From: Shivani Bhardwaj Date: Tue, 21 Apr 2020 09:06:06 +0000 (+0530) Subject: dcerpc: Replace C function calls with Rust X-Git-Tag: suricata-6.0.0-beta1~418 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6457754fd678c29b30c368c2fedf198a144f04e9;p=thirdparty%2Fsuricata.git dcerpc: Replace C function calls with Rust All the dead code in C after the Rust implementation is hereby removed. Invalid/migrated tests have also been deleted. All the function calls in C have been replaced with appropriate calls to Rust functions. Same has been done for smb/detect.rs as a part of this migration. --- diff --git a/rust/src/lib.rs b/rust/src/lib.rs index 30624ba7b1..a510cc736d 100644 --- a/rust/src/lib.rs +++ b/rust/src/lib.rs @@ -58,6 +58,7 @@ pub mod nfs; pub mod ftp; pub mod smb; pub mod krb; +pub mod dcerpc; pub mod ikev2; pub mod snmp; diff --git a/rust/src/smb/detect.rs b/rust/src/smb/detect.rs index 58d65c3224..96a6a7386c 100644 --- a/rust/src/smb/detect.rs +++ b/rust/src/smb/detect.rs @@ -15,11 +15,11 @@ * 02110-1301, USA. */ -use std; use std::ptr; use crate::core::*; use crate::log::*; use crate::smb::smb::*; +use crate::dcerpc::detect::{DCEIfaceData, DCEOpnumData, DETECT_DCE_OPNUM_RANGE_UNINITIALIZED}; #[no_mangle] pub extern "C" fn rs_smb_tx_get_share(tx: &mut SMBTransaction, @@ -111,17 +111,22 @@ pub extern "C" fn rs_smb_tx_get_stub_data(tx: &mut SMBTransaction, } #[no_mangle] -pub extern "C" fn rs_smb_tx_get_dce_opnum(tx: &mut SMBTransaction, - opnum: *mut u16) +pub extern "C" fn rs_smb_tx_match_dce_opnum(tx: &mut SMBTransaction, + dce_data: &mut DCEOpnumData) -> u8 { SCLogDebug!("rs_smb_tx_get_dce_opnum: start"); match tx.type_data { Some(SMBTransactionTypeData::DCERPC(ref x)) => { if x.req_cmd == 1 { // REQUEST - unsafe { - *opnum = x.opnum as u16; - return 1; + for range in dce_data.data.iter() { + if range.range2 == DETECT_DCE_OPNUM_RANGE_UNINITIALIZED { + if range.range1 == x.opnum as u32 { + return 1; + } else if range.range1 <= x.opnum as u32 && range.range2 >= x.opnum as u32 { + return 1; + } + } } } } @@ -129,9 +134,6 @@ pub extern "C" fn rs_smb_tx_get_dce_opnum(tx: &mut SMBTransaction, } } - unsafe { - *opnum = 0; - } return 0; } @@ -176,12 +178,12 @@ fn match_version(op: u8, them: u16, us: u16) -> bool { #[no_mangle] pub extern "C" fn rs_smb_tx_get_dce_iface(state: &mut SMBState, tx: &mut SMBTransaction, - uuid_ptr: *mut u8, - uuid_len: u16, - ver_op: u8, - ver_check: u16) + dce_data: &mut DCEIfaceData) -> u8 { + let if_uuid = dce_data.if_uuid.as_slice(); + let if_op = dce_data.op; + let if_version = dce_data.version; let is_dcerpc_request = match tx.type_data { Some(SMBTransactionTypeData::DCERPC(ref x)) => { x.req_cmd == 1 }, _ => { false }, @@ -196,14 +198,13 @@ pub extern "C" fn rs_smb_tx_get_dce_iface(state: &mut SMBState, }, }; - let uuid = unsafe{std::slice::from_raw_parts(uuid_ptr, uuid_len as usize)}; - SCLogDebug!("looking for UUID {:?}", uuid); + SCLogDebug!("looking for UUID {:?}", if_uuid); for i in ifaces { SCLogDebug!("stored UUID {:?} acked {} ack_result {}", i, i.acked, i.ack_result); - if i.acked && i.ack_result == 0 && i.uuid == uuid { - if match_version(ver_op as u8, ver_check as u16, i.ver) { + if i.acked && i.ack_result == 0 && i.uuid == if_uuid { + if match_version(if_op as u8, if_version as u16, i.ver) { return 1; } } diff --git a/src/app-layer-dcerpc-common.h b/src/app-layer-dcerpc-common.h index 01b3ce71dd..0bbfc55401 100644 --- a/src/app-layer-dcerpc-common.h +++ b/src/app-layer-dcerpc-common.h @@ -15,12 +15,6 @@ * 02110-1301, USA. */ -/** - * \file - * - * \author Kirby Kuehl - */ - #ifndef __APP_LAYER_DCERPC_COMMON_H__ #define __APP_LAYER_DCERPC_COMMON_H__ @@ -34,210 +28,4 @@ void RegisterDCERPCParsers(void); void DCERPCParserTests(void); void DCERPCParserRegisterTests(void); -// http://www.opengroup.org/onlinepubs/9629399/chap12.htm#tagcjh_17_06 -#define REQUEST 0 -#define PING 1 -#define RESPONSE 2 -#define FAULT 3 -#define WORKING 4 -#define NOCALL 5 -#define REJECT 6 -#define ACK 7 -#define CL_CANCEL 8 -#define FACK 9 -#define CANCEL_ACK 10 -#define BIND 11 -#define BIND_ACK 12 -#define BIND_NAK 13 -#define ALTER_CONTEXT 14 -#define ALTER_CONTEXT_RESP 15 -#define SHUTDOWN 17 -#define CO_CANCEL 18 -#define ORPHANED 19 -#if 0 -typedef struct { - uint8_t rpc_vers; /* 4 RPC protocol major version (4 LSB only)*/ - uint8_t ptype; /* Packet type (5 LSB only) */ - uint8_t flags1; /* Packet flags */ - uint8_t flags2; /* Packet flags */ - uint8_t drep[3]; /* Data representation format label */ - uint8_t serial_hi; /* High byte of serial number */ - uuid_t object; /* Object identifier */ - uuid_t if_id; /* Interface identifier */ - uuid_t act_id; /* Activity identifier */ - unsigned long server_boot;/* Server boot time */ - unsigned long if_vers; /* Interface version */ - unsigned long seqnum; /* Sequence number */ - unsigned short opnum; /* Operation number */ - unsigned short ihint; /* Interface hint */ - unsigned short ahint; /* Activity hint */ - unsigned short len; /* Length of packet body */ - unsigned short fragnum; /* Fragment number */ - unsigned small auth_proto; /* Authentication protocol identifier*/ - unsigned small serial_lo; /* Low byte of serial number */ -} dc_rpc_cl_pkt_hdr_t; -#endif - -#define RESERVED_01 0x01 -#define LASTFRAG 0x02 -#define FRAG 0x04 -#define NOFACK 0x08 -#define MAYBE 0x10 -#define IDEMPOTENT 0x20 -#define BROADCAST 0x40 -#define RESERVED_80 0x80 - -#define CANCEL_PENDING 0x02 -#define RESERVED_04 0x04 -#define RESERVED_10 0x10 -#define RESERVED_20 0x20 -#define RESERVED_40 0x40 -#define RESERVED_80 0x80 - -typedef struct DCERPCHdr_ { - uint8_t rpc_vers; /**< 00:01 RPC version should be 5 */ - uint8_t rpc_vers_minor; /**< 01:01 minor version */ - uint8_t type; /**< 02:01 packet type */ - uint8_t pfc_flags; /**< 03:01 flags (see PFC_... ) */ - uint8_t packed_drep[4]; /**< 04:04 NDR data representation format label */ - uint16_t frag_length; /**< 08:02 total length of fragment */ - uint16_t auth_length; /**< 10:02 length of auth_value */ - uint32_t call_id; /**< 12:04 call identifier */ -} DCERPCHdr; - -#define DCERPC_HDR_LEN 16 - -typedef struct DCERPCHdrUdp_ { - uint8_t rpc_vers; /**< 4 RPC protocol major version (4 LSB only)*/ - uint8_t type; /**< Packet type (5 LSB only) */ - uint8_t flags1; /**< Packet flags */ - uint8_t flags2; /**< Packet flags */ - uint8_t drep[3]; /**< Data representation format label */ - uint8_t serial_hi; /**< High byte of serial number */ - uint8_t objectuuid[16]; - uint8_t interfaceuuid[16]; - uint8_t activityuuid[16]; - uint32_t server_boot; /**< Server boot time */ - uint32_t if_vers; /**< Interface version */ - uint32_t seqnum; /**< Sequence number */ - uint16_t opnum; /**< Operation number */ - uint16_t ihint; /**< Interface hint */ - uint16_t ahint; /**< Activity hint */ - uint16_t fraglen; /**< Length of packet body */ - uint16_t fragnum; /**< Fragment number */ - uint8_t auth_proto; /**< Authentication protocol identifier*/ - uint8_t serial_lo; /**< Low byte of serial number */ -} DCERPCHdrUdp; - -#define DCERPC_UDP_HDR_LEN 80 - -#define DCERPC_UUID_ENTRY_FLAG_FF 0x0001 /**< FIRST flag set on the packet - that contained this uuid entry */ - -typedef struct DCERPCUuidEntry_ { - uint16_t ctxid; - uint16_t internal_id; - uint16_t