suricata
detect-dce-opnum.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
22  *
23  * Implements dce_opnum keyword
24  */
25 
26 #include "suricata-common.h"
27 
28 #include "detect.h"
29 #include "detect-parse.h"
30 
31 #include "detect-engine.h"
32 #include "detect-engine-mpm.h"
33 #include "detect-engine-state.h"
34 
35 #include "flow.h"
36 #include "flow-var.h"
37 #include "flow-util.h"
38 
39 #include "app-layer.h"
40 #include "app-layer-dcerpc.h"
41 #include "queue.h"
42 #include "stream-tcp-reassemble.h"
43 #include "detect-dce-opnum.h"
44 #include "detect-dce-iface.h"
45 
46 #include "util-debug.h"
47 #include "util-unittest.h"
48 #include "util-unittest-helper.h"
49 #include "stream-tcp.h"
50 
51 #include "rust.h"
52 
53 #define PARSE_REGEX "^\\s*([0-9]{1,5}(\\s*-\\s*[0-9]{1,5}\\s*)?)(,\\s*[0-9]{1,5}(\\s*-\\s*[0-9]{1,5})?\\s*)*$"
54 
55 static DetectParseRegex parse_regex;
56 
57 static int DetectDceOpnumMatchRust(DetectEngineThreadCtx *det_ctx,
58  Flow *f, uint8_t flags, void *state, void *txv,
59  const Signature *s, const SigMatchCtx *m);
60 static int DetectDceOpnumSetup(DetectEngineCtx *, Signature *, const char *);
61 static void DetectDceOpnumFree(DetectEngineCtx *, void *);
62 #ifdef UNITTESTS
63 static void DetectDceOpnumRegisterTests(void);
64 #endif
65 static int g_dce_generic_list_id = 0;
66 
67 /**
68  * \brief Registers the keyword handlers for the "dce_opnum" keyword.
69  */
70 void DetectDceOpnumRegister(void)
71 {
72  sigmatch_table[DETECT_DCE_OPNUM].name = "dcerpc.opnum";
73  sigmatch_table[DETECT_DCE_OPNUM].alias = "dce_opnum";
74  sigmatch_table[DETECT_DCE_OPNUM].AppLayerTxMatch = DetectDceOpnumMatchRust;
75  sigmatch_table[DETECT_DCE_OPNUM].Setup = DetectDceOpnumSetup;
76  sigmatch_table[DETECT_DCE_OPNUM].Free = DetectDceOpnumFree;
77 #ifdef UNITTESTS
78  sigmatch_table[DETECT_DCE_OPNUM].RegisterTests = DetectDceOpnumRegisterTests;
79 #endif
80  DetectSetupParseRegexes(PARSE_REGEX, &parse_regex);
81 
82  g_dce_generic_list_id = DetectBufferTypeRegister("dce_generic");
83 }
84 
85 /**
86  * \brief App layer match function for the "dce_opnum" keyword.
87  *
88  * \param t Pointer to the ThreadVars instance.
89  * \param det_ctx Pointer to the DetectEngineThreadCtx.
90  * \param f Pointer to the flow.
91  * \param flags Pointer to the flags indicating the flow direction.
92  * \param state Pointer to the app layer state data.
93  * \param s Pointer to the Signature instance.
94  * \param m Pointer to the SigMatch.
95  *
96  * \retval 1 On Match.
97  * \retval 0 On no match.
98  */
99 static int DetectDceOpnumMatchRust(DetectEngineThreadCtx *det_ctx,
100  Flow *f, uint8_t flags, void *state, void *txv,
101  const Signature *s, const SigMatchCtx *m)
102 {
103  SCEnter();
104 
105  if (f->alproto == ALPROTO_DCERPC) {
106  return rs_dcerpc_opnum_match(txv, (void *)m);
107  }
108 
109  if (rs_smb_tx_match_dce_opnum(txv, (void *)m) != 1)
110  SCReturnInt(0);
111 
112  SCReturnInt(1);
113 }
114 
115 /**
116  * \brief Creates a SigMatch for the "dce_opnum" keyword being sent as argument,
117  * and appends it to the rs_dcerpc_opnum_matchSignature(s).
118  *
119  * \param de_ctx Pointer to the detection engine context.
120  * \param s Pointer to signature for the current Signature being parsed
121  * from the rules.
122  * \param arg Pointer to the string holding the keyword value.
123  *
124  * \retval 0 on success, -1 on failure
125  */
126 
127 static int DetectDceOpnumSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
128 {
129  if (arg == NULL) {
130  SCLogError(SC_ERR_INVALID_SIGNATURE, "Error parsing dce_opnum option in "
131  "signature, option needs a value");
132  return -1;
133  }
134 
135  if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_DCERPC &&
136  s->alproto != ALPROTO_SMB) {
137  SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords.");
138  return -1;
139  }
140  void *dod = rs_dcerpc_opnum_parse(arg);
141  if (dod == NULL) {
142  SCLogError(SC_ERR_INVALID_SIGNATURE, "Error parsing dce_opnum option in "
143  "signature");
144  return -1;
145  }
146 
147  SigMatch *sm = SigMatchAlloc();
148  if (sm == NULL) {
149  DetectDceOpnumFree(de_ctx, dod);
150  return -1;
151  }
152 
153  sm->type = DETECT_DCE_OPNUM;
154  sm->ctx = (void *)dod;
155 
156  SigMatchAppendSMToList(s, sm, g_dce_generic_list_id);
157  s->init_data->init_flags |= SIG_FLAG_INIT_DCERPC;
158  return 0;
159 }
160 
161 static void DetectDceOpnumFree(DetectEngineCtx *de_ctx, void *ptr)
162 {
163  SCEnter();
164  if (ptr != NULL) {
165  rs_dcerpc_opnum_free(ptr);
166  }
167  SCReturn;
168 }
169 
170 /************************************Unittests*********************************/
171 
172 #ifdef UNITTESTS
173 
174 /**
175  * \test Test a valid dce_opnum entry with a bind, bind_ack and a request.
176  */
177 static int DetectDceOpnumTestParse01(void)
178 {
179  int result = 0;
180  Signature *s = NULL;
181  ThreadVars th_v;
182  Packet *p = NULL;
183  Flow f;
184  TcpSession ssn;
185  DetectEngineThreadCtx *det_ctx = NULL;
186  DetectEngineCtx *de_ctx = NULL;
187  DCERPCState *dcerpc_state = NULL;
188  int r = 0;
189 
190  uint8_t dcerpc_bind[] = {
191  0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00,
192  0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
193  0xb8, 0x10, 0xb8, 0x10, 0x00, 0x00, 0x00, 0x00,
194  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
195  0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11,
196  0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5,
197  0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
198  0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
199  0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
200  };
201 
202  uint8_t dcerpc_bindack[] = {
203  0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00,
204  0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
205  0xb8, 0x10, 0xb8, 0x10, 0x26, 0x3d, 0x00, 0x00,
206  0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c,
207  0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00,
208  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
209  0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
210  0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
211  0x02, 0x00, 0x00, 0x00
212  };
213 
214  /* todo chop the request frag length and change the
215  * length related parameters in the frag */
216  uint8_t dcerpc_request[] = {
217  0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
218  0xec, 0x0c, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
219  0xd4, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00,
220  0xe1, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
221  0xe1, 0x03, 0x00, 0x00, 0x83, 0xc7, 0x0b, 0x47,
222  0x47, 0x47, 0x47, 0x81, 0x37, 0x22, 0xa5, 0x9b,
223  0x4a, 0x75, 0xf4, 0xa3, 0x61, 0xd3, 0xbe, 0xdd,
224  0x5a, 0xfb, 0x20, 0x1e, 0xfc, 0x10, 0x8e, 0x0f,
225  0xa5, 0x9f, 0x4a, 0x22, 0x20, 0x9b, 0xa8, 0xd5,
226  0xc4, 0xff, 0xc1, 0x3f, 0xbd, 0x9b, 0x4a, 0x22,
227  0x2e, 0xc0, 0x7a, 0xa9, 0xfe, 0x97, 0xc9, 0xe1,
228  0xa9, 0xf3, 0x2f, 0x22, 0xc9, 0x9b, 0x22, 0x50,
229  0xa5, 0xf5, 0x4a, 0x4a, 0xce, 0x9b, 0x2f, 0x22,
230  0x2e, 0x6f, 0xc1, 0xe1, 0xf3, 0xa8, 0x83, 0xa2,
231  0x64, 0x98, 0xc1, 0x62, 0xa1, 0xa0, 0x89, 0x56,
232  0xa8, 0x1b, 0x8b, 0x2b, 0x2e, 0xe3, 0x7a, 0xd1,
233  0x03, 0xef, 0x58, 0x7c, 0x4e, 0x7d, 0x14, 0x76,
234  0xfa, 0xc3, 0x7f, 0x02, 0xa5, 0xbb, 0x4a, 0x89,
235  0x47, 0x6c, 0x12, 0xc9, 0x70, 0x18, 0x8e, 0x3a,
236  0x2e, 0xcb, 0x52, 0xa9, 0x67, 0x98, 0x0a, 0x1e,
237  0x2e, 0xc3, 0x32, 0x21, 0x7f, 0x10, 0x31, 0x3e,
238  0xa6, 0x61, 0xc1, 0x61, 0x85, 0x98, 0x88, 0xa9,
239  0xee, 0x83, 0x22, 0x51, 0xd6, 0xda, 0x4a, 0x4a,
240  0xc1, 0xff, 0x38, 0x47, 0xcd, 0xe9, 0x25, 0x41,
241  0xe4, 0xf3, 0x0d, 0x47, 0xd1, 0xcb, 0xc1, 0xd6,
242  0x1e, 0x95, 0x4a, 0x22, 0xa5, 0x73, 0x08, 0x22,
243  0xa5, 0x9b, 0xc9, 0xe6, 0xb5, 0xcd, 0x22, 0x43,
244  0xd7, 0xe2, 0x0b, 0x4a, 0xe9, 0xf2, 0x28, 0x50,
245  0xcd, 0xd7, 0x25, 0x43, 0xc1, 0x10, 0xbe, 0x99,
246  0xa9, 0x9b, 0x4a, 0x22, 0x4d, 0xb8, 0x4a, 0x22,
247  0xa5, 0x18, 0x8e, 0x2e, 0xf3, 0xc9, 0x22, 0x4e,
248  0xc9, 0x9b, 0x4a, 0x4a, 0x96, 0xa9, 0x64, 0x46,
249  0xcd, 0xec, 0x39, 0x10, 0xfa, 0xcf, 0xb5, 0x76,
250  0x81, 0x8f, 0xc9, 0xe6, 0xa9, 0x10, 0x82, 0x7c,
251  0xff, 0xc4, 0xa1, 0x0a, 0xf5, 0xcc, 0x1b, 0x74,
252  0xf4, 0x10, 0x81, 0xa9, 0x9d, 0x98, 0xb0, 0xa1,
253  0x65, 0x9f, 0xb9, 0x84, 0xd1, 0x9f, 0x13, 0x7c,
254  0x47, 0x76, 0x12, 0x7c, 0xfc, 0x10, 0xbb, 0x09,
255  0x55, 0x5a, 0xac, 0x20, 0xfa, 0x10, 0x7e, 0x15,
256  0xa6, 0x69, 0x12, 0xe1, 0xf7, 0xca, 0x22, 0x57,
257  0xd5, 0x9b, 0x4a, 0x4a, 0xd1, 0xfa, 0x38, 0x56,
258  0xcd, 0xcc, 0x19, 0x63, 0xf6, 0xf3, 0x2f, 0x56,
259  0xa5, 0x9b, 0x22, 0x51, 0xca, 0xf8, 0x21, 0x48,
260  0xa5, 0xf3, 0x28, 0x4b, 0xcb, 0xff, 0x22, 0x47,
261  0xcb, 0x9b, 0x4a, 0x4a, 0xc9, 0xf2, 0x39, 0x56,
262  0xcd, 0xeb, 0x3e, 0x22, 0xa5, 0xf3, 0x2b, 0x41,
263  0xc6, 0xfe, 0xc1, 0xfe, 0xf6, 0xca, 0xc9, 0xe1,
264  0xad, 0xc8, 0x1b, 0xa1, 0x66, 0x93, 0x19, 0x73,
265  0x26, 0x58, 0x42, 0x71, 0xf4, 0x18, 0x89, 0x2a,
266  0xf6, 0xca, 0xb5, 0xf5, 0x2c, 0xd8, 0x42, 0xdd,
267  0x72, 0x12, 0x09, 0x26, 0x5a, 0x4c, 0xc3, 0x21,
268  0x5a, 0x4c, 0xc3, 0x61, 0x59, 0x64, 0x9d, 0xab,
269  0xe6, 0x63, 0xc9, 0xc9, 0xad, 0x10, 0xa9, 0xa3,
270  0x49, 0x0b, 0x4b, 0x22, 0xa5, 0xcf, 0x22, 0x23,
271  0xa4, 0x9b, 0x4a, 0xdd, 0x31, 0xbf, 0xe2, 0x23,
272  0xa5, 0x9b, 0xcb, 0xe6, 0x35, 0x9a, 0x4a, 0x22,
273  0xcf, 0x9d, 0x20, 0x23, 0xcf, 0x99, 0xb5, 0x76,
274  0x81, 0x83, 0x20, 0x22, 0xcf, 0x9b, 0x20, 0x22,
275  0xcd, 0x99, 0x4a, 0xe6, 0x96, 0x10, 0x96, 0x71,
276  0xf6, 0xcb, 0x20, 0x23, 0xf5, 0xf1, 0x5a, 0x71,
277  0xf5, 0x64, 0x1e, 0x06, 0x9d, 0x64, 0x1e, 0x06,
278  0x8d, 0x5c, 0x49, 0x32, 0xa5, 0x9b, 0x4a, 0xdd,
279  0xf1, 0xbf, 0x56, 0xa1, 0x61, 0xbf, 0x13, 0x78,
280  0xf4, 0xc9, 0x1a, 0x11, 0x77, 0xc9, 0x22, 0x51,
281  0xc0, 0xf5, 0x2e, 0xa9, 0x61, 0xc9, 0x22, 0x50,
282  0xc0, 0xf8, 0x3c, 0xa9, 0x71, 0xc9, 0x1b, 0x72,
283  0xf4, 0x64, 0x9d, 0xb1, 0x5a, 0x4c, 0xdf, 0xa1,
284  0x61, 0x8b, 0x12, 0x78, 0xfc, 0xc8, 0x1f, 0x72,
285  0x2e, 0x77, 0x1a, 0x42, 0xcf, 0x9f, 0x10, 0x72,
286  0x2e, 0x47, 0xa2, 0x63, 0xa5, 0x9b, 0x4a, 0x48,
287  0xa5, 0xf3, 0x26, 0x4e, 0xca, 0xf8, 0x22, 0x57,
288  0xc4, 0xf7, 0x0b, 0x4a, 0xf3, 0xf2, 0x38, 0x56,
289  0xf1, 0xcd, 0xb5, 0xf5, 0x26, 0x5f, 0x5a, 0x78,
290  0xf7, 0xf1, 0x0a, 0x4a, 0xa5, 0x8b, 0x4a, 0x22,
291  0xf7, 0xf1, 0x4a, 0xdd, 0x75, 0x12, 0x0e, 0x06,
292  0x81, 0xc1, 0xd9, 0xca, 0xb5, 0x9b, 0x4a, 0x22,
293  0xc4, 0xc0, 0xb5, 0xc1, 0xc5, 0xa8, 0x8a, 0x92,
294  0xa1, 0x73, 0x5c, 0x22, 0xa5, 0x9b, 0x2b, 0xe1,
295  0xc5, 0xc9, 0x19, 0x11, 0x65, 0x73, 0x40, 0x22,
296  0xa5, 0x9b, 0x11, 0x78, 0xa6, 0x43, 0x61, 0xf2,
297  0xd0, 0x74, 0x2b, 0xe1, 0x96, 0x52, 0x1b, 0x70,
298  0xf6, 0x64, 0x3f, 0x22, 0x5a, 0xcf, 0x4f, 0x26,
299  0x20, 0x5b, 0x34, 0x23, 0x66, 0x64, 0x1f, 0xd2,
300  0xa5, 0x9b, 0x4a, 0x22, 0xa5, 0x9b, 0x4a, 0x41,
301  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
302  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
303  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
304  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
305  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
306  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
307  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
308  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
309  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
310  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
311  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
312  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
313  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
314  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
315  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
316  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
317  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
318  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
319  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
320  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
321  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
322  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
323  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
324  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
325  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
326  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
327  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
328  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
329  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
330  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
331  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
332  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
333  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
334  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
335  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
336  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
337  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
338  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
339  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
340  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
341  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
342  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
343  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
344  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
345  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
346  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
347  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
348  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
349  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
350  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
351  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
352  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
353  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
354  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
355  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
356  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
357  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
358  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
359  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
360  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
361  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
362  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
363  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
364  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
365  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
366  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
367  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
368  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
369  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
370  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
371  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
372  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
373  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
374  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
375  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
376  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
377  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
378  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
379  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
380  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
381  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
382  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
383  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
384  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
385  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
386  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
387  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
388  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
389  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
390  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
391  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
392  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
393  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
394  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
395  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
396  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
397  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
398  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
