Create a mapping between the individual parsers local field id's
1202 * and the global field parser id's.
1203 *
1204 */
c1e485cc
GS		 1205void AppLayerParsersInitPostProcess(void)
1206{
fa5939ca 1207 uint16_t u16 = 0;
5a9a23f9
VJ		 1208
1209 /* build local->global mapping */
1210 for (u16 = 1; u16 <= al_max_parsers; u16++) {
1211 /* no local parser */
1212 if (al_parser_table[u16].parser_local_id == 0)
1213 continue;
1214
c1e485cc
GS		 1215 if (al_parser_table[u16].parser_local_id >
1216 al_proto_table[al_parser_table[u16].proto].map_size)
1217 {
1218 al_proto_table[al_parser_table[u16].proto].map_size =
1219 al_parser_table[u16].parser_local_id;
1220 }
1221 SCLogDebug("map_size %" PRIu32 "", al_proto_table
1222 [al_parser_table[u16].proto].map_size);
5a9a23f9
VJ		 1223 }
1224
1225 /* for each proto, alloc the map array */
1226 for (u16 = 0; u16 < ALPROTO_MAX; u16++) {
1227 if (al_proto_table[u16].map_size == 0)
1228 continue;
1229
1230 al_proto_table[u16].map_size++;
25a3a5c6 1231 al_proto_table[u16].map = (AppLayerLocalMap **)SCMalloc
c1e485cc
GS		 1232 (al_proto_table[u16].map_size *
1233 sizeof(AppLayerLocalMap *));
5a9a23f9 1234 if (al_proto_table[u16].map == NULL) {
9f4fae5b
GIG		 1235 SCLogError(SC_ERR_FATAL, "Fatal error encountered in AppLayerParsersInitPostProcess. Exiting...");
1236 exit(EXIT_FAILURE);
5a9a23f9 1237 }
c1e485cc
GS		 1238 memset(al_proto_table[u16].map, 0, al_proto_table[u16].map_size *
1239 sizeof(AppLayerLocalMap *));
5a9a23f9 1240
fa5939ca 1241 uint16_t u = 0;
5a9a23f9
VJ		 1242 for (u = 1; u <= al_max_parsers; u++) {
1243 /* no local parser */
1244 if (al_parser_table[u].parser_local_id == 0)
1245 continue;
1246
1247 if (al_parser_table[u].proto != u16)
1248 continue;
1249
fa5939ca 1250 uint16_t parser_local_id = al_parser_table[u].parser_local_id;
c1e485cc 1251 SCLogDebug("parser_local_id: %" PRIu32 "", parser_local_id);
5a9a23f9
VJ		 1252
1253 if (parser_local_id < al_proto_table[u16].map_size) {
25a3a5c6 1254 al_proto_table[u16].map[parser_local_id] = SCMalloc(sizeof(AppLayerLocalMap));
5a9a23f9 1255 if (al_proto_table[u16].map[parser_local_id] == NULL) {
9f4fae5b 1256 exit(EXIT_FAILURE);
5a9a23f9
VJ		 1257 }
1258
1259 al_proto_table[u16].map[parser_local_id]->parser_id = u;
1260 }
1261 }
1262 }
1263
1264 for (u16 = 0; u16 < ALPROTO_MAX; u16++) {
1265 if (al_proto_table[u16].map_size == 0)
1266 continue;
1267
1268 if (al_proto_table[u16].map == NULL)
1269 continue;
1270
fa5939ca 1271 uint16_t x = 0;
5a9a23f9
VJ		 1272 for (x = 0; x < al_proto_table[u16].map_size; x++) {
1273 if (al_proto_table[u16].map[x] == NULL)
1274 continue;
1275
c1e485cc 1276 SCLogDebug("al_proto_table[%" PRIu32 "].map[%" PRIu32 "]->parser_id:"
48248687 1277 " %" PRIu32 "", u16, x, al_proto_table[u16].map[x]->parser_id);
5a9a23f9
VJ		 1278 }
1279 }
8e10844f
VJ		 1280}
1281
7c31a232
AS		 1282/********************************Probing Parsers*******************************/
1283
432c3317 1284
d68775d4 1285static uint32_t AppLayerProbingParserGetMask(uint16_t al_proto)
432c3317 1286{
d68775d4
AS		 1287 if (al_proto > ALPROTO_UNKNOWN &&
1288 al_proto < ALPROTO_FAILED) {
1289 return (1 << al_proto);
432c3317
AS		 1290 } else {
1291 SCLogError(SC_ERR_ALPARSER, "Unknown protocol detected - %"PRIu16,
1292 al_proto);
1293 exit(EXIT_FAILURE);
1294 }
1295}
7c31a232
AS		 1296
1297static AppLayerProbingParserElement *
1298AppLayerCreateAppLayerProbingParserElement(const char *al_proto_name,
432c3317 1299 uint16_t ip_proto,
7c31a232
AS		 1300 uint16_t al_proto,
1301 uint16_t min_depth,
1302 uint16_t max_depth,
1303 uint16_t port,
1304 uint8_t priority,
1305 uint8_t top,
d3989e7c
AS		 1306 uint16_t (*AppLayerProbingParser)
1307 (uint8_t *input, uint32_t input_len))
7c31a232
AS		 1308{
1309 AppLayerProbingParserElement *pe = SCMalloc(sizeof(AppLayerProbingParserElement));
1310 if (pe == NULL) {
1311 return NULL;
1312 }
1313
1314 pe->al_proto_name = al_proto_name;
432c3317 1315 pe->ip_proto = ip_proto;
7c31a232 1316 pe->al_proto = al_proto;
432c3317 1317 pe->al_proto_mask = AppLayerProbingParserGetMask(al_proto);
7c31a232
AS		 1318 pe->min_depth = min_depth;
1319 pe->max_depth = max_depth;
1320 pe->port = port;
1321 pe->priority = priority;
1322 pe->top = top;
1323 pe->ProbingParser = AppLayerProbingParser;
1324 pe->next = NULL;
1325
6e0d98d9 1326 if (max_depth != 0 && min_depth > max_depth) {
7f8fb0f0 1327 SCLogError(SC_ERR_ALPARSER, "Invalid arguments sent to "
6e0d98d9
AS		 1328 "register the probing parser. min_depth > max_depth");
1329 goto error;
1330 }
1331 if (al_proto <= ALPROTO_UNKNOWN || al_proto >= ALPROTO_MAX) {
1332 SCLogError(SC_ERR_ALPARSER, "Invalid arguments sent to register "
1333 "the probing parser. Invalid alproto - %d", al_proto);
1334 goto error;
1335 }
1336 if (AppLayerProbingParser == NULL) {
1337 SCLogError(SC_ERR_ALPARSER, "Invalid arguments sent to "
1338 "register the probing parser. Probing parser func NULL");
1339 goto error;
7f8fb0f0
AS		 1340 }
1341
7c31a232 1342 return pe;
6e0d98d9
AS		 1343 error:
1344 SCFree(pe);
1345 return NULL;
7c31a232
AS		 1346}
1347
432c3317
AS		 1348static AppLayerProbingParserElement *
1349AppLayerDuplicateAppLayerProbingParserElement(AppLayerProbingParserElement *pe)
7c31a232 1350{
432c3317
AS		 1351 AppLayerProbingParserElement *new_pe = SCMalloc(sizeof(AppLayerProbingParserElement));
1352 if (pe == NULL) {
1353 return NULL;
7c31a232
AS		 1354 }
1355
432c3317
AS		 1356 new_pe->al_proto_name = pe->al_proto_name;
1357 new_pe->ip_proto = pe->ip_proto;
1358 new_pe->al_proto = pe->al_proto;
1359 new_pe->al_proto_mask = pe->al_proto_mask;
1360 new_pe->min_depth = pe->min_depth;
1361 new_pe->max_depth = pe->max_depth;
1362 new_pe->port = pe->port;
1363 new_pe->priority = pe->priority;
1364 new_pe->top = pe->top;
1365 new_pe->ProbingParser = pe->ProbingParser;
1366 new_pe->next = NULL;
1367
1368 return new_pe;
1369}
1370
1371static void
1372AppLayerFreeAppLayerProbingParserElement(AppLayerProbingParserElement *pe)
1373{
1374 SCFree(pe);
1375
1376 return;
1377}
1378
1379static void
1380AppLayerInsertNewProbingParserSingleElement(AppLayerProbingParser *pp,
1381 AppLayerProbingParser **probing_parsers,
1382 AppLayerProbingParserElement *new_pe,
1383 uint8_t flags)
1384{
7c31a232
AS		 1385 if (pp == NULL) {
1386 AppLayerProbingParser *new_pp = SCMalloc(sizeof(AppLayerProbingParser));
1387 if (new_pp == NULL)
1388 return;
1389 memset(new_pp, 0, sizeof(AppLayerProbingParser));
1390
1391 new_pp->port = new_pe->port;
1392
a40fdc79
AS		 1393 if (probing_parsers[0] == NULL) {
1394 probing_parsers[0] = new_pp;
7c31a232 1395 } else {
a40fdc79 1396 AppLayerProbingParser *pp = probing_parsers[0];
432c3317
AS		 1397 if (pp->port == 0) {
1398 new_pp->next = probing_parsers[0];
1399 probing_parsers[0] = new_pp;
1400 } else {
1401 /* port 0 based pp is always the last one. Hence the
1402 * premature exit condition if port is 0 */
1403 while (pp->next != NULL && pp->next->port != 0) {
1404 pp = pp->next;
1405 }
1406 new_pp->next = pp->next;
1407 pp->next = new_pp;
7c31a232 1408 }
7c31a232
AS		 1409 }
1410
1411 pp = new_pp;
1412 }
1413
1414 AppLayerProbingParserElement *pe = NULL;
1415 if (flags & STREAM_TOSERVER) {
1416 pe = pp->toserver;
1417 } else {
1418 pe = pp->toclient;
1419 }
1420
1421 if (pe == NULL) {
1422 if (flags & STREAM_TOSERVER) {
1423 pp->toserver = new_pe;
1424 pp->toserver_max_depth = new_pe->max_depth;
1425 } else {
1426 pp->toclient = new_pe;
1427 pp->toclient_max_depth = new_pe->max_depth;
1428 }
1429 } else {
1430 uint8_t break_priority;
1431 if (new_pe->top) {
1432 break_priority = new_pe->priority;
1433 } else {
1434 break_priority = new_pe->priority + 1;
1435 }
1436
1437 AppLayerProbingParserElement *prev_pe = pe;
1438 while (pe != NULL) {
1439 if (pe->priority < break_priority) {
1440 prev_pe = pe;
1441 pe = pe->next;
1442 continue;
1443 }
1444 break;
1445 }
1446 if (prev_pe == pe) {
1447 if (flags & STREAM_TOSERVER) {
1448 new_pe->next = pp->toserver;
1449 pp->toserver = new_pe;
1450 } else {
1451 new_pe->next = pp->toclient;
1452 pp->toclient = new_pe;
1453 }
1454 } else {
1455 new_pe->next = prev_pe->next;
1456 prev_pe->next = new_pe;
1457 }
1458
1459 if (flags & STREAM_TOSERVER) {
1460 if (new_pe->max_depth == 0) {
1461 pp->toserver_max_depth = 0;
1462 } else {
1463 if (pp->toserver_max_depth != 0 &&
1464 pp->toserver_max_depth < new_pe->max_depth) {
1465 pp->toserver_max_depth = new_pe->max_depth;
1466 }
1467 }
1468 } else {
1469 if (new_pe->max_depth == 0) {
1470 pp->toclient_max_depth = 0;
1471 } else {
1472 if (pp->toclient_max_depth != 0 &&
1473 pp->toclient_max_depth < new_pe->max_depth) {
1474 pp->toclient_max_depth = new_pe->max_depth;
1475 }
1476 }
1477 } /* else - if (flags & STREAM_TOSERVER) */
1478
1479 } /* else - if (pe == NULL) */
1480
432c3317
AS		 1481 if (flags & STREAM_TOSERVER)
1482 pp->toserver_al_proto_mask |= new_pe->al_proto_mask;
1483 else
1484 pp->toclient_al_proto_mask |= new_pe->al_proto_mask;
1485
1486 return;
1487}
1488
1489static void AppLayerInsertNewProbingParserElement(AppLayerProbingParser **probing_parsers,
1490 AppLayerProbingParserElement *new_pe,
1491 uint8_t flags)
1492{
1493 AppLayerProbingParser *pp = probing_parsers[0];
1494
1495 if (new_pe->port != 0) {
1496 AppLayerProbingParser *zero_pp = NULL;
1497 while (pp != NULL) {
1498 if (pp->port == new_pe->port) {
1499 break;
1500 }
1501 if (pp->port == 0)
1502 zero_pp = pp;
1503 pp = pp->next;
1504 }
1505 AppLayerInsertNewProbingParserSingleElement(pp, probing_parsers, new_pe,
1506 flags);
1507 if (zero_pp != NULL) {
1508 pp = probing_parsers[0];
1509 while (pp != NULL) {
1510 if (pp->port == new_pe->port)
1511 break;
1512 pp = pp->next;
1513 }
1514 BUG_ON(pp == NULL);
1515 AppLayerProbingParserElement *temp_pe;
1516 if (flags & STREAM_TOSERVER) {
1517 temp_pe = zero_pp->toserver;
1518 } else {
1519 temp_pe = zero_pp->toclient;
1520 }
1521 while (temp_pe != NULL) {
1522 AppLayerProbingParserElement *dup_pe =
1523 AppLayerDuplicateAppLayerProbingParserElement(temp_pe);
1524 AppLayerInsertNewProbingParserSingleElement(pp, probing_parsers, dup_pe,
1525 flags);
1526 temp_pe = temp_pe->next;
1527 }
1528 }
1529
1530 } else {
1531 int zero_port_present = 0;
1532 while (pp != NULL) {
1533 AppLayerProbingParserElement *dup_pe =
1534 AppLayerDuplicateAppLayerProbingParserElement(new_pe);
1535
1536 AppLayerInsertNewProbingParserSingleElement(pp, probing_parsers, dup_pe,
1537 flags);
1538 if (pp->port == 0)
1539 zero_port_present = 1;
1540 pp = pp->next;
1541 }
1542
1543 if (zero_port_present == 0) {
1544 AppLayerInsertNewProbingParserSingleElement(NULL, probing_parsers, new_pe,
1545 flags);
1546 } else {
1547 SCFree(new_pe);
1548 }
1549 }
1550
7c31a232
AS		 1551 return;
1552}
1553
a40fdc79 1554void AppLayerPrintProbingParsers(AppLayerProbingParser *pp)
7c31a232 1555{
7c31a232
AS		 1556 AppLayerProbingParserElement *pe = NULL;
1557
1558 printf("\n");
1559 while (pp != NULL) {
1560 printf("Port: %"PRIu16 "\n", pp->port);
432c3317 1561 printf(" to_server: max-depth: %"PRIu16 ", "
d68775d4 1562 "mask - %"PRIu32"\n", pp->toserver_max_depth,
432c3317 1563 pp->toserver_al_proto_mask);
7c31a232
AS		 1564 pe = pp->toserver;
1565 while (pe != NULL) {
1566 printf(" name: %s\n", pe->al_proto_name);
1567
1568 if (pe->al_proto == ALPROTO_HTTP)
1569 printf(" alproto: ALPROTO_HTTP\n");
1570 else if (pe->al_proto == ALPROTO_FTP)
1571 printf(" alproto: ALPROTO_FTP\n");
1572 else if (pe->al_proto == ALPROTO_SMTP)
1573 printf(" alproto: ALPROTO_SMTP\n");
1574 else if (pe->al_proto == ALPROTO_TLS)
1575 printf(" alproto: ALPROTO_TLS\n");
1576 else if (pe->al_proto == ALPROTO_SSH)
1577 printf(" alproto: ALPROTO_SSH\n");
1578 else if (pe->al_proto == ALPROTO_IMAP)
1579 printf(" alproto: ALPROTO_IMAP\n");
1580 else if (pe->al_proto == ALPROTO_MSN)
1581 printf(" alproto: ALPROTO_MSN\n");
1582 else if (pe->al_proto == ALPROTO_JABBER)
1583 printf(" alproto: ALPROTO_JABBER\n");
1584 else if (pe->al_proto == ALPROTO_SMB)
1585 printf(" alproto: ALPROTO_SMB\n");
1586 else if (pe->al_proto == ALPROTO_SMB2)
1587 printf(" alproto: ALPROTO_SMB2\n");
1588 else if (pe->al_proto == ALPROTO_DCERPC)
1589 printf(" alproto: ALPROTO_DCERPC\n");
1590 else if (pe->al_proto == ALPROTO_DCERPC_UDP)
1591 printf(" alproto: ALPROTO_DCERPC_UDP\n");
432c3317
AS		 1592 else if (pe->al_proto == ALPROTO_IRC)
1593 printf(" alproto: ALPROTO_IRC\n");
7c31a232
AS		 1594 else
1595 printf("impossible\n");
1596
1597 printf(" port: %"PRIu16 "\n", pe->port);
1598
1599 if (pe->priority == APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
1600 printf(" priority: HIGH\n");
1601 else if (pe->priority == APP_LAYER_PROBING_PARSER_PRIORITY_MEDIUM)
1602 printf(" priority: MEDIUM\n");
1603 else if (pe->priority == APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
1604 printf(" priority: LOW\n");
1605 else
1606 printf(" priority: impossible\n");
1607
1608 printf(" top: %"PRIu8 "\n", pe->top);
1609
1610 printf(" min_depth: %"PRIu32 "\n", pe->min_depth);
1611 printf(" max_depth: %"PRIu32 "\n", pe->max_depth);
d68775d4 1612 printf(" mask: %"PRIu32 "\n", pe->al_proto_mask);
7c31a232
AS		 1613
1614 printf("\n");
1615 pe = pe->next;
1616 }
7c31a232
AS		 1617 pp = pp->next;
1618 }
1619
1620 return;
1621}
1622
432c3317
AS		 1623int AppLayerProbingParserInfoAdd(AlpProtoDetectCtx *ctx,
1624 const char *al_proto_name,
1625 uint16_t ip_proto,
1626 uint16_t al_proto,
d3989e7c
AS		 1627 uint16_t (*ProbingParser)
1628 (uint8_t *input, uint32_t input_len))
432c3317
AS		 1629{
1630 AppLayerProbingParserInfo *new_ppi = NULL;
1631
1632 AppLayerProbingParserInfo *ppi = ctx->probing_parsers_info;
1633 while (ppi != NULL) {
1634 if (strcmp(ppi->al_proto_name, al_proto_name) == 0)
1635 break;
1636 ppi = ppi->next;
1637 }
1638
1639 if (ppi == NULL) {
1640 new_ppi = SCMalloc(sizeof(AppLayerProbingParserInfo));
1641 if (new_ppi == NULL) {
1642 return -1;
1643 }
1644 memset(new_ppi, 0, sizeof(AppLayerProbingParserInfo));
1645 new_ppi->al_proto_name = al_proto_name;
1646 new_ppi->ip_proto = ip_proto;
1647 new_ppi->al_proto = al_proto;
1648 new_ppi->ProbingParser = ProbingParser;
1649
1650 if (ctx->probing_parsers_info == NULL) {
1651 ctx->probing_parsers_info = new_ppi;
1652 } else {
1653 new_ppi->next = ctx->probing_parsers_info;
1654 ctx->probing_parsers_info = new_ppi;
1655 }
1656 return 0;
1657 }
1658
1659 if (ppi->ip_proto != ip_proto) {
1660 SCLogError(SC_ERR_ALPARSER, "New probing parser \"%s\" being registered "
1661 "already exists in the database of registered parsers, "
1662 "except that the new one registers with a different ip_proto"
1663 " %"PRIu16" compared to the existing entry of %"PRIu16,
1664 ppi->al_proto_name, ppi->ip_proto, ip_proto);
1665 return -1;
1666 }
1667 if (ppi->al_proto != al_proto) {
1668 SCLogError(SC_ERR_ALPARSER, "New probing parser \"%s\" being registered "
1669 "already exists in the database of registered parsers, "
1670 "except that the new one registers with a different alproto "
1671 "%"PRIu16" compared to the existing entry of %"PRIu16,
1672 ppi->al_proto_name, ppi->al_proto, al_proto);
1673 return -1;
1674 }
1675 if (ppi->ProbingParser != ProbingParser) {
1676 SCLogError(SC_ERR_ALPARSER, "New probing parser \"%s\" being registered "
1677 "already exists in the database of registered parsers, "
1678 "except that the new one registers with a differnt "
1679 "ProbingParser function compared to the existing entry "
1680 "in the database", ppi->al_proto_name);
1681 return -1;
1682 }
1683
1684 return 0;
1685}
1686
6e0d98d9 1687void AppLayerRegisterProbingParser(AlpProtoDetectCtx *ctx,
a40fdc79 1688 uint16_t port,
7c31a232
AS		 1689 uint16_t ip_proto,