result; - uint8_t uuid[16]; - uint16_t version; - uint16_t versionminor; - uint16_t flags; /**< DCERPC_UUID_ENTRY_FLAG_* flags */ - TAILQ_ENTRY(DCERPCUuidEntry_) next; -} DCERPCUuidEntry; - -typedef TAILQ_HEAD(DCERPCUuidEntryList_, DCERPCUuidEntry_) DCERPCUuidEntryList; - -typedef struct DCERPCBindBindAck_ { - uint8_t numctxitems; - uint8_t numctxitemsleft; - uint8_t ctxbytesprocessed; - uint16_t ctxid; - uint8_t uuid[16]; - uint16_t version; - uint16_t versionminor; - DCERPCUuidEntry *uuid_entry; - DCERPCUuidEntryList uuid_list; - /* the interface uuids that the server has accepted */ - DCERPCUuidEntryList accepted_uuid_list; - uint16_t uuid_internal_id; - uint16_t secondaryaddrlen; - uint16_t secondaryaddrlenleft; - uint16_t result; -} DCERPCBindBindAck; - -typedef struct DCERPCRequest_ { - uint16_t ctxid; - uint16_t opnum; - /* holds the stub data for the request */ - uint8_t *stub_data_buffer; - /* length of the above buffer */ - uint32_t stub_data_buffer_len; - uint8_t first_request_seen; - bool stub_data_buffer_reset; -} DCERPCRequest; - -typedef struct DCERPCResponse_ { - /* holds the stub data for the response */ - uint8_t *stub_data_buffer; - /* length of the above buffer */ - uint32_t stub_data_buffer_len; - bool stub_data_buffer_reset; -} DCERPCResponse; - -typedef struct DCERPC_ { - DCERPCHdr dcerpchdr; - DCERPCBindBindAck dcerpcbindbindack; - DCERPCRequest dcerpcrequest; - DCERPCResponse dcerpcresponse; - uint16_t bytesprocessed; - uint8_t pad; - uint16_t padleft; - uint16_t transaction_id; -} DCERPC; - -typedef struct DCERPCUDP_ { - DCERPCHdrUdp dcerpchdrudp; - DCERPCBindBindAck dcerpcbindbindack; - DCERPCRequest dcerpcrequest; - DCERPCResponse dcerpcresponse; - uint16_t bytesprocessed; - uint16_t fraglenleft; - uint8_t *frag_data; - DCERPCUuidEntry *uuid_entry; - TAILQ_HEAD(, uuid_entry) uuid_list; -} DCERPCUDP; - -/** First fragment */ -#define PFC_FIRST_FRAG 0x01 -/** Last fragment */ -#define PFC_LAST_FRAG 0x02 -/** Cancel was pending at sender */ -#define PFC_PENDING_CANCEL 0x04 -#define PFC_RESERVED_1 0x08 -/** supports concurrent multiplexing of a single connection. */ -#define PFC_CONC_MPX 0x10 -/** only meaningful on `fault' packet; if true, guaranteed - * call did not execute. */ -#define PFC_DID_NOT_EXECUTE 0x20 -/** `maybe' call semantics requested */ -#define PFC_MAYBE 0x40 -/** if true, a non-nil object UUID was specified in the handle, and - * is present in the optional object field. If false, the object field - * is omitted. */ -#define PFC_OBJECT_UUID 0x80 - -#define REASON_NOT_SPECIFIED 0 -#define TEMPORARY_CONGESTION 1 -#define LOCAL_LIMIT_EXCEEDED 2 -#define CALLED_PADDR_UNKNOWN 3 /* not used */ -#define PROTOCOL_VERSION_NOT_SUPPORTED 4 -#define DEFAULT_CONTEXT_NOT_SUPPORTED 5 /* not used */ -#define USER_DATA_NOT_READABLE 6 /* not used */ -#define NO_PSAP_AVAILABLE 7 /* not used */ - -int32_t DCERPCParser(DCERPC *, const uint8_t *, uint32_t); -void hexdump(const void *buf, size_t len); -void printUUID(const char *type, DCERPCUuidEntry *uuid); - #endif /* __APP_LAYER_DCERPC_COMMON_H__ */ - diff --git a/src/app-layer-dcerpc-udp.c b/src/app-layer-dcerpc-udp.c index 6474456daa..abd3f16411 100644 --- a/src/app-layer-dcerpc-udp.c +++ b/src/app-layer-dcerpc-udp.c @@ -15,11 +15,7 @@ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ - -/* \file - * - * \author Kirby Kuehl - * +/* * \todo Updated by AS: Inspect the possibilities of sending junk start at the * start of udp session to avoid alproto detection. */ @@ -50,817 +46,60 @@ #include "util-spm.h" #include "util-unittest.h" +#include "app-layer-dcerpc-common.h" #include "app-layer-dcerpc-udp.h" -enum { - DCERPC_FIELD_NONE = 0, - DCERPC_PARSE_DCERPC_HEADER, - DCERPC_PARSE_DCERPC_BIND, - DCERPC_PARSE_DCERPC_BIND_ACK, - DCERPC_PARSE_DCERPC_REQUEST, - /* must be last */ - DCERPC_FIELD_MAX, -}; - -/** \internal - * \retval stub_len or 0 in case of error */ -static uint32_t FragmentDataParser(Flow *f, void *dcerpcudp_state, - AppLayerParserState *pstate, const uint8_t *input, uint32_t input_len) -{ - SCEnter(); - DCERPCUDPState *sstate = (DCERPCUDPState *) dcerpcudp_state; - uint8_t **stub_data_buffer = NULL; - uint32_t *stub_data_buffer_len = NULL; - uint16_t stub_len = 0; - void *ptmp; - - /* request PDU. Retrieve the request stub buffer */ - if (sstate->dcerpc.dcerpchdrudp.type == REQUEST) { - stub_data_buffer = &sstate->dcerpc.dcerpcrequest.stub_data_buffer; - stub_data_buffer_len = &sstate->dcerpc.dcerpcrequest.stub_data_buffer_len; - - /* response PDU. Retrieve the response stub buffer */ - } else { - stub_data_buffer = &sstate->dcerpc.dcerpcresponse.stub_data_buffer; - stub_data_buffer_len = &sstate->dcerpc.dcerpcresponse.stub_data_buffer_len; - } - - stub_len = (sstate->dcerpc.fraglenleft < input_len) ? sstate->dcerpc.fraglenleft : input_len; - - if (stub_len == 0) { - SCReturnUInt(0); - } - /* if the frag is the the first frag irrespective of it being a part of - * a multi frag PDU or not, it indicates the previous PDU's stub would - * have been buffered and processed and we can use the buffer to hold - * frags from a fresh request/response */ - if (sstate->dcerpc.dcerpchdrudp.flags1 & PFC_FIRST_FRAG) { - *stub_data_buffer_len = 0; - } - - ptmp = SCRealloc(*stub_data_buffer, *stub_data_buffer_len + stub_len); - if (ptmp == NULL) { - SCFree(*stub_data_buffer); - *stub_data_buffer = NULL; - SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); - SCReturnUInt(0); - } - - *stub_data_buffer = ptmp; - memcpy(*stub_data_buffer + *stub_data_buffer_len, input, stub_len); - - /* length of the buffered stub */ - *stub_data_buffer_len += stub_len; - - sstate->dcerpc.fraglenleft -= stub_len; - sstate->dcerpc.bytesprocessed += stub_len; - -#ifdef DEBUG - if (SCLogDebugEnabled()) { - int i = 0; - for (i = 0; i < stub_len; i++) { - SCLogDebug("0x%02x ", input[i]); - } - } -#endif - - SCReturnUInt((uint32_t)stub_len); -} - -/** - * \brief DCERPCParseHeader parses the 16 byte DCERPC header - * A fast path for normal decoding is used when there is enough bytes - * present to parse the entire header. A slow path is used to parse - * fragmented packets. - */ -static int DCERPCUDPParseHeader(Flow *f, void *dcerpcudp_state, - AppLayerParserState *pstate, const uint8_t *input, uint32_t input_len) -{ - SCEnter(); - const uint8_t *p = input; - DCERPCUDPState *sstate = (DCERPCUDPState *) dcerpcudp_state; - if (input_len) { - switch (sstate->bytesprocessed) { - case 0: - // fallthrough - /* above statement to prevent coverity FPs from the switch - * fall through */ - if (input_len >= DCERPC_UDP_HDR_LEN) { - sstate->dcerpc.dcerpchdrudp.rpc_vers = *p; - if (sstate->dcerpc.dcerpchdrudp.rpc_vers != 4) { - SCLogDebug("DCERPC UDP Header did not validate"); - SCReturnInt(-1); - } - sstate->dcerpc.dcerpchdrudp.type = *(p + 1); - sstate->dcerpc.dcerpchdrudp.flags1 = *(p + 2); - sstate->dcerpc.dcerpchdrudp.flags2 = *(p + 3); - sstate->dcerpc.dcerpchdrudp.drep[0] = *(p + 4); - sstate->dcerpc.dcerpchdrudp.drep[1] = *(p + 5); - sstate->dcerpc.dcerpchdrudp.drep[2] = *(p + 6); - sstate->dcerpc.dcerpchdrudp.serial_hi = *(p + 7); - sstate->dcerpc.dcerpchdrudp.objectuuid[3] = *(p + 8); - sstate->dcerpc.dcerpchdrudp.objectuuid[2] = *(p + 9); - sstate->dcerpc.dcerpchdrudp.objectuuid[1] = *(p + 