54 static int g_dce_stub_data_buffer_id = 0;
65 static int DcePayloadTest15(
void)
69 uint8_t request1[] = {
70 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
71 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
72 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00,
73 0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00,
74 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00,
75 0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x37, 0x00,
76 0x31, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00,
77 0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00,
78 0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00,
79 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
80 0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00,
81 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
82 0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00
84 uint32_t request1_len =
sizeof(request1);
94 const char *sig1 =
"alert tcp any any -> any any "
95 "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
96 "byte_test:2,=,14080,0,relative,dce; sid:1;)";
97 const char *sig2 =
"alert tcp any any -> any any "
98 "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
99 "byte_test:2,=,46,5,relative,dce; sid:2;)";
105 memset(&f, 0,
sizeof(
Flow));
116 f.
proto = IPPROTO_TCP;
140 STREAM_TOSERVER, request1, request1_len);
142 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
149 printf(
"sid 1 didn't match but should have for packet: ");
153 printf(
"sid 2 didn't match but should have for packet: ");
179 static int DcePayloadTest16(
void)
183 uint8_t request1[] = {
184 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
185 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
186 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00,
187 0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00,
188 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00,
189 0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x37, 0x00,
190 0x31, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00,
191 0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00,
192 0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00,
193 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
194 0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00,
195 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
196 0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00
198 uint32_t request1_len =
sizeof(request1);
208 const char *sig1 =
"alert tcp any any -> any any "
209 "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
210 "byte_test:2,=,55,0,relative; sid:1;)";
211 const char *sig2 =
"alert tcp any any -> any any "
212 "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
213 "byte_test:2,=,11776,5,relative; sid:2;)";
219 memset(&f, 0,
sizeof(
Flow));
230 f.
proto = IPPROTO_TCP;
254 STREAM_TOSERVER, request1, request1_len);
256 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
263 printf(
"sid 1 didn't match but should have for packet: ");
267 printf(
"sid 2 didn't match but should have for packet: ");
293 static int DcePayloadTest17(
void)
297 uint8_t request1[] = {
298 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
299 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
300 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00,
301 0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00,
302 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00,
303 0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x37, 0x00,
304 0x31, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00,
305 0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00,
306 0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00,
307 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
308 0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00,
309 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
310 0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00
312 uint32_t request1_len =
sizeof(request1);
322 const char *sig1 =
"alert tcp any any -> any any "
323 "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
324 "byte_test:2,=,55,0,relative,big; sid:1;)";
325 const char *sig2 =
"alert tcp any any -> any any "
326 "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
327 "byte_test:2,=,46,5,relative,little; sid:2;)";
333 memset(&f, 0,
sizeof(
Flow));
344 f.
proto = IPPROTO_TCP;
368 STREAM_TOSERVER, request1, request1_len);
370 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
377 printf(
"sid 1 didn't match but should have for packet: ");
381 printf(
"sid 2 didn't match but should have for packet: ");
407 static int DcePayloadTest18(
void)
411 uint8_t request1[] = {
412 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
413 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
414 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00,
415 0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00,
416 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00,
417 0x5c, 0x00, 0x5c, 0x00, 0x31, 0x03, 0x00, 0x03,
418 0x00, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00,
419 0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00,
420 0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00,
421 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
422 0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00,
423 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
424 0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00
426 uint32_t request1_len =
sizeof(request1);
436 const char *sig1 =
"alert tcp any any -> any any "
437 "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
438 "byte_jump:2,0,relative,dce; byte_test:2,=,46,0,relative,dce; sid:1;)";
439 const char *sig2 =
"alert tcp any any -> any any "
440 "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
441 "byte_jump:2,2,relative,dce; byte_test:2,=,14080,0,relative; sid:2;)";
447 memset(&f, 0,
sizeof(
Flow));
458 f.
proto = IPPROTO_TCP;
482 STREAM_TOSERVER, request1, request1_len);
484 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
491 printf(
"sid 1 didn't match but should have for packet: ");
495 printf(
"sid 2 didn't match but should have for packet: ");
521 static int DcePayloadTest19(
void)
525 uint8_t request1[] = {
526 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
527 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
528 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00,
529 0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00,
530 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00,
531 0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x03, 0x00,
532 0x03, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00,
533 0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00,
534 0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00,
535 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
536 0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00,
537 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
538 0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00
540 uint32_t request1_len =
sizeof(request1);
550 const char *sig1 =
"alert tcp any any -> any any "
551 "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
552 "byte_jump:2,0,relative; byte_test:2,=,46,0,relative,dce; sid:1;)";
553 const char *sig2 =
"alert tcp any any -> any any "
554 "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
555 "byte_jump:2,2,relative; byte_test:2,=,14080,0,relative; sid:2;)";
561 memset(&f, 0,
sizeof(
Flow));
572 f.