1690 const char *al_proto_name,
1691 uint16_t al_proto,
1692 uint16_t min_depth,
1693 uint16_t max_depth,
1694 uint8_t flags,
1695 uint8_t priority,
1696 uint8_t top,
d3989e7c
AS		 1697 uint16_t (*ProbingParser)
1698 (uint8_t *input, uint32_t input_len))
7c31a232 1699{
6e0d98d9 1700 AppLayerProbingParser **probing_parsers = &ctx->probing_parsers;
7c31a232 1701 AppLayerProbingParserElement *pe = NULL;
81865652 1702 AppLayerProbingParserElement *new_pe = NULL;
432c3317
AS		 1703 AppLayerProbingParser *pp = NULL;
1704
1705 /* Add info about this probing parser to our database. Also detects any
1706 * duplicate existance of this parser but with conflicting parameters */
1707 if (AppLayerProbingParserInfoAdd(ctx, al_proto_name, ip_proto, al_proto,
1708 ProbingParser) < 0) {
1709 goto error;
1710 }
1711
1712 /* \todo introduce parsing port range here */
1713
1714 /* Get a new parser element */
81865652 1715 new_pe = AppLayerCreateAppLayerProbingParserElement(al_proto_name, ip_proto,
432c3317
AS		 1716 al_proto, min_depth,
1717 max_depth, port,
1718 priority, top,
1719 ProbingParser);
1720 if (new_pe == NULL)
1721 goto error;
1722
1723 pp = AppLayerGetProbingParsers(probing_parsers[0], ip_proto, port);
7c31a232
AS		 1724 if (pp != NULL) {
1725 if (flags & STREAM_TOSERVER) {
1726 pe = pp->toserver;
1727 } else {
1728 pe = pp->toclient;
1729 }
1730 }
1731
1732 /* check if this parser has already been registered for this port + dir */
1733 if (pe != NULL) {
1734 AppLayerProbingParserElement *tmp_pe = pe;
1735 while (tmp_pe != NULL) {
1736 if (pe->al_proto == al_proto ||
1737 strcmp(pe->al_proto_name, al_proto_name) == 0) {
1738 /* looks like we have it registered for this port + dir */
1739 SCLogWarning(SC_ERR_ALPARSER, "App layer probing parser already "
1740 "registered for this port, direction");
432c3317 1741 goto error;
7c31a232
AS		 1742 }
1743 tmp_pe = tmp_pe->next;
1744 }
1745 }
1746
a40fdc79 1747 AppLayerInsertNewProbingParserElement(probing_parsers, new_pe, flags);
432c3317
AS		 1748
1749 return;
1750 error:
1751 if (new_pe != NULL)
1752 SCFree(new_pe);
1753 return;
1754}
1755
1756void AppLayerFreeProbingParsersInfo(AppLayerProbingParserInfo *probing_parsers_info)
1757{
1758 AppLayerProbingParserInfo *ppi = probing_parsers_info;
1759 AppLayerProbingParserInfo *next_ppi = NULL;
1760
1761 while (ppi != NULL) {
1762 next_ppi = ppi->next;
1763 SCFree(ppi);
1764 ppi = next_ppi;
1765 }
1766
7c31a232
AS		 1767 return;
1768}
1769
a40fdc79 1770void AppLayerFreeProbingParsers(AppLayerProbingParser *probing_parsers)
7c31a232
AS		 1771{
1772 while (probing_parsers != NULL) {
1773 AppLayerProbingParserElement *pe;
1774 AppLayerProbingParserElement *next_pe;
1775
1776 pe = probing_parsers->toserver;
1777 while (pe != NULL) {
1778 next_pe = pe->next;
432c3317 1779 AppLayerFreeAppLayerProbingParserElement(pe);
7c31a232
AS		 1780 pe = next_pe;
1781 }
1782
1783 pe = probing_parsers->toclient;
1784 while (pe != NULL) {
1785 next_pe = pe->next;
432c3317 1786 AppLayerFreeAppLayerProbingParserElement(pe);
7c31a232
AS		 1787 pe = next_pe;
1788 }
1789
1790 probing_parsers = probing_parsers->next;
1791 }
1792
1793 return;
1794}
1795
1796/**************************************Unittests*******************************/
1797
c1e485cc
GS		 1798#ifdef UNITTESTS
1799
1800typedef struct TestState_ {
1801 uint8_t test;
1802}TestState;
1803
1804/**
1805 * \brief Test parser function to test the memory deallocation of app layer
1806 * parser of occurence of an error.
1807 */
fc2f7f29 1808static int TestProtocolParser(Flow *f, void *test_state, AppLayerParserState *pstate,
c1e485cc 1809 uint8_t *input, uint32_t input_len,
18fe3818 1810 AppLayerParserResult *output)
c1e485cc
GS		 1811{
1812 return -1;
1813}
1814
1815/** \brief Function to allocates the Test protocol state memory
1816 */
1817static void *TestProtocolStateAlloc(void)
1818{
25a3a5c6 1819 void *s = SCMalloc(sizeof(TestState));
c1e485cc
GS		 1820 if (s == NULL)
1821 return NULL;
1822
1823 memset(s, 0, sizeof(TestState));
1824 return s;
1825}
1826
1827/** \brief Function to free the Test Protocol state memory
1828 */
1829static void TestProtocolStateFree(void *s)
1830{
25a3a5c6 1831 SCFree(s);
c1e485cc
GS		 1832}
1833
1834/** \test Test the deallocation of app layer parser memory on occurance of
1835 * error in the parsing process.
1836 */
1837static int AppLayerParserTest01 (void)
1838{
9f95ab74 1839 int result = 0;
262a7300 1840 Flow *f = NULL;
c1e485cc
GS		 1841 uint8_t testbuf[] = { 0x11 };
1842 uint32_t testlen = sizeof(testbuf);
1843 TcpSession ssn;
c1e485cc 1844
c1e485cc 1845 memset(&ssn, 0, sizeof(ssn));
c1e485cc
GS		 1846
1847 /* Register the Test protocol state and parser functions */
1848 AppLayerRegisterProto("test", ALPROTO_TEST, STREAM_TOSERVER,
1849 TestProtocolParser);
1850 AppLayerRegisterStateFuncs(ALPROTO_TEST, TestProtocolStateAlloc,
1851 TestProtocolStateFree);
1852
262a7300
VJ		 1853 f = UTHBuildFlow(AF_INET, "1.2.3.4", "4.3.2.1", 20, 40);
1854 if (f == NULL)
1855 goto end;
1856 f->protoctx = &ssn;
1857
1858 f->alproto = ALPROTO_TEST;
1859 f->proto = IPPROTO_TCP;
c1e485cc 1860
6a53ab9c 1861 StreamTcpInitConfig(TRUE);
6a53ab9c 1862
262a7300 1863 int r = AppLayerParse(f, ALPROTO_TEST, STREAM_TOSERVER|STREAM_EOF, testbuf,
c352bff6 1864 testlen);
c1e485cc 1865 if (r != -1) {
9f95ab74 1866 printf("returned %" PRId32 ", expected -1: ", r);
c1e485cc
GS		 1867 goto end;
1868 }
1869
262a7300 1870 if (!(f->flags & FLOW_NO_APPLAYER_INSPECTION))
c1e485cc 1871 {
9f95ab74 1872 printf("flag should have been set, but is not: ");
c1e485cc
GS		 1873 goto end;
1874 }
1875
9f95ab74 1876 result = 1;
c1e485cc 1877end:
8cc525c9 1878 StreamTcpFreeConfig(TRUE);
262a7300
VJ		 1879
1880 UTHFreeFlow(f);
8cc525c9
PR		 1881 return result;
1882}
1883
1884/** \test Test the deallocation of app layer parser memory on occurance of
1885 * error in the parsing process for UDP.
1886 */
1887static int AppLayerParserTest02 (void)
1888{
1889 int result = 1;
262a7300 1890 Flow *f = NULL;
8cc525c9
PR		 1891 uint8_t testbuf[] = { 0x11 };
1892 uint32_t testlen = sizeof(testbuf);
8cc525c9
PR		 1893
1894 /* Register the Test protocol state and parser functions */
1895 AppLayerRegisterProto("test", ALPROTO_TEST, STREAM_TOSERVER,
1896 TestProtocolParser);
1897 AppLayerRegisterStateFuncs(ALPROTO_TEST, TestProtocolStateAlloc,
1898 TestProtocolStateFree);
1899
262a7300
VJ		 1900 f = UTHBuildFlow(AF_INET, "1.2.3.4", "4.3.2.1", 20, 40);
1901 if (f == NULL)
1902 goto end;
1903 f->alproto = ALPROTO_TEST;
1904 f->proto = IPPROTO_UDP;
8cc525c9
PR		 1905
1906 StreamTcpInitConfig(TRUE);
8cc525c9 1907
262a7300 1908 int r = AppLayerParse(f, ALPROTO_TEST, STREAM_TOSERVER|STREAM_EOF, testbuf,
8cc525c9
PR		 1909 testlen);
1910 if (r != -1) {
1911 printf("returned %" PRId32 ", expected -1: \n", r);
1912 result = 0;
1913 goto end;
1914 }
1915
1916end:
6a53ab9c 1917 StreamTcpFreeConfig(TRUE);
262a7300 1918 UTHFreeFlow(f);
c1e485cc
GS		 1919 return result;
1920}
1921
d3989e7c 1922uint16_t ProbingParserDummyForTesting(uint8_t *input, uint32_t input_len)
6e0d98d9
AS		 1923{
1924 return 0;
1925}
7c31a232
AS		 1926static int AppLayerProbingParserTest01(void)
1927{
6e0d98d9
AS		 1928 AlpProtoDetectCtx ctx;
1929 AlpProtoInit(&ctx);
7c31a232 1930
6e0d98d9 1931 AppLayerRegisterProbingParser(&ctx,
a40fdc79 1932 80,
7c31a232
AS		 1933 IPPROTO_TCP,
1934 "http",
1935 ALPROTO_HTTP,
1936 5, 5,
1937 STREAM_TOSERVER,
1938 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 1939 ProbingParserDummyForTesting);
1940 if (ctx.probing_parsers == NULL)
7c31a232
AS		 1941 return 0;
1942
6e0d98d9 1943 AlpProtoTestDestroy(&ctx);
7c31a232
AS		 1944 return 1;
1945}
c1e485cc 1946
7c31a232 1947static int AppLayerProbingParserTest02(void)
c1e485cc 1948{
7c31a232
AS		 1949 int result = 0;
1950 AppLayerProbingParser *pp;
1951 AppLayerProbingParserElement *pe;
1952
6e0d98d9
AS		 1953 AlpProtoDetectCtx ctx;
1954 AlpProtoInit(&ctx);
1955
1956 AppLayerRegisterProbingParser(&ctx,
a40fdc79 1957 80,
7c31a232
AS		 1958 IPPROTO_TCP,
1959 "http",
1960 ALPROTO_HTTP,
1961 5, 8,
1962 STREAM_TOSERVER,
1963 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 1964 ProbingParserDummyForTesting);
1965 pp = ctx.probing_parsers;
1966 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 1967 goto end;
1968 }
1969 if (pp->toclient != NULL)
1970 goto end;
1971 if (pp->next != NULL)
1972 goto end;
1973 if (pp->port != 80)
1974 goto end;
1975 if (pp->toserver_max_depth != 8)
1976 goto end;
1977 if (pp->toclient_max_depth != 0)
1978 goto end;
1979 if (pp->toserver == NULL)
1980 goto end;
1981 if (pp->toserver->next != NULL)
1982 goto end;
d68775d4 1983 if (pp->toserver_al_proto_mask != 1 << ALPROTO_HTTP)
432c3317 1984 goto end;
7c31a232
AS		 1985 /* first one */
1986 pe = pp->toserver;
1987 if (strcmp(pe->al_proto_name, "http") != 0)
1988 goto end;
1989 if (pe->al_proto != ALPROTO_HTTP)
1990 goto end;
1991 if (pe->port != 80)
1992 goto end;
1993 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
1994 goto end;
1995 if (pe->min_depth != 5)
1996 goto end;
1997 if (pe->max_depth != 8)
1998 goto end;
6e0d98d9 1999 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2000 goto end;
d68775d4 2001 if (pe->al_proto_mask != 1 << ALPROTO_HTTP)
432c3317 2002 goto end;
7c31a232 2003
6e0d98d9 2004 AppLayerRegisterProbingParser(&ctx,
a40fdc79 2005 80,
7c31a232
AS		 2006 IPPROTO_TCP,
2007 "smb",
2008 ALPROTO_SMB,
2009 5, 5,
2010 STREAM_TOSERVER,
2011 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 2012 ProbingParserDummyForTesting);
2013 pp = ctx.probing_parsers;
2014 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 2015 goto end;
2016 }
2017 if (pp->toclient != NULL)
2018 goto end;
2019 if (pp->next != NULL)
2020 goto end;
2021 if (pp->port != 80)
2022 goto end;
2023 if (pp->toserver_max_depth != 8)
2024 goto end;
2025 if (pp->toclient_max_depth != 0)
2026 goto end;
2027 if (pp->toserver == NULL)
2028 goto end;
2029 if (pp->toserver->next == NULL)
2030 goto end;
2031 if (pp->toserver->next->next != NULL)
2032 goto end;
d68775d4
AS		 2033 if (pp->toserver_al_proto_mask != (1 << ALPROTO_HTTP |
2034 1 << ALPROTO_SMB)) {
432c3317
AS		 2035 goto end;
2036 }
7c31a232
AS		 2037 /* first one */
2038 pe = pp->toserver;
2039 if (strcmp(pe->al_proto_name, "smb") != 0)
2040 goto end;
2041 if (pe->al_proto != ALPROTO_SMB)
2042 goto end;
2043 if (pe->port != 80)
2044 goto end;
2045 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2046 goto end;
2047 if (pe->min_depth != 5)
2048 goto end;
2049 if (pe->max_depth != 5)
2050 goto end;
6e0d98d9 2051 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2052 goto end;
d68775d4 2053 if (pe->al_proto_mask != 1 << ALPROTO_SMB) {
432c3317
AS		 2054 goto end;
2055 }
7c31a232
AS		 2056 /* second one */
2057 pe = pp->toserver->next;
2058 if (strcmp(pe->al_proto_name, "http") != 0)
2059 goto end;
2060 if (pe->al_proto != ALPROTO_HTTP)
2061 goto end;
2062 if (pe->port != 80)
2063 goto end;
2064 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2065 goto end;
2066 if (pe->min_depth != 5)
2067 goto end;
2068 if (pe->max_depth != 8)
2069 goto end;
6e0d98d9 2070 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2071 goto end;
d68775d4 2072 if (pe->al_proto_mask != 1 << ALPROTO_HTTP) {
432c3317
AS		 2073 goto end;
2074 }
7c31a232 2075
6e0d98d9 2076 AppLayerRegisterProbingParser(&ctx,
a40fdc79 2077 80,
7c31a232
AS		 2078 IPPROTO_TCP,
2079 "dcerpc",
2080 ALPROTO_DCERPC,
2081 9, 10,
2082 STREAM_TOSERVER,
2083 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 2084 ProbingParserDummyForTesting);
2085 pp = ctx.probing_parsers;
2086 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 2087 goto end;
2088 }
2089 if (pp->toclient != NULL)
2090 goto end;
2091 if (pp->next != NULL)
2092 goto end;
2093 if (pp->port != 80)
2094 goto end;
2095 if (pp->toserver_max_depth != 10)
2096 goto end;
2097 if (pp->toclient_max_depth != 0)
2098 goto end;
2099 if (pp->toserver == NULL)
2100 goto end;
2101 if (pp->toserver->next == NULL)
2102 goto end;
2103 if (pp->toserver->next->next == NULL)
2104 goto end;
2105 if (pp->toserver->next->next->next != NULL)
2106 goto end;
d68775d4
AS		 2107 if (pp->toserver_al_proto_mask != (1 << ALPROTO_HTTP |
2108 1 << ALPROTO_SMB |
2109 1 << ALPROTO_DCERPC)) {
432c3317
AS		 2110 goto end;
2111 }
2112
7c31a232
AS		 2113 /* first one */
2114 pe = pp->toserver;
2115 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
2116 goto end;
2117 if (pe->al_proto != ALPROTO_DCERPC)
2118 goto end;
2119 if (pe->port != 80)
2120 goto end;
2121 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2122 goto end;
2123 if (pe->min_depth != 9)
2124 goto end;
2125 if (pe->max_depth != 10)
2126 goto end;
6e0d98d9 2127 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2128 goto end;
d68775d4 2129 if (pe->al_proto_mask != 1 << ALPROTO_DCERPC) {
432c3317
AS		 2130 goto end;
2131 }
7c31a232
AS		 2132 /* second one */
2133 pe = pp->toserver->next;
2134 if (strcmp(pe->al_proto_name, "smb") != 0)
2135 goto end;
2136 if (pe->al_proto != ALPROTO_SMB)
2137 goto end;
2138 if (pe->port != 80)
2139 goto end;
2140 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2141 goto end;
2142 if (pe->min_depth != 5)
2143 goto end;
2144 if (pe->max_depth != 5)
2145 goto end;
6e0d98d9 2146 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2147 goto end;
d68775d4 2148 if (pe->al_proto_mask != 1 << ALPROTO_SMB) {
432c3317
AS		 2149 goto end;
2150 }
7c31a232
AS		 2151 /* third one */
2152 pe = pp->toserver->next->next;
2153 if (strcmp(pe->al_proto_name, "http") != 0)
2154 goto end;
2155 if (pe->al_proto != ALPROTO_HTTP)
2156 goto end;
2157 if (pe->port != 80)
2158 goto end;
2159 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2160 goto end;
2161 if (pe->min_depth != 5)
2162 goto end;
2163 if (pe->max_depth != 8)
2164 goto end;
6e0d98d9 2165 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2166 goto end;
d68775d4 2167 if (pe->al_proto_mask != 1 << ALPROTO_HTTP) {
432c3317
AS		 2168 goto end;
2169 }
7c31a232
AS		 2170
2171 result = 1;
2172
2173 end:
6e0d98d9 2174 AlpProtoTestDestroy(&ctx);
7c31a232
AS		 2175 return result;
2176}
2177
2178static int AppLayerProbingParserTest03(void)
2179{
2180 int result = 0;
2181 AppLayerProbingParser *pp;
2182 AppLayerProbingParserElement *pe;
2183
6e0d98d9
AS		 2184 AlpProtoDetectCtx ctx;
2185 AlpProtoInit(&ctx);
2186
2187 AppLayerRegisterProbingParser(&ctx,
a40fdc79 2188 80,
7c31a232
AS		 2189 IPPROTO_TCP,
2190 "http",
2191 ALPROTO_HTTP,
2192 5, 8,
2193 STREAM_TOSERVER,
2194 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 0,
6e0d98d9
AS		 2195 ProbingParserDummyForTesting);
2196 pp = ctx.probing_parsers;
2197 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 2198 goto end;
2199 }
2200 if (pp->toclient != NULL)
2201 goto end;
2202 if (pp->next != NULL)
2203 goto end;
2204 if (pp->port != 80)
2205 goto end;
2206 if (pp->toserver_max_depth != 8)
2207 goto end;
2208 if (pp->toclient_max_depth != 0)
2209 goto end;
2210 if (pp->toserver == NULL)
2211 goto end;
2212 if (pp->toserver->next != NULL)
2213 goto end;
d68775d4 2214 if (pp->toserver_al_proto_mask != (1 << ALPROTO_HTTP)) {
432c3317
AS		 2215 goto end;
2216 }
7c31a232
AS		 2217 /* first one */
2218 pe = pp->toserver;
2219 if (strcmp(pe->al_proto_name, "http") != 0)
2220 goto end;
2221 if (pe->al_proto != ALPROTO_HTTP)
2222 goto end;
2223 if (pe->port != 80)
2224 goto end;
2225 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2226 goto end;
2227 if (pe->min_depth != 5)
2228 goto end;
2229 if (pe->max_depth != 8)
2230 goto end;
6e0d98d9 2231 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2232 goto end;