399  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
400  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
401  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
402  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
403  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
404  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
405  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
406  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
407  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
408  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
409  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
410  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
411  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
412  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
413  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
414  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
415  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
416  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
417  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
418  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
419  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
420  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
421  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
422  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
423  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
424  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
425  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
426  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
427  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
428  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
429  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
430  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
431  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
432  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
433  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
434  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
435  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
436  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
437  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
438  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
439  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
440  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
441  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
442  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
443  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
444  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
445  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
446  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
447  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
448  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
449  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
450  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
451  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
452  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
453  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
454  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
455  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
456  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
457  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
458  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
459  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
460  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
461  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
462  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
463  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x54, 0x58,
464  0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d, 0x6f, 0x41,
465  0x3f, 0x3f, 0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d,
466  0x6f, 0x43, 0x42, 0x42, 0x50, 0x5f, 0x57, 0xc3,
467  0x33, 0x5f, 0x37, 0x74, 0x78, 0x78, 0x78, 0x78,
468  0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78,
469  0xeb, 0xd4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
470  0x01, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00,
471  0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00,
472  0x53, 0x69, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65,
473  0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
474  0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
475  0x44, 0x73, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61,
476  0x73, 0x65, 0x50, 0x61, 0x74, 0x68, 0x00, 0x00,
477  0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,
478  0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,
479  0x44, 0x73, 0x4c, 0x6f, 0x67, 0x50, 0x61, 0x74,
480  0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
481  0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
482  0x0b, 0x00, 0x00, 0x00, 0x53, 0x79, 0x73, 0x74,
483  0x65, 0x6d, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65,
484  0x52, 0x6f, 0x6f, 0x74, 0x50, 0x61, 0x74, 0x68,
485  0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
486  0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
487  0x0b, 0x00, 0x00, 0x00, 0x50, 0x61, 0x72, 0x65,
488  0x6e, 0x74, 0x44, 0x6e, 0x73, 0x44, 0x6f, 0x6d,
489  0x61, 0x69, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x00,
490  0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
491  0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
492  0x07, 0x00, 0x00, 0x00, 0x50, 0x61, 0x72, 0x65,
493  0x6e, 0x74, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
494  0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
495  0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
496  0x05, 0x00, 0x00, 0x00, 0x41, 0x63, 0x63, 0x6f,
497  0x75, 0x6e, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00,
498  0x72, 0x65, 0x66, 0x31, 0x41, 0x41, 0x41, 0x41,
499  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
500  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
501  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
502  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
503  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
504  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
505  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
506  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
507  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
508  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
509  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
510  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
511  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
512  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
513  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
514  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
515  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
516  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
517  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
518  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
519  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
520  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
521  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
522  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
523  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
524  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
525  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
526  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
527  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
528  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
529  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
530  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
531  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
532  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
533  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
534  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
535  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
536  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
537  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
538  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
539  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
540  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
541  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
542  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
543  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
544  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
545  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
546  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
547  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
548  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
549  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
550  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
551  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
552  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
553  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
554  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
555  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
556  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
557  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
558  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
559  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
560  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
561  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
562  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
563  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
564  0x72, 0x65, 0x66, 0x32, 0x42, 0x42, 0x42, 0x42,
565  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
566  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
567  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
568  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
569  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
570  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
571  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
572  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
573  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
574  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
575  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
576  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
577  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
578  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
579  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
580  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
581  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
582  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
583  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
584  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
585  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
586  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
587  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
588  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
589  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
590  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
591  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
592  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
593  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
594  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
595  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
596  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
597  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
598  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
599  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
600  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
601  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
602  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
603  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
604  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
605  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
606  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
607  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
608  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
609  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
610  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
611  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
612  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
613  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
614  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
615  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
616  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
617  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
618  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
619  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
620  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
621  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
622  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
623  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
624  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
625  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
626  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
627  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
628  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
629  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
630  0x01, 0x02, 0x03, 0x04
631  };
632 
633  uint32_t dcerpc_bind_len = sizeof(dcerpc_bind);
634  uint32_t dcerpc_bindack_len = sizeof(dcerpc_bindack);
635  uint32_t dcerpc_request_len = sizeof(dcerpc_request);
636 
637  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
638 
639  memset(&th_v, 0, sizeof(th_v));
640  memset(&f, 0, sizeof(f));
641  memset(&ssn, 0, sizeof(ssn));
642 
643  p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
644 
645  FLOW_INITIALIZE(&f);
646  f.protoctx = (void *)&ssn;
647  f.proto = IPPROTO_TCP;
648  p->flow = &f;
649  p->flowflags |= FLOW_PKT_TOSERVER;
650  p->flowflags |= FLOW_PKT_ESTABLISHED;
651  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
652  f.alproto = ALPROTO_DCERPC;
653 
654  StreamTcpInitConfig(TRUE);
655 
656  de_ctx = DetectEngineCtxInit();
657  if (de_ctx == NULL)
658  goto end;
659 
660  de_ctx->flags |= DE_QUIET;
661 
662  s = de_ctx->sig_list = SigInit(de_ctx,
663  "alert tcp any any -> any any "
664  "(msg:\"DCERPC\"; "
665  "dce_opnum:9; "
666  "sid:1;)");
667  if (s == NULL)
668  goto end;
669 
670  SigGroupBuild(de_ctx);
671  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
672 
673  FLOWLOCK_WRLOCK(&f);
674  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC,
675  STREAM_TOSERVER | STREAM_START, dcerpc_bind,
676  dcerpc_bind_len);
677  if (r != 0) {
678  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
679  FLOWLOCK_UNLOCK(&f);
680  goto end;
681  }
682  FLOWLOCK_UNLOCK(&f);
683 
684  dcerpc_state = f.alstate;
685  if (dcerpc_state == NULL) {
686  SCLogDebug("no dcerpc state: ");
687  goto end;
688  }
689 
690  FLOWLOCK_WRLOCK(&f);
691  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC,
692  STREAM_TOCLIENT, dcerpc_bindack,
693  dcerpc_bindack_len);
694  if (r != 0) {
695  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
696  FLOWLOCK_UNLOCK(&f);
697  goto end;
698  }
699  FLOWLOCK_UNLOCK(&f);
700 
701  FLOWLOCK_WRLOCK(&f);
702  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC,
703  STREAM_TOSERVER | STREAM_EOF, dcerpc_request,
704  dcerpc_request_len);
705  if (r != 0) {
706  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
707  FLOWLOCK_UNLOCK(&f);
708  goto end;
709  }
710  FLOWLOCK_UNLOCK(&f);
711 
712  dcerpc_state = f.alstate;
713  if (dcerpc_state == NULL) {
714  SCLogDebug("no dcerpc state: ");
715  goto end;
716  }
717 
718  /* do detect */
719  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
720 
721  if (!PacketAlertCheck(p, 1))
722  goto end;
723 
724  result = 1;
725 
726  end:
727  if (alp_tctx != NULL)
728  AppLayerParserThreadCtxFree(alp_tctx);
729  SigGroupCleanup(de_ctx);
730  SigCleanSignatures(de_ctx);
731 
732  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
733  DetectEngineCtxFree(de_ctx);
734 
735  StreamTcpFreeConfig(TRUE);
736  FLOW_DESTROY(&f);
737 
738  UTHFreePackets(&p, 1);
739  return result;
740 }
741 
742 /**
743  * \test Test a valid dce_opnum entry with only a request frag.
