52 #define PARSE_REGEX "^\\s*([0-9]{1,5}(\\s*-\\s*[0-9]{1,5}\\s*)?)(,\\s*[0-9]{1,5}(\\s*-\\s*[0-9]{1,5})?\\s*)*$"
57 Flow *f, uint8_t
flags,
void *state,
void *txv,
62 static void DetectDceOpnumRegisterTests(
void);
64 static int g_dce_generic_list_id = 0;
99 Flow *f, uint8_t
flags,
void *state,
void *txv,
105 return rs_dcerpc_opnum_match(txv, (
void *)
m);
108 if (rs_smb_tx_match_dce_opnum(txv, (
void *)
m) != 1)
130 "signature, option needs a value");
139 void *dod = rs_dcerpc_opnum_parse(arg);
148 DetectDceOpnumFree(
de_ctx, dod);
153 sm->
ctx = (
void *)dod;
164 rs_dcerpc_opnum_free(ptr);
181 static int DetectDceOpnumTestParse10(
void)
191 DCERPCState *dcerpc_state = NULL;
194 uint8_t dcerpc_bind[] = {
195 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00,
196 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
197 0xb8, 0x10, 0xb8, 0x10, 0x00, 0x00, 0x00, 0x00,
198 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
199 0x01, 0xd0, 0x8c, 0x33, 0x44, 0x22, 0xf1, 0x31,
200 0xaa, 0xaa, 0x90, 0x00, 0x38, 0x00, 0x10, 0x03,
201 0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
202 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
203 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
206 uint8_t dcerpc_bindack[] = {
207 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00,
208 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
209 0xb8, 0x10, 0xb8, 0x10, 0x65, 0x8e, 0x00, 0x00,
210 0x0d, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c,
211 0x77, 0x69, 0x6e, 0x72, 0x65, 0x67, 0x00, 0x6d,
212 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
213 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
214 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
215 0x02, 0x00, 0x00, 0x00,
218 uint8_t dcerpc_request1[] = {
219 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
220 0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
221 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00,
222 0x2c, 0xfd, 0xb5, 0x00, 0x40, 0xaa, 0x01, 0x00,
223 0x00, 0x00, 0x00, 0x02,
226 uint8_t dcerpc_response1[] = {
227 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
228 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
229 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
230 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c,
231 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
232 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00,
235 uint8_t dcerpc_request2[] = {
236 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
237 0xa4, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
238 0x8c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00,
239 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c,
240 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
241 0x29, 0x87, 0xea, 0xe9, 0x5c, 0x00, 0x5c, 0x00,
242 0xa8, 0xb9, 0x14, 0x00, 0x2e, 0x00, 0x00, 0x00,
243 0x00, 0x00, 0x00, 0x00, 0x2e, 0x00, 0x00, 0x00,
244 0x53, 0x00, 0x4f, 0x00, 0x46, 0x00, 0x54, 0x00,
245 0x57, 0x00, 0x41, 0x00, 0x52, 0x00, 0x45, 0x00,
246 0x5c, 0x00, 0x4d, 0x00, 0x69, 0x00, 0x63, 0x00,
247 0x72, 0x00, 0x6f, 0x00, 0x73, 0x00, 0x6f, 0x00,
248 0x66, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x57, 0x00,
249 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00,
250 0x77, 0x00, 0x73, 0x00, 0x5c, 0x00, 0x43, 0x00,
251 0x75, 0x00, 0x72, 0x00, 0x72, 0x00, 0x65, 0x00,
252 0x6e, 0x00, 0x74, 0x00, 0x56, 0x00, 0x65, 0x00,
253 0x72, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00,
254 0x6e, 0x00, 0x5c, 0x00, 0x52, 0x00, 0x75, 0x00,
255 0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
256 0x03, 0x00, 0x00, 0x00,
259 uint8_t dcerpc_response2[] = {
260 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
261 0x30, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
262 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
263 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c,
264 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
265 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00,
268 uint8_t dcerpc_request3[] = {
269 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
270 0x70, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