d68775d4 2233 if (pe->al_proto_mask != 1 << ALPROTO_HTTP) {
432c3317
AS		 2234 goto end;
2235 }
7c31a232 2236
6e0d98d9 2237 AppLayerRegisterProbingParser(&ctx,
a40fdc79 2238 80,
7c31a232
AS		 2239 IPPROTO_TCP,
2240 "smb",
2241 ALPROTO_SMB,
2242 5, 5,
2243 STREAM_TOSERVER,
2244 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 0,
6e0d98d9
AS		 2245 ProbingParserDummyForTesting);
2246 pp = ctx.probing_parsers;
2247 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 2248 goto end;
2249 }
2250 if (pp->toclient != NULL)
2251 goto end;
2252 if (pp->next != NULL)
2253 goto end;
2254 if (pp->port != 80)
2255 goto end;
2256 if (pp->toserver_max_depth != 8)
2257 goto end;
2258 if (pp->toclient_max_depth != 0)
2259 goto end;
2260 if (pp->toserver == NULL)
2261 goto end;
2262 if (pp->toserver->next == NULL)
2263 goto end;
2264 if (pp->toserver->next->next != NULL)
2265 goto end;
d68775d4
AS		 2266 if (pp->toserver_al_proto_mask != (1 << ALPROTO_HTTP |
2267 1 << ALPROTO_SMB)) {
432c3317
AS		 2268 goto end;
2269 }
7c31a232
AS		 2270 /* first one */
2271 pe = pp->toserver;
2272 if (strcmp(pe->al_proto_name, "http") != 0)
2273 goto end;
2274 if (pe->al_proto != ALPROTO_HTTP)
2275 goto end;
2276 if (pe->port != 80)
2277 goto end;
2278 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2279 goto end;
2280 if (pe->min_depth != 5)
2281 goto end;
2282 if (pe->max_depth != 8)
2283 goto end;
6e0d98d9 2284 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2285 goto end;
d68775d4 2286 if (pe->al_proto_mask != 1 << ALPROTO_HTTP) {
432c3317
AS		 2287 goto end;
2288 }
7c31a232
AS		 2289 /* second one */
2290 pe = pp->toserver->next;
2291 if (strcmp(pe->al_proto_name, "smb") != 0)
2292 goto end;
2293 if (pe->al_proto != ALPROTO_SMB)
2294 goto end;
2295 if (pe->port != 80)
2296 goto end;
2297 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2298 goto end;
2299 if (pe->min_depth != 5)
2300 goto end;
2301 if (pe->max_depth != 5)
2302 goto end;
6e0d98d9 2303 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2304 goto end;
d68775d4 2305 if (pe->al_proto_mask != 1 << ALPROTO_SMB) {
432c3317
AS		 2306 goto end;
2307 }
7c31a232 2308
6e0d98d9 2309 AppLayerRegisterProbingParser(&ctx,
a40fdc79 2310 80,
7c31a232
AS		 2311 IPPROTO_TCP,
2312 "dcerpc",
2313 ALPROTO_DCERPC,
2314 9, 10,
2315 STREAM_TOSERVER,
2316 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 0,
6e0d98d9
AS		 2317 ProbingParserDummyForTesting);
2318 pp = ctx.probing_parsers;
2319 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 2320 goto end;
2321 }
2322 if (pp->toclient != NULL)
2323 goto end;
2324 if (pp->next != NULL)
2325 goto end;
2326 if (pp->port != 80)
2327 goto end;
2328 if (pp->toserver_max_depth != 10)
2329 goto end;
2330 if (pp->toclient_max_depth != 0)
2331 goto end;
2332 if (pp->toserver == NULL)
2333 goto end;
2334 if (pp->toserver->next == NULL)
2335 goto end;
2336 if (pp->toserver->next->next == NULL)
2337 goto end;
2338 if (pp->toserver->next->next->next != NULL)
2339 goto end;
d68775d4
AS		 2340 if (pp->toserver_al_proto_mask != (1 << ALPROTO_HTTP |
2341 1 << ALPROTO_DCERPC |
2342 1 << ALPROTO_SMB)) {
432c3317
AS		 2343 goto end;
2344 }
7c31a232
AS		 2345 /* first one */
2346 pe = pp->toserver;
2347 if (strcmp(pe->al_proto_name, "http") != 0)
2348 goto end;
2349 if (pe->al_proto != ALPROTO_HTTP)
2350 goto end;
2351 if (pe->port != 80)
2352 goto end;
2353 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2354 goto end;
2355 if (pe->min_depth != 5)
2356 goto end;
2357 if (pe->max_depth != 8)
2358 goto end;
6e0d98d9 2359 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2360 goto end;
d68775d4 2361 if (pe->al_proto_mask != 1 << ALPROTO_HTTP) {
432c3317
AS		 2362 goto end;
2363 }
7c31a232
AS		 2364 /* second one */
2365 pe = pp->toserver->next;
2366 if (strcmp(pe->al_proto_name, "smb") != 0)
2367 goto end;
2368 if (pe->al_proto != ALPROTO_SMB)
2369 goto end;
2370 if (pe->port != 80)
2371 goto end;
2372 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2373 goto end;
2374 if (pe->min_depth != 5)
2375 goto end;
2376 if (pe->max_depth != 5)
2377 goto end;
6e0d98d9 2378 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2379 goto end;
d68775d4 2380 if (pe->al_proto_mask != 1 << ALPROTO_SMB) {
432c3317
AS		 2381 goto end;
2382 }
7c31a232
AS		 2383 /* third one */
2384 pe = pp->toserver->next->next;
2385 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
2386 goto end;
2387 if (pe->al_proto != ALPROTO_DCERPC)
2388 goto end;
2389 if (pe->port != 80)
2390 goto end;
2391 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2392 goto end;
2393 if (pe->min_depth != 9)
2394 goto end;
2395 if (pe->max_depth != 10)
2396 goto end;
6e0d98d9 2397 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2398 goto end;
d68775d4 2399 if (pe->al_proto_mask != 1 << ALPROTO_DCERPC) {
432c3317
AS		 2400 goto end;
2401 }
7c31a232
AS		 2402
2403 result = 1;
2404
2405 end:
6e0d98d9 2406 AlpProtoTestDestroy(&ctx);
7c31a232
AS		 2407 return result;
2408}
2409
2410static int AppLayerProbingParserTest04(void)
2411{
2412 int result = 0;
2413 AppLayerProbingParser *pp;
2414 AppLayerProbingParserElement *pe;
2415
6e0d98d9
AS		 2416 AlpProtoDetectCtx ctx;
2417 AlpProtoInit(&ctx);
7c31a232 2418
6e0d98d9 2419 AppLayerRegisterProbingParser(&ctx,
a40fdc79 2420 80,
7c31a232
AS		 2421 IPPROTO_TCP,
2422 "http",
2423 ALPROTO_HTTP,
2424 5, 8,
2425 STREAM_TOSERVER,
2426 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 2427 ProbingParserDummyForTesting);
2428 pp = ctx.probing_parsers;
2429 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 2430 goto end;
2431 }
2432 if (pp->toclient != NULL)
2433 goto end;
2434 if (pp->next != NULL)
2435 goto end;
2436 if (pp->port != 80)
2437 goto end;
2438 if (pp->toserver_max_depth != 8)
2439 goto end;
2440 if (pp->toclient_max_depth != 0)
2441 goto end;
2442 if (pp->toserver == NULL)
2443 goto end;
2444 if (pp->toserver->next != NULL)
2445 goto end;
d68775d4 2446 if (pp->toserver_al_proto_mask != (1 << ALPROTO_HTTP)) {
432c3317
AS		 2447 goto end;
2448 }
7c31a232
AS		 2449 /* first one */
2450 pe = pp->toserver;
2451 if (strcmp(pe->al_proto_name, "http") != 0)
2452 goto end;
2453 if (pe->al_proto != ALPROTO_HTTP)
2454 goto end;
2455 if (pe->port != 80)
2456 goto end;
2457 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2458 goto end;
2459 if (pe->min_depth != 5)
2460 goto end;
2461 if (pe->max_depth != 8)
2462 goto end;
6e0d98d9 2463 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2464 goto end;
d68775d4 2465 if (pe->al_proto_mask != 1 << ALPROTO_HTTP) {
432c3317
AS		 2466 goto end;
2467 }
7c31a232 2468
6e0d98d9 2469 AppLayerRegisterProbingParser(&ctx,
a40fdc79 2470 80,
7c31a232
AS		 2471 IPPROTO_TCP,
2472 "smb",
2473 ALPROTO_SMB,
2474 5, 5,
2475 STREAM_TOSERVER,
2476 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 2477 ProbingParserDummyForTesting);
2478 pp = ctx.probing_parsers;
2479 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 2480 goto end;
2481 }
2482 if (pp->toclient != NULL)
2483 goto end;
2484 if (pp->next != NULL)
2485 goto end;
2486 if (pp->port != 80)
2487 goto end;
2488 if (pp->toserver_max_depth != 8)
2489 goto end;
2490 if (pp->toclient_max_depth != 0)
2491 goto end;
2492 if (pp->toserver == NULL)
2493 goto end;
2494 if (pp->toserver->next == NULL)
2495 goto end;
2496 if (pp->toserver->next->next != NULL)
2497 goto end;
d68775d4
AS		 2498 if (pp->toserver_al_proto_mask != (1 << ALPROTO_HTTP |
2499 1 << ALPROTO_SMB)) {
432c3317
AS		 2500 goto end;
2501 }
7c31a232
AS		 2502 /* first one */
2503 pe = pp->toserver;
2504 if (strcmp(pe->al_proto_name, "smb") != 0)
2505 goto end;
2506 if (pe->al_proto != ALPROTO_SMB)
2507 goto end;
2508 if (pe->port != 80)
2509 goto end;
2510 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2511 goto end;
2512 if (pe->min_depth != 5)
2513 goto end;
2514 if (pe->max_depth != 5)
2515 goto end;
6e0d98d9 2516 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2517 goto end;
d68775d4 2518 if (pe->al_proto_mask != 1 << ALPROTO_SMB) {
432c3317
AS		 2519 goto end;
2520 }
7c31a232
AS		 2521 /* second one */
2522 pe = pp->toserver->next;
2523 if (strcmp(pe->al_proto_name, "http") != 0)
2524 goto end;
2525 if (pe->al_proto != ALPROTO_HTTP)
2526 goto end;
2527 if (pe->port != 80)
2528 goto end;
2529 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2530 goto end;
2531 if (pe->min_depth != 5)
2532 goto end;
2533 if (pe->max_depth != 8)
2534 goto end;
6e0d98d9 2535 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2536 goto end;
d68775d4 2537 if (pe->al_proto_mask != 1 << ALPROTO_HTTP) {
432c3317
AS		 2538 goto end;
2539 }
7c31a232 2540
6e0d98d9 2541 AppLayerRegisterProbingParser(&ctx,
a40fdc79 2542 80,
7c31a232
AS		 2543 IPPROTO_TCP,
2544 "dcerpc",
2545 ALPROTO_DCERPC,
2546 9, 10,
2547 STREAM_TOSERVER,
2548 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 0,
6e0d98d9
AS		 2549 ProbingParserDummyForTesting);
2550 pp = ctx.probing_parsers;
2551 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 2552 goto end;
2553 }
2554 if (pp->toclient != NULL)
2555 goto end;
2556 if (pp->next != NULL)
2557 goto end;
2558 if (pp->port != 80)
2559 goto end;
2560 if (pp->toserver_max_depth != 10)
2561 goto end;
2562 if (pp->toclient_max_depth != 0)
2563 goto end;
2564 if (pp->toserver == NULL)
2565 goto end;
2566 if (pp->toserver->next == NULL)
2567 goto end;
2568 if (pp->toserver->next->next == NULL)
2569 goto end;
2570 if (pp->toserver->next->next->next != NULL)
2571 goto end;
d68775d4
AS		 2572 if (pp->toserver_al_proto_mask != (1 << ALPROTO_HTTP |
2573 1 << ALPROTO_DCERPC |
2574 1 << ALPROTO_SMB)) {
432c3317
AS		 2575 goto end;
2576 }
7c31a232
AS		 2577 /* first one */
2578 pe = pp->toserver;
2579 if (strcmp(pe->al_proto_name, "smb") != 0)
2580 goto end;
2581 if (pe->al_proto != ALPROTO_SMB)
2582 goto end;
2583 if (pe->port != 80)
2584 goto end;
2585 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2586 goto end;
2587 if (pe->min_depth != 5)
2588 goto end;
2589 if (pe->max_depth != 5)
2590 goto end;
6e0d98d9 2591 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2592 goto end;
d68775d4 2593 if (pe->al_proto_mask != 1 << ALPROTO_SMB) {
432c3317
AS		 2594 goto end;
2595 }
7c31a232
AS		 2596 /* second one */
2597 pe = pp->toserver->next;
2598 if (strcmp(pe->al_proto_name, "http") != 0)
2599 goto end;
2600 if (pe->al_proto != ALPROTO_HTTP)
2601 goto end;
2602 if (pe->port != 80)
2603 goto end;
2604 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2605 goto end;
2606 if (pe->min_depth != 5)
2607 goto end;
2608 if (pe->max_depth != 8)
2609 goto end;
6e0d98d9 2610 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2611 goto end;
d68775d4 2612 if (pe->al_proto_mask != 1 << ALPROTO_HTTP) {
432c3317
AS		 2613 goto end;
2614 }
7c31a232
AS		 2615 /* third one */
2616 pe = pp->toserver->next->next;
2617 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
2618 goto end;
2619 if (pe->al_proto != ALPROTO_DCERPC)
2620 goto end;
2621 if (pe->port != 80)
2622 goto end;
2623 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2624 goto end;
2625 if (pe->min_depth != 9)
2626 goto end;
2627 if (pe->max_depth != 10)
2628 goto end;
6e0d98d9 2629 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232 2630 goto end;
d68775d4 2631 if (pe->al_proto_mask != 1 << ALPROTO_DCERPC) {
432c3317
AS		 2632 goto end;
2633 }
7c31a232
AS		 2634
2635 result = 1;
2636
2637 end:
6e0d98d9 2638 AlpProtoTestDestroy(&ctx);
7c31a232
AS		 2639 return result;
2640}
2641
2642static int AppLayerProbingParserTest05(void)
2643{
2644 int result = 0;
2645 AppLayerProbingParser *pp;
2646 AppLayerProbingParserElement *pe;
2647
6e0d98d9
AS		 2648 AlpProtoDetectCtx ctx;
2649 AlpProtoInit(&ctx);
2650
2651 AppLayerRegisterProbingParser(&ctx,
a40fdc79 2652 80,
7c31a232
AS		 2653 IPPROTO_TCP,
2654 "http",
2655 ALPROTO_HTTP,
2656 5, 8,
2657 STREAM_TOSERVER,
2658 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 2659 ProbingParserDummyForTesting);
2660 pp = ctx.probing_parsers;
2661 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 2662 goto end;
2663 }
2664 if (pp->toclient != NULL)
2665 goto end;
2666 if (pp->next != NULL)
2667 goto end;
2668 if (pp->port != 80)
2669 goto end;
2670 if (pp->toserver_max_depth != 8)
2671 goto end;
2672 if (pp->toclient_max_depth != 0)
2673 goto end;
2674 if (pp->toserver == NULL)
2675 goto end;
2676 if (pp->toserver->next != NULL)
2677 goto end;
2678 /* first one */
2679 pe = pp->toserver;
2680 if (strcmp(pe->al_proto_name, "http") != 0)
2681 goto end;
2682 if (pe->al_proto != ALPROTO_HTTP)
2683 goto end;
2684 if (pe->port != 80)
2685 goto end;
2686 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2687 goto end;
2688 if (pe->min_depth != 5)
2689 goto end;
2690 if (pe->max_depth != 8)
2691 goto end;
6e0d98d9 2692 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 2693 goto end;
2694
6e0d98d9 2695 AppLayerRegisterProbingParser(&ctx,
a40fdc79 2696 80,
7c31a232
AS		 2697 IPPROTO_TCP,
2698 "smb",
2699 ALPROTO_SMB,
2700 5, 5,
2701 STREAM_TOSERVER,
2702 APP_LAYER_PROBING_PARSER_PRIORITY_LOW, 1,
6e0d98d9
AS		 2703 ProbingParserDummyForTesting);
2704 pp = ctx.probing_parsers;
2705 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 2706 goto end;
2707 }
2708 if (pp->toclient != NULL)
2709 goto end;
2710 if (pp->next != NULL)
2711 goto end;
2712 if (pp->port != 80)
2713 goto end;
2714 if (pp->toserver_max_depth != 8)
2715 goto end;
2716 if (pp->toclient_max_depth != 0)
2717 goto end;
2718 if (pp->toserver == NULL)
2719 goto end;
2720 if (pp->toserver->next == NULL)
2721 goto end;
2722 if (pp->toserver->next->next != NULL)
2723 goto end;
2724 /* first one */
2725 pe = pp->toserver;
2726 if (strcmp(pe->al_proto_name, "http") != 0)
2727 goto end;
2728 if (pe->al_proto != ALPROTO_HTTP)
2729 goto end;
2730 if (pe->port != 80)
2731 goto end;
2732 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2733 goto end;
2734 if (pe->min_depth != 5)
2735 goto end;
2736 if (pe->max_depth != 8)
2737 goto end;
6e0d98d9 2738 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 2739 goto end;
2740 /* second one */
2741 pe = pp->toserver->next;
2742 if (strcmp(pe->al_proto_name, "smb") != 0)
2743 goto end;
2744 if (pe->al_proto != ALPROTO_SMB)
2745 goto end;
2746 if (pe->port != 80)
2747 goto end;
2748 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
2749 goto end;
2750 if (pe->min_depth != 5)
2751 goto end;
2752 if (pe->max_depth != 5)
2753 goto end;
6e0d98d9 2754 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 2755 goto end;
2756
6e0d98d9 2757 AppLayerRegisterProbingParser(&ctx,
a40fdc79 2758 80,
7c31a232
AS		 2759 IPPROTO_TCP,
2760 "dcerpc",
2761 ALPROTO_DCERPC,
2762 9, 10,
2763 STREAM_TOSERVER,
2764 APP_LAYER_PROBING_PARSER_PRIORITY_LOW, 1,
6e0d98d9
AS		 2765 ProbingParserDummyForTesting);
2766 pp = ctx.probing_parsers;
2767 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 2768 goto end;
2769 }
2770 if (pp->toclient != NULL)
2771 goto end;
2772 if (pp->next != NULL)
2773 goto end;
2774 if (pp->port != 80)
2775 goto end;
2776 if (pp->toserver_max_depth != 10)
2777 goto end;
2778 if (pp->toclient_max_depth != 0)
2779 goto end;
2780 if (pp->toserver == NULL)
2781 goto end;
2782 if (pp->toserver->next == NULL)
2783 goto end;
2784 if (pp->toserver->next->next == NULL)
2785 goto end;
2786 if (pp->toserver->next->next->next != NULL)
2787 goto end;
2788 /* first one */
2789 pe = pp->toserver;
2790 if (strcmp(pe->al_proto_name, "http") != 0)
2791 goto end;
2792 if (pe->al_proto != ALPROTO_HTTP)
2793 goto end;
2794 if (pe->port != 80)
2795 goto end;
2796 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2797 goto end;