744  */
745 static int DetectDceOpnumTestParse02(void)
746 {
747  int result = 0;
748  Signature *s = NULL;
749  ThreadVars th_v;
750  Packet *p = NULL;
751  Flow f;
752  TcpSession ssn;
753  DetectEngineThreadCtx *det_ctx = NULL;
754  DetectEngineCtx *de_ctx = NULL;
755  DCERPCState *dcerpc_state = NULL;
756  int r = 0;
757 
758  /* todo chop the request frag length and change the
759  * length related parameters in the frag */
760  uint8_t dcerpc_request[] = {
761  0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
762  0xec, 0x0c, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
763  0xd4, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00,
764  0xe1, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
765  0xe1, 0x03, 0x00, 0x00, 0x83, 0xc7, 0x0b, 0x47,
766  0x47, 0x47, 0x47, 0x81, 0x37, 0x22, 0xa5, 0x9b,
767  0x4a, 0x75, 0xf4, 0xa3, 0x61, 0xd3, 0xbe, 0xdd,
768  0x5a, 0xfb, 0x20, 0x1e, 0xfc, 0x10, 0x8e, 0x0f,
769  0xa5, 0x9f, 0x4a, 0x22, 0x20, 0x9b, 0xa8, 0xd5,
770  0xc4, 0xff, 0xc1, 0x3f, 0xbd, 0x9b, 0x4a, 0x22,
771  0x2e, 0xc0, 0x7a, 0xa9, 0xfe, 0x97, 0xc9, 0xe1,
772  0xa9, 0xf3, 0x2f, 0x22, 0xc9, 0x9b, 0x22, 0x50,
773  0xa5, 0xf5, 0x4a, 0x4a, 0xce, 0x9b, 0x2f, 0x22,
774  0x2e, 0x6f, 0xc1, 0xe1, 0xf3, 0xa8, 0x83, 0xa2,
775  0x64, 0x98, 0xc1, 0x62, 0xa1, 0xa0, 0x89, 0x56,
776  0xa8, 0x1b, 0x8b, 0x2b, 0x2e, 0xe3, 0x7a, 0xd1,
777  0x03, 0xef, 0x58, 0x7c, 0x4e, 0x7d, 0x14, 0x76,
778  0xfa, 0xc3, 0x7f, 0x02, 0xa5, 0xbb, 0x4a, 0x89,
779  0x47, 0x6c, 0x12, 0xc9, 0x70, 0x18, 0x8e, 0x3a,
780  0x2e, 0xcb, 0x52, 0xa9, 0x67, 0x98, 0x0a, 0x1e,
781  0x2e, 0xc3, 0x32, 0x21, 0x7f, 0x10, 0x31, 0x3e,
782  0xa6, 0x61, 0xc1, 0x61, 0x85, 0x98, 0x88, 0xa9,
783  0xee, 0x83, 0x22, 0x51, 0xd6, 0xda, 0x4a, 0x4a,
784  0xc1, 0xff, 0x38, 0x47, 0xcd, 0xe9, 0x25, 0x41,
785  0xe4, 0xf3, 0x0d, 0x47, 0xd1, 0xcb, 0xc1, 0xd6,
786  0x1e, 0x95, 0x4a, 0x22, 0xa5, 0x73, 0x08, 0x22,
787  0xa5, 0x9b, 0xc9, 0xe6, 0xb5, 0xcd, 0x22, 0x43,
788  0xd7, 0xe2, 0x0b, 0x4a, 0xe9, 0xf2, 0x28, 0x50,
789  0xcd, 0xd7, 0x25, 0x43, 0xc1, 0x10, 0xbe, 0x99,
790  0xa9, 0x9b, 0x4a, 0x22, 0x4d, 0xb8, 0x4a, 0x22,
791  0xa5, 0x18, 0x8e, 0x2e, 0xf3, 0xc9, 0x22, 0x4e,
792  0xc9, 0x9b, 0x4a, 0x4a, 0x96, 0xa9, 0x64, 0x46,
793  0xcd, 0xec, 0x39, 0x10, 0xfa, 0xcf, 0xb5, 0x76,
794  0x81, 0x8f, 0xc9, 0xe6, 0xa9, 0x10, 0x82, 0x7c,
795  0xff, 0xc4, 0xa1, 0x0a, 0xf5, 0xcc, 0x1b, 0x74,
796  0xf4, 0x10, 0x81, 0xa9, 0x9d, 0x98, 0xb0, 0xa1,
797  0x65, 0x9f, 0xb9, 0x84, 0xd1, 0x9f, 0x13, 0x7c,
798  0x47, 0x76, 0x12, 0x7c, 0xfc, 0x10, 0xbb, 0x09,
799  0x55, 0x5a, 0xac, 0x20, 0xfa, 0x10, 0x7e, 0x15,
800  0xa6, 0x69, 0x12, 0xe1, 0xf7, 0xca, 0x22, 0x57,
801  0xd5, 0x9b, 0x4a, 0x4a, 0xd1, 0xfa, 0x38, 0x56,
802  0xcd, 0xcc, 0x19, 0x63, 0xf6, 0xf3, 0x2f, 0x56,
803  0xa5, 0x9b, 0x22, 0x51, 0xca, 0xf8, 0x21, 0x48,
804  0xa5, 0xf3, 0x28, 0x4b, 0xcb, 0xff, 0x22, 0x47,
805  0xcb, 0x9b, 0x4a, 0x4a, 0xc9, 0xf2, 0x39, 0x56,
806  0xcd, 0xeb, 0x3e, 0x22, 0xa5, 0xf3, 0x2b, 0x41,
807  0xc6, 0xfe, 0xc1, 0xfe, 0xf6, 0xca, 0xc9, 0xe1,
808  0xad, 0xc8, 0x1b, 0xa1, 0x66, 0x93, 0x19, 0x73,
809  0x26, 0x58, 0x42, 0x71, 0xf4, 0x18, 0x89, 0x2a,
810  0xf6, 0xca, 0xb5, 0xf5, 0x2c, 0xd8, 0x42, 0xdd,
811  0x72, 0x12, 0x09, 0x26, 0x5a, 0x4c, 0xc3, 0x21,
812  0x5a, 0x4c, 0xc3, 0x61, 0x59, 0x64, 0x9d, 0xab,
813  0xe6, 0x63, 0xc9, 0xc9, 0xad, 0x10, 0xa9, 0xa3,
814  0x49, 0x0b, 0x4b, 0x22, 0xa5, 0xcf, 0x22, 0x23,
815  0xa4, 0x9b, 0x4a, 0xdd, 0x31, 0xbf, 0xe2, 0x23,
816  0xa5, 0x9b, 0xcb, 0xe6, 0x35, 0x9a, 0x4a, 0x22,
817  0xcf, 0x9d, 0x20, 0x23, 0xcf, 0x99, 0xb5, 0x76,
818  0x81, 0x83, 0x20, 0x22, 0xcf, 0x9b, 0x20, 0x22,
819  0xcd, 0x99, 0x4a, 0xe6, 0x96, 0x10, 0x96, 0x71,
820  0xf6, 0xcb, 0x20, 0x23, 0xf5, 0xf1, 0x5a, 0x71,
821  0xf5, 0x64, 0x1e, 0x06, 0x9d, 0x64, 0x1e, 0x06,
822  0x8d, 0x5c, 0x49, 0x32, 0xa5, 0x9b, 0x4a, 0xdd,
823  0xf1, 0xbf, 0x56, 0xa1, 0x61, 0xbf, 0x13, 0x78,
824  0xf4, 0xc9, 0x1a, 0x11, 0x77, 0xc9, 0x22, 0x51,
825  0xc0, 0xf5, 0x2e, 0xa9, 0x61, 0xc9, 0x22, 0x50,
826  0xc0, 0xf8, 0x3c, 0xa9, 0x71, 0xc9, 0x1b, 0x72,
827  0xf4, 0x64, 0x9d, 0xb1, 0x5a, 0x4c, 0xdf, 0xa1,
828  0x61, 0x8b, 0x12, 0x78, 0xfc, 0xc8, 0x1f, 0x72,
829  0x2e, 0x77, 0x1a, 0x42, 0xcf, 0x9f, 0x10, 0x72,
830  0x2e, 0x47, 0xa2, 0x63, 0xa5, 0x9b, 0x4a, 0x48,
831  0xa5, 0xf3, 0x26, 0x4e, 0xca, 0xf8, 0x22, 0x57,
832  0xc4, 0xf7, 0x0b, 0x4a, 0xf3, 0xf2, 0x38, 0x56,
833  0xf1, 0xcd, 0xb5, 0xf5, 0x26, 0x5f, 0x5a, 0x78,
834  0xf7, 0xf1, 0x0a, 0x4a, 0xa5, 0x8b, 0x4a, 0x22,
835  0xf7, 0xf1, 0x4a, 0xdd, 0x75, 0x12, 0x0e, 0x06,
836  0x81, 0xc1, 0xd9, 0xca, 0xb5, 0x9b, 0x4a, 0x22,
837  0xc4, 0xc0, 0xb5, 0xc1, 0xc5, 0xa8, 0x8a, 0x92,
838  0xa1, 0x73, 0x5c, 0x22, 0xa5, 0x9b, 0x2b, 0xe1,
839  0xc5, 0xc9, 0x19, 0x11, 0x65, 0x73, 0x40, 0x22,
840  0xa5, 0x9b, 0x11, 0x78, 0xa6, 0x43, 0x61, 0xf2,
841  0xd0, 0x74, 0x2b, 0xe1, 0x96, 0x52, 0x1b, 0x70,
842  0xf6, 0x64, 0x3f, 0x22, 0x5a, 0xcf, 0x4f, 0x26,
843  0x20, 0x5b, 0x34, 0x23, 0x66, 0x64, 0x1f, 0xd2,
844  0xa5, 0x9b, 0x4a, 0x22, 0xa5, 0x9b, 0x4a, 0x41,
845  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
846  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
847  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
848  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
849  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
850  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
851  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
852  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
853  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
854  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
855  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
856  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
857  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
858  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
859  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
860  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
861  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
862  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
863  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
864  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
865  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
866  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
867  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
868  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
869  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
870  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
871  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
872  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
873  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
874  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
875  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
876  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
877  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
878  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
879  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
880  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
881  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
882  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
883  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
884  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
885  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
886  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
887  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
888  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
889  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
890  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
891  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
892  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
893  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
894  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
895  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
896  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
897  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
898  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
899  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
900  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
901  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
902  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
903  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
904  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
905  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
906  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
907  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
908  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
909  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
910  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
911  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
912  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
913  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
914  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
915  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
916  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
917  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
918  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
919  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
920  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
921  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
922  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
923  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
924  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
925  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
926  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
927  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
928  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
929  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
930  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
931  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
932  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
933  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
934  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
935  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
936  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
937  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
938  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
939  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
940  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
941  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
942  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
943  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
944  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
945  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
946  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
947  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
948  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
949  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
950  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
951  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
952  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
953  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
954  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
955  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
956  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
957  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
958  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
959  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
960  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
961  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
962  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
963  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
964  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
965  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
966  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
967  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
968  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
969  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
970  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
971  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
972  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
973  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
974  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
975  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
976  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
977  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
978  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
979  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
980  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
981  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
982  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
983  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
984  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
985  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
986  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
987  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
988  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