proto = IPPROTO_TCP;
596 STREAM_TOSERVER, request1, request1_len);
598 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
605 printf(
"sid 1 didn't match but should have for packet: ");
609 printf(
"sid 2 didn't match but should have for packet: ");
635 static int DcePayloadTest20(
void)
639 uint8_t request1[] = {
640 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
641 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
642 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00,
643 0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00,
644 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00,
645 0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x03, 0x03,
646 0x00, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00,
647 0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00,
648 0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00,
649 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
650 0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00,
651 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
652 0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00
654 uint32_t request1_len =
sizeof(request1);
664 const char *sig1 =
"alert tcp any any -> any any "
665 "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
666 "byte_jump:2,0,relative,big; byte_test:2,=,46,0,relative,dce; sid:1;)";
667 const char *sig2 =
"alert tcp any any -> any any "
668 "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
669 "byte_jump:2,2,little,relative; byte_test:2,=,14080,0,relative; sid:2;)";
675 memset(&f, 0,
sizeof(
Flow));
686 f.
proto = IPPROTO_TCP;
710 STREAM_TOSERVER, request1, request1_len);
712 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
719 printf(
"sid 1 didn't match but should have for packet: ");
723 printf(
"sid 2 didn't match but should have for packet: ");
749 static int DcePayloadParseTest25(
void)
763 "(msg:\"Testing bytejump_body\"; "
764 "content:\"one\"; content:\"two\"; "
765 "content:\"three\"; within:10; "
766 "content:\"four\"; distance:4; "
767 "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; "
798 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
817 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
836 result &= (strncmp((
char *)data->
content,
"three", 5) == 0);
855 result &= (strncmp((
char *)data->
content,
"four", 4) == 0);
870 static int DcePayloadParseTest26(
void)
884 "(msg:\"Testing bytejump_body\"; "
889 "content:\"three\"; within:5; "
890 "content:\"four\"; distance:10; "
919 printf(
"one failed\n");
922 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
939 printf(
"two failed\n");
942 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
958 printf(
"three failed\n");
962 result &= (strncmp((
char *)data->
content,
"three", 5) == 0);
978 printf(
"four failed\n");
982 result &= (strncmp((
char *)data->
content,
"four", 4) == 0);
997 static int DcePayloadParseTest27(
void)
1011 "(msg:\"Testing bytejump_body\"; "
1013 "content:\"one\"; distance:10; within:5; "
1014 "content:\"two\"; within:5;"
1015 "content:\"three\"; within:5; "
1016 "content:\"four\"; distance:10; "
1045 printf(
"one failed\n");
1048 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
1065 printf(
"two failed\n");
1068 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
1084 printf(
"three failed\n");
1088 result &= (strncmp((
char *)data->
content,
"three", 5) == 0);
1104 printf(
"four failed\n");
1108 result &= (strncmp((
char *)data->
content,
"four", 4) == 0);
1123 static int DcePayloadParseTest28(
void)
1137 "(msg:\"Testing bytejump_body\"; "
1139 "content:\"one\"; distance:10; within:5; "
1140 "content:\"two\"; within:5;"
1142 "content:\"three\";"
1172 printf(
"one failed\n");
1175 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
1192 printf(
"two failed\n");
1195 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
1211 printf(
"three failed\n");
1215 result &= (strncmp((
char *)data->
content,
"three", 5) == 0);
1231 printf(
"four failed\n");
1235 result &= (strncmp((
char *)data->
content,
"four", 4) == 0);
1250 static int DcePayloadParseTest29(
void)
1265 "(msg:\"Testing bytejump_body\"; "
1269 "content:\"one\"; distance:10; within:5; "
1270 "content:\"two\"; within:5;"
1271 "content:\"three\";"