2798 if (pe->min_depth != 5)
2799 goto end;
2800 if (pe->max_depth != 8)
2801 goto end;
6e0d98d9 2802 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 2803 goto end;
2804 /* second one */
2805 pe = pp->toserver->next;
2806 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
2807 goto end;
2808 if (pe->al_proto != ALPROTO_DCERPC)
2809 goto end;
2810 if (pe->port != 80)
2811 goto end;
2812 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
2813 goto end;
2814 if (pe->min_depth != 9)
2815 goto end;
2816 if (pe->max_depth != 10)
2817 goto end;
6e0d98d9 2818 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 2819 goto end;
2820 /* third one */
2821 pe = pp->toserver->next->next;
2822 if (strcmp(pe->al_proto_name, "smb") != 0)
2823 goto end;
2824 if (pe->al_proto != ALPROTO_SMB)
2825 goto end;
2826 if (pe->port != 80)
2827 goto end;
2828 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
2829 goto end;
2830 if (pe->min_depth != 5)
2831 goto end;
2832 if (pe->max_depth != 5)
2833 goto end;
6e0d98d9 2834 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 2835 goto end;
2836
2837 result = 1;
2838
2839 end:
6e0d98d9 2840 AlpProtoTestDestroy(&ctx);
7c31a232
AS		 2841 return result;
2842}
2843
2844static int AppLayerProbingParserTest06(void)
2845{
2846 int result = 0;
2847 AppLayerProbingParser *pp;
2848 AppLayerProbingParserElement *pe;
2849
6e0d98d9
AS		 2850 AlpProtoDetectCtx ctx;
2851 AlpProtoInit(&ctx);
7c31a232 2852
6e0d98d9 2853 AppLayerRegisterProbingParser(&ctx,
a40fdc79 2854 80,
7c31a232
AS		 2855 IPPROTO_TCP,
2856 "http",
2857 ALPROTO_HTTP,
2858 5, 8,
2859 STREAM_TOSERVER,
2860 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 2861 ProbingParserDummyForTesting);
2862 pp = ctx.probing_parsers;
2863 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 2864 goto end;
2865 }
2866 if (pp->toclient != NULL)
2867 goto end;
2868 if (pp->next != NULL)
2869 goto end;
2870 if (pp->port != 80)
2871 goto end;
2872 if (pp->toserver_max_depth != 8)
2873 goto end;
2874 if (pp->toclient_max_depth != 0)
2875 goto end;
2876 if (pp->toserver == NULL)
2877 goto end;
2878 if (pp->toserver->next != NULL)
2879 goto end;
2880 /* first one */
2881 pe = pp->toserver;
2882 if (strcmp(pe->al_proto_name, "http") != 0)
2883 goto end;
2884 if (pe->al_proto != ALPROTO_HTTP)
2885 goto end;
2886 if (pe->port != 80)
2887 goto end;
2888 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2889 goto end;
2890 if (pe->min_depth != 5)
2891 goto end;
2892 if (pe->max_depth != 8)
2893 goto end;
6e0d98d9 2894 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 2895 goto end;
2896
6e0d98d9 2897 AppLayerRegisterProbingParser(&ctx,
a40fdc79 2898 80,
7c31a232
AS		 2899 IPPROTO_TCP,
2900 "smb",
2901 ALPROTO_SMB,
2902 5, 5,
2903 STREAM_TOSERVER,
2904 APP_LAYER_PROBING_PARSER_PRIORITY_LOW, 1,
6e0d98d9
AS		 2905 ProbingParserDummyForTesting);
2906 pp = ctx.probing_parsers;
2907 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 2908 goto end;
2909 }
2910 if (pp->toclient != NULL)
2911 goto end;
2912 if (pp->next != NULL)
2913 goto end;
2914 if (pp->port != 80)
2915 goto end;
2916 if (pp->toserver_max_depth != 8)
2917 goto end;
2918 if (pp->toclient_max_depth != 0)
2919 goto end;
2920 if (pp->toserver == NULL)
2921 goto end;
2922 if (pp->toserver->next == NULL)
2923 goto end;
2924 if (pp->toserver->next->next != NULL)
2925 goto end;
2926 /* first one */
2927 pe = pp->toserver;
2928 if (strcmp(pe->al_proto_name, "http") != 0)
2929 goto end;
2930 if (pe->al_proto != ALPROTO_HTTP)
2931 goto end;
2932 if (pe->port != 80)
2933 goto end;
2934 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2935 goto end;
2936 if (pe->min_depth != 5)
2937 goto end;
2938 if (pe->max_depth != 8)
2939 goto end;
6e0d98d9 2940 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 2941 goto end;
2942 /* second one */
2943 pe = pp->toserver->next;
2944 if (strcmp(pe->al_proto_name, "smb") != 0)
2945 goto end;
2946 if (pe->al_proto != ALPROTO_SMB)
2947 goto end;
2948 if (pe->port != 80)
2949 goto end;
2950 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
2951 goto end;
2952 if (pe->min_depth != 5)
2953 goto end;
2954 if (pe->max_depth != 5)
2955 goto end;
6e0d98d9 2956 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 2957 goto end;
2958
6e0d98d9 2959 AppLayerRegisterProbingParser(&ctx,
a40fdc79 2960 80,
7c31a232
AS		 2961 IPPROTO_TCP,
2962 "dcerpc",
2963 ALPROTO_DCERPC,
2964 9, 10,
2965 STREAM_TOSERVER,
2966 APP_LAYER_PROBING_PARSER_PRIORITY_LOW, 0,
6e0d98d9
AS		 2967 ProbingParserDummyForTesting);
2968 pp = ctx.probing_parsers;
2969 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 2970 goto end;
2971 }
2972 if (pp->toclient != NULL)
2973 goto end;
2974 if (pp->next != NULL)
2975 goto end;
2976 if (pp->port != 80)
2977 goto end;
2978 if (pp->toserver_max_depth != 10)
2979 goto end;
2980 if (pp->toclient_max_depth != 0)
2981 goto end;
2982 if (pp->toserver == NULL)
2983 goto end;
2984 if (pp->toserver->next == NULL)
2985 goto end;
2986 if (pp->toserver->next->next == NULL)
2987 goto end;
2988 if (pp->toserver->next->next->next != NULL)
2989 goto end;
2990 /* first one */
2991 pe = pp->toserver;
2992 if (strcmp(pe->al_proto_name, "http") != 0)
2993 goto end;
2994 if (pe->al_proto != ALPROTO_HTTP)
2995 goto end;
2996 if (pe->port != 80)
2997 goto end;
2998 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
2999 goto end;
3000 if (pe->min_depth != 5)
3001 goto end;
3002 if (pe->max_depth != 8)
3003 goto end;
6e0d98d9 3004 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3005 goto end;
3006 /* second one */
3007 pe = pp->toserver->next;
3008 if (strcmp(pe->al_proto_name, "smb") != 0)
3009 goto end;
3010 if (pe->al_proto != ALPROTO_SMB)
3011 goto end;
3012 if (pe->port != 80)
3013 goto end;
3014 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
3015 goto end;
3016 if (pe->min_depth != 5)
3017 goto end;
3018 if (pe->max_depth != 5)
3019 goto end;
6e0d98d9 3020 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3021 goto end;
3022 /* third one */
3023 pe = pp->toserver->next->next;
3024 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
3025 goto end;
3026 if (pe->al_proto != ALPROTO_DCERPC)
3027 goto end;
3028 if (pe->port != 80)
3029 goto end;
3030 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
3031 goto end;
3032 if (pe->min_depth != 9)
3033 goto end;
3034 if (pe->max_depth != 10)
3035 goto end;
6e0d98d9 3036 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3037 goto end;
3038
3039 result = 1;
3040
3041 end:
6e0d98d9 3042 AlpProtoTestDestroy(&ctx);
7c31a232
AS		 3043 return result;
3044}
3045
3046static int AppLayerProbingParserTest07(void)
3047{
3048 int result = 0;
3049 AppLayerProbingParser *pp;
3050 AppLayerProbingParserElement *pe;
3051
6e0d98d9
AS		 3052 AlpProtoDetectCtx ctx;
3053 AlpProtoInit(&ctx);
7c31a232 3054
6e0d98d9 3055 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3056 80,
7c31a232
AS		 3057 IPPROTO_TCP,
3058 "http",
3059 ALPROTO_HTTP,
3060 5, 8,
3061 STREAM_TOSERVER,
3062 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 3063 ProbingParserDummyForTesting);
3064 pp = ctx.probing_parsers;
3065 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3066 goto end;
3067 }
3068 if (pp->toclient != NULL)
3069 goto end;
3070 if (pp->next != NULL)
3071 goto end;
3072 if (pp->port != 80)
3073 goto end;
3074 if (pp->toserver_max_depth != 8)
3075 goto end;
3076 if (pp->toclient_max_depth != 0)
3077 goto end;
3078 if (pp->toserver == NULL)
3079 goto end;
3080 if (pp->toserver->next != NULL)
3081 goto end;
3082 /* first one */
3083 pe = pp->toserver;
3084 if (strcmp(pe->al_proto_name, "http") != 0)
3085 goto end;
3086 if (pe->al_proto != ALPROTO_HTTP)
3087 goto end;
3088 if (pe->port != 80)
3089 goto end;
3090 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3091 goto end;
3092 if (pe->min_depth != 5)
3093 goto end;
3094 if (pe->max_depth != 8)
3095 goto end;
6e0d98d9 3096 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3097 goto end;
3098
6e0d98d9 3099 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3100 80,
7c31a232
AS		 3101 IPPROTO_TCP,
3102 "smb",
3103 ALPROTO_SMB,
3104 5, 5,
3105 STREAM_TOSERVER,
3106 APP_LAYER_PROBING_PARSER_PRIORITY_LOW, 1,
6e0d98d9
AS		 3107 ProbingParserDummyForTesting);
3108 pp = ctx.probing_parsers;
3109 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3110 goto end;
3111 }
3112 if (pp->toclient != NULL)
3113 goto end;
3114 if (pp->next != NULL)
3115 goto end;
3116 if (pp->port != 80)
3117 goto end;
3118 if (pp->toserver_max_depth != 8)
3119 goto end;
3120 if (pp->toclient_max_depth != 0)
3121 goto end;
3122 if (pp->toserver == NULL)
3123 goto end;
3124 if (pp->toserver->next == NULL)
3125 goto end;
3126 if (pp->toserver->next->next != NULL)
3127 goto end;
3128 /* first one */
3129 pe = pp->toserver;
3130 if (strcmp(pe->al_proto_name, "http") != 0)
3131 goto end;
3132 if (pe->al_proto != ALPROTO_HTTP)
3133 goto end;
3134 if (pe->port != 80)
3135 goto end;
3136 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3137 goto end;
3138 if (pe->min_depth != 5)
3139 goto end;
3140 if (pe->max_depth != 8)
3141 goto end;
6e0d98d9 3142 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3143 goto end;
3144 /* second one */
3145 pe = pp->toserver->next;
3146 if (strcmp(pe->al_proto_name, "smb") != 0)
3147 goto end;
3148 if (pe->al_proto != ALPROTO_SMB)
3149 goto end;
3150 if (pe->port != 80)
3151 goto end;
3152 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
3153 goto end;
3154 if (pe->min_depth != 5)
3155 goto end;
3156 if (pe->max_depth != 5)
3157 goto end;
6e0d98d9 3158 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3159 goto end;
3160
6e0d98d9 3161 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3162 80,
7c31a232
AS		 3163 IPPROTO_TCP,
3164 "dcerpc",
3165 ALPROTO_DCERPC,
3166 9, 10,
3167 STREAM_TOSERVER,
3168 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 3169 ProbingParserDummyForTesting);
3170 pp = ctx.probing_parsers;
3171 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3172 goto end;
3173 }
3174 if (pp->toclient != NULL)
3175 goto end;
3176 if (pp->next != NULL)
3177 goto end;
3178 if (pp->port != 80)
3179 goto end;
3180 if (pp->toserver_max_depth != 10)
3181 goto end;
3182 if (pp->toclient_max_depth != 0)
3183 goto end;
3184 if (pp->toserver == NULL)
3185 goto end;
3186 if (pp->toserver->next == NULL)
3187 goto end;
3188 if (pp->toserver->next->next == NULL)
3189 goto end;
3190 if (pp->toserver->next->next->next != NULL)
3191 goto end;
3192 /* first one */
3193 pe = pp->toserver;
3194 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
3195 goto end;
3196 if (pe->al_proto != ALPROTO_DCERPC)
3197 goto end;
3198 if (pe->port != 80)
3199 goto end;
3200 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3201 goto end;
3202 if (pe->min_depth != 9)
3203 goto end;
3204 if (pe->max_depth != 10)
3205 goto end;
6e0d98d9 3206 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3207 goto end;
3208 /* second one */
3209 pe = pp->toserver->next;
3210 if (strcmp(pe->al_proto_name, "http") != 0)
3211 goto end;
3212 if (pe->al_proto != ALPROTO_HTTP)
3213 goto end;
3214 if (pe->port != 80)
3215 goto end;
3216 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3217 goto end;
3218 if (pe->min_depth != 5)
3219 goto end;
3220 if (pe->max_depth != 8)
3221 goto end;
6e0d98d9 3222 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3223 goto end;
3224 /* third one */
3225 pe = pp->toserver->next->next;
3226 if (strcmp(pe->al_proto_name, "smb") != 0)
3227 goto end;
3228 if (pe->al_proto != ALPROTO_SMB)
3229 goto end;
3230 if (pe->port != 80)
3231 goto end;
3232 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
3233 goto end;
3234 if (pe->min_depth != 5)
3235 goto end;
3236 if (pe->max_depth != 5)
3237 goto end;
6e0d98d9 3238 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3239 goto end;
3240
3241 result = 1;
3242
3243 end:
6e0d98d9 3244 AlpProtoTestDestroy(&ctx);
7c31a232
AS		 3245 return result;
3246}
3247
3248static int AppLayerProbingParserTest08(void)
3249{
3250 int result = 0;
3251 AppLayerProbingParser *pp;
3252 AppLayerProbingParserElement *pe;
3253
6e0d98d9
AS		 3254 AlpProtoDetectCtx ctx;
3255 AlpProtoInit(&ctx);
7c31a232 3256
6e0d98d9 3257 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3258 80,
7c31a232
AS		 3259 IPPROTO_TCP,
3260 "http",
3261 ALPROTO_HTTP,
3262 5, 8,
3263 STREAM_TOSERVER,
3264 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 3265 ProbingParserDummyForTesting);
3266 pp = ctx.probing_parsers;
3267 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3268 goto end;
3269 }
3270 if (pp->toclient != NULL)
3271 goto end;
3272 if (pp->next != NULL)
3273 goto end;
3274 if (pp->port != 80)
3275 goto end;
3276 if (pp->toserver_max_depth != 8)
3277 goto end;
3278 if (pp->toclient_max_depth != 0)
3279 goto end;
3280 if (pp->toserver == NULL)
3281 goto end;
3282 if (pp->toserver->next != NULL)
3283 goto end;
3284 /* first one */
3285 pe = pp->toserver;
3286 if (strcmp(pe->al_proto_name, "http") != 0)
3287 goto end;
3288 if (pe->al_proto != ALPROTO_HTTP)
3289 goto end;
3290 if (pe->port != 80)
3291 goto end;
3292 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3293 goto end;
3294 if (pe->min_depth != 5)
3295 goto end;
3296 if (pe->max_depth != 8)
3297 goto end;
6e0d98d9 3298 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3299 goto end;
3300
6e0d98d9 3301 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3302 80,
7c31a232
AS		 3303 IPPROTO_TCP,
3304 "smb",
3305 ALPROTO_SMB,
3306 5, 5,
3307 STREAM_TOSERVER,
3308 APP_LAYER_PROBING_PARSER_PRIORITY_LOW, 1,
6e0d98d9
AS		 3309 ProbingParserDummyForTesting);
3310 pp = ctx.probing_parsers;
3311 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3312 goto end;
3313 }
3314 if (pp->toclient != NULL)
3315 goto end;
3316 if (pp->next != NULL)
3317 goto end;
3318 if (pp->port != 80)
3319 goto end;
3320 if (pp->toserver_max_depth != 8)
3321 goto end;
3322 if (pp->toclient_max_depth != 0)
3323 goto end;
3324 if (pp->toserver == NULL)
3325 goto end;
3326 if (pp->toserver->next == NULL)
3327 goto end;
3328 if (pp->toserver->next->next != NULL)
3329 goto end;
3330 /* first one */
3331 pe = pp->toserver;
3332 if (strcmp(pe->al_proto_name, "http") != 0)
3333 goto end;
3334 if (pe->al_proto != ALPROTO_HTTP)
3335 goto end;
3336 if (pe->port != 80)
3337 goto end;
3338 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3339 goto end;
3340 if (pe->min_depth != 5)
3341 goto end;
3342 if (pe->max_depth != 8)
3343 goto end;
6e0d98d9 3344 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3345 goto end;
3346 /* second one */
3347 pe = pp->toserver->next;
3348 if (strcmp(pe->al_proto_name, "smb") != 0)
3349 goto end;
3350 if (pe->al_proto != ALPROTO_SMB)
3351 goto end;
3352 if (pe->port != 80)
3353 goto end;
3354 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
3355 goto end;
3356 if (pe->min_depth != 5)
3357 goto end;
3358 if (pe->max_depth != 5)
3359 goto end;
6e0d98d9 3360 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3361 goto end;
3362
6e0d98d9 3363 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3364 80,
7c31a232
AS		 3365 IPPROTO_TCP,
3366 "dcerpc",
3367 ALPROTO_DCERPC,
3368 9, 10,
3369 STREAM_TOSERVER,
3370 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 0,
6e0d98d9
AS		 3371 ProbingParserDummyForTesting);
3372 pp = ctx.probing_parsers;
3373 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3374 goto end;
3375 }
3376 if (pp->toclient != NULL)
3377 goto end;
3378 if (pp->next != NULL)
3379 goto end;
3380 if (pp->port != 80)
3381 goto end;
3382 if (pp->toserver_max_depth != 10)