989  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
990  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
991  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
992  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
993  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
994  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
995  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
996  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
997  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
998  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
999  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1000  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1001  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1002  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1003  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1004  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1005  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1006  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1007  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x54, 0x58,
1008  0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d, 0x6f, 0x41,
1009  0x3f, 0x3f, 0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d,
1010  0x6f, 0x43, 0x42, 0x42, 0x50, 0x5f, 0x57, 0xc3,
1011  0x33, 0x5f, 0x37, 0x74, 0x78, 0x78, 0x78, 0x78,
1012  0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78,
1013  0xeb, 0xd4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1014  0x01, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00,
1015  0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00,
1016  0x53, 0x69, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65,
1017  0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
1018  0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
1019  0x44, 0x73, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61,
1020  0x73, 0x65, 0x50, 0x61, 0x74, 0x68, 0x00, 0x00,
1021  0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,
1022  0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,
1023  0x44, 0x73, 0x4c, 0x6f, 0x67, 0x50, 0x61, 0x74,
1024  0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1025  0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1026  0x0b, 0x00, 0x00, 0x00, 0x53, 0x79, 0x73, 0x74,
1027  0x65, 0x6d, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65,
1028  0x52, 0x6f, 0x6f, 0x74, 0x50, 0x61, 0x74, 0x68,
1029  0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
1030  0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1031  0x0b, 0x00, 0x00, 0x00, 0x50, 0x61, 0x72, 0x65,
1032  0x6e, 0x74, 0x44, 0x6e, 0x73, 0x44, 0x6f, 0x6d,
1033  0x61, 0x69, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x00,
1034  0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
1035  0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1036  0x07, 0x00, 0x00, 0x00, 0x50, 0x61, 0x72, 0x65,
1037  0x6e, 0x74, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
1038  0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
1039  0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1040  0x05, 0x00, 0x00, 0x00, 0x41, 0x63, 0x63, 0x6f,
1041  0x75, 0x6e, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00,
1042  0x72, 0x65, 0x66, 0x31, 0x41, 0x41, 0x41, 0x41,
1043  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1044  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1045  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1046  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1047  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1048  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1049  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1050  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1051  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1052  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1053  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1054  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1055  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1056  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1057  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1058  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1059  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1060  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1061  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1062  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1063  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1064  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1065  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1066  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1067  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1068  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1069  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1070  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1071  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1072  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1073  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1074  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1075  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1076  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1077  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1078  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1079  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1080  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1081  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1082  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1083  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1084  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1085  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1086  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1087  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1088  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1089  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1090  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1091  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1092  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1093  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1094  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1095  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1096  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1097  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1098  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1099  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1100  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1101  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1102  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1103  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1104  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1105  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1106  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1107  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1108  0x72, 0x65, 0x66, 0x32, 0x42, 0x42, 0x42, 0x42,
1109  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1110  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1111  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1112  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1113  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1114  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1115  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1116  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1117  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1118  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1119  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1120  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1121  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1122  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1123  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1124  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1125  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1126  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1127  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1128  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1129  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1130  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1131  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1132  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1133  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1134  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1135  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1136  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1137  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1138  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1139  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1140  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1141  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1142  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1143  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1144  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1145  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1146  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1147  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1148  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1149  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1150  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1151  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1152  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1153  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1154  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1155  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1156  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1157  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1158  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1159  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1160  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1161  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1162  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1163  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1164  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1165  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1166  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1167  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1168  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1169  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1170  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1171  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1172  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1173  0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
1174  0x01, 0x02, 0x03, 0x04
1175  };
1176 
1177  uint32_t dcerpc_request_len = sizeof(dcerpc_request);
1178 
1179  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1180 
1181  memset(&th_v, 0, sizeof(th_v));
1182  memset(&f, 0, sizeof(f));
1183  memset(&ssn, 0, sizeof(ssn));
1184 
1185  p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1186 
1187  FLOW_INITIALIZE(&f);
1188  f.protoctx = (void *)&ssn;
1189  f.proto = IPPROTO_TCP;
1190  p->flow = &f;
1191  p->flowflags |= FLOW_PKT_TOSERVER;
1192  p->flowflags |= FLOW_PKT_ESTABLISHED;
1193  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1194  f.alproto = ALPROTO_DCERPC;
1195 
1196  StreamTcpInitConfig(TRUE);
1197 
1198  de_ctx = DetectEngineCtxInit();
1199  if (de_ctx == NULL)
1200  goto end;
1201 
1202  de_ctx->flags |= DE_QUIET;
1203 
1204  s = de_ctx->sig_list = SigInit(de_ctx,
1205  "alert tcp any any -> any any "
1206  "(msg:\"DCERPC\"; "
1207  "dce_opnum:9; "
1208  "sid:1;)");
1209  if (s == NULL)
1210  goto end;
1211 
1212  SigGroupBuild(de_ctx);
1213  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1214 
1215  FLOWLOCK_WRLOCK(&f);
1216  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC,
1217  STREAM_TOSERVER | STREAM_START, dcerpc_request,
1218  dcerpc_request_len);
1219  if (r != 0) {
1220  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1221  FLOWLOCK_UNLOCK(&f);
1222  goto end;
1223  }
1224  FLOWLOCK_UNLOCK(&f);
1225 
1226  dcerpc_state = f.alstate;
1227  if (dcerpc_state == NULL) {
1228  SCLogDebug("no dcerpc state: ");
1229  goto end;
1230  }
1231 
1232  /* do detect */
1233  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1234 
1235  if (!PacketAlertCheck(p, 1))
1236  goto end;
1237 
1238  result = 1;
1239 
1240  end:
1241  if (alp_tctx != NULL)
1242  AppLayerParserThreadCtxFree(alp_tctx);
1243  SigGroupCleanup(de_ctx);
1244  SigCleanSignatures(de_ctx);
1245 
1246  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1247  DetectEngineCtxFree(de_ctx);
1248 
1249  StreamTcpFreeConfig(TRUE);
1250  FLOW_DESTROY(&f);
1251 
1252  UTHFreePackets(&p, 1);
1253  return result;
1254 }
1255 
1256 /* Disabled because of bug_753. Would be enabled, once we rewrite
1257  * dce parser */
1258 #if 0
1259 
1260 /**
1261  * \test Test a valid dce_opnum(with multiple values) with a bind, bind_ack,
1262  * and multiple request/responses with a match test after each frag parsing.