271 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x00,
272 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c,
273 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
274 0x29, 0x87, 0xea, 0xe9, 0x0c, 0x00, 0x0c, 0x00,
275 0x98, 0xda, 0x14, 0x00, 0x06, 0x00, 0x00, 0x00,
276 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,
277 0x4f, 0x00, 0x73, 0x00, 0x61, 0x00, 0x33, 0x00,
278 0x32, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
279 0x18, 0x00, 0x00, 0x00, 0x4e, 0x00, 0x54, 0x00,
280 0x4f, 0x00, 0x53, 0x00, 0x41, 0x00, 0x33, 0x00,
281 0x32, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x58, 0x00,
282 0x45, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
285 uint8_t dcerpc_response3[] = {
286 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
287 0x1c, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
288 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
289 0x00, 0x00, 0x00, 0x00,
292 uint32_t dcerpc_bind_len =
sizeof(dcerpc_bind);
293 uint32_t dcerpc_bindack_len =
sizeof(dcerpc_bindack);
295 uint32_t dcerpc_request1_len =
sizeof(dcerpc_request1);
296 uint32_t dcerpc_response1_len =
sizeof(dcerpc_response1);
298 uint32_t dcerpc_request2_len =
sizeof(dcerpc_request2);
299 uint32_t dcerpc_response2_len =
sizeof(dcerpc_response2);
301 uint32_t dcerpc_request3_len =
sizeof(dcerpc_request3);
302 uint32_t dcerpc_response3_len =
sizeof(dcerpc_response3);
306 memset(&th_v, 0,
sizeof(th_v));
307 memset(&f, 0,
sizeof(f));
308 memset(&ssn, 0,
sizeof(ssn));
314 f.
proto = IPPROTO_TCP;
331 "(msg:\"DCERPC\"; dce_opnum:2,15,22; sid:1;)");
342 dcerpc_bind, dcerpc_bind_len);
344 SCLogDebug(
"AppLayerParse for dcerpc bind failed. Returned %" PRId32, r);
349 if (dcerpc_state == NULL) {
360 dcerpc_bindack, dcerpc_bindack_len);
362 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
373 dcerpc_request1, dcerpc_request1_len);
375 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
385 printf(
"sig 1 didn't match, but should have: ");
393 dcerpc_response1, dcerpc_response1_len);
395 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
405 printf(
"sig 1 did match, shouldn't have on response1: ");
411 dcerpc_request2, dcerpc_request2_len);
413 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
423 printf(
"sig 1 didn't match, but should have on request2: ");
429 dcerpc_response2, dcerpc_response2_len);
431 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
441 printf(
"sig 1 did match, shouldn't have on response2: ");
447 dcerpc_request3, dcerpc_request3_len);
449 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
459 printf(
"sig 1 didn't match, but should have on request3: ");
465 dcerpc_response3, dcerpc_response3_len);
467 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
477 printf(
"sig 1 did match, shouldn't have on response2: ");
503 static int DetectDceOpnumTestParse11(
void)
513 DCERPCState *dcerpc_state = NULL;
516 uint8_t dcerpc_request1[] = {
517 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
518 0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
519 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00,
520 0x2c, 0xfd, 0xb5, 0x00, 0x40, 0xaa, 0x01, 0x00,
521 0x00, 0x00, 0x00, 0x02,
524 uint8_t dcerpc_response1[] = {
525 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
526 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
527 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
528 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c,
529 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
530 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00,
533 uint8_t dcerpc_request2[] = {
534 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
535 0xa4, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
536 0x8c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00,
537 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c,
538 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
539 0x29, 0x87, 0xea, 0xe9, 0x5c, 0x00, 0x5c, 0x00,
540 0xa8, 0xb9, 0x14, 0x00, 0x2e, 0x00, 0x00, 0x00,
541 0x00, 0x00, 0x00, 0x00, 0x2e, 0x00, 0x00, 0x00,
542 0x53, 0x00, 0x4f, 0x00, 0x46, 0x00, 0x54, 0x00,
543 0x57, 0x00, 0x41, 0x00, 0x52, 0x00, 0x45, 0x00,
544 0x5c, 0x00, 0x4d, 0x00, 0x69, 0x00, 0x63, 0x00,