3383 goto end;
3384 if (pp->toclient_max_depth != 0)
3385 goto end;
3386 if (pp->toserver == NULL)
3387 goto end;
3388 if (pp->toserver->next == NULL)
3389 goto end;
3390 if (pp->toserver->next->next == NULL)
3391 goto end;
3392 if (pp->toserver->next->next->next != NULL)
3393 goto end;
3394 /* first one */
3395 pe = pp->toserver;
3396 if (strcmp(pe->al_proto_name, "http") != 0)
3397 goto end;
3398 if (pe->al_proto != ALPROTO_HTTP)
3399 goto end;
3400 if (pe->port != 80)
3401 goto end;
3402 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3403 goto end;
3404 if (pe->min_depth != 5)
3405 goto end;
3406 if (pe->max_depth != 8)
3407 goto end;
6e0d98d9 3408 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3409 goto end;
3410 /* second one */
3411 pe = pp->toserver->next;
3412 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
3413 goto end;
3414 if (pe->al_proto != ALPROTO_DCERPC)
3415 goto end;
3416 if (pe->port != 80)
3417 goto end;
3418 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3419 goto end;
3420 if (pe->min_depth != 9)
3421 goto end;
3422 if (pe->max_depth != 10)
3423 goto end;
6e0d98d9 3424 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3425 goto end;
3426 /* third one */
3427 pe = pp->toserver->next->next;
3428 if (strcmp(pe->al_proto_name, "smb") != 0)
3429 goto end;
3430 if (pe->al_proto != ALPROTO_SMB)
3431 goto end;
3432 if (pe->port != 80)
3433 goto end;
3434 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
3435 goto end;
3436 if (pe->min_depth != 5)
3437 goto end;
3438 if (pe->max_depth != 5)
3439 goto end;
6e0d98d9 3440 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3441 goto end;
3442
3443 result = 1;
3444
3445 end:
6e0d98d9 3446 AlpProtoTestDestroy(&ctx);
7c31a232
AS		 3447 return result;
3448}
3449
3450static int AppLayerProbingParserTest09(void)
3451{
3452 int result = 0;
3453 AppLayerProbingParser *pp;
3454 AppLayerProbingParserElement *pe;
3455
6e0d98d9
AS		 3456 AlpProtoDetectCtx ctx;
3457 AlpProtoInit(&ctx);
7c31a232 3458
6e0d98d9 3459 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3460 80,
7c31a232
AS		 3461 IPPROTO_TCP,
3462 "http",
3463 ALPROTO_HTTP,
3464 5, 8,
3465 STREAM_TOSERVER,
3466 APP_LAYER_PROBING_PARSER_PRIORITY_LOW, 1,
6e0d98d9
AS		 3467 ProbingParserDummyForTesting);
3468 pp = ctx.probing_parsers;
3469 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3470 goto end;
3471 }
3472 if (pp->toclient != NULL)
3473 goto end;
3474 if (pp->next != NULL)
3475 goto end;
3476 if (pp->port != 80)
3477 goto end;
3478 if (pp->toserver_max_depth != 8)
3479 goto end;
3480 if (pp->toclient_max_depth != 0)
3481 goto end;
3482 if (pp->toserver == NULL)
3483 goto end;
3484 if (pp->toserver->next != NULL)
3485 goto end;
3486 /* first one */
3487 pe = pp->toserver;
3488 if (strcmp(pe->al_proto_name, "http") != 0)
3489 goto end;
3490 if (pe->al_proto != ALPROTO_HTTP)
3491 goto end;
3492 if (pe->port != 80)
3493 goto end;
3494 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
3495 goto end;
3496 if (pe->min_depth != 5)
3497 goto end;
3498 if (pe->max_depth != 8)
3499 goto end;
6e0d98d9 3500 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3501 goto end;
3502
6e0d98d9 3503 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3504 80,
7c31a232
AS		 3505 IPPROTO_TCP,
3506 "smb",
3507 ALPROTO_SMB,
3508 5, 5,
3509 STREAM_TOSERVER,
3510 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 3511 ProbingParserDummyForTesting);
3512 pp = ctx.probing_parsers;
3513 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3514 goto end;
3515 }
3516 if (pp->toclient != NULL)
3517 goto end;
3518 if (pp->next != NULL)
3519 goto end;
3520 if (pp->port != 80)
3521 goto end;
3522 if (pp->toserver_max_depth != 8)
3523 goto end;
3524 if (pp->toclient_max_depth != 0)
3525 goto end;
3526 if (pp->toserver == NULL)
3527 goto end;
3528 if (pp->toserver->next == NULL)
3529 goto end;
3530 if (pp->toserver->next->next != NULL)
3531 goto end;
3532 /* first one */
3533 pe = pp->toserver;
3534 if (strcmp(pe->al_proto_name, "smb") != 0)
3535 goto end;
3536 if (pe->al_proto != ALPROTO_SMB)
3537 goto end;
3538 if (pe->port != 80)
3539 goto end;
3540 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3541 goto end;
3542 if (pe->min_depth != 5)
3543 goto end;
3544 if (pe->max_depth != 5)
3545 goto end;
6e0d98d9 3546 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3547 goto end;
3548 /* second one */
3549 pe = pp->toserver->next;
3550 if (strcmp(pe->al_proto_name, "http") != 0)
3551 goto end;
3552 if (pe->al_proto != ALPROTO_HTTP)
3553 goto end;
3554 if (pe->port != 80)
3555 goto end;
3556 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
3557 goto end;
3558 if (pe->min_depth != 5)
3559 goto end;
3560 if (pe->max_depth != 8)
3561 goto end;
6e0d98d9 3562 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3563 goto end;
3564
6e0d98d9 3565 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3566 80,
7c31a232
AS		 3567 IPPROTO_TCP,
3568 "dcerpc",
3569 ALPROTO_DCERPC,
3570 9, 10,
3571 STREAM_TOSERVER,
3572 APP_LAYER_PROBING_PARSER_PRIORITY_LOW, 1,
6e0d98d9
AS		 3573 ProbingParserDummyForTesting);
3574 pp = ctx.probing_parsers;
3575 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3576 goto end;
3577 }
3578 if (pp->toclient != NULL)
3579 goto end;
3580 if (pp->next != NULL)
3581 goto end;
3582 if (pp->port != 80)
3583 goto end;
3584 if (pp->toserver_max_depth != 10)
3585 goto end;
3586 if (pp->toclient_max_depth != 0)
3587 goto end;
3588 if (pp->toserver == NULL)
3589 goto end;
3590 if (pp->toserver->next == NULL)
3591 goto end;
3592 if (pp->toserver->next->next == NULL)
3593 goto end;
3594 if (pp->toserver->next->next->next != NULL)
3595 goto end;
3596 /* first one */
3597 pe = pp->toserver;
3598 if (strcmp(pe->al_proto_name, "smb") != 0)
3599 goto end;
3600 if (pe->al_proto != ALPROTO_SMB)
3601 goto end;
3602 if (pe->port != 80)
3603 goto end;
3604 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3605 goto end;
3606 if (pe->min_depth != 5)
3607 goto end;
3608 if (pe->max_depth != 5)
3609 goto end;
6e0d98d9 3610 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3611 goto end;
3612 /* second one */
3613 pe = pp->toserver->next;
3614 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
3615 goto end;
3616 if (pe->al_proto != ALPROTO_DCERPC)
3617 goto end;
3618 if (pe->port != 80)
3619 goto end;
3620 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
3621 goto end;
3622 if (pe->min_depth != 9)
3623 goto end;
3624 if (pe->max_depth != 10)
3625 goto end;
6e0d98d9 3626 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3627 goto end;
3628 /* third one */
3629 pe = pp->toserver->next->next;
3630 if (strcmp(pe->al_proto_name, "http") != 0)
3631 goto end;
3632 if (pe->al_proto != ALPROTO_HTTP)
3633 goto end;
3634 if (pe->port != 80)
3635 goto end;
3636 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
3637 goto end;
3638 if (pe->min_depth != 5)
3639 goto end;
3640 if (pe->max_depth != 8)
3641 goto end;
6e0d98d9 3642 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3643 goto end;
3644
3645 result = 1;
3646
3647 end:
6e0d98d9 3648 AlpProtoTestDestroy(&ctx);
7c31a232
AS		 3649 return result;
3650}
3651
3652static int AppLayerProbingParserTest10(void)
3653{
3654 int result = 0;
3655 AppLayerProbingParser *pp;
3656 AppLayerProbingParserElement *pe;
3657
6e0d98d9
AS		 3658 AlpProtoDetectCtx ctx;
3659 AlpProtoInit(&ctx);
7c31a232 3660
6e0d98d9 3661 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3662 80,
7c31a232
AS		 3663 IPPROTO_TCP,
3664 "http",
3665 ALPROTO_HTTP,
3666 5, 8,
3667 STREAM_TOSERVER,
3668 APP_LAYER_PROBING_PARSER_PRIORITY_LOW, 1,
6e0d98d9
AS		 3669 ProbingParserDummyForTesting);
3670 pp = ctx.probing_parsers;
3671 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3672 goto end;
3673 }
3674 if (pp->toclient != NULL)
3675 goto end;
3676 if (pp->next != NULL)
3677 goto end;
3678 if (pp->port != 80)
3679 goto end;
3680 if (pp->toserver_max_depth != 8)
3681 goto end;
3682 if (pp->toclient_max_depth != 0)
3683 goto end;
3684 if (pp->toserver == NULL)
3685 goto end;
3686 if (pp->toserver->next != NULL)
3687 goto end;
3688 /* first one */
3689 pe = pp->toserver;
3690 if (strcmp(pe->al_proto_name, "http") != 0)
3691 goto end;
3692 if (pe->al_proto != ALPROTO_HTTP)
3693 goto end;
3694 if (pe->port != 80)
3695 goto end;
3696 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
3697 goto end;
3698 if (pe->min_depth != 5)
3699 goto end;
3700 if (pe->max_depth != 8)
3701 goto end;
6e0d98d9 3702 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3703 goto end;
3704
6e0d98d9 3705 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3706 80,
7c31a232
AS		 3707 IPPROTO_TCP,
3708 "smb",
3709 ALPROTO_SMB,
3710 5, 5,
3711 STREAM_TOSERVER,
3712 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 3713 ProbingParserDummyForTesting);
3714 pp = ctx.probing_parsers;
3715 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3716 goto end;
3717 }
3718 if (pp->toclient != NULL)
3719 goto end;
3720 if (pp->next != NULL)
3721 goto end;
3722 if (pp->port != 80)
3723 goto end;
3724 if (pp->toserver_max_depth != 8)
3725 goto end;
3726 if (pp->toclient_max_depth != 0)
3727 goto end;
3728 if (pp->toserver == NULL)
3729 goto end;
3730 if (pp->toserver->next == NULL)
3731 goto end;
3732 if (pp->toserver->next->next != NULL)
3733 goto end;
3734 /* first one */
3735 pe = pp->toserver;
3736 if (strcmp(pe->al_proto_name, "smb") != 0)
3737 goto end;
3738 if (pe->al_proto != ALPROTO_SMB)
3739 goto end;
3740 if (pe->port != 80)
3741 goto end;
3742 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3743 goto end;
3744 if (pe->min_depth != 5)
3745 goto end;
3746 if (pe->max_depth != 5)
3747 goto end;
6e0d98d9 3748 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3749 goto end;
3750 /* second one */
3751 pe = pp->toserver->next;
3752 if (strcmp(pe->al_proto_name, "http") != 0)
3753 goto end;
3754 if (pe->al_proto != ALPROTO_HTTP)
3755 goto end;
3756 if (pe->port != 80)
3757 goto end;
3758 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
3759 goto end;
3760 if (pe->min_depth != 5)
3761 goto end;
3762 if (pe->max_depth != 8)
3763 goto end;
6e0d98d9 3764 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3765 goto end;
3766
6e0d98d9 3767 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3768 80,
7c31a232
AS		 3769 IPPROTO_TCP,
3770 "dcerpc",
3771 ALPROTO_DCERPC,
3772 9, 10,
3773 STREAM_TOSERVER,
3774 APP_LAYER_PROBING_PARSER_PRIORITY_LOW, 0,
6e0d98d9
AS		 3775 ProbingParserDummyForTesting);
3776 pp = ctx.probing_parsers;
3777 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3778 goto end;
3779 }
3780 if (pp->toclient != NULL)
3781 goto end;
3782 if (pp->next != NULL)
3783 goto end;
3784 if (pp->port != 80)
3785 goto end;
3786 if (pp->toserver_max_depth != 10)
3787 goto end;
3788 if (pp->toclient_max_depth != 0)
3789 goto end;
3790 if (pp->toserver == NULL)
3791 goto end;
3792 if (pp->toserver->next == NULL)
3793 goto end;
3794 if (pp->toserver->next->next == NULL)
3795 goto end;
3796 if (pp->toserver->next->next->next != NULL)
3797 goto end;
3798 /* first one */
3799 pe = pp->toserver;
3800 if (strcmp(pe->al_proto_name, "smb") != 0)
3801 goto end;
3802 if (pe->al_proto != ALPROTO_SMB)
3803 goto end;
3804 if (pe->port != 80)
3805 goto end;
3806 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3807 goto end;
3808 if (pe->min_depth != 5)
3809 goto end;
3810 if (pe->max_depth != 5)
3811 goto end;
6e0d98d9 3812 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3813 goto end;
3814 /* second one */
3815 pe = pp->toserver->next;
3816 if (strcmp(pe->al_proto_name, "http") != 0)
3817 goto end;
3818 if (pe->al_proto != ALPROTO_HTTP)
3819 goto end;
3820 if (pe->port != 80)
3821 goto end;
3822 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
3823 goto end;
3824 if (pe->min_depth != 5)
3825 goto end;
3826 if (pe->max_depth != 8)
3827 goto end;
6e0d98d9 3828 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3829 goto end;
3830 /* third one */
3831 pe = pp->toserver->next->next;
3832 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
3833 goto end;
3834 if (pe->al_proto != ALPROTO_DCERPC)
3835 goto end;
3836 if (pe->port != 80)
3837 goto end;
3838 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
3839 goto end;
3840 if (pe->min_depth != 9)
3841 goto end;
3842 if (pe->max_depth != 10)
3843 goto end;
6e0d98d9 3844 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3845 goto end;
3846
3847 result = 1;
3848
3849 end:
6e0d98d9 3850 AlpProtoTestDestroy(&ctx);
7c31a232
AS		 3851 return result;
3852}
3853
3854static int AppLayerProbingParserTest11(void)
3855{
3856 int result = 0;
3857 AppLayerProbingParser *pp;
3858 AppLayerProbingParserElement *pe;
3859
6e0d98d9
AS		 3860 AlpProtoDetectCtx ctx;
3861 AlpProtoInit(&ctx);
7c31a232 3862
6e0d98d9 3863 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3864 80,
7c31a232
AS		 3865 IPPROTO_TCP,
3866 "http",
3867 ALPROTO_HTTP,
3868 5, 8,
3869 STREAM_TOSERVER,
3870 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 3871 ProbingParserDummyForTesting);
3872 pp = ctx.probing_parsers;
3873 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3874 goto end;
3875 }
3876 if (pp->toclient != NULL)
3877 goto end;
3878 if (pp->next != NULL)
3879 goto end;
3880 if (pp->port != 80)
3881 goto end;
3882 if (pp->toserver_max_depth != 8)
3883 goto end;
3884 if (pp->toclient_max_depth != 0)
3885 goto end;
3886 if (pp->toserver == NULL)
3887 goto end;
3888 if (pp->toserver->next != NULL)
3889 goto end;
3890 /* first one */
3891 pe = pp->toserver;
3892 if (strcmp(pe->al_proto_name, "http") != 0)
3893 goto end;
3894 if (pe->al_proto != ALPROTO_HTTP)
3895 goto end;
3896 if (pe->port != 80)
3897 goto end;
3898 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3899 goto end;
3900 if (pe->min_depth != 5)
3901 goto end;
3902 if (pe->max_depth != 8)
3903 goto end;
6e0d98d9 3904 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3905 goto end;
3906
6e0d98d9 3907 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3908 80,
7c31a232
AS		 3909 IPPROTO_TCP,
3910 "smb",
3911 ALPROTO_SMB,
3912 5, 5,
3913 STREAM_TOSERVER,
3914 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 3915 ProbingParserDummyForTesting);
3916 pp = ctx.probing_parsers;
3917 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3918 goto end;
3919 }
3920 if (pp->toclient != NULL)
3921 goto end;
3922 if (pp->next != NULL)
3923 goto end;
3924 if (pp->port != 80)
3925 goto end;
3926 if (pp->toserver_max_depth != 8)
3927 goto end;
3928 if (pp->toclient_max_depth != 0)
3929 goto end;
3930 if (pp->toserver == NULL)
3931 goto end;
3932 if (pp->toserver->next == NULL)
3933 goto end;
3934 if (pp->toserver->next->next != NULL)
3935 goto end;
3936 /* first one */
3937 pe = pp->toserver;
3938 if (strcmp(pe->al_proto_name, "smb") != 0)
3939 goto end;
3940 if (pe->al_proto != ALPROTO_SMB)
3941 goto end;
3942 if (pe->port != 80)
3943 goto end;
3944 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3945 goto end;
3946 if (pe->min_depth != 5)
3947 goto end;
3948 if (pe->max_depth != 5)
3949 goto end;
6e0d98d9 3950 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3951 goto end;
3952 /* second one */
3953 pe = pp->toserver->next;
3954 if (strcmp(pe->al_proto_name, "http") != 0)
3955 goto end;
3956 if (pe->al_proto != ALPROTO_HTTP)
3957 goto end;
3958 if (pe->port != 80)
3959 goto end;
3960 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
3961 goto end;
3962 if (pe->min_depth != 5)
3963 goto end;
3964 if (pe->max_depth != 8)
3965 goto end;
6e0d98d9 3966 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 3967 goto end;