1263  */
1264 static int DetectDceOpnumTestParse10(void)
1265 {
1266  int result = 0;
1267  Signature *s = NULL;
1268  ThreadVars th_v;
1269  Packet *p = NULL;
1270  Flow f;
1271  TcpSession ssn;
1272  DetectEngineThreadCtx *det_ctx = NULL;
1273  DetectEngineCtx *de_ctx = NULL;
1274  DCERPCState *dcerpc_state = NULL;
1275  int r = 0;
1276 
1277  uint8_t dcerpc_bind[] = {
1278  0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00,
1279  0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1280  0xb8, 0x10, 0xb8, 0x10, 0x00, 0x00, 0x00, 0x00,
1281  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
1282  0x01, 0xd0, 0x8c, 0x33, 0x44, 0x22, 0xf1, 0x31,
1283  0xaa, 0xaa, 0x90, 0x00, 0x38, 0x00, 0x10, 0x03,
1284  0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
1285  0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
1286  0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
1287  };
1288 
1289  uint8_t dcerpc_bindack[] = {
1290  0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00,
1291  0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1292  0xb8, 0x10, 0xb8, 0x10, 0x65, 0x8e, 0x00, 0x00,
1293  0x0d, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c,
1294  0x77, 0x69, 0x6e, 0x72, 0x65, 0x67, 0x00, 0x6d,
1295  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1296  0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
1297  0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
1298  0x02, 0x00, 0x00, 0x00,
1299  };
1300 
1301  uint8_t dcerpc_request1[] = {
1302  0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
1303  0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1304  0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00,
1305  0x2c, 0xfd, 0xb5, 0x00, 0x40, 0xaa, 0x01, 0x00,
1306  0x00, 0x00, 0x00, 0x02,
1307  };
1308 
1309  uint8_t dcerpc_response1[] = {
1310  0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
1311  0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1312  0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1313  0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c,
1314  0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
1315  0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00,
1316  };
1317 
1318  uint8_t dcerpc_request2[] = {
1319  0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
1320  0xa4, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
1321  0x8c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00,
1322  0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c,
1323  0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
1324  0x29, 0x87, 0xea, 0xe9, 0x5c, 0x00, 0x5c, 0x00,
1325  0xa8, 0xb9, 0x14, 0x00, 0x2e, 0x00, 0x00, 0x00,
1326  0x00, 0x00, 0x00, 0x00, 0x2e, 0x00, 0x00, 0x00,
1327  0x53, 0x00, 0x4f, 0x00, 0x46, 0x00, 0x54, 0x00,
1328  0x57, 0x00, 0x41, 0x00, 0x52, 0x00, 0x45, 0x00,
1329  0x5c, 0x00, 0x4d, 0x00, 0x69, 0x00, 0x63, 0x00,
1330  0x72, 0x00, 0x6f, 0x00, 0x73, 0x00, 0x6f, 0x00,
1331  0x66, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x57, 0x00,
1332  0x69, 0x00, 0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00,
1333  0x77, 0x00, 0x73, 0x00, 0x5c, 0x00, 0x43, 0x00,
1334  0x75, 0x00, 0x72, 0x00, 0x72, 0x00, 0x65, 0x00,
1335  0x6e, 0x00, 0x74, 0x00, 0x56, 0x00, 0x65, 0x00,
1336  0x72, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00,
1337  0x6e, 0x00, 0x5c, 0x00, 0x52, 0x00, 0x75, 0x00,
1338  0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1339  0x03, 0x00, 0x00, 0x00,
1340  };
1341 
1342  uint8_t dcerpc_response2[] = {
1343  0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
1344  0x30, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
1345  0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1346  0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c,
1347  0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
1348  0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00,
1349  };
1350 
1351  uint8_t dcerpc_request3[] = {
1352  0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
1353  0x70, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
1354  0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x00,
1355  0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c,
1356  0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
1357  0x29, 0x87, 0xea, 0xe9, 0x0c, 0x00, 0x0c, 0x00,
1358  0x98, 0xda, 0x14, 0x00, 0x06, 0x00, 0x00, 0x00,
1359  0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,
1360  0x4f, 0x00, 0x73, 0x00, 0x61, 0x00, 0x33, 0x00,
1361  0x32, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1362  0x18, 0x00, 0x00, 0x00, 0x4e, 0x00, 0x54, 0x00,
1363  0x4f, 0x00, 0x53, 0x00, 0x41, 0x00, 0x33, 0x00,
1364  0x32, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x58, 0x00,
1365  0x45, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
1366  };
1367 
1368  uint8_t dcerpc_response3[] = {
1369  0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
1370  0x1c, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
1371  0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1372  0x00, 0x00, 0x00, 0x00,
1373  };
1374 
1375  uint32_t dcerpc_bind_len = sizeof(dcerpc_bind);
1376  uint32_t dcerpc_bindack_len = sizeof(dcerpc_bindack);
1377 
1378  uint32_t dcerpc_request1_len = sizeof(dcerpc_request1);
1379  uint32_t dcerpc_response1_len = sizeof(dcerpc_response1);
1380 
1381  uint32_t dcerpc_request2_len = sizeof(dcerpc_request2);
1382  uint32_t dcerpc_response2_len = sizeof(dcerpc_response2);
1383 
1384  uint32_t dcerpc_request3_len = sizeof(dcerpc_request3);
1385  uint32_t dcerpc_response3_len = sizeof(dcerpc_response3);
1386 
1387  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1388 
1389  memset(&th_v, 0, sizeof(th_v));
1390  memset(&f, 0, sizeof(f));
1391  memset(&ssn, 0, sizeof(ssn));
1392 
1393  p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1394 
1395  FLOW_INITIALIZE(&f);
1396  f.protoctx = (void *)&ssn;
1397  f.proto = IPPROTO_TCP;
1398  p->flow = &f;
1399  p->flowflags |= FLOW_PKT_TOSERVER;
1400  p->flowflags |= FLOW_PKT_ESTABLISHED;
1401  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1402  f.alproto = ALPROTO_DCERPC;
1403 
1404  StreamTcpInitConfig(TRUE);
1405 
1406  de_ctx = DetectEngineCtxInit();
1407  if (de_ctx == NULL) {
1408  goto end;
1409  }
1410 
1411  de_ctx->flags |= DE_QUIET;
1412 
1413  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
1414  "(msg:\"DCERPC\"; dce_opnum:2,15,22; sid:1;)");
1415  if (s == NULL) {
1416  goto end;
1417  }
1418 
1419  SigGroupBuild(de_ctx);
1420  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1421 
1422  SCLogDebug("sending bind");
1423 
1424  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START,
1425  dcerpc_bind, dcerpc_bind_len);
1426  if (r != 0) {
1427  SCLogDebug("AppLayerParse for dcerpc bind failed. Returned %" PRId32, r);
1428  goto end;
1429  }
1430 
1431  dcerpc_state = f.alstate;
1432  if (dcerpc_state == NULL) {
1433  SCLogDebug("no dcerpc state: ");
1434  goto end;
1435  }
1436  p->flowflags &=~ FLOW_PKT_TOCLIENT;
1437  p->flowflags |= FLOW_PKT_TOSERVER;
1438  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1439 
1440  SCLogDebug("sending bind_ack");
1441 
1442  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT,
1443  dcerpc_bindack, dcerpc_bindack_len);
1444  if (r != 0) {
1445  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1446  goto end;
1447  }
1448  p->flowflags &=~ FLOW_PKT_TOSERVER;
1449  p->flowflags |= FLOW_PKT_TOCLIENT;
1450  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1451 
1452  SCLogDebug("sending request1");
1453 
1454  /* request1 */
1455  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER,
1456  dcerpc_request1, dcerpc_request1_len);
1457  if (r != 0) {
1458  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1459  goto end;
1460  }
1461 
1462  p->flowflags &=~ FLOW_PKT_TOCLIENT;
1463  p->flowflags |= FLOW_PKT_TOSERVER;
1464  /* do detect */
1465  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1466 
1467  if (!PacketAlertCheck(p, 1)) {
1468  printf("sig 1 didn't match, but should have: ");
1469  goto end;
1470  }
1471 
1472  SCLogDebug("sending response1");
1473 
1474  /* response1 */
1475  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT,
1476  dcerpc_response1, dcerpc_response1_len);
1477  if (r != 0) {
1478  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1479  goto end;
1480  }
1481 
1482  p->flowflags &=~ FLOW_PKT_TOSERVER;
1483  p->flowflags |= FLOW_PKT_TOCLIENT;
1484  /* do detect */
1485  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1486 
1487  if (PacketAlertCheck(p, 1)) {
1488  printf("sig 1 did match, shouldn't have on response1: ");
1489  goto end;
1490  }
1491 
1492  /* request2 */
1493  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER,
1494  dcerpc_request2, dcerpc_request2_len);
1495  if (r != 0) {
1496  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1497  goto end;
1498  }
1499 
1500  p->flowflags &=~ FLOW_PKT_TOCLIENT;
1501  p->flowflags |= FLOW_PKT_TOSERVER;
1502  /* do detect */
1503  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1504 
1505  if (!PacketAlertCheck(p, 1)) {
1506  printf("sig 1 didn't match, but should have on request2: ");
1507  goto end;
1508  }
1509 
1510  /* response2 */
1511  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT,
1512  dcerpc_response2, dcerpc_response2_len);
1513  if (r != 0) {
1514  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1515  goto end;
1516  }
1517 
1518  p->flowflags &=~ FLOW_PKT_TOSERVER;
1519  p->flowflags |= FLOW_PKT_TOCLIENT;
1520  /* do detect */
1521  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1522 
1523  if (PacketAlertCheck(p, 1)) {
1524  printf("sig 1 did match, shouldn't have on response2: ");
1525  goto end;
1526  }
1527 
1528  /* request3 */
1529  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER,
1530  dcerpc_request3, dcerpc_request3_len);
1531  if (r != 0) {
1532  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1533  goto end;
1534  }
1535 
1536  p->flowflags &=~ FLOW_PKT_TOCLIENT;
1537  p->flowflags |= FLOW_PKT_TOSERVER;
1538  /* do detect */
1539  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1540 
1541  if (!PacketAlertCheck(p, 1)) {
1542  printf("sig 1 didn't match, but should have on request3: ");
1543  goto end;
1544  }
1545 
1546  /* response3 */
1547  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT | STREAM_EOF,
1548  dcerpc_response3, dcerpc_response3_len);
1549  if (r != 0) {
1550  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1551  goto end;
1552  }
1553 
1554  p->flowflags &=~ FLOW_PKT_TOSERVER;
1555  p->flowflags |= FLOW_PKT_TOCLIENT;
1556  /* do detect */
1557  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1558 
1559  if (PacketAlertCheck(p, 1)) {
1560  printf("sig 1 did match, shouldn't have on response2: ");
1561  goto end;
1562  }
1563 
1564  result = 1;
1565 
1566  end:
1567  if (alp_tctx != NULL)
1568  AppLayerDestroyCtxThread(alp_tctx);
1569  SigGroupCleanup(de_ctx);
1570  SigCleanSignatures(de_ctx);
1571 
1572  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1573  DetectEngineCtxFree(de_ctx);
1574 
1575  StreamTcpFreeConfig(TRUE);
1576  FLOW_DESTROY(&f);
1577 
1578  UTHFreePackets(&p, 1);
1579  return result;
1580 }
1581 
1582 /**
1583  * \test Test a valid dce_opnum entry(with multiple values) with multiple
1584  * request/responses.
