52 #define PARSE_REGEX "^\\s*([0-9a-zA-Z]{8}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{12})(?:\\s*,\\s*(<|>|=|!)([0-9]{1,5}))?(?:\\s*,\\s*(any_frag))?\\s*$"
57 Flow *f, uint8_t
flags,
void *state,
void *txv,
62 static void DetectDceIfaceRegisterTests(
void);
64 static int g_dce_generic_list_id = 0;
109 Flow *f, uint8_t
flags,
void *state,
void *txv,
116 return rs_dcerpc_iface_match(txv, state, (
void *)
m);
121 if (rs_smb_tx_get_dce_iface(f->
alstate, txv, (
void *)
m) != 1) {
122 SCLogDebug(
"rs_smb_tx_get_dce_iface: didn't match");
124 SCLogDebug(
"rs_smb_tx_get_dce_iface: matched!");
150 void *did = rs_dcerpc_iface_parse(arg);
152 SCLogError(
"Error parsing dce_iface option in "
173 rs_dcerpc_iface_free(ptr);
189 static int DetectDceIfaceTestParse13(
void)
199 DCERPCState *dcerpc_state = NULL;
202 uint8_t dcerpc_bind[] = {
203 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00,
204 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
205 0xb8, 0x10, 0xb8, 0x10, 0x00, 0x00, 0x00, 0x00,
206 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
207 0x01, 0xd0, 0x8c, 0x33, 0x44, 0x22, 0xf1, 0x31,
208 0xaa, 0xaa, 0x90, 0x00, 0x38, 0x00, 0x10, 0x03,
209 0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
210 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
211 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
214 uint8_t dcerpc_bindack[] = {
215 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00,
216 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
217 0xb8, 0x10, 0xb8, 0x10, 0x65, 0x8e, 0x00, 0x00,
218 0x0d, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c,
219 0x77, 0x69, 0x6e, 0x72, 0x65, 0x67, 0x00, 0x6d,
220 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
221 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
222 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
223 0x02, 0x00, 0x00, 0x00,
226 uint8_t dcerpc_request1[] = {
227 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
228 0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
229 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00,
230 0x2c, 0xfd, 0xb5, 0x00, 0x40, 0xaa, 0x01, 0x00,
231 0x00, 0x00, 0x00, 0x02,
234 uint8_t dcerpc_response1[] = {
235 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
236 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
237 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
238 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c,
239 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
240 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00,
243 uint8_t dcerpc_request2[] = {
244 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
245 0xa4, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
246 0x8c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00,
247 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c,
248 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
249 0x29, 0x87, 0xea, 0xe9, 0x5c, 0x00, 0x5c, 0x00,
250 0xa8, 0xb9, 0x14, 0x00, 0x2e, 0x00, 0x00, 0x00,
251 0x00, 0x00, 0x00, 0x00, 0x2e, 0x00, 0x00, 0x00,
252 0x53, 0x00, 0x4f, 0x00, 0x46, 0x00, 0x54, 0x00,
253 0x57, 0x00, 0x41, 0x00, 0x52, 0x00, 0x45, 0x00,
254 0x5c, 0x00, 0x4d, 0x00, 0x69, 0x00, 0x63, 0x00,
255 0x72, 0x00, 0x6f, 0x00, 0x73, 0x00, 0x6f, 0x00,
256 0x66, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x57, 0x00,
257 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00,
258 0x77, 0x00, 0x73, 0x00, 0x5c, 0x00, 0x43, 0x00,
259 0x75, 0x00, 0x72, 0x00, 0x72, 0x00, 0x65, 0x00,
260 0x6e, 0x00, 0x74, 0x00, 0x56, 0x00, 0x65, 0x00,
261 0x72, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00,
262 0x6e, 0x00, 0x5c, 0x00, 0x52, 0x00, 0x75, 0x00,
263 0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
264 0x03, 0x00, 0x00, 0x00,
267 uint8_t dcerpc_response2[] = {
268 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
269 0x30, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
270 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
271 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c,
272 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
273 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00,
276 uint8_t dcerpc_request3[] = {
277 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
278 0x70, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
279 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x00,
280 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c,
281 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
282 0x29, 0x87, 0xea, 0xe9, 0x0c, 0x00, 0x0c, 0x00,
283 0x98, 0xda, 0x14, 0x00, 0x06, 0x00, 0x00, 0x00,
284 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,
285 0x4f, 0x00, 0x73, 0x00, 0x61, 0x00, 0x33, 0x00,
286 0x32, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
287 0x18, 0x00, 0x00, 0x00, 0x4e, 0x00, 0x54, 0x00,
288 0x4f, 0x00, 0x53, 0x00, 0x41, 0x00, 0x33, 0x00,
289 0x32, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x58, 0x00,
290 0x45, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
293 uint8_t dcerpc_response3[] = {
294 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
295 0x1c, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
296 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
297 0x00, 0x00, 0x00, 0x00,
300 uint32_t dcerpc_bind_len =
sizeof(dcerpc_bind);
301 uint32_t dcerpc_bindack_len =
sizeof(dcerpc_bindack);
303 uint32_t dcerpc_request1_len =
sizeof(dcerpc_request1);
304 uint32_t dcerpc_response1_len =
sizeof(dcerpc_response1);
306 uint32_t dcerpc_request2_len =
sizeof(dcerpc_request2);
307 uint32_t dcerpc_response2_len =
sizeof(dcerpc_response2);
309 uint32_t dcerpc_request3_len =
sizeof(dcerpc_request3);
310 uint32_t dcerpc_response3_len =
sizeof(dcerpc_response3);
314 memset(&th_v, 0,
sizeof(th_v));
315 memset(&p, 0,
sizeof(p));
316 memset(&f, 0,
sizeof(f));
317 memset(&ssn, 0,
sizeof(ssn));
323 f.
proto = IPPROTO_TCP;
339 "(msg:\"DCERPC\"; dce_iface:338cd001-2244-31f1-aaaa-900038001003,=1,any_frag; sid:1;)");
349 dcerpc_bind, dcerpc_bind_len);
351 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
356 if (dcerpc_state == NULL) {
367 SCLogDebug(
"sig 1 didn't match after bind request: ");
376 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
386 SCLogDebug(
"sig 1 matched again after bind ack: ");
394 dcerpc_request1_len);
396 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
406 SCLogDebug(
"sig 1 didn't match after request1: ");
414 dcerpc_response1_len);
416 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
426 SCLogDebug(
"sig 1 matched after response1, but shouldn't: ");
434 dcerpc_request2_len);
436 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
446 SCLogDebug(
"sig 1 didn't match after request2: ");
452 dcerpc_response2_len);
454 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
464 SCLogDebug(
"sig 1 matched after response2, but shouldn't have: ");
470 dcerpc_request3_len);
472 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
482 SCLogDebug(
"sig 1 didn't match after request3: ");
488 dcerpc_response3, dcerpc_response3_len);
490 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
500 SCLogDebug(
"sig 1 matched after response3, but shouldn't have: ");
522 static void DetectDceIfaceRegisterTests(
void)
527 UtRegisterTest(
"DetectDceIfaceTestParse13", DetectDceIfaceTestParse13, 1);