1297 printf(
"one failed\n");
1314 printf(
"one failed\n");
1317 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
1334 printf(
"two failed\n");
1337 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
1353 printf(
"three failed\n");
1357 result &= (strncmp((
char *)data->
content,
"three", 5) == 0);
1373 printf(
"four failed\n");
1377 result &= (strncmp((
char *)data->
content,
"four", 4) == 0);
1392 static int DcePayloadParseTest30(
void)
1407 "(msg:\"Testing bytejump_body\"; "
1411 "content:\"one\"; distance:10; within:5; "
1412 "content:\"two\"; within:5;"
1413 "content:\"three\";"
1444 printf(
"one failed\n");
1461 printf(
"one failed\n");
1464 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
1481 printf(
"two failed\n");
1484 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
1500 printf(
"three failed\n");
1504 result &= (strncmp((
char *)data->
content,
"three", 5) == 0);
1520 printf(
"four failed\n");
1524 result &= (strncmp((
char *)data->
content,
"four", 4) == 0);
1539 static int DcePayloadParseTest31(
void)
1554 "(msg:\"Testing bytejump_body\"; "
1556 "byte_jump:2,5,relative; "
1557 "content:\"one\"; distance:10; within:5; "
1558 "content:\"two\"; within:5;"
1560 "content:\"three\";"
1591 printf(
"one failed\n");
1608 printf(
"one failed\n");
1611 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
1628 printf(
"two failed\n");
1631 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
1647 printf(
"three failed\n");
1651 result &= (strncmp((
char *)data->
content,
"three", 5) == 0);
1667 printf(
"four failed\n");
1671 result &= (strncmp((
char *)data->
content,
"four", 4) == 0);
1686 static int DcePayloadParseTest32(
void)
1701 "(msg:\"Testing bytejump_body\"; "
1703 "byte_jump:2,5,relative; "
1704 "content:\"one\"; distance:10; within:5; "
1705 "content:\"two\"; within:5;"
1707 "content:\"three\";"
1708 "content:\"four\"; within:4; "
1738 printf(
"one failed\n");
1755 printf(
"one failed\n");
1758 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
1775 printf(
"two failed\n");
1778 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
1794 printf(
"three failed\n");
1798 result &= (strncmp((
char *)data->
content,
"three", 5) == 0);
1814 printf(
"four failed\n");
1818 result &= (strncmp((
char *)data->
content,
"four", 4) == 0);
1833 static int DcePayloadParseTest33(
void)
1848 "(msg:\"Testing bytejump_body\"; "
1851 "content:\"one\"; distance:10; within:5; "
1852 "content:\"two\"; within:5;"
1854 "content:\"three\";"
1855 "content:\"four\"; distance:5;"
1880 printf(
"one failed\n");
1897 printf(
"one failed\n");
1900 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
1917 printf(
"two failed\n");
1920 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
1936 printf(
"three failed\n");
1940 result &= (strncmp((
char *)data->
content,
"three", 5) == 0);
1956 printf(
"four failed\n");
1960 result &= (strncmp((
char *)data->
content,
"four", 4) == 0);
1975 static int DcePayloadParseTest34(
void)
1991 "(msg:\"Testing bytejump_body\"; "
1992 "dce_iface:12345678-1234-1234-1234-123456789012; "
1993 "dce_opnum:10; dce_stub_data; "
1995 "byte_jump:1,2,relative,align,dce; "
1996 "content:\"one\"; within:4; distance:8; "
2040 printf(
"one failed\n");
2057 printf(
"two failed\n");
2060 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
2064 result &= (sm->
next == NULL);
2078 printf(
"three failed\n");
2082 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
2086 result &= (sm->
next == NULL);
2099 static int DcePayloadParseTest35(
void)
2114 "(msg:\"Testing bytejump_body\"; "
2115 "dce_iface:12345678-1234-1234-1234-123456789012; "
2116 "dce_opnum:10; dce_stub_data; "
2117 "byte_test:1,=,0,0,relative,dce; "
2147 printf(
"one failed\n");
2151 result &= (sm->
next == NULL);
2166 printf(
"two failed\n");
2169 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
2173 result &= (sm->
next == NULL);
2186 static int DcePayloadParseTest36(
void)
2201 "(msg:\"Testing bytejump_body\"; "
2202 "dce_iface:12345678-1234-1234-1234-123456789012; "
2203 "dce_opnum:10; dce_stub_data; "
2204 "isdataat:10,relative; "
2205 "content:\"one\"; within:4; distance:8; "
2248 printf(
"two failed\n");
2251 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