545 0x72, 0x00, 0x6f, 0x00, 0x73, 0x00, 0x6f, 0x00,
546 0x66, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x57, 0x00,
547 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00,
548 0x77, 0x00, 0x73, 0x00, 0x5c, 0x00, 0x43, 0x00,
549 0x75, 0x00, 0x72, 0x00, 0x72, 0x00, 0x65, 0x00,
550 0x6e, 0x00, 0x74, 0x00, 0x56, 0x00, 0x65, 0x00,
551 0x72, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00,
552 0x6e, 0x00, 0x5c, 0x00, 0x52, 0x00, 0x75, 0x00,
553 0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
554 0x03, 0x00, 0x00, 0x00,
557 uint8_t dcerpc_response2[] = {
558 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
559 0x30, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
560 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
561 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c,
562 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
563 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00,
566 uint8_t dcerpc_request3[] = {
567 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
568 0x70, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
569 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x00,
570 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c,
571 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c,
572 0x29, 0x87, 0xea, 0xe9, 0x0c, 0x00, 0x0c, 0x00,
573 0x98, 0xda, 0x14, 0x00, 0x06, 0x00, 0x00, 0x00,
574 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,
575 0x4f, 0x00, 0x73, 0x00, 0x61, 0x00, 0x33, 0x00,
576 0x32, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
577 0x18, 0x00, 0x00, 0x00, 0x4e, 0x00, 0x54, 0x00,
578 0x4f, 0x00, 0x53, 0x00, 0x41, 0x00, 0x33, 0x00,
579 0x32, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x58, 0x00,
580 0x45, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
583 uint8_t dcerpc_response3[] = {
584 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
585 0x1c, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
586 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
587 0x00, 0x00, 0x00, 0x00,
590 uint32_t dcerpc_request1_len =
sizeof(dcerpc_request1);
591 uint32_t dcerpc_response1_len =
sizeof(dcerpc_response1);
593 uint32_t dcerpc_request2_len =
sizeof(dcerpc_request2);
594 uint32_t dcerpc_response2_len =
sizeof(dcerpc_response2);
596 uint32_t dcerpc_request3_len =
sizeof(dcerpc_request3);
597 uint32_t dcerpc_response3_len =
sizeof(dcerpc_response3);
601 memset(&th_v, 0,
sizeof(th_v));
602 memset(&f, 0,
sizeof(f));
603 memset(&ssn, 0,
sizeof(ssn));
609 f.
proto = IPPROTO_TCP;
625 "alert tcp any any -> any any "
637 dcerpc_request1, dcerpc_request1_len);
639 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
640 printf(
"AppLayerParse for dcerpcrequest1 failed. Returned %" PRId32, r);
645 if (dcerpc_state == NULL) {
647 printf(
"no dcerpc state: ");
661 dcerpc_response1, dcerpc_response1_len);
663 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
664 printf(
"AppLayerParse for dcerpcresponse1 failed. Returned %" PRId32, r);
678 dcerpc_request2, dcerpc_request2_len);
680 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
681 printf(
"AppLayerParse for dcerpcrequest2 failed. Returned %" PRId32, r);
695 dcerpc_response2, dcerpc_response2_len);
697 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
698 printf(
"AppLayerParse for dcerpcresponse2 failed. Returned %" PRId32, r);
712 dcerpc_request3, dcerpc_request3_len);
714 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
715 printf(
"AppLayerParse for dcerpc request3 failed. Returned %" PRId32, r);
729 dcerpc_response3, dcerpc_response3_len);
731 SCLogDebug(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
732 printf(
"AppLayerParse for dcerpc response3 failed. Returned %" PRId32, r);
766 static int DetectDceOpnumTestParse12(
void)
776 DCERPCState *dcerpc_state = NULL;
779 uint8_t dcerpc_bind[] = {
780 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00,
781 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
782 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00,
783 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
784 0x40, 0xfd, 0x2c, 0x34, 0x6c, 0x3c, 0xce, 0x11,
785 0xa8, 0x93, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d,