3968
6e0d98d9 3969 AppLayerRegisterProbingParser(&ctx,
a40fdc79 3970 81,
7c31a232
AS		 3971 IPPROTO_TCP,
3972 "dcerpc",
3973 ALPROTO_DCERPC,
3974 9, 10,
3975 STREAM_TOSERVER,
3976 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 3977 ProbingParserDummyForTesting);
3978 pp = ctx.probing_parsers;
3979 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 3980 goto end;
3981 }
3982 /* first pp */
3983 if (pp->toclient != NULL)
3984 goto end;
3985 if (pp->next == NULL)
3986 goto end;
3987 if (pp->port != 80)
3988 goto end;
3989 if (pp->toserver_max_depth != 8)
3990 goto end;
3991 if (pp->toclient_max_depth != 0)
3992 goto end;
3993 if (pp->toserver == NULL)
3994 goto end;
3995 if (pp->toserver->next == NULL)
3996 goto end;
3997 if (pp->toserver->next->next != NULL)
3998 goto end;
3999 /* first one */
4000 pe = pp->toserver;
4001 if (strcmp(pe->al_proto_name, "smb") != 0)
4002 goto end;
4003 if (pe->al_proto != ALPROTO_SMB)
4004 goto end;
4005 if (pe->port != 80)
4006 goto end;
4007 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4008 goto end;
4009 if (pe->min_depth != 5)
4010 goto end;
4011 if (pe->max_depth != 5)
4012 goto end;
6e0d98d9 4013 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4014 goto end;
4015 /* second one */
4016 pe = pp->toserver->next;
4017 if (strcmp(pe->al_proto_name, "http") != 0)
4018 goto end;
4019 if (pe->al_proto != ALPROTO_HTTP)
4020 goto end;
4021 if (pe->port != 80)
4022 goto end;
4023 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4024 goto end;
4025 if (pe->min_depth != 5)
4026 goto end;
4027 if (pe->max_depth != 8)
4028 goto end;
6e0d98d9 4029 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4030 goto end;
4031 /* second pp */
4032 if (pp->next->next != NULL)
4033 goto end;
4034 if (pp->next->toclient != NULL)
4035 goto end;
4036 if (pp->next->port != 81)
4037 goto end;
4038 if (pp->next->toserver_max_depth != 10)
4039 goto end;
4040 if (pp->next->toclient_max_depth != 0)
4041 goto end;
4042 if (pp->next->toserver == NULL)
4043 goto end;
4044 if (pp->next->toserver->next != NULL)
4045 goto end;
4046 /* second pp - first one */
4047 pe = pp->next->toserver;
4048 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
4049 goto end;
4050 if (pe->al_proto != ALPROTO_DCERPC)
4051 goto end;
4052 if (pe->port != 81)
4053 goto end;
4054 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4055 goto end;
4056 if (pe->min_depth != 9)
4057 goto end;
4058 if (pe->max_depth != 10)
4059 goto end;
6e0d98d9 4060 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4061 goto end;
4062
6e0d98d9 4063 AppLayerRegisterProbingParser(&ctx,
a40fdc79 4064 81,
7c31a232
AS		 4065 IPPROTO_TCP,
4066 "ftp",
4067 ALPROTO_FTP,
4068 7, 15,
4069 STREAM_TOSERVER,
4070 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 4071 ProbingParserDummyForTesting);
4072 pp = ctx.probing_parsers;
4073 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 4074 goto end;
4075 }
4076 /* first pp */
4077 if (pp->toclient != NULL)
4078 goto end;
4079 if (pp->next == NULL)
4080 goto end;
4081 if (pp->port != 80)
4082 goto end;
4083 if (pp->toserver_max_depth != 8)
4084 goto end;
4085 if (pp->toclient_max_depth != 0)
4086 goto end;
4087 if (pp->toserver == NULL)
4088 goto end;
4089 if (pp->toserver->next == NULL)
4090 goto end;
4091 if (pp->toserver->next->next != NULL)
4092 goto end;
4093 /* first one */
4094 pe = pp->toserver;
4095 if (strcmp(pe->al_proto_name, "smb") != 0)
4096 goto end;
4097 if (pe->al_proto != ALPROTO_SMB)
4098 goto end;
4099 if (pe->port != 80)
4100 goto end;
4101 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4102 goto end;
4103 if (pe->min_depth != 5)
4104 goto end;
4105 if (pe->max_depth != 5)
4106 goto end;
6e0d98d9 4107 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4108 goto end;
4109 /* second one */
4110 pe = pp->toserver->next;
4111 if (strcmp(pe->al_proto_name, "http") != 0)
4112 goto end;
4113 if (pe->al_proto != ALPROTO_HTTP)
4114 goto end;
4115 if (pe->port != 80)
4116 goto end;
4117 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4118 goto end;
4119 if (pe->min_depth != 5)
4120 goto end;
4121 if (pe->max_depth != 8)
4122 goto end;
6e0d98d9 4123 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4124 goto end;
4125 /* second pp */
4126 if (pp->next->next != NULL)
4127 goto end;
4128 if (pp->next->toclient != NULL)
4129 goto end;
4130 if (pp->next->port != 81)
4131 goto end;
4132 if (pp->next->toserver_max_depth != 15)
4133 goto end;
4134 if (pp->next->toclient_max_depth != 0)
4135 goto end;
4136 if (pp->next->toserver == NULL)
4137 goto end;
4138 if (pp->next->toserver->next == NULL)
4139 goto end;
4140 if (pp->next->toserver->next->next != NULL)
4141 goto end;
4142 /* second pp - first one */
4143 pe = pp->next->toserver;
4144 if (strcmp(pe->al_proto_name, "ftp") != 0)
4145 goto end;
4146 if (pe->al_proto != ALPROTO_FTP)
4147 goto end;
4148 if (pe->port != 81)
4149 goto end;
4150 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4151 goto end;
4152 if (pe->min_depth != 7)
4153 goto end;
4154 if (pe->max_depth != 15)
4155 goto end;
6e0d98d9 4156 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4157 goto end;
4158 /* second pp - second one */
4159 pe = pp->next->toserver->next;
4160 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
4161 goto end;
4162 if (pe->al_proto != ALPROTO_DCERPC)
4163 goto end;
4164 if (pe->port != 81)
4165 goto end;
4166 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4167 goto end;
4168 if (pe->min_depth != 9)
4169 goto end;
4170 if (pe->max_depth != 10)
4171 goto end;
6e0d98d9 4172 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4173 goto end;
4174
4175 result = 1;
4176
4177 end:
6e0d98d9 4178 AlpProtoTestDestroy(&ctx);
7c31a232
AS		 4179 return result;
4180}
4181
4182static int AppLayerProbingParserTest12(void)
4183{
4184 int result = 0;
4185 AppLayerProbingParser *pp;
4186 AppLayerProbingParserElement *pe;
4187
6e0d98d9
AS		 4188 AlpProtoDetectCtx ctx;
4189 AlpProtoInit(&ctx);
7c31a232 4190
6e0d98d9 4191 AppLayerRegisterProbingParser(&ctx,
a40fdc79 4192 80,
7c31a232
AS		 4193 IPPROTO_TCP,
4194 "http",
4195 ALPROTO_HTTP,
4196 5, 8,
4197 STREAM_TOSERVER,
4198 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 4199 ProbingParserDummyForTesting);
4200 pp = ctx.probing_parsers;
4201 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 4202 goto end;
4203 }
4204 if (pp->toclient != NULL)
4205 goto end;
4206 if (pp->next != NULL)
4207 goto end;
4208 if (pp->port != 80)
4209 goto end;
4210 if (pp->toserver_max_depth != 8)
4211 goto end;
4212 if (pp->toclient_max_depth != 0)
4213 goto end;
4214 if (pp->toserver == NULL)
4215 goto end;
4216 if (pp->toserver->next != NULL)
4217 goto end;
4218 /* first one */
4219 pe = pp->toserver;
4220 if (strcmp(pe->al_proto_name, "http") != 0)
4221 goto end;
4222 if (pe->al_proto != ALPROTO_HTTP)
4223 goto end;
4224 if (pe->port != 80)
4225 goto end;
4226 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4227 goto end;
4228 if (pe->min_depth != 5)
4229 goto end;
4230 if (pe->max_depth != 8)
4231 goto end;
6e0d98d9 4232 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4233 goto end;
4234
6e0d98d9 4235 AppLayerRegisterProbingParser(&ctx,
a40fdc79 4236 81,
7c31a232
AS		 4237 IPPROTO_TCP,
4238 "dcerpc",
4239 ALPROTO_DCERPC,
4240 9, 10,
4241 STREAM_TOSERVER,
4242 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 4243 ProbingParserDummyForTesting);
4244 pp = ctx.probing_parsers;
4245 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 4246 goto end;
4247 }
4248 /* first pp */
4249 if (pp->toclient != NULL)
4250 goto end;
4251 if (pp->next == NULL)
4252 goto end;
4253 if (pp->port != 80)
4254 goto end;
4255 if (pp->toserver_max_depth != 8)
4256 goto end;
4257 if (pp->toclient_max_depth != 0)
4258 goto end;
4259 if (pp->toserver == NULL)
4260 goto end;
4261 if (pp->toserver->next != NULL)
4262 goto end;
4263 /* first one */
4264 pe = pp->toserver;
4265 if (strcmp(pe->al_proto_name, "http") != 0)
4266 goto end;
4267 if (pe->al_proto != ALPROTO_HTTP)
4268 goto end;
4269 if (pe->port != 80)
4270 goto end;
4271 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4272 goto end;
4273 if (pe->min_depth != 5)
4274 goto end;
4275 if (pe->max_depth != 8)
4276 goto end;
6e0d98d9 4277 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4278 goto end;
4279 /* second pp */
4280 if (pp->next->next != NULL)
4281 goto end;
4282 if (pp->next->toclient != NULL)
4283 goto end;
4284 if (pp->next->port != 81)
4285 goto end;
4286 if (pp->next->toserver_max_depth != 10)
4287 goto end;
4288 if (pp->next->toclient_max_depth != 0)
4289 goto end;
4290 if (pp->next->toserver == NULL)
4291 goto end;
4292 if (pp->next->toserver->next != NULL)
4293 goto end;
4294 /* second pp - first one */
4295 pe = pp->next->toserver;
4296 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
4297 goto end;
4298 if (pe->al_proto != ALPROTO_DCERPC)
4299 goto end;
4300 if (pe->port != 81)
4301 goto end;
4302 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4303 goto end;
4304 if (pe->min_depth != 9)
4305 goto end;
4306 if (pe->max_depth != 10)
4307 goto end;
6e0d98d9 4308 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4309 goto end;
4310
6e0d98d9 4311 AppLayerRegisterProbingParser(&ctx,
a40fdc79 4312 80,
7c31a232
AS		 4313 IPPROTO_TCP,
4314 "smb",
4315 ALPROTO_SMB,
4316 5, 5,
4317 STREAM_TOSERVER,
4318 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 4319 ProbingParserDummyForTesting);
4320 pp = ctx.probing_parsers;
4321 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 4322 goto end;
4323 }
4324 if (pp->toclient != NULL)
4325 goto end;
4326 if (pp->next == NULL)
4327 goto end;
4328 if (pp->port != 80)
4329 goto end;
4330 if (pp->toserver_max_depth != 8)
4331 goto end;
4332 if (pp->toclient_max_depth != 0)
4333 goto end;
4334 if (pp->toserver == NULL)
4335 goto end;
4336 if (pp->toserver->next == NULL)
4337 goto end;
4338 if (pp->toserver->next->next != NULL)
4339 goto end;
4340 /* first one */
4341 pe = pp->toserver;
4342 if (strcmp(pe->al_proto_name, "smb") != 0)
4343 goto end;
4344 if (pe->al_proto != ALPROTO_SMB)
4345 goto end;
4346 if (pe->port != 80)
4347 goto end;
4348 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4349 goto end;
4350 if (pe->min_depth != 5)
4351 goto end;
4352 if (pe->max_depth != 5)
4353 goto end;
6e0d98d9 4354 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4355 goto end;
4356 /* second one */
4357 pe = pp->toserver->next;
4358 if (strcmp(pe->al_proto_name, "http") != 0)
4359 goto end;
4360 if (pe->al_proto != ALPROTO_HTTP)
4361 goto end;
4362 if (pe->port != 80)
4363 goto end;
4364 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4365 goto end;
4366 if (pe->min_depth != 5)
4367 goto end;
4368 if (pe->max_depth != 8)
4369 goto end;
6e0d98d9 4370 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4371 goto end;
4372 /* second pp */
4373 if (pp->next->next != NULL)
4374 goto end;
4375 if (pp->next->toclient != NULL)
4376 goto end;
4377 if (pp->next->port != 81)
4378 goto end;
4379 if (pp->next->toserver_max_depth != 10)
4380 goto end;
4381 if (pp->next->toclient_max_depth != 0)
4382 goto end;
4383 if (pp->next->toserver == NULL)
4384 goto end;
4385 if (pp->next->toserver->next != NULL)
4386 goto end;
4387 /* second pp - first one */
4388 pe = pp->next->toserver;
4389 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
4390 goto end;
4391 if (pe->al_proto != ALPROTO_DCERPC)
4392 goto end;
4393 if (pe->port != 81)
4394 goto end;
4395 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4396 goto end;
4397 if (pe->min_depth != 9)
4398 goto end;
4399 if (pe->max_depth != 10)
4400 goto end;
6e0d98d9 4401 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4402 goto end;
4403
6e0d98d9 4404 AppLayerRegisterProbingParser(&ctx,
a40fdc79 4405 81,
7c31a232
AS		 4406 IPPROTO_TCP,
4407 "ftp",
4408 ALPROTO_FTP,
4409 7, 15,
4410 STREAM_TOSERVER,
4411 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 4412 ProbingParserDummyForTesting);
4413 pp = ctx.probing_parsers;
4414 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 4415 goto end;
4416 }
4417 /* first pp */
4418 if (pp->toclient != NULL)
4419 goto end;
4420 if (pp->next == NULL)
4421 goto end;
4422 if (pp->port != 80)
4423 goto end;
4424 if (pp->toserver_max_depth != 8)
4425 goto end;
4426 if (pp->toclient_max_depth != 0)
4427 goto end;
4428 if (pp->toserver == NULL)
4429 goto end;
4430 if (pp->toserver->next == NULL)
4431 goto end;
4432 if (pp->toserver->next->next != NULL)
4433 goto end;
4434 /* first one */
4435 pe = pp->toserver;
4436 if (strcmp(pe->al_proto_name, "smb") != 0)
4437 goto end;
4438 if (pe->al_proto != ALPROTO_SMB)
4439 goto end;
4440 if (pe->port != 80)
4441 goto end;
4442 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4443 goto end;
4444 if (pe->min_depth != 5)
4445 goto end;
4446 if (pe->max_depth != 5)
4447 goto end;
6e0d98d9 4448 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4449 goto end;
4450 /* second one */
4451 pe = pp->toserver->next;
4452 if (strcmp(pe->al_proto_name, "http") != 0)
4453 goto end;
4454 if (pe->al_proto != ALPROTO_HTTP)
4455 goto end;
4456 if (pe->port != 80)
4457 goto end;
4458 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4459 goto end;
4460 if (pe->min_depth != 5)
4461 goto end;
4462 if (pe->max_depth != 8)
4463 goto end;
6e0d98d9 4464 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4465 goto end;
4466 /* second pp */
4467 if (pp->next->next != NULL)
4468 goto end;
4469 if (pp->next->toclient != NULL)
4470 goto end;
4471 if (pp->next->port != 81)
4472 goto end;
4473 if (pp->next->toserver_max_depth != 15)
4474 goto end;
4475 if (pp->next->toclient_max_depth != 0)
4476 goto end;
4477 if (pp->next->toserver == NULL)
4478 goto end;
4479 if (pp->next->toserver->next == NULL)
4480 goto end;
4481 if (pp->next->toserver->next->next != NULL)
4482 goto end;
4483 /* second pp - first one */
4484 pe = pp->next->toserver;
4485 if (strcmp(pe->al_proto_name, "ftp") != 0)
4486 goto end;
4487 if (pe->al_proto != ALPROTO_FTP)
4488 goto end;
4489 if (pe->port != 81)
4490 goto end;
4491 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4492 goto end;
4493 if (pe->min_depth != 7)
4494 goto end;
4495 if (pe->max_depth != 15)
4496 goto end;
6e0d98d9 4497 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4498 goto end;
4499 /* second pp - second one */
4500 pe = pp->next->toserver->next;
4501 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
4502 goto end;
4503 if (pe->al_proto != ALPROTO_DCERPC)
4504 goto end;
4505 if (pe->port != 81)
4506 goto end;
4507 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4508 goto end;
4509 if (pe->min_depth != 9)
4510 goto end;
4511 if (pe->max_depth != 10)
4512 goto end;
6e0d98d9 4513 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4514 goto end;
4515
4516 result = 1;
4517
4518 end:
6e0d98d9 4519 AlpProtoTestDestroy(&ctx);
7c31a232
AS		 4520 return result;
4521}
4522
4523static int AppLayerProbingParserTest13(void)
4524{
4525 int result = 0;
4526 AppLayerProbingParser *pp;
4527 AppLayerProbingParserElement *pe;
4528
6e0d98d9
AS		 4529 AlpProtoDetectCtx ctx;
4530 AlpProtoInit(&ctx);
7c31a232 4531
6e0d98d9 4532 AppLayerRegisterProbingParser(&ctx,
a40fdc79 4533 80,
7c31a232
AS		 4534 IPPROTO_TCP,
4535 "http",
4536 ALPROTO_HTTP,
4537 5, 8,
4538 STREAM_TOSERVER,
4539 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 4540 ProbingParserDummyForTesting);
4541 pp = ctx.probing_parsers;
4542 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 4543 goto end;
4544 }
4545 if (pp->toclient != NULL)
4546 goto end;
4547 if (pp->next != NULL)
