51 #define PARSE_REGEX "^\\s*([0-9a-zA-Z]{8}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{12})(?:\\s*,\\s*(<|>|=|!)([0-9]{1,5}))?(?:\\s*,\\s*(any_frag))?\\s*$"
56 Flow *f, uint8_t
flags,
void *state,
void *txv,
61 static void DetectDceIfaceRegisterTests(
void);
63 static int g_dce_generic_list_id = 0;
67 uint8_t
flags,
void *alstate,
void *txv, uint64_t tx_id);
99 uint8_t
flags,
void *alstate,
void *txv, uint64_t tx_id)
120 Flow *f, uint8_t
flags,
void *state,
void *txv,
127 return rs_dcerpc_iface_match(txv, state, (
void *)
m);
132 if (rs_smb_tx_get_dce_iface(f->
alstate, txv, (
void *)
m) != 1) {
133 SCLogDebug(
"rs_smb_tx_get_dce_iface: didn't match");
135 SCLogDebug(
"rs_smb_tx_get_dce_iface: matched!");
163 void *did = rs_dcerpc_iface_parse(arg);
187 rs_dcerpc_iface_free(ptr);
203 static int DetectDceIfaceTestParse13(
void)
213 DCERPCState *dcerpc_state = NULL;
216 uint8_t dcerpc_bind[] = {
217 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00,
218 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
219 0xb8, 0x10, 0xb8, 0x10, 0x00, 0x00, 0x00, 0x00,
220 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
221 0x01, 0xd0, 0x8c, 0x33, 0x44, 0x22, 0xf1, 0x31,
222 0xaa, 0xaa, 0x90, 0x00, 0x38, 0x00, 0x10, 0x03,
223 0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
224 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
225 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
228 uint8_t dcerpc_bindack[] = {
229 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00,
230 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
231 0xb8, 0x10, 0xb8, 0x10, 0x65, 0x8e, 0x00, 0x00,
232 0x0d, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c,
233 0x77, 0x69, 0x6e, 0x72, 0x65, 0x67, 0x00, 0x6d,
234 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
235 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
236 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
237 0x02, 0x00, 0x00, 0x00,
240 uint8_t dcerpc_request1[] = {
241 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
242 0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
243 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00,
244 0x2c, 0xfd, 0xb5, 0x00, 0x40, 0xaa, 0x01, 0x00,
245 0x00, 0x00, 0x00, 0x02,
248 uint8_t dcerpc_response1[] = {
249 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
250 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
251 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
252 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c,
253 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
254 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00,
257 uint8_t dcerpc_request2[] = {
258 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
259 0xa4, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
260 0x8c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00,
261 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c,
262 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
263 0x29, 0x87, 0xea, 0xe9, 0x5c, 0x00, 0x5c, 0x00,
264 0xa8, 0xb9, 0x14, 0x00, 0x2e, 0x00, 0x00, 0x00,
265 0x00, 0x00, 0x00, 0x00, 0x2e, 0x00, 0x00, 0x00,
266 0x53, 0x00, 0x4f, 0x00, 0x46, 0x00, 0x54, 0x00,
267 0x57, 0x00, 0x41, 0x00, 0x52, 0x00, 0x45, 0x00,
268 0x5c, 0x00, 0x4d, 0x00, 0x69, 0x00, 0x63, 0x00,
269 0x72, 0x00, 0x6f, 0x00, 0x73, 0x00, 0x6f, 0x00,
270 0x66, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x57, 0x00,
271 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00,
272 0x77, 0x00, 0x73, 0x00, 0x5c, 0x00, 0x43, 0x00,
273 0x75, 0x00, 0x72, 0x00, 0x72, 0x00, 0x65, 0x00,
274 0x6e, 0x00, 0x74, 0x00, 0x56, 0x00, 0x65, 0x00,
275 0x72, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00,
276 0x6e, 0x00, 0x5c, 0x00, 0x52, 0x00, 0x75, 0x00,
277 0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
278 0x03, 0x00, 0x00, 0x00,
281 uint8_t dcerpc_response2[] = {
282 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
283 0x30, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
284 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
285 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c,
286 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
287 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00,
290 uint8_t dcerpc_request3[] = {
291 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
292 0x70, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
293 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x00,
294 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c,
295 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
296 0x29, 0x87, 0xea, 0xe9, 0x0c, 0x00, 0x0c, 0x00,
297 0x98, 0xda, 0x14, 0x00, 0x06, 0x00, 0x00, 0x00,
298 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,
299 0x4f, 0x00, 0x73, 0x00, 0x61, 0x00, 0x33, 0x00,
300 0x32, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
301 0x18, 0x00, 0x00, 0x00, 0x4e, 0x00, 0x54, 0x00,
302 0x4f, 0x00, 0x53, 0x00, 0x41, 0x00, 0x33, 0x00,
303 0x32, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x58, 0x00,
304 0x45, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
307 uint8_t dcerpc_response3[] = {
308 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
309 0x1c, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
310 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
311 0x00, 0x00, 0x00, 0x00,
314 uint32_t dcerpc_bind_len =
sizeof(dcerpc_bind);
315 uint32_t dcerpc_bindack_len =
sizeof(dcerpc_bindack);
317 uint32_t dcerpc_request1_len =
sizeof(dcerpc_request1);
318 uint32_t dcerpc_response1_len =
sizeof(dcerpc_response1);
320 uint32_t dcerpc_request2_len =
sizeof(dcerpc_request2);
321 uint32_t dcerpc_response2_len =
sizeof(dcerpc_response2);
323 uint32_t dcerpc_request3_len =
sizeof(dcerpc_request3);
324 uint32_t dcerpc_response3_len =
sizeof(dcerpc_response3);
328 memset(&th_v, 0,
sizeof(th_v));
329 memset(&p, 0,
sizeof(p));
330 memset(&f, 0,
sizeof(f));
331 memset(&ssn, 0,
sizeof(ssn));
337 f.
proto = IPPROTO_TCP;
353 "(msg:\"DCERPC\"; dce_iface:338cd001-2244-31f1-aaaa-900038001003,=1,any_frag; sid:1;)");
363 dcerpc_bind, dcerpc_bind_len);
365 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
370 if (dcerpc_state == NULL) {
381 SCLogDebug(
"sig 1 didn't match after bind request: ");
390 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
400 SCLogDebug(
"sig 1 matched again after bind ack: ");
408 dcerpc_request1_len);
410 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
420 SCLogDebug(
"sig 1 didn't match after request1: ");
428 dcerpc_response1_len);
430 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
440 SCLogDebug(
"sig 1 matched after response1, but shouldn't: ");
448 dcerpc_request2_len);
450 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
460 SCLogDebug(
"sig 1 didn't match after request2: ");
466 dcerpc_response2_len);
468 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
478 SCLogDebug(
"sig 1 matched after response2, but shouldn't have: ");
484 dcerpc_request3_len);
486 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
496 SCLogDebug(
"sig 1 didn't match after request3: ");
502 dcerpc_response3, dcerpc_response3_len);
504 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
514 SCLogDebug(
"sig 1 matched after response3, but shouldn't have: ");
536 static void DetectDceIfaceRegisterTests(
void)
541 UtRegisterTest(
"DetectDceIfaceTestParse13", DetectDceIfaceTestParse13, 1);