786 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
787 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
788 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
791 uint8_t dcerpc_bindack[] = {
792 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00,
793 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
794 0xb8, 0x10, 0xb8, 0x10, 0x7d, 0xd8, 0x00, 0x00,
795 0x0d, 0x00, 0x5c, 0x70, 0x69, 0x70, 0x65, 0x5c,
796 0x6c, 0x6c, 0x73, 0x72, 0x70, 0x63, 0x00, 0x00,
797 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
798 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
799 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
800 0x02, 0x00, 0x00, 0x00,
803 uint8_t dcerpc_request1[] = {
804 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
805 0x9a, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
806 0x82, 0x00, 0x00, 0x00, 0x00, 0x00, 0x28, 0x00,
807 0x00, 0x00, 0x00, 0x00, 0x07, 0x9f, 0x13, 0xd9,
808 0x2d, 0x97, 0xf4, 0x4a, 0xac, 0xc2, 0xbc, 0x70,
809 0xec, 0xaa, 0x9a, 0xd3, 0x01, 0x00, 0x00, 0x00,
810 0x01, 0x00, 0x00, 0x00, 0x40, 0x80, 0x40, 0x00,
811 0x44, 0x80, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00,
812 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
813 0x09, 0x00, 0x00, 0x00, 0x4d, 0x6f, 0x00, 0x4e,
814 0x61, 0x6d, 0x65, 0x00, 0x35, 0x39, 0x31, 0x63,
815 0x64, 0x30, 0x35, 0x38, 0x00, 0x00, 0x00, 0x00,
816 0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
817 0x17, 0x00, 0x00, 0x00, 0xd0, 0x2e, 0x08, 0x00,
818 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
819 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
820 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
821 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
822 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
826 uint8_t dcerpc_response1[] = {
827 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
828 0x1c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
829 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
830 0x00, 0x00, 0x00, 0x00,
833 uint8_t dcerpc_request2[] = {
834 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
835 0x54, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
836 0x3c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1e, 0x00,
837 0x00, 0x00, 0x00, 0x00, 0x07, 0x9f, 0x13, 0xd9,
838 0x2d, 0x97, 0xf4, 0x4a, 0xac, 0xc2, 0xbc, 0x70,
839 0xec, 0xaa, 0x9a, 0xd3, 0x09, 0x00, 0x00, 0x00,
840 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
841 0x4d, 0x6f, 0x00, 0x4e, 0x61, 0x6d, 0x65, 0x00,
842 0x35, 0x39, 0x31, 0x63, 0x64, 0x30, 0x35, 0x38,
843 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
844 0x4e, 0x6f, 0x6e, 0x65
847 uint8_t dcerpc_response2[] = {
848 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
849 0x8c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
850 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
851 0xd8, 0x17, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00,
852 0x58, 0x1d, 0x08, 0x00, 0xe8, 0x32, 0x08, 0x00,
853 0x01, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
854 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
855 0x4d, 0x6f, 0x00, 0x4e, 0x61, 0x6d, 0x65, 0x00,
856 0x35, 0x39, 0x31, 0x63, 0x64, 0x30, 0x35, 0x38,
857 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00,
858 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00,
859 0xd0, 0x2e, 0x08, 0x00, 0x41, 0x41, 0x41, 0x41,
860 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
861 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
862 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
863 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
864 0x41, 0x41, 0x41, 0x41, 0x00, 0x00, 0x00, 0x00,
865 0x00, 0x00, 0x00, 0x00,
868 uint32_t dcerpc_bind_len =
sizeof(dcerpc_bind);
869 uint32_t dcerpc_bindack_len =
sizeof(dcerpc_bindack);
871 uint32_t dcerpc_request1_len =
sizeof(dcerpc_request1);
872 uint32_t dcerpc_response1_len =
sizeof(dcerpc_response1);
874 uint32_t dcerpc_request2_len =
sizeof(dcerpc_request2);
875 uint32_t dcerpc_response2_len =
sizeof(dcerpc_response2);
879 memset(&th_v, 0,
sizeof(th_v));
880 memset(&f, 0,
sizeof(f));
881 memset(&ssn, 0,
sizeof(ssn));
887 f.