1585  */
1586 static int DetectDceOpnumTestParse11(void)
1587 {
1588  int result = 0;
1589  Signature *s = NULL;
1590  ThreadVars th_v;
1591  Packet *p = NULL;
1592  Flow f;
1593  TcpSession ssn;
1594  DetectEngineThreadCtx *det_ctx = NULL;
1595  DetectEngineCtx *de_ctx = NULL;
1596  DCERPCState *dcerpc_state = NULL;
1597  int r = 0;
1598 
1599  uint8_t dcerpc_request1[] = {
1600  0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
1601  0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1602  0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00,
1603  0x2c, 0xfd, 0xb5, 0x00, 0x40, 0xaa, 0x01, 0x00,
1604  0x00, 0x00, 0x00, 0x02,
1605  };
1606 
1607  uint8_t dcerpc_response1[] = {
1608  0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
1609  0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1610  0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1611  0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c,
1612  0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
1613  0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00,
1614  };
1615 
1616  uint8_t dcerpc_request2[] = {
1617  0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
1618  0xa4, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
1619  0x8c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00,
1620  0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c,
1621  0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
1622  0x29, 0x87, 0xea, 0xe9, 0x5c, 0x00, 0x5c, 0x00,
1623  0xa8, 0xb9, 0x14, 0x00, 0x2e, 0x00, 0x00, 0x00,
1624  0x00, 0x00, 0x00, 0x00, 0x2e, 0x00, 0x00, 0x00,
1625  0x53, 0x00, 0x4f, 0x00, 0x46, 0x00, 0x54, 0x00,
1626  0x57, 0x00, 0x41, 0x00, 0x52, 0x00, 0x45, 0x00,
1627  0x5c, 0x00, 0x4d, 0x00, 0x69, 0x00, 0x63, 0x00,
1628  0x72, 0x00, 0x6f, 0x00, 0x73, 0x00, 0x6f, 0x00,
1629  0x66, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x57, 0x00,
1630  0x69, 0x00, 0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00,
1631  0x77, 0x00, 0x73, 0x00, 0x5c, 0x00, 0x43, 0x00,
1632  0x75, 0x00, 0x72, 0x00, 0x72, 0x00, 0x65, 0x00,
1633  0x6e, 0x00, 0x74, 0x00, 0x56, 0x00, 0x65, 0x00,
1634  0x72, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00,
1635  0x6e, 0x00, 0x5c, 0x00, 0x52, 0x00, 0x75, 0x00,
1636  0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1637  0x03, 0x00, 0x00, 0x00,
1638  };
1639 
1640  uint8_t dcerpc_response2[] = {
1641  0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
1642  0x30, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
1643  0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1644  0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c,
1645  0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
1646  0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00,
1647  };
1648 
1649  uint8_t dcerpc_request3[] = {
1650  0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
1651  0x70, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
1652  0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x00,
1653  0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c,
1654  0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
1655  0x29, 0x87, 0xea, 0xe9, 0x0c, 0x00, 0x0c, 0x00,
1656  0x98, 0xda, 0x14, 0x00, 0x06, 0x00, 0x00, 0x00,
1657  0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,
1658  0x4f, 0x00, 0x73, 0x00, 0x61, 0x00, 0x33, 0x00,
1659  0x32, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1660  0x18, 0x00, 0x00, 0x00, 0x4e, 0x00, 0x54, 0x00,
1661  0x4f, 0x00, 0x53, 0x00, 0x41, 0x00, 0x33, 0x00,
1662  0x32, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x58, 0x00,
1663  0x45, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
1664  };
1665 
1666  uint8_t dcerpc_response3[] = {
1667  0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
1668  0x1c, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
1669  0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1670  0x00, 0x00, 0x00, 0x00,
1671  };
1672 
1673  uint32_t dcerpc_request1_len = sizeof(dcerpc_request1);
1674  uint32_t dcerpc_response1_len = sizeof(dcerpc_response1);
1675 
1676  uint32_t dcerpc_request2_len = sizeof(dcerpc_request2);
1677  uint32_t dcerpc_response2_len = sizeof(dcerpc_response2);
1678 
1679  uint32_t dcerpc_request3_len = sizeof(dcerpc_request3);
1680  uint32_t dcerpc_response3_len = sizeof(dcerpc_response3);
1681 
1682  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1683 
1684  memset(&th_v, 0, sizeof(th_v));
1685  memset(&f, 0, sizeof(f));
1686  memset(&ssn, 0, sizeof(ssn));
1687 
1688  p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1689 
1690  FLOW_INITIALIZE(&f);
1691  f.protoctx = (void *)&ssn;
1692  f.proto = IPPROTO_TCP;
1693  p->flow = &f;
1694  p->flowflags |= FLOW_PKT_TOSERVER;
1695  p->flowflags |= FLOW_PKT_ESTABLISHED;
1696  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1697  f.alproto = ALPROTO_DCERPC;
1698 
1699  StreamTcpInitConfig(TRUE);
1700 
1701  de_ctx = DetectEngineCtxInit();
1702  if (de_ctx == NULL)
1703  goto end;
1704 
1705  de_ctx->flags |= DE_QUIET;
1706 
1707  s = de_ctx->sig_list = SigInit(de_ctx,
1708  "alert tcp any any -> any any "
1709  "(msg:\"DCERPC\"; "
1710  "dce_opnum:2-22; "
1711  "sid:1;)");
1712  if (s == NULL)
1713  goto end;
1714 
1715  SigGroupBuild(de_ctx);
1716  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1717 
1718  /* request1 */
1719  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START,
1720  dcerpc_request1, dcerpc_request1_len);
1721  if (r != 0) {
1722  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1723  printf("AppLayerParse for dcerpcrequest1 failed. Returned %" PRId32, r);
1724  goto end;
1725  }
1726 
1727  dcerpc_state = f.alstate;
1728  if (dcerpc_state == NULL) {
1729  SCLogDebug("no dcerpc state: ");
1730  printf("no dcerpc state: ");
1731  goto end;
1732  }
1733 
1734  p->flowflags &=~ FLOW_PKT_TOCLIENT;
1735  p->flowflags |= FLOW_PKT_TOSERVER;
1736  /* do detect */
1737  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1738 
1739  if (!PacketAlertCheck(p, 1))
1740  goto end;
1741 
1742  /* response1 */
1743  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT,
1744  dcerpc_response1, dcerpc_response1_len);
1745  if (r != 0) {
1746  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1747  printf("AppLayerParse for dcerpcresponse1 failed. Returned %" PRId32, r);
1748  goto end;
1749  }
1750 
1751  p->flowflags &=~ FLOW_PKT_TOSERVER;
1752  p->flowflags |= FLOW_PKT_TOCLIENT;
1753  /* do detect */
1754  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1755 
1756  if (PacketAlertCheck(p, 1))
1757  goto end;
1758 
1759  /* request2 */
1760  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER,
1761  dcerpc_request2, dcerpc_request2_len);
1762  if (r != 0) {
1763  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1764  printf("AppLayerParse for dcerpcrequest2 failed. Returned %" PRId32, r);
1765  goto end;
1766  }
1767 
1768  p->flowflags &=~ FLOW_PKT_TOCLIENT;
1769  p->flowflags |= FLOW_PKT_TOSERVER;
1770  /* do detect */
1771  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1772 
1773  if (!PacketAlertCheck(p, 1))
1774  goto end;
1775 
1776  /* response2 */
1777  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT,
1778  dcerpc_response2, dcerpc_response2_len);
1779  if (r != 0) {
1780  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1781  printf("AppLayerParse for dcerpcresponse2 failed. Returned %" PRId32, r);
1782  goto end;
1783  }
1784 
1785  p->flowflags &=~ FLOW_PKT_TOSERVER;
1786  p->flowflags |= FLOW_PKT_TOCLIENT;
1787  /* do detect */
1788  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1789 
1790  if (PacketAlertCheck(p, 1))
1791  goto end;
1792 
1793  /* request3 */
1794  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER,
1795  dcerpc_request3, dcerpc_request3_len);
1796  if (r != 0) {
1797  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1798  printf("AppLayerParse for dcerpc request3 failed. Returned %" PRId32, r);
1799  goto end;
1800  }
1801 
1802  p->flowflags &=~ FLOW_PKT_TOCLIENT;
1803  p->flowflags |= FLOW_PKT_TOSERVER;
1804  /* do detect */
1805  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1806 
1807  if (!PacketAlertCheck(p, 1))
1808  goto end;
1809 
1810  /* response3 */
1811  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT | STREAM_EOF,
1812  dcerpc_response3, dcerpc_response3_len);
1813  if (r != 0) {
1814  SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1815  printf("AppLayerParse for dcerpc response3 failed. Returned %" PRId32, r);
1816  goto end;
1817  }
1818 
1819  p->flowflags &=~ FLOW_PKT_TOSERVER;
1820  p->flowflags |= FLOW_PKT_TOCLIENT;
1821  /* do detect */
1822  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
1823 
1824  if (PacketAlertCheck(p, 1))
1825  goto end;
1826 
1827  result = 1;
1828 
1829  end:
1830  if (alp_tctx != NULL)
1831  AppLayerDestroyCtxThread(alp_tctx);
1832  SigGroupCleanup(de_ctx);
1833  SigCleanSignatures(de_ctx);
1834 
1835  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
1836  DetectEngineCtxFree(de_ctx);
1837 
1838  StreamTcpFreeConfig(TRUE);
1839  FLOW_DESTROY(&f);
1840 
1841  UTHFreePackets(&p, 1);
1842  return result;
1843 }
1844 
1845 /**
1846  * \test Test a valid dce_opnum(with multiple values) with a bind, bind_ack,
1847  * and multiple request/responses with a match test after each frag parsing.
1848  */
1849 static int DetectDceOpnumTestParse12(void)
1850 {
1851  int result = 0;
1852  Signature *s = NULL;
1853  ThreadVars th_v;
1854  Packet *p = NULL;
1855  Flow f;
1856  TcpSession ssn;
1857  DetectEngineThreadCtx *det_ctx = NULL;
1858  DetectEngineCtx *de_ctx = NULL;
1859  DCERPCState *dcerpc_state = NULL;
1860  int r = 0;
1861 
1862  uint8_t dcerpc_bind[] = {
1863  0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00,
1864  0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1865  0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00,
1866  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
1867  0x40, 0xfd, 0x2c, 0x34, 0x6c, 0x3c, 0xce, 0x11,
1868  0xa8, 0x93, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d,
1869  0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
1870  0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
1871  0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
1872  };
1873 
1874  uint8_t dcerpc_bindack[] = {
1875  0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00,
1876  0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1877  0xb8, 0x10, 0xb8, 0x10, 0x7d, 0xd8, 0x00, 0x00,
1878  0x0d, 0x00, 0x5c, 0x70, 0x69, 0x70, 0x65, 0x5c,
1879  0x6c, 0x6c, 0x73, 0x72, 0x70, 0x63, 0x00, 0x00,
1880  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1881  0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
1882  0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
1883  0x02, 0x00, 0x00, 0x00,
1884  };
1885 
1886  uint8_t dcerpc_request1[] = {
1887  0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
1888  0x9a, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1889  0x82, 0x00, 0x00, 0x00, 0x00, 0x00, 0x28, 0x00, //opnum is 0x28 0x00
1890  0x00, 0x00, 0x00, 0x00, 0x07, 0x9f, 0x13, 0xd9,
1891  0x2d, 0x97, 0xf4, 0x4a, 0xac, 0xc2, 0xbc, 0x70,
1892  0xec, 0xaa, 0x9a, 0xd3, 0x01, 0x00, 0x00, 0x00,
1893  0x01, 0x00, 0x00, 0x00, 0x40, 0x80, 0x40, 0x00,
1894  0x44, 0x80, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00,
1895  0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1896  0x09, 0x00, 0x00, 0x00, 0x4d, 0x6f, 0x00, 0x4e,
1897  0x61, 0x6d, 0x65, 0x00, 0x35, 0x39, 0x31, 0x63,
1898  0x64, 0x30, 0x35, 0x38, 0x00, 0x00, 0x00, 0x00,
1899  0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1900  0x17, 0x00, 0x00, 0x00, 0xd0, 0x2e, 0x08, 0x00,
1901  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1902  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1903  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1904  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1905  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1906  0x00, 0x00
1907  };
1908 
1909  uint8_t dcerpc_response1[] = {