4548 goto end;
4549 if (pp->port != 80)
4550 goto end;
4551 if (pp->toserver_max_depth != 8)
4552 goto end;
4553 if (pp->toclient_max_depth != 0)
4554 goto end;
4555 if (pp->toserver == NULL)
4556 goto end;
4557 if (pp->toserver->next != NULL)
4558 goto end;
4559 /* first one */
4560 pe = pp->toserver;
4561 if (strcmp(pe->al_proto_name, "http") != 0)
4562 goto end;
4563 if (pe->al_proto != ALPROTO_HTTP)
4564 goto end;
4565 if (pe->port != 80)
4566 goto end;
4567 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4568 goto end;
4569 if (pe->min_depth != 5)
4570 goto end;
4571 if (pe->max_depth != 8)
4572 goto end;
6e0d98d9 4573 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4574 goto end;
4575
6e0d98d9 4576 AppLayerRegisterProbingParser(&ctx,
a40fdc79 4577 81,
7c31a232
AS		 4578 IPPROTO_TCP,
4579 "dcerpc",
4580 ALPROTO_DCERPC,
4581 9, 10,
4582 STREAM_TOSERVER,
4583 APP_LAYER_PROBING_PARSER_PRIORITY_LOW, 1,
6e0d98d9
AS		 4584 ProbingParserDummyForTesting);
4585 pp = ctx.probing_parsers;
4586 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 4587 goto end;
4588 }
4589 /* first pp */
4590 if (pp->toclient != NULL)
4591 goto end;
4592 if (pp->next == NULL)
4593 goto end;
4594 if (pp->port != 80)
4595 goto end;
4596 if (pp->toserver_max_depth != 8)
4597 goto end;
4598 if (pp->toclient_max_depth != 0)
4599 goto end;
4600 if (pp->toserver == NULL)
4601 goto end;
4602 if (pp->toserver->next != NULL)
4603 goto end;
4604 /* first one */
4605 pe = pp->toserver;
4606 if (strcmp(pe->al_proto_name, "http") != 0)
4607 goto end;
4608 if (pe->al_proto != ALPROTO_HTTP)
4609 goto end;
4610 if (pe->port != 80)
4611 goto end;
4612 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4613 goto end;
4614 if (pe->min_depth != 5)
4615 goto end;
4616 if (pe->max_depth != 8)
4617 goto end;
6e0d98d9 4618 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4619 goto end;
4620 /* second pp */
4621 if (pp->next->next != NULL)
4622 goto end;
4623 if (pp->next->toclient != NULL)
4624 goto end;
4625 if (pp->next->port != 81)
4626 goto end;
4627 if (pp->next->toserver_max_depth != 10)
4628 goto end;
4629 if (pp->next->toclient_max_depth != 0)
4630 goto end;
4631 if (pp->next->toserver == NULL)
4632 goto end;
4633 if (pp->next->toserver->next != NULL)
4634 goto end;
4635 /* second pp - first one */
4636 pe = pp->next->toserver;
4637 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
4638 goto end;
4639 if (pe->al_proto != ALPROTO_DCERPC)
4640 goto end;
4641 if (pe->port != 81)
4642 goto end;
4643 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
4644 goto end;
4645 if (pe->min_depth != 9)
4646 goto end;
4647 if (pe->max_depth != 10)
4648 goto end;
6e0d98d9 4649 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4650 goto end;
4651
6e0d98d9 4652 AppLayerRegisterProbingParser(&ctx,
a40fdc79 4653 80,
7c31a232
AS		 4654 IPPROTO_TCP,
4655 "smb",
4656 ALPROTO_SMB,
4657 5, 5,
4658 STREAM_TOSERVER,
4659 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 0,
6e0d98d9
AS		 4660 ProbingParserDummyForTesting);
4661 pp = ctx.probing_parsers;
4662 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 4663 goto end;
4664 }
4665 if (pp->toclient != NULL)
4666 goto end;
4667 if (pp->next == NULL)
4668 goto end;
4669 if (pp->port != 80)
4670 goto end;
4671 if (pp->toserver_max_depth != 8)
4672 goto end;
4673 if (pp->toclient_max_depth != 0)
4674 goto end;
4675 if (pp->toserver == NULL)
4676 goto end;
4677 if (pp->toserver->next == NULL)
4678 goto end;
4679 if (pp->toserver->next->next != NULL)
4680 goto end;
4681 /* first one */
4682 pe = pp->toserver;
4683 if (strcmp(pe->al_proto_name, "http") != 0)
4684 goto end;
4685 if (pe->al_proto != ALPROTO_HTTP)
4686 goto end;
4687 if (pe->port != 80)
4688 goto end;
4689 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4690 goto end;
4691 if (pe->min_depth != 5)
4692 goto end;
4693 if (pe->max_depth != 8)
4694 goto end;
6e0d98d9 4695 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4696 goto end;
4697 /* second one */
4698 pe = pp->toserver->next;
4699 if (strcmp(pe->al_proto_name, "smb") != 0)
4700 goto end;
4701 if (pe->al_proto != ALPROTO_SMB)
4702 goto end;
4703 if (pe->port != 80)
4704 goto end;
4705 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4706 goto end;
4707 if (pe->min_depth != 5)
4708 goto end;
4709 if (pe->max_depth != 5)
4710 goto end;
6e0d98d9 4711 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4712 goto end;
4713 /* second pp */
4714 if (pp->next->next != NULL)
4715 goto end;
4716 if (pp->next->toclient != NULL)
4717 goto end;
4718 if (pp->next->port != 81)
4719 goto end;
4720 if (pp->next->toserver_max_depth != 10)
4721 goto end;
4722 if (pp->next->toclient_max_depth != 0)
4723 goto end;
4724 if (pp->next->toserver == NULL)
4725 goto end;
4726 if (pp->next->toserver->next != NULL)
4727 goto end;
4728 /* second pp - first one */
4729 pe = pp->next->toserver;
4730 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
4731 goto end;
4732 if (pe->al_proto != ALPROTO_DCERPC)
4733 goto end;
4734 if (pe->port != 81)
4735 goto end;
4736 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
4737 goto end;
4738 if (pe->min_depth != 9)
4739 goto end;
4740 if (pe->max_depth != 10)
4741 goto end;
6e0d98d9 4742 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4743 goto end;
4744
6e0d98d9 4745 AppLayerRegisterProbingParser(&ctx,
a40fdc79 4746 81,
7c31a232
AS		 4747 IPPROTO_TCP,
4748 "ftp",
4749 ALPROTO_FTP,
4750 7, 15,
4751 STREAM_TOSERVER,
4752 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
6e0d98d9
AS		 4753 ProbingParserDummyForTesting);
4754 pp = ctx.probing_parsers;
4755 if (ctx.probing_parsers == NULL) {
7c31a232
AS		 4756 goto end;
4757 }
4758 /* first pp */
4759 if (pp->toclient != NULL)
4760 goto end;
4761 if (pp->next == NULL)
4762 goto end;
4763 if (pp->port != 80)
4764 goto end;
4765 if (pp->toserver_max_depth != 8)
4766 goto end;
4767 if (pp->toclient_max_depth != 0)
4768 goto end;
4769 if (pp->toserver == NULL)
4770 goto end;
4771 if (pp->toserver->next == NULL)
4772 goto end;
4773 if (pp->toserver->next->next != NULL)
4774 goto end;
4775 /* first one */
4776 pe = pp->toserver;
4777 if (strcmp(pe->al_proto_name, "http") != 0)
4778 goto end;
4779 if (pe->al_proto != ALPROTO_HTTP)
4780 goto end;
4781 if (pe->port != 80)
4782 goto end;
4783 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4784 goto end;
4785 if (pe->min_depth != 5)
4786 goto end;
4787 if (pe->max_depth != 8)
4788 goto end;
6e0d98d9 4789 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4790 goto end;
4791 /* second one */
4792 pe = pp->toserver->next;
4793 if (strcmp(pe->al_proto_name, "smb") != 0)
4794 goto end;
4795 if (pe->al_proto != ALPROTO_SMB)
4796 goto end;
4797 if (pe->port != 80)
4798 goto end;
4799 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4800 goto end;
4801 if (pe->min_depth != 5)
4802 goto end;
4803 if (pe->max_depth != 5)
4804 goto end;
6e0d98d9 4805 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4806 goto end;
4807 /* second pp */
4808 if (pp->next->next != NULL)
4809 goto end;
4810 if (pp->next->toclient != NULL)
4811 goto end;
4812 if (pp->next->port != 81)
4813 goto end;
4814 if (pp->next->toserver_max_depth != 15)
4815 goto end;
4816 if (pp->next->toclient_max_depth != 0)
4817 goto end;
4818 if (pp->next->toserver == NULL)
4819 goto end;
4820 if (pp->next->toserver->next == NULL)
4821 goto end;
4822 if (pp->next->toserver->next->next != NULL)
4823 goto end;
4824 /* second pp - first one */
4825 pe = pp->next->toserver;
4826 if (strcmp(pe->al_proto_name, "ftp") != 0)
4827 goto end;
4828 if (pe->al_proto != ALPROTO_FTP)
4829 goto end;
4830 if (pe->port != 81)
4831 goto end;
4832 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4833 goto end;
4834 if (pe->min_depth != 7)
4835 goto end;
4836 if (pe->max_depth != 15)
4837 goto end;
6e0d98d9 4838 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4839 goto end;
4840 /* second pp - second one */
4841 pe = pp->next->toserver->next;
4842 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
4843 goto end;
4844 if (pe->al_proto != ALPROTO_DCERPC)
4845 goto end;
4846 if (pe->port != 81)
4847 goto end;
4848 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_LOW)
4849 goto end;
4850 if (pe->min_depth != 9)
4851 goto end;
4852 if (pe->max_depth != 10)
4853 goto end;
6e0d98d9 4854 if (pe->ProbingParser != ProbingParserDummyForTesting)
7c31a232
AS		 4855 goto end;
4856
6e0d98d9 4857 AppLayerPrintProbingParsers(ctx.probing_parsers);
7c31a232
AS		 4858
4859 result = 1;
4860
4861 end:
6e0d98d9 4862 AlpProtoTestDestroy(&ctx);
7c31a232
AS		 4863 return result;
4864}
4865
432c3317
AS		 4866static int AppLayerProbingParserTest14(void)
4867{
4868 int result = 0;
4869 AppLayerProbingParser *pp;
4870 AppLayerProbingParserElement *pe;
4871
4872 AlpProtoDetectCtx ctx;
4873 AlpProtoInit(&ctx);
4874
4875 AppLayerRegisterProbingParser(&ctx,
4876 80,
4877 IPPROTO_TCP,
4878 "http",
4879 ALPROTO_HTTP,
4880 5, 8,
4881 STREAM_TOSERVER,
4882 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
4883 ProbingParserDummyForTesting);
4884 pp = ctx.probing_parsers;
4885 if (ctx.probing_parsers == NULL) {
4886 goto end;
4887 }
4888 if (pp->toclient != NULL)
4889 goto end;
4890 if (pp->next != NULL)
4891 goto end;
4892 if (pp->port != 80)
4893 goto end;
4894 if (pp->toserver_max_depth != 8)
4895 goto end;
4896 if (pp->toclient_max_depth != 0)
4897 goto end;
4898 if (pp->toserver == NULL)
4899 goto end;
4900 if (pp->toserver->next != NULL)
4901 goto end;
4902 /* first one */
4903 pe = pp->toserver;
4904 if (strcmp(pe->al_proto_name, "http") != 0)
4905 goto end;
4906 if (pe->al_proto != ALPROTO_HTTP)
4907 goto end;
4908 if (pe->port != 80)
4909 goto end;
4910 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4911 goto end;
4912 if (pe->min_depth != 5)
4913 goto end;
4914 if (pe->max_depth != 8)
4915 goto end;
4916 if (pe->ProbingParser != ProbingParserDummyForTesting)
4917 goto end;
4918
4919 AppLayerRegisterProbingParser(&ctx,
4920 80,
4921 IPPROTO_TCP,
4922 "smb",
4923 ALPROTO_SMB,
4924 5, 15,
4925 STREAM_TOSERVER,
4926 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 0,
4927 ProbingParserDummyForTesting);
4928 pp = ctx.probing_parsers;
4929 if (ctx.probing_parsers == NULL) {
4930 goto end;
4931 }
4932 if (pp->toclient != NULL)
4933 goto end;
4934 if (pp->next != NULL)
4935 goto end;
4936 if (pp->port != 80)
4937 goto end;
4938 if (pp->toserver_max_depth != 15)
4939 goto end;
4940 if (pp->toclient_max_depth != 0)
4941 goto end;
4942 if (pp->toserver == NULL)
4943 goto end;
4944 if (pp->toserver->next == NULL)
4945 goto end;
4946 if (pp->toserver->next->next != NULL)
4947 goto end;
4948 /* first one */
4949 pe = pp->toserver;
4950 if (strcmp(pe->al_proto_name, "http") != 0)
4951 goto end;
4952 if (pe->al_proto != ALPROTO_HTTP)
4953 goto end;
4954 if (pe->port != 80)
4955 goto end;
4956 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4957 goto end;
4958 if (pe->min_depth != 5)
4959 goto end;
4960 if (pe->max_depth != 8)
4961 goto end;
4962 if (pe->ProbingParser != ProbingParserDummyForTesting)
4963 goto end;
4964 /* second one */
4965 pe = pp->toserver->next;
4966 if (strcmp(pe->al_proto_name, "smb") != 0)
4967 goto end;
4968 if (pe->al_proto != ALPROTO_SMB)
4969 goto end;
4970 if (pe->port != 80)
4971 goto end;
4972 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
4973 goto end;
4974 if (pe->min_depth != 5)
4975 goto end;
4976 if (pe->max_depth != 15)
4977 goto end;
4978 if (pe->ProbingParser != ProbingParserDummyForTesting)
4979 goto end;
4980
4981 AppLayerRegisterProbingParser(&ctx,
4982 0,
4983 IPPROTO_TCP,
4984 "dcerpc",
4985 ALPROTO_DCERPC,
4986 5, 25,
4987 STREAM_TOSERVER,
4988 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 0,
4989 ProbingParserDummyForTesting);
4990 pp = ctx.probing_parsers;
4991 if (ctx.probing_parsers == NULL) {
4992 goto end;
4993 }
4994 if (pp->toclient != NULL)
4995 goto end;
4996 if (pp->next == NULL)
4997 goto end;
4998 if (pp->next->next != NULL)
4999 goto end;
5000 if (pp->port != 80)
5001 goto end;
5002 if (pp->toserver_max_depth != 25)
5003 goto end;
5004 if (pp->toclient_max_depth != 0)
5005 goto end;
5006 if (pp->toserver == NULL)
5007 goto end;
5008 if (pp->toserver->next == NULL)
5009 goto end;
5010 if (pp->toserver->next->next == NULL)
5011 goto end;
5012 if (pp->toserver->next->next->next != NULL)
5013 goto end;
5014 /* first one */
5015 pe = pp->toserver;
5016 if (strcmp(pe->al_proto_name, "http") != 0)
5017 goto end;
5018 if (pe->al_proto != ALPROTO_HTTP)
5019 goto end;
5020 if (pe->port != 80)
5021 goto end;
5022 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5023 goto end;
5024 if (pe->min_depth != 5)
5025 goto end;
5026 if (pe->max_depth != 8)
5027 goto end;
5028 if (pe->ProbingParser != ProbingParserDummyForTesting)
5029 goto end;
5030 /* second one */
5031 pe = pp->toserver->next;
5032 if (strcmp(pe->al_proto_name, "smb") != 0)
5033 goto end;
5034 if (pe->al_proto != ALPROTO_SMB)
5035 goto end;
5036 if (pe->port != 80)
5037 goto end;
5038 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5039 goto end;
5040 if (pe->min_depth != 5)
5041 goto end;
5042 if (pe->max_depth != 15)
5043 goto end;
5044 if (pe->ProbingParser != ProbingParserDummyForTesting)
5045 goto end;
5046 pe = pp->toserver->next->next;
5047 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
5048 goto end;
5049 if (pe->al_proto != ALPROTO_DCERPC)
5050 goto end;
5051 if (pe->port != 0)
5052 goto end;
5053 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5054 goto end;
5055 if (pe->min_depth != 5)
5056 goto end;
5057 if (pe->max_depth != 25)
5058 goto end;
5059 if (pe->ProbingParser != ProbingParserDummyForTesting)
5060 goto end;
5061 /* second probing parser */
5062 pp = pp->next;
5063 if (pp->toclient != NULL)
5064 goto end;
5065 if (pp->next != NULL)
5066 goto end;
5067 if (pp->port != 0)
5068 goto end;
5069 if (pp->toserver_max_depth != 25)
5070 goto end;
5071 if (pp->toclient_max_depth != 0)
5072 goto end;
5073 if (pp->toserver == NULL)
5074 goto end;
5075 if (pp->toserver->next != NULL)
5076 goto end;
5077 /* first one */
5078 pe = pp->toserver;
5079 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
5080 goto end;
5081 if (pe->al_proto != ALPROTO_DCERPC)
5082 goto end;
5083 if (pe->port != 0)
5084 goto end;
5085 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5086 goto end;
5087 if (pe->min_depth != 5)
5088 goto end;
5089 if (pe->max_depth != 25)
5090 goto end;
5091 if (pe->ProbingParser != ProbingParserDummyForTesting)
5092 goto end;
5093
5094 AppLayerRegisterProbingParser(&ctx,
5095 81,
5096 IPPROTO_TCP,
5097 "ftp",
5098 ALPROTO_FTP,
5099 7, 50,
5100 STREAM_TOSERVER,
5101 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
5102 ProbingParserDummyForTesting);
5103 pp = ctx.probing_parsers;
5104 if (ctx.probing_parsers == NULL) {
5105 goto end;
5106 }
5107 if (pp->toclient != NULL)
5108 goto end;
5109 if (pp->next == NULL)
5110 goto end;
5111 if (pp->next->next == NULL)
5112 goto end;
5113 if (pp->next->next->next != NULL)
5114 goto end;
5115 if (pp->port != 80)
5116 goto end;
5117 if (pp->toserver_max_depth != 25)
5118 goto end;
5119 if (pp->toclient_max_depth != 0)
5120 goto end;
5121 if (pp->toserver == NULL)
5122 goto end;
5123 if (pp->toserver->next == NULL)
5124 goto end;
5125 if (pp->toserver->next->next == NULL)
5126 goto end;
5127 if (pp->toserver->next->next->next != NULL)
5128 goto end;
5129 /* first one */
5130 pe = pp->toserver;
5131 if (strcmp(pe->al_proto_name, "http") != 0)
5132 goto end;
5133 if (pe->al_proto != ALPROTO_HTTP)
5134 goto end;
5135 if (pe->port != 80)
5136 goto end;