2255 result &= (sm->
next == NULL);
2269 printf(
"three failed\n");
2273 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
2277 result &= (sm->
next == NULL);
2290 static int DcePayloadParseTest37(
void)
2306 "(msg:\"Testing bytejump_body\"; "
2307 "dce_iface:12345678-1234-1234-1234-123456789012; "
2308 "dce_opnum:10; dce_stub_data; "
2309 "byte_jump:1,2,relative,align,dce; "
2310 "byte_test:1,=,2,0,relative,dce; "
2342 printf(
"one failed\n");
2358 printf(
"one failed\n");
2362 result &= (sm->
next == NULL);
2376 printf(
"three failed\n");
2380 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
2384 result &= (sm->
next == NULL);
2397 static int DcePayloadParseTest38(
void)
2414 "(msg:\"Testing bytejump_body\"; "
2415 "dce_iface:12345678-1234-1234-1234-123456789012; "
2416 "dce_opnum:10; dce_stub_data; "
2418 "byte_jump:1,2,relative,align,dce; "
2419 "byte_test:1,=,2,0,relative,dce; "
2446 printf(
"one failed\n");
2464 printf(
"one failed\n");
2480 printf(
"one failed\n");
2484 result &= (sm->
next == NULL);
2498 printf(
"three failed\n");
2502 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
2506 result &= (sm->
next == NULL);
2519 static int DcePayloadParseTest39(
void)
2533 "(msg:\"Testing bytejump_body\"; "
2535 "dce_iface:12345678-1234-1234-1234-123456789012; "
2536 "dce_opnum:10; dce_stub_data; "
2537 "content:\"two\"; within:4; distance:8; "
2565 printf(
"three failed\n");
2569 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
2573 result &= (sm->
next == NULL);
2583 printf(
"three failed\n");
2587 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
2591 result &= (sm->
next == NULL);
2604 static int DcePayloadParseTest40(
void)
2619 "(msg:\"Testing bytejump_body\"; "
2620 "dce_iface:12345678-1234-1234-1234-123456789012; "
2621 "dce_opnum:10; dce_stub_data; "
2622 "content:\"one\"; within:10; "
2623 "content:\"two\"; distance:20; within:30; "
2624 "byte_test:1,=,2,0,relative,dce; "
2626 "content:\"three\"; "
2654 printf(
"three failed\n");
2658 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
2675 printf(
"three failed\n");
2679 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
2695 printf(
"one failed\n");
2699 result &= (sm->
next == NULL);
2713 printf(
"three failed\n");
2717 result &= (strncmp((
char *)data->
content,
"three", 5) == 0);
2721 result &= (sm->
next == NULL);
2734 static int DcePayloadParseTest41(
void)
2749 "(msg:\"Testing bytejump_body\"; "
2750 "dce_iface:12345678-1234-1234-1234-123456789012; "
2751 "dce_opnum:10; dce_stub_data; "
2752 "content:\"one\"; within:10; "
2755 "byte_test:1,=,2,0,relative,dce; "
2756 "content:\"three\"; "
2784 printf(
"three failed\n");
2788 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
2792 result &= (sm->
next == NULL);
2806 printf(
"three failed\n");
2810 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
2826 printf(
"one failed\n");
2842 printf(
"three failed\n");
2846 result &= (strncmp((
char *)data->
content,
"three", 5) == 0);
2850 result &= (sm->
next == NULL);
2863 static int DcePayloadParseTest44(
void)
2877 "dce_iface:12345678-1234-1234-1234-123456789012; "
2878 "dce_opnum:10; dce_stub_data; "
2879 "isdataat:10,relative; "
2880 "content:\"one\"; within:4; distance:8; "
2953 static int DcePayloadParseTest45(
void)
2968 "(msg:\"Testing bytejump_body\"; "
2969 "dce_iface:12345678-1234-1234-1234-123456789012; "
2971 "dce_opnum:10; dce_stub_data; "
2972 "byte_jump:1,2,relative,align,dce; "
3004 printf(
"one failed\n");
3008 result &= (sm->
next == NULL);
3023 printf(
"one failed\n");
3027 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
3044 printf(
"two failed\n");
3048 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
3052 result &= (sm->
next == NULL);
3065 static int DcePayloadParseTest46(
void)
3080 "(msg:\"Testing bytejump_body\"; "
3081 "dce_iface:12345678-1234-1234-1234-123456789012; "
3083 "dce_opnum:10; dce_stub_data; "
3084 "byte_test:1,=,2,0,relative,dce; "
3114 printf(
"one failed\n");
3118 result &= (sm->
next == NULL);
3133 printf(
"one failed\n");
3137 result &= (strncmp((
char *)data->
content,
"one", 3) == 0);
3154 printf(
"two failed\n");
3158 result &= (strncmp((
char *)data->
content,
"two", 3) == 0);
3162 result &= (sm->
next == NULL);