1910  0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
1911  0x1c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1912  0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1913  0x00, 0x00, 0x00, 0x00,
1914  };
1915 
1916  uint8_t dcerpc_request2[] = {
1917  0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
1918  0x54, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1919  0x3c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1e, 0x00,
1920  0x00, 0x00, 0x00, 0x00, 0x07, 0x9f, 0x13, 0xd9,
1921  0x2d, 0x97, 0xf4, 0x4a, 0xac, 0xc2, 0xbc, 0x70,
1922  0xec, 0xaa, 0x9a, 0xd3, 0x09, 0x00, 0x00, 0x00,
1923  0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
1924  0x4d, 0x6f, 0x00, 0x4e, 0x61, 0x6d, 0x65, 0x00,
1925  0x35, 0x39, 0x31, 0x63, 0x64, 0x30, 0x35, 0x38,
1926  0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1927  0x4e, 0x6f, 0x6e, 0x65
1928  };
1929 
1930  uint8_t dcerpc_response2[] = {
1931  0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
1932  0x8c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1933  0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1934  0xd8, 0x17, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00,
1935  0x58, 0x1d, 0x08, 0x00, 0xe8, 0x32, 0x08, 0x00,
1936  0x01, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
1937  0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
1938  0x4d, 0x6f, 0x00, 0x4e, 0x61, 0x6d, 0x65, 0x00,
1939  0x35, 0x39, 0x31, 0x63, 0x64, 0x30, 0x35, 0x38,
1940  0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00,
1941  0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00,
1942  0xd0, 0x2e, 0x08, 0x00, 0x41, 0x41, 0x41, 0x41,
1943  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1944  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1945  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1946  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1947  0x41, 0x41, 0x41, 0x41, 0x00, 0x00, 0x00, 0x00,
1948  0x00, 0x00, 0x00, 0x00,
1949  };
1950 
1951  uint32_t dcerpc_bind_len = sizeof(dcerpc_bind);
1952  uint32_t dcerpc_bindack_len = sizeof(dcerpc_bindack);
1953 
1954  uint32_t dcerpc_request1_len = sizeof(dcerpc_request1);
1955  uint32_t dcerpc_response1_len = sizeof(dcerpc_response1);
1956 
1957  uint32_t dcerpc_request2_len = sizeof(dcerpc_request2);
1958  uint32_t dcerpc_response2_len = sizeof(dcerpc_response2);
1959 
1960  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1961 
1962  memset(&th_v, 0, sizeof(th_v));
1963  memset(&f, 0, sizeof(f));
1964  memset(&ssn, 0, sizeof(ssn));
1965 
1966  p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
1967 
1968  FLOW_INITIALIZE(&f);
1969  f.protoctx = (void *)&ssn;
1970  f.proto = IPPROTO_TCP;
1971  p->flow = &f;
1972  p->flowflags |= FLOW_PKT_TOSERVER;
1973  p->flowflags |= FLOW_PKT_ESTABLISHED;
1974  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
1975  f.alproto = ALPROTO_DCERPC;
1976 
1977  StreamTcpInitConfig(TRUE);
1978 
1979  de_ctx = DetectEngineCtxInit();
1980  if (de_ctx == NULL)
1981  goto end;
1982 
1983  de_ctx->flags |= DE_QUIET;
1984 
1985  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
1986  "(msg:\"DCERPC\"; dce_opnum:30, 40; sid:1;)");
1987  if (s == NULL)
1988  goto end;
1989 
1990  SigGroupBuild(de_ctx);
1991  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
1992 
1993  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START,
1994  dcerpc_bind, dcerpc_bind_len);
1995  if (r != 0) {
1996  printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1997  goto end;
1998  }
1999  p->flowflags &=~ FLOW_PKT_TOCLIENT;
2000  p->flowflags |= FLOW_PKT_TOSERVER;
2001  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2002 
2003  dcerpc_state = f.alstate;
2004  if (dcerpc_state == NULL) {
2005  printf("no dcerpc state: ");
2006  goto end;
2007  }
2008 
2009  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_bindack,
2010  dcerpc_bindack_len);
2011  if (r != 0) {
2012  printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
2013  goto end;
2014  }
2015  p->flowflags &=~ FLOW_PKT_TOSERVER;
2016  p->flowflags |= FLOW_PKT_TOCLIENT;
2017  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2018 
2019  /* request1 */
2020  SCLogDebug("Sending request1");
2021 
2022  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request1,
2023  dcerpc_request1_len);
2024  if (r != 0) {
2025  printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
2026  goto end;
2027  }
2028 
2029  dcerpc_state = f.alstate;
2030  if (dcerpc_state == NULL) {
2031  printf("no dcerpc state: ");
2032  goto end;
2033  }
2034 
2035  if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 40) {
2036  printf("dcerpc state holding invalid opnum. Holding %d, while we are "
2037  "expecting 40: ", dcerpc_state->dcerpc.dcerpcrequest.opnum);
2038  goto end;
2039  }
2040 
2041  p->flowflags &=~ FLOW_PKT_TOCLIENT;
2042  p->flowflags |= FLOW_PKT_TOSERVER;
2043  /* do detect */
2044  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2045 
2046  if (!PacketAlertCheck(p, 1)) {
2047  printf("signature 1 didn't match, should have: ");
2048  goto end;
2049  }
2050 
2051  /* response1 */
2052  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response1,
2053  dcerpc_response1_len);
2054  if (r != 0) {
2055  printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
2056  goto end;
2057  }
2058 
2059  dcerpc_state = f.alstate;
2060  if (dcerpc_state == NULL) {
2061  printf("no dcerpc state: ");
2062  goto end;
2063  }
2064 
2065  if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 40) {
2066  printf("dcerpc state holding invalid opnum. Holding %d, while we are "
2067  "expecting 40\n", dcerpc_state->dcerpc.dcerpcrequest.opnum);
2068  goto end;
2069  }
2070 
2071  p->flowflags &=~ FLOW_PKT_TOSERVER;
2072  p->flowflags |= FLOW_PKT_TOCLIENT;
2073  /* do detect */
2074  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2075 
2076  if (PacketAlertCheck(p, 1)) {
2077  printf("sig 1 matched on response 1, but shouldn't: ");
2078  goto end;
2079  }
2080 
2081  /* request2 */
2082  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request2,
2083  dcerpc_request2_len);
2084  if (r != 0) {
2085  printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
2086  goto end;
2087  }
2088 
2089  dcerpc_state = f.alstate;
2090  if (dcerpc_state == NULL) {
2091  printf("no dcerpc state: ");
2092  goto end;
2093  }
2094 
2095  if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 30) {
2096  printf("dcerpc state holding invalid opnum. Holding %d, while we are "
2097  "expecting 30\n", dcerpc_state->dcerpc.dcerpcrequest.opnum);
2098  goto end;
2099  }
2100 
2101  p->flowflags &=~ FLOW_PKT_TOCLIENT;
2102  p->flowflags |= FLOW_PKT_TOSERVER;
2103  /* do detect */
2104  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2105 
2106  if (!PacketAlertCheck(p, 1)) {
2107  printf("sig 1 didn't match on request 2: ");
2108  goto end;
2109  }
2110 
2111  /* response2 */
2112  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT | STREAM_EOF, dcerpc_response2,
2113  dcerpc_response2_len);
2114  if (r != 0) {
2115  printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
2116  goto end;
2117  }
2118 
2119  dcerpc_state = f.alstate;
2120  if (dcerpc_state == NULL) {
2121  printf("no dcerpc state: ");
2122  goto end;
2123  }
2124 
2125  if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 30) {
2126  printf("dcerpc state holding invalid opnum. Holding %d, while we are "
2127  "expecting 30\n", dcerpc_state->dcerpc.dcerpcrequest.opnum);
2128  goto end;
2129  }
2130 
2131  p->flowflags &=~ FLOW_PKT_TOSERVER;
2132  p->flowflags |= FLOW_PKT_TOCLIENT;
2133  /* do detect */
2134  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2135 
2136  if (PacketAlertCheck(p, 1)) {
2137  printf("sig 1 matched on response2, but shouldn't: ");
2138  goto end;
2139  }
2140 
2141  result = 1;
2142 
2143 end:
2144  if (alp_tctx != NULL)
2145  AppLayerDestroyCtxThread(alp_tctx);
2146  SigGroupCleanup(de_ctx);
2147  SigCleanSignatures(de_ctx);
2148 
2149  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2150  DetectEngineCtxFree(de_ctx);
2151 
2152  StreamTcpFreeConfig(TRUE);
2153  FLOW_DESTROY(&f);
2154 
2155  UTHFreePackets(&p, 1);
2156  return result;
2157 }
2158 
2159 /**
2160  * \test Test a valid dce_opnum(with multiple values) with a bind, bind_ack,
2161  * and multiple request/responses with a match test after each frag parsing.
2162  */
2163 static int DetectDceOpnumTestParse13(void)
2164 {
2165  int result = 0;
2166  Signature *s = NULL;
2167  ThreadVars th_v;
2168  Packet *p = NULL;
2169  Flow f;
2170  TcpSession ssn;
2171  DetectEngineThreadCtx *det_ctx = NULL;
2172  DetectEngineCtx *de_ctx = NULL;
2173  DCERPCState *dcerpc_state = NULL;
2174  int r = 0;
2175 
2176  uint8_t dcerpc_request1[] = {
2177  0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
2178  0x9a, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
2179  0x82, 0x00, 0x00, 0x00, 0x00, 0x00, 0x28, 0x00,
2180  0x00, 0x00, 0x00, 0x00, 0x07, 0x9f, 0x13, 0xd9,
2181  0x2d, 0x97, 0xf4, 0x4a, 0xac, 0xc2, 0xbc, 0x70,
2182  0xec, 0xaa, 0x9a, 0xd3, 0x01, 0x00, 0x00, 0x00,
2183  0x01, 0x00, 0x00, 0x00, 0x40, 0x80, 0x40, 0x00,
2184  0x44, 0x80, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00,
2185  0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2186  0x09, 0x00, 0x00, 0x00, 0x4d, 0x6f, 0x00, 0x4e,
2187  0x61, 0x6d, 0x65, 0x00, 0x35, 0x39, 0x31, 0x63,
2188  0x64, 0x30, 0x35, 0x38, 0x00, 0x00, 0x00, 0x00,
2189  0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2190  0x17, 0x00, 0x00, 0x00, 0xd0, 0x2e, 0x08, 0x00,
2191  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2192  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2193  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2194  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2195  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2196  0x00, 0x00
2197  };
2198 
2199  uint8_t dcerpc_response1[] = {
2200  0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
2201  0x1c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
2202  0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2203  0x00, 0x00, 0x00, 0x00,
2204  };
2205 
2206  uint8_t dcerpc_request2[] = {
2207  0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
2208  0x54, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
2209  0x3c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1e, 0x00,
2210  0x00, 0x00, 0x00, 0x00, 0x07, 0x9f, 0x13, 0xd9,
2211  0x2d, 0x97, 0xf4, 0x4a, 0xac, 0xc2, 0xbc, 0x70,
2212  0xec, 0xaa, 0x9a, 0xd3, 0x09, 0x00, 0x00, 0x00,
2213  0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
2214  0x4d, 0x6f, 0x00, 0x4e, 0x61, 0x6d, 0x65, 0x00,
2215  0x35, 0x39, 0x31, 0x63, 0x64, 0x30, 0x35, 0x38,
2216  0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
2217  0x4e, 0x6f, 0x6e, 0x65
2218  };
2219 
2220  uint8_t dcerpc_response2[] = {
2221  0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
2222  0x8c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
2223  0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2224  0xd8, 0x17, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00,
2225  0x58, 0x1d, 0x08, 0x00, 0xe8, 0x32, 0x08, 0x00,
2226  0x01, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
2227  0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
2228  0x4d, 0x6f, 0x00, 0x4e, 0x61, 0x6d, 0x65, 0x00,
2229  0x35, 0x39, 0x31, 0x63, 0x64, 0x30, 0x35, 0x38,
2230  0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00,
2231  0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00,
2232  0xd0, 0x2e, 0x08, 0x00, 0x41, 0x41, 0x41, 0x41,
2233  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2234  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2235  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2236  0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2237  0x41, 0x41, 0x41, 0x41, 0x00, 0x00, 0x00, 0x00,
2238  0x00, 0x00, 0x00, 0x00,
2239  };
2240 
2241  uint32_t dcerpc_request1_len = sizeof(dcerpc_request1);