5137 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5138 goto end;
5139 if (pe->min_depth != 5)
5140 goto end;
5141 if (pe->max_depth != 8)
5142 goto end;
5143 if (pe->ProbingParser != ProbingParserDummyForTesting)
5144 goto end;
5145 /* second one */
5146 pe = pp->toserver->next;
5147 if (strcmp(pe->al_proto_name, "smb") != 0)
5148 goto end;
5149 if (pe->al_proto != ALPROTO_SMB)
5150 goto end;
5151 if (pe->port != 80)
5152 goto end;
5153 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5154 goto end;
5155 if (pe->min_depth != 5)
5156 goto end;
5157 if (pe->max_depth != 15)
5158 goto end;
5159 if (pe->ProbingParser != ProbingParserDummyForTesting)
5160 goto end;
5161 pe = pp->toserver->next->next;
5162 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
5163 goto end;
5164 if (pe->al_proto != ALPROTO_DCERPC)
5165 goto end;
5166 if (pe->port != 0)
5167 goto end;
5168 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5169 goto end;
5170 if (pe->min_depth != 5)
5171 goto end;
5172 if (pe->max_depth != 25)
5173 goto end;
5174 if (pe->ProbingParser != ProbingParserDummyForTesting)
5175 goto end;
5176
5177 /* second probing parser */
5178 pp = pp->next;
5179 if (pp->toclient != NULL)
5180 goto end;
5181 if (pp->next == NULL)
5182 goto end;
5183 if (pp->next->next != NULL)
5184 goto end;
5185 if (pp->port != 81)
5186 goto end;
5187 if (pp->toserver_max_depth != 50)
5188 goto end;
5189 if (pp->toclient_max_depth != 0)
5190 goto end;
5191 if (pp->toserver == NULL)
5192 goto end;
5193 if (pp->toserver->next == NULL)
5194 goto end;
5195 if (pp->toserver->next->next != NULL)
5196 goto end;
5197 /* first one */
5198 pe = pp->toserver;
5199 if (strcmp(pe->al_proto_name, "ftp") != 0)
5200 goto end;
5201 if (pe->al_proto != ALPROTO_FTP)
5202 goto end;
5203 if (pe->port != 81)
5204 goto end;
5205 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5206 goto end;
5207 if (pe->min_depth != 7)
5208 goto end;
5209 if (pe->max_depth != 50)
5210 goto end;
5211 if (pe->ProbingParser != ProbingParserDummyForTesting)
5212 goto end;
5213 /* second one */
5214 pe = pp->toserver->next;
5215 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
5216 goto end;
5217 if (pe->al_proto != ALPROTO_DCERPC)
5218 goto end;
5219 if (pe->port != 0)
5220 goto end;
5221 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5222 goto end;
5223 if (pe->min_depth != 5)
5224 goto end;
5225 if (pe->max_depth != 25)
5226 goto end;
5227 if (pe->ProbingParser != ProbingParserDummyForTesting)
5228 goto end;
5229
5230 /* third probing parser */
5231 pp = pp->next;
5232 if (pp->toclient != NULL)
5233 goto end;
5234 if (pp->next != NULL)
5235 goto end;
5236 if (pp->port != 0)
5237 goto end;
5238 if (pp->toserver_max_depth != 25)
5239 goto end;
5240 if (pp->toclient_max_depth != 0)
5241 goto end;
5242 if (pp->toserver == NULL)
5243 goto end;
5244 if (pp->toserver->next != NULL)
5245 goto end;
5246 /* first one */
5247 pe = pp->toserver;
5248 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
5249 goto end;
5250 if (pe->al_proto != ALPROTO_DCERPC)
5251 goto end;
5252 if (pe->port != 0)
5253 goto end;
5254 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5255 goto end;
5256 if (pe->min_depth != 5)
5257 goto end;
5258 if (pe->max_depth != 25)
5259 goto end;
5260 if (pe->ProbingParser != ProbingParserDummyForTesting)
5261 goto end;
5262
5263 AppLayerPrintProbingParsers(ctx.probing_parsers);
5264
5265 result = 1;
5266
5267 end:
5268 AlpProtoTestDestroy(&ctx);
5269 return result;
5270}
5271
5272static int AppLayerProbingParserTest15(void)
5273{
5274 int result = 0;
5275 AppLayerProbingParser *pp;
5276 AppLayerProbingParserElement *pe;
5277
5278 AlpProtoDetectCtx ctx;
5279 AlpProtoInit(&ctx);
5280
5281 AppLayerRegisterProbingParser(&ctx,
5282 80,
5283 IPPROTO_TCP,
5284 "http",
5285 ALPROTO_HTTP,
5286 5, 8,
5287 STREAM_TOSERVER,
5288 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
5289 ProbingParserDummyForTesting);
5290 pp = ctx.probing_parsers;
5291 if (ctx.probing_parsers == NULL) {
5292 goto end;
5293 }
5294 if (pp->toclient != NULL)
5295 goto end;
5296 if (pp->next != NULL)
5297 goto end;
5298 if (pp->port != 80)
5299 goto end;
5300 if (pp->toserver_max_depth != 8)
5301 goto end;
5302 if (pp->toclient_max_depth != 0)
5303 goto end;
5304 if (pp->toserver == NULL)
5305 goto end;
5306 if (pp->toserver->next != NULL)
5307 goto end;
5308 /* first one */
5309 pe = pp->toserver;
5310 if (strcmp(pe->al_proto_name, "http") != 0)
5311 goto end;
5312 if (pe->al_proto != ALPROTO_HTTP)
5313 goto end;
5314 if (pe->port != 80)
5315 goto end;
5316 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5317 goto end;
5318 if (pe->min_depth != 5)
5319 goto end;
5320 if (pe->max_depth != 8)
5321 goto end;
5322 if (pe->ProbingParser != ProbingParserDummyForTesting)
5323 goto end;
5324
5325 AppLayerRegisterProbingParser(&ctx,
5326 80,
5327 IPPROTO_TCP,
5328 "smb",
5329 ALPROTO_SMB,
5330 5, 15,
5331 STREAM_TOSERVER,
5332 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 0,
5333 ProbingParserDummyForTesting);
5334 pp = ctx.probing_parsers;
5335 if (ctx.probing_parsers == NULL) {
5336 goto end;
5337 }
5338 if (pp->toclient != NULL)
5339 goto end;
5340 if (pp->next != NULL)
5341 goto end;
5342 if (pp->port != 80)
5343 goto end;
5344 if (pp->toserver_max_depth != 15)
5345 goto end;
5346 if (pp->toclient_max_depth != 0)
5347 goto end;
5348 if (pp->toserver == NULL)
5349 goto end;
5350 if (pp->toserver->next == NULL)
5351 goto end;
5352 if (pp->toserver->next->next != NULL)
5353 goto end;
5354 /* first one */
5355 pe = pp->toserver;
5356 if (strcmp(pe->al_proto_name, "http") != 0)
5357 goto end;
5358 if (pe->al_proto != ALPROTO_HTTP)
5359 goto end;
5360 if (pe->port != 80)
5361 goto end;
5362 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5363 goto end;
5364 if (pe->min_depth != 5)
5365 goto end;
5366 if (pe->max_depth != 8)
5367 goto end;
5368 if (pe->ProbingParser != ProbingParserDummyForTesting)
5369 goto end;
5370 /* second one */
5371 pe = pp->toserver->next;
5372 if (strcmp(pe->al_proto_name, "smb") != 0)
5373 goto end;
5374 if (pe->al_proto != ALPROTO_SMB)
5375 goto end;
5376 if (pe->port != 80)
5377 goto end;
5378 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5379 goto end;
5380 if (pe->min_depth != 5)
5381 goto end;
5382 if (pe->max_depth != 15)
5383 goto end;
5384 if (pe->ProbingParser != ProbingParserDummyForTesting)
5385 goto end;
5386
5387 AppLayerRegisterProbingParser(&ctx,
5388 0,
5389 IPPROTO_TCP,
5390 "dcerpc",
5391 ALPROTO_DCERPC,
5392 5, 25,
5393 STREAM_TOSERVER,
5394 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 0,
5395 ProbingParserDummyForTesting);
5396 pp = ctx.probing_parsers;
5397 if (ctx.probing_parsers == NULL) {
5398 goto end;
5399 }
5400 if (pp->toclient != NULL)
5401 goto end;
5402 if (pp->next == NULL)
5403 goto end;
5404 if (pp->next->next != NULL)
5405 goto end;
5406 if (pp->port != 80)
5407 goto end;
5408 if (pp->toserver_max_depth != 25)
5409 goto end;
5410 if (pp->toclient_max_depth != 0)
5411 goto end;
5412 if (pp->toserver == NULL)
5413 goto end;
5414 if (pp->toserver->next == NULL)
5415 goto end;
5416 if (pp->toserver->next->next == NULL)
5417 goto end;
5418 if (pp->toserver->next->next->next != NULL)
5419 goto end;
5420 /* first one */
5421 pe = pp->toserver;
5422 if (strcmp(pe->al_proto_name, "http") != 0)
5423 goto end;
5424 if (pe->al_proto != ALPROTO_HTTP)
5425 goto end;
5426 if (pe->port != 80)
5427 goto end;
5428 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5429 goto end;
5430 if (pe->min_depth != 5)
5431 goto end;
5432 if (pe->max_depth != 8)
5433 goto end;
5434 if (pe->ProbingParser != ProbingParserDummyForTesting)
5435 goto end;
5436 /* second one */
5437 pe = pp->toserver->next;
5438 if (strcmp(pe->al_proto_name, "smb") != 0)
5439 goto end;
5440 if (pe->al_proto != ALPROTO_SMB)
5441 goto end;
5442 if (pe->port != 80)
5443 goto end;
5444 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5445 goto end;
5446 if (pe->min_depth != 5)
5447 goto end;
5448 if (pe->max_depth != 15)
5449 goto end;
5450 if (pe->ProbingParser != ProbingParserDummyForTesting)
5451 goto end;
5452 pe = pp->toserver->next->next;
5453 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
5454 goto end;
5455 if (pe->al_proto != ALPROTO_DCERPC)
5456 goto end;
5457 if (pe->port != 0)
5458 goto end;
5459 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5460 goto end;
5461 if (pe->min_depth != 5)
5462 goto end;
5463 if (pe->max_depth != 25)
5464 goto end;
5465 if (pe->ProbingParser != ProbingParserDummyForTesting)
5466 goto end;
5467 /* second probing parser */
5468 pp = pp->next;
5469 if (pp->toclient != NULL)
5470 goto end;
5471 if (pp->next != NULL)
5472 goto end;
5473 if (pp->port != 0)
5474 goto end;
5475 if (pp->toserver_max_depth != 25)
5476 goto end;
5477 if (pp->toclient_max_depth != 0)
5478 goto end;
5479 if (pp->toserver == NULL)
5480 goto end;
5481 if (pp->toserver->next != NULL)
5482 goto end;
5483 /* first one */
5484 pe = pp->toserver;
5485 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
5486 goto end;
5487 if (pe->al_proto != ALPROTO_DCERPC)
5488 goto end;
5489 if (pe->port != 0)
5490 goto end;
5491 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5492 goto end;
5493 if (pe->min_depth != 5)
5494 goto end;
5495 if (pe->max_depth != 25)
5496 goto end;
5497 if (pe->ProbingParser != ProbingParserDummyForTesting)
5498 goto end;
5499
5500 AppLayerRegisterProbingParser(&ctx,
5501 81,
5502 IPPROTO_TCP,
5503 "ftp",
5504 ALPROTO_FTP,
5505 7, 15,
5506 STREAM_TOSERVER,
5507 APP_LAYER_PROBING_PARSER_PRIORITY_HIGH, 1,
5508 ProbingParserDummyForTesting);
5509 pp = ctx.probing_parsers;
5510 if (ctx.probing_parsers == NULL) {
5511 goto end;
5512 }
5513 if (pp->toclient != NULL)
5514 goto end;
5515 if (pp->next == NULL)
5516 goto end;
5517 if (pp->next->next == NULL)
5518 goto end;
5519 if (pp->next->next->next != NULL)
5520 goto end;
5521 if (pp->port != 80)
5522 goto end;
5523 if (pp->toserver_max_depth != 25)
5524 goto end;
5525 if (pp->toclient_max_depth != 0)
5526 goto end;
5527 if (pp->toserver == NULL)
5528 goto end;
5529 if (pp->toserver->next == NULL)
5530 goto end;
5531 if (pp->toserver->next->next == NULL)
5532 goto end;
5533 if (pp->toserver->next->next->next != NULL)
5534 goto end;
5535 /* first one */
5536 pe = pp->toserver;
5537 if (strcmp(pe->al_proto_name, "http") != 0)
5538 goto end;
5539 if (pe->al_proto != ALPROTO_HTTP)
5540 goto end;
5541 if (pe->port != 80)
5542 goto end;
5543 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5544 goto end;
5545 if (pe->min_depth != 5)
5546 goto end;
5547 if (pe->max_depth != 8)
5548 goto end;
5549 if (pe->ProbingParser != ProbingParserDummyForTesting)
5550 goto end;
5551 /* second one */
5552 pe = pp->toserver->next;
5553 if (strcmp(pe->al_proto_name, "smb") != 0)
5554 goto end;
5555 if (pe->al_proto != ALPROTO_SMB)
5556 goto end;
5557 if (pe->port != 80)
5558 goto end;
5559 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5560 goto end;
5561 if (pe->min_depth != 5)
5562 goto end;
5563 if (pe->max_depth != 15)
5564 goto end;
5565 if (pe->ProbingParser != ProbingParserDummyForTesting)
5566 goto end;
5567 pe = pp->toserver->next->next;
5568 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
5569 goto end;
5570 if (pe->al_proto != ALPROTO_DCERPC)
5571 goto end;
5572 if (pe->port != 0)
5573 goto end;
5574 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5575 goto end;
5576 if (pe->min_depth != 5)
5577 goto end;
5578 if (pe->max_depth != 25)
5579 goto end;
5580 if (pe->ProbingParser != ProbingParserDummyForTesting)
5581 goto end;
5582
5583 /* second probing parser */
5584 pp = pp->next;
5585 if (pp->toclient != NULL)
5586 goto end;
5587 if (pp->next == NULL)
5588 goto end;
5589 if (pp->next->next != NULL)
5590 goto end;
5591 if (pp->port != 81)
5592 goto end;
5593 if (pp->toserver_max_depth != 25)
5594 goto end;
5595 if (pp->toclient_max_depth != 0)
5596 goto end;
5597 if (pp->toserver == NULL)
5598 goto end;
5599 if (pp->toserver->next == NULL)
5600 goto end;
5601 if (pp->toserver->next->next != NULL)
5602 goto end;
5603 /* first one */
5604 pe = pp->toserver;
5605 if (strcmp(pe->al_proto_name, "ftp") != 0)
5606 goto end;
5607 if (pe->al_proto != ALPROTO_FTP)
5608 goto end;
5609 if (pe->port != 81)
5610 goto end;
5611 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5612 goto end;
5613 if (pe->min_depth != 7)
5614 goto end;
5615 if (pe->max_depth != 15)
5616 goto end;
5617 if (pe->ProbingParser != ProbingParserDummyForTesting)
5618 goto end;
5619 /* second one */
5620 pe = pp->toserver->next;
5621 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
5622 goto end;
5623 if (pe->al_proto != ALPROTO_DCERPC)
5624 goto end;
5625 if (pe->port != 0)
5626 goto end;
5627 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5628 goto end;
5629 if (pe->min_depth != 5)
5630 goto end;
5631 if (pe->max_depth != 25)
5632 goto end;
5633 if (pe->ProbingParser != ProbingParserDummyForTesting)
5634 goto end;
5635
5636 /* third probing parser */
5637 pp = pp->next;
5638 if (pp->toclient != NULL)
5639 goto end;
5640 if (pp->next != NULL)
5641 goto end;
5642 if (pp->port != 0)
5643 goto end;
5644 if (pp->toserver_max_depth != 25)
5645 goto end;
5646 if (pp->toclient_max_depth != 0)
5647 goto end;
5648 if (pp->toserver == NULL)
5649 goto end;
5650 if (pp->toserver->next != NULL)
5651 goto end;
5652 /* first one */
5653 pe = pp->toserver;
5654 if (strcmp(pe->al_proto_name, "dcerpc") != 0)
5655 goto end;
5656 if (pe->al_proto != ALPROTO_DCERPC)
5657 goto end;
5658 if (pe->port != 0)
5659 goto end;
5660 if (pe->priority != APP_LAYER_PROBING_PARSER_PRIORITY_HIGH)
5661 goto end;
5662 if (pe->min_depth != 5)
5663 goto end;
5664 if (pe->max_depth != 25)
5665 goto end;
5666 if (pe->ProbingParser != ProbingParserDummyForTesting)
5667 goto end;
5668
5669 AppLayerPrintProbingParsers(ctx.probing_parsers);
5670
5671 result = 1;
5672
5673 end:
5674 AlpProtoTestDestroy(&ctx);
5675 return result;
5676}
5677
7c31a232
AS		 5678#endif /* UNITESTS */
5679
5680void AppLayerParserRegisterTests(void)
5681{
5682#ifdef UNITTESTS
5683 UtRegisterTest("AppLayerParserTest01", AppLayerParserTest01, 1);
5684 UtRegisterTest("AppLayerParserTest02", AppLayerParserTest02, 1);
5685 UtRegisterTest("AppLayerProbingParserTest01", AppLayerProbingParserTest01, 1);
5686 UtRegisterTest("AppLayerProbingParserTest02", AppLayerProbingParserTest02, 1);
5687 UtRegisterTest("AppLayerProbingParserTest03", AppLayerProbingParserTest03, 1);
5688 UtRegisterTest("AppLayerProbingParserTest04", AppLayerProbingParserTest04, 1);
5689 UtRegisterTest("AppLayerProbingParserTest05", AppLayerProbingParserTest05, 1);
5690 UtRegisterTest("AppLayerProbingParserTest06", AppLayerProbingParserTest06, 1);
5691 UtRegisterTest("AppLayerProbingParserTest07", AppLayerProbingParserTest07, 1);
5692 UtRegisterTest("AppLayerProbingParserTest08", AppLayerProbingParserTest08, 1);
5693 UtRegisterTest("AppLayerProbingParserTest09", AppLayerProbingParserTest09, 1);
5694 UtRegisterTest("AppLayerProbingParserTest10", AppLayerProbingParserTest10, 1);
5695 UtRegisterTest("AppLayerProbingParserTest11", AppLayerProbingParserTest11, 1);
5696 UtRegisterTest("AppLayerProbingParserTest12", AppLayerProbingParserTest12, 1);
5697 UtRegisterTest("AppLayerProbingParserTest13", AppLayerProbingParserTest13, 1);
432c3317
AS		 5698 UtRegisterTest("AppLayerProbingParserTest14", AppLayerProbingParserTest14, 1);
5699 UtRegisterTest("AppLayerProbingParserTest15", AppLayerProbingParserTest15, 1);
7c31a232
AS		 5700#endif /* UNITTESTS */
5701
5702 return;
c1e485cc 5703}
Michael's tree of suricata