proto = IPPROTO_TCP;
903 "(msg:\"DCERPC\"; dce_opnum:30, 40; sid:1;)");
911 dcerpc_bind, dcerpc_bind_len);
913 printf(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
921 if (dcerpc_state == NULL) {
922 printf(
"no dcerpc state: ");
929 printf(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
940 dcerpc_request1_len);
942 printf(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
947 if (dcerpc_state == NULL) {
948 printf(
"no dcerpc state: ");
952 if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 40) {
953 printf(
"dcerpc state holding invalid opnum. Holding %d, while we are "
954 "expecting 40: ", dcerpc_state->dcerpc.dcerpcrequest.opnum);
964 printf(
"signature 1 didn't match, should have: ");
970 dcerpc_response1_len);
972 printf(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
977 if (dcerpc_state == NULL) {
978 printf(
"no dcerpc state: ");
982 if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 40) {
983 printf(
"dcerpc state holding invalid opnum. Holding %d, while we are "
984 "expecting 40\n", dcerpc_state->dcerpc.dcerpcrequest.opnum);
994 printf(
"sig 1 matched on response 1, but shouldn't: ");
1000 dcerpc_request2_len);
1002 printf(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1007 if (dcerpc_state == NULL) {
1008 printf(
"no dcerpc state: ");
1012 if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 30) {
1013 printf(
"dcerpc state holding invalid opnum. Holding %d, while we are "
1014 "expecting 30\n", dcerpc_state->dcerpc.dcerpcrequest.opnum);
1024 printf(
"sig 1 didn't match on request 2: ");
1030 dcerpc_response2_len);
1032 printf(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1037 if (dcerpc_state == NULL) {
1038 printf(
"no dcerpc state: ");
1042 if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 30) {
1043 printf(
"dcerpc state holding invalid opnum. Holding %d, while we are "
1044 "expecting 30\n", dcerpc_state->dcerpc.dcerpcrequest.opnum);
1054 printf(
"sig 1 matched on response2, but shouldn't: ");
1080 static int DetectDceOpnumTestParse13(
void)
1090 DCERPCState *dcerpc_state = NULL;
1093 uint8_t dcerpc_request1[] = {
1094 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
1095 0x9a, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1096 0x82, 0x00, 0x00, 0x00, 0x00, 0x00, 0x28, 0x00,
1097 0x00, 0x00, 0x00, 0x00, 0x07, 0x9f, 0x13, 0xd9,
1098 0x2d, 0x97, 0xf4, 0x4a, 0xac, 0xc2, 0xbc, 0x70,
1099 0xec, 0xaa, 0x9a, 0xd3, 0x01, 0x00, 0x00, 0x00,
1100 0x01, 0x00, 0x00, 0x00, 0x40, 0x80, 0x40, 0x00,
1101 0x44, 0x80, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00,
1102 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1103 0x09, 0x00, 0x00, 0x00, 0x4d, 0x6f, 0x00, 0x4e,
1104 0x61, 0x6d, 0x65, 0x00, 0x35, 0x39, 0x31, 0x63,
1105 0x64, 0x30, 0x35, 0x38, 0x00, 0x00, 0x00, 0x00,
1106 0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1107 0x17, 0x00, 0x00, 0x00, 0xd0, 0x2e, 0x08, 0x00,
1108 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1109 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1110 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1111 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1112 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1116 uint8_t dcerpc_response1[] = {
1117 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
1118 0x1c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1119 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1120 0x00, 0x00, 0x00, 0x00,
1123 uint8_t dcerpc_request2[] = {
1124 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
1125 0x54, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1126 0x3c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1e, 0x00,
1127 0x00, 0x00, 0x00, 0x00, 0x07, 0x9f, 0x13, 0xd9,
1128 0x2d, 0x97, 0xf4, 0x4a, 0xac, 0xc2, 0xbc, 0x70,