2242  uint32_t dcerpc_response1_len = sizeof(dcerpc_response1);
2243 
2244  uint32_t dcerpc_request2_len = sizeof(dcerpc_request2);
2245  uint32_t dcerpc_response2_len = sizeof(dcerpc_response2);
2246 
2247  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
2248 
2249  memset(&th_v, 0, sizeof(th_v));
2250  memset(&f, 0, sizeof(f));
2251  memset(&ssn, 0, sizeof(ssn));
2252 
2253  p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
2254 
2255  FLOW_INITIALIZE(&f);
2256  f.protoctx = (void *)&ssn;
2257  f.proto = IPPROTO_TCP;
2258  p->flow = &f;
2259  p->flowflags |= FLOW_PKT_TOSERVER;
2260  p->flowflags |= FLOW_PKT_ESTABLISHED;
2261  p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
2262  f.alproto = ALPROTO_DCERPC;
2263 
2264  StreamTcpInitConfig(TRUE);
2265 
2266  de_ctx = DetectEngineCtxInit();
2267  if (de_ctx == NULL)
2268  goto end;
2269 
2270  de_ctx->flags |= DE_QUIET;
2271 
2272  s = de_ctx->sig_list = SigInit(de_ctx,
2273  "alert tcp any any -> any any "
2274  "(msg:\"DCERPC\"; "
2275  "dce_opnum:30, 40; "
2276  "sid:1;)");
2277  if (s == NULL)
2278  goto end;
2279 
2280  SigGroupBuild(de_ctx);
2281  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
2282 
2283  /* request1 */
2284  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request1,
2285  dcerpc_request1_len);
2286  if (r != 0) {
2287  printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
2288  goto end;
2289  }
2290 
2291  dcerpc_state = f.alstate;
2292  if (dcerpc_state == NULL) {
2293  printf("no dcerpc state: ");
2294  goto end;
2295  }
2296 
2297  if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 40) {
2298  printf("dcerpc state holding invalid opnum after request1. Holding %d, while we are "
2299  "expecting 40\n", dcerpc_state->dcerpc.dcerpcrequest.opnum);
2300  goto end;
2301  }
2302 
2303  p->flowflags &=~ FLOW_PKT_TOCLIENT;
2304  p->flowflags |= FLOW_PKT_TOSERVER;
2305  /* do detect */
2306  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2307 
2308  if (!PacketAlertCheck(p, 1))
2309  goto end;
2310 
2311  /* response1 */
2312  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response1,
2313  dcerpc_response1_len);
2314  if (r != 0) {
2315  printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
2316  goto end;
2317  }
2318 
2319  dcerpc_state = f.alstate;
2320  if (dcerpc_state == NULL) {
2321  printf("no dcerpc state: ");
2322  goto end;
2323  }
2324 
2325  if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 40) {
2326  printf("dcerpc state holding invalid opnum after response1. Holding %d, while we are "
2327  "expecting 40\n", dcerpc_state->dcerpc.dcerpcrequest.opnum);
2328  goto end;
2329  }
2330 
2331  p->flowflags &=~ FLOW_PKT_TOSERVER;
2332  p->flowflags |= FLOW_PKT_TOCLIENT;
2333  /* do detect */
2334  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2335 
2336  if (PacketAlertCheck(p, 1))
2337  goto end;
2338 
2339  /* request2 */
2340  printf("Sending Request2\n");
2341  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request2,
2342  dcerpc_request2_len);
2343  if (r != 0) {
2344  printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
2345  goto end;
2346  }
2347 
2348  dcerpc_state = f.alstate;
2349  if (dcerpc_state == NULL) {
2350  printf("no dcerpc state: ");
2351  goto end;
2352  }
2353 
2354  if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 30) {
2355  printf("dcerpc state holding invalid opnum after request2. Holding %d, while we are "
2356  "expecting 30\n", dcerpc_state->dcerpc.dcerpcrequest.opnum);
2357  goto end;
2358  }
2359 
2360  p->flowflags &=~ FLOW_PKT_TOCLIENT;
2361  p->flowflags |= FLOW_PKT_TOSERVER;
2362  /* do detect */
2363  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2364 
2365  if (!PacketAlertCheck(p, 1))
2366  goto end;
2367 
2368  /* response2 */
2369  r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT | STREAM_EOF, dcerpc_response2,
2370  dcerpc_response2_len);
2371  if (r != 0) {
2372  printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r);
2373  goto end;
2374  }
2375 
2376  dcerpc_state = f.alstate;
2377  if (dcerpc_state == NULL) {
2378  printf("no dcerpc state: ");
2379  goto end;
2380  }
2381 
2382  if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 30) {
2383  printf("dcerpc state holding invalid opnum after response2. Holding %d, while we are "
2384  "expecting 30\n", dcerpc_state->dcerpc.dcerpcrequest.opnum);
2385  goto end;
2386  }
2387 
2388  p->flowflags &=~ FLOW_PKT_TOSERVER;
2389  p->flowflags |= FLOW_PKT_TOCLIENT;
2390  /* do detect */
2391  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
2392 
2393  if (PacketAlertCheck(p, 1))
2394  goto end;
2395 
2396  result = 1;
2397 
2398  end:
2399  if (alp_tctx != NULL)
2400  AppLayerDestroyCtxThread(alp_tctx);
2401  SigGroupCleanup(de_ctx);
2402  SigCleanSignatures(de_ctx);
2403 
2404  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
2405  DetectEngineCtxFree(de_ctx);
2406 
2407  StreamTcpFreeConfig(TRUE);
2408  FLOW_DESTROY(&f);
2409 
2410  UTHFreePackets(&p, 1);
2411  return result;
2412 }
2413 #endif
2414 
2415 static void DetectDceOpnumRegisterTests(void)
2416 {
2417  UtRegisterTest("DetectDceOpnumTestParse01", DetectDceOpnumTestParse01);
2418  UtRegisterTest("DetectDceOpnumTestParse02", DetectDceOpnumTestParse02);
2419  /* Disabled because of bug_753. Would be enabled, once we rewrite
2420  * dce parser */
2421 #if 0
2422  UtRegisterTest("DetectDceOpnumTestParse10", DetectDceOpnumTestParse10, 1);
2423  UtRegisterTest("DetectDceOpnumTestParse11", DetectDceOpnumTestParse11, 1);
2424  UtRegisterTest("DetectDceOpnumTestParse12", DetectDceOpnumTestParse12, 1);
2425  UtRegisterTest("DetectDceOpnumTestParse13", DetectDceOpnumTestParse13, 1);
2426 #endif
2427 }
2428 #endif /* UNITTESTS */
app-layer-dcerpc.h
detect-engine.h
detect-dce-iface.h
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1109
ALPROTO_DCERPC
@ ALPROTO_DCERPC
Definition: app-layer-protos.h:38
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1201
flow-util.h
SigTableElmt_::name
const char * name
Definition: detect.h:1211
stream-tcp.h
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
Signature_::alproto
AppProto alproto
Definition: detect.h:532
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
Flow_::proto
uint8_t proto
Definition: flow.h:365
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:138
Packet_::flags
uint32_t flags
Definition: decode.h:449
Flow_
Flow data structure.
Definition: flow.h:347
SigInit
Signature * SigInit(DetectEngineCtx *, const char *)
Parses a signature and adds it to the Detection Engine Context.
Definition: detect-parse.c:2056
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:767
SC_ERR_INVALID_SIGNATURE
@ SC_ERR_INVALID_SIGNATURE
Definition: util-error.h:69
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2093
SigTableElmt_::AppLayerTxMatch
int(* AppLayerTxMatch)(DetectEngineThreadCtx *, Flow *, uint8_t flags, void *alstate, void *txv, const Signature *, const SigMatchCtx *)
Definition: detect.h:1182
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:278
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:219
rust.h
DE_QUIET
#define DE_QUIET
Definition: detect.h:294
stream-tcp-reassemble.h
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:337
SignatureInitData_::init_flags
uint32_t init_flags
Definition: detect.h:493
m
SCMutex m
Definition: flow-hash.h:6
SigCleanSignatures
void SigCleanSignatures(DetectEngineCtx *de_ctx)
Definition: detect-engine-build.c:39
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:445
Flow_::protoctx
void * protoctx
Definition: flow.h:441
PARSE_REGEX
#define PARSE_REGEX
Definition: detect-dce-opnum.c:53
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1196
util-unittest.h
util-unittest-helper.h
FLOWLOCK_UNLOCK
#define FLOWLOCK_UNLOCK(fb)
Definition: flow.h:264
STREAM_START
#define STREAM_START
Definition: stream.h:29
FLOW_INITIALIZE
#define FLOW_INITIALIZE(f)
Definition: flow-util.h:39
util-debug.h
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1010
STREAM_TOSERVER
#define STREAM_TOSERVER
Definition: stream.h:31
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:19
DetectSetupParseRegexes
void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *detect_parse)
Definition: detect-parse.c:2493
FLOWLOCK_WRLOCK
#define FLOWLOCK_WRLOCK(fb)
Definition: flow.h:261
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
detect-engine-mpm.h
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
TRUE
#define TRUE
Definition: suricata-common.h:33
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:323
SigMatchSignatures
void SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:1688
SigGroupCleanup
int SigGroupCleanup(DetectEngineCtx *de_ctx)
Definition: detect-engine-build.c:1953
SCReturn
#define SCReturn
Definition: util-debug.h:302
Packet_
Definition: decode.h:414
StreamTcpFreeConfig
void StreamTcpFreeConfig(char quiet)
Definition: stream-tcp.c:668
SIG_FLAG_INIT_DCERPC
#define SIG_FLAG_INIT_DCERPC
Definition: detect.h:266
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:597
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
queue.h
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:220
SigMatchAlloc
SigMatch * SigMatchAlloc(void)
Definition: detect-parse.c:235
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:1888
SigMatch_::type
uint8_t type
Definition: detect.h:321
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:252
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:315
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2361
Packet_::flow
struct Flow_ * flow
Definition: decode.h:451
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
Definition: detect-engine.c:2797
DetectBufferTypeRegister
int DetectBufferTypeRegister(const char *name)
Definition: detect-engine.c:836
flags
uint8_t flags
Definition: decode-gre.h:0
SigTableElmt_::alias
const char * alias
Definition: detect.h:1212
DetectDceOpnumRegister
void DetectDceOpnumRegister(void)
Registers the keyword handlers for the "dce_opnum" keyword.
Definition: detect-dce-opnum.c:70
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1203
suricata-common.h
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
Definition: detect-engine.c:3005
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
DetectParseRegex_
Definition: detect-parse.h:42
STREAM_TOCLIENT
#define STREAM_TOCLIENT
Definition: stream.h:32
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
DetectEngineCtx_::sig_list
Signature * sig_list
Definition: detect.h:773
DETECT_DCE_OPNUM
@ DETECT_DCE_OPNUM
Definition: detect-engine-register.h:185
Flow_::alstate
void * alstate
Definition: flow.h:476
AppLayerDestroyCtxThread
void AppLayerDestroyCtxThread(AppLayerThreadCtx *app_tctx)
Destroys the context created by AppLayeGetCtxThread().
Definition: app-layer.c:870
detect-parse.h
Signature_
Signature container.
Definition: detect.h:528
SigMatch_
a single match condition for a signature
Definition: detect.h:320
StreamTcpInitConfig
void StreamTcpInitConfig(char)
To initialize the stream global configuration data.
Definition: stream-tcp.c:365
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:221
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2048
STREAM_EOF
#define STREAM_EOF
Definition: stream.h:30
ALPROTO_SMB
@ ALPROTO_SMB
Definition: app-layer-protos.h:37
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:768
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:87
TcpSession_
Definition: stream-tcp-private.h:260
flow.h
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:450
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
flow-var.h
SigMatchAppendSMToList
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:349
FLOW_DESTROY
#define FLOW_DESTROY(f)
Definition: flow-util.h:130
detect-dce-opnum.h
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:1107
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1203
app-layer.h
SC_ERR_CONFLICTING_RULE_KEYWORDS
@ SC_ERR_CONFLICTING_RULE_KEYWORDS
Definition: util-error.h:171
UTHFreePackets
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:468