1129 0xec, 0xaa, 0x9a, 0xd3, 0x09, 0x00, 0x00, 0x00,
1130 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
1131 0x4d, 0x6f, 0x00, 0x4e, 0x61, 0x6d, 0x65, 0x00,
1132 0x35, 0x39, 0x31, 0x63, 0x64, 0x30, 0x35, 0x38,
1133 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1134 0x4e, 0x6f, 0x6e, 0x65
1137 uint8_t dcerpc_response2[] = {
1138 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00,
1139 0x8c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
1140 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1141 0xd8, 0x17, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00,
1142 0x58, 0x1d, 0x08, 0x00, 0xe8, 0x32, 0x08, 0x00,
1143 0x01, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
1144 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
1145 0x4d, 0x6f, 0x00, 0x4e, 0x61, 0x6d, 0x65, 0x00,
1146 0x35, 0x39, 0x31, 0x63, 0x64, 0x30, 0x35, 0x38,
1147 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00,
1148 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00,
1149 0xd0, 0x2e, 0x08, 0x00, 0x41, 0x41, 0x41, 0x41,
1150 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1151 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1152 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1153 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
1154 0x41, 0x41, 0x41, 0x41, 0x00, 0x00, 0x00, 0x00,
1155 0x00, 0x00, 0x00, 0x00,
1158 uint32_t dcerpc_request1_len =
sizeof(dcerpc_request1);
1159 uint32_t dcerpc_response1_len =
sizeof(dcerpc_response1);
1161 uint32_t dcerpc_request2_len =
sizeof(dcerpc_request2);
1162 uint32_t dcerpc_response2_len =
sizeof(dcerpc_response2);
1166 memset(&th_v, 0,
sizeof(th_v));
1167 memset(&f, 0,
sizeof(f));
1168 memset(&ssn, 0,
sizeof(ssn));
1174 f.
proto = IPPROTO_TCP;
1190 "alert tcp any any -> any any "
1192 "dce_opnum:30, 40; "
1202 dcerpc_request1_len);
1204 printf(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1209 if (dcerpc_state == NULL) {
1210 printf(
"no dcerpc state: ");
1214 if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 40) {
1215 printf(
"dcerpc state holding invalid opnum after request1. Holding %d, while we are "
1216 "expecting 40\n", dcerpc_state->dcerpc.dcerpcrequest.opnum);
1230 dcerpc_response1_len);
1232 printf(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1237 if (dcerpc_state == NULL) {
1238 printf(
"no dcerpc state: ");
1242 if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 40) {
1243 printf(
"dcerpc state holding invalid opnum after response1. Holding %d, while we are "
1244 "expecting 40\n", dcerpc_state->dcerpc.dcerpcrequest.opnum);
1257 printf(
"Sending Request2\n");
1259 dcerpc_request2_len);
1261 printf(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1266 if (dcerpc_state == NULL) {
1267 printf(
"no dcerpc state: ");
1271 if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 30) {
1272 printf(
"dcerpc state holding invalid opnum after request2. Holding %d, while we are "
1273 "expecting 30\n", dcerpc_state->dcerpc.dcerpcrequest.opnum);
1287 dcerpc_response2_len);
1289 printf(
"AppLayerParse for dcerpc failed. Returned %" PRId32, r);
1294 if (dcerpc_state == NULL) {
1295 printf(
"no dcerpc state: ");
1299 if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 30) {
1300 printf(
"dcerpc state holding invalid opnum after response2. Holding %d, while we are "
1301 "expecting 30\n", dcerpc_state->dcerpc.dcerpcrequest.opnum);
1332 static void DetectDceOpnumRegisterTests(
void)
1337 UtRegisterTest(
"DetectDceOpnumTestParse10", DetectDceOpnumTestParse10, 1);
1338 UtRegisterTest(
"DetectDceOpnumTestParse11", DetectDceOpnumTestParse11, 1);
1339 UtRegisterTest(
"DetectDceOpnumTestParse12", DetectDceOpnumTestParse12, 1);
1340 UtRegisterTest(
"DetectDceOpnumTestParse13", DetectDceOpnumTestParse13, 1);