10); - sstate->dcerpc.dcerpchdrudp.objectuuid[0] = *(p + 11); - sstate->dcerpc.dcerpchdrudp.objectuuid[5] = *(p + 12); - sstate->dcerpc.dcerpchdrudp.objectuuid[4] = *(p + 13); - sstate->dcerpc.dcerpchdrudp.objectuuid[7] = *(p + 14); - sstate->dcerpc.dcerpchdrudp.objectuuid[6] = *(p + 15); - sstate->dcerpc.dcerpchdrudp.objectuuid[8] = *(p + 16); - sstate->dcerpc.dcerpchdrudp.objectuuid[9] = *(p + 17); - sstate->dcerpc.dcerpchdrudp.objectuuid[10] = *(p + 18); - sstate->dcerpc.dcerpchdrudp.objectuuid[11] = *(p + 19); - sstate->dcerpc.dcerpchdrudp.objectuuid[12] = *(p + 20); - sstate->dcerpc.dcerpchdrudp.objectuuid[13] = *(p + 21); - sstate->dcerpc.dcerpchdrudp.objectuuid[14] = *(p + 22); - sstate->dcerpc.dcerpchdrudp.objectuuid[15] = *(p + 23); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[3] = *(p + 24); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[2] = *(p + 25); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[1] = *(p + 26); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[0] = *(p + 27); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[5] = *(p + 28); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[4] = *(p + 29); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[7] = *(p + 30); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[6] = *(p + 31); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[8] = *(p + 32); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[9] = *(p + 33); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[10] = *(p + 34); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[11] = *(p + 35); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[12] = *(p + 36); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[13] = *(p + 37); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[14] = *(p + 38); - sstate->dcerpc.dcerpchdrudp.interfaceuuid[15] = *(p + 39); - sstate->dcerpc.dcerpchdrudp.activityuuid[3] = *(p + 40); - sstate->dcerpc.dcerpchdrudp.activityuuid[2] = *(p + 41); - sstate->dcerpc.dcerpchdrudp.activityuuid[1] = *(p + 42); - sstate->dcerpc.dcerpchdrudp.activityuuid[0] = *(p + 43); - sstate->dcerpc.dcerpchdrudp.activityuuid[5] = *(p + 44); - sstate->dcerpc.dcerpchdrudp.activityuuid[4] = *(p + 45); - sstate->dcerpc.dcerpchdrudp.activityuuid[7] = *(p + 46); - sstate->dcerpc.dcerpchdrudp.activityuuid[6] = *(p + 47); - sstate->dcerpc.dcerpchdrudp.activityuuid[8] = *(p + 48); - sstate->dcerpc.dcerpchdrudp.activityuuid[9] = *(p + 49); - sstate->dcerpc.dcerpchdrudp.activityuuid[10] = *(p + 50); - sstate->dcerpc.dcerpchdrudp.activityuuid[11] = *(p + 51); - sstate->dcerpc.dcerpchdrudp.activityuuid[12] = *(p + 52); - sstate->dcerpc.dcerpchdrudp.activityuuid[13] = *(p + 53); - sstate->dcerpc.dcerpchdrudp.activityuuid[14] = *(p + 54); - sstate->dcerpc.dcerpchdrudp.activityuuid[15] = *(p + 55); - if (sstate->dcerpc.dcerpchdrudp.drep[0] == 0x10) { - sstate->dcerpc.dcerpchdrudp.server_boot = (uint32_t) *(p + 56); - sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 57) << 8; - sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 58) << 16; - sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 59) << 24; - sstate->dcerpc.dcerpchdrudp.if_vers = (uint32_t) *(p + 60); - sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 61) << 8; - sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 62) << 16; - sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 63) << 24; - sstate->dcerpc.dcerpchdrudp.seqnum = (uint32_t) *(p + 64); - sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 65) << 8; - sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 66) << 16; - sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 67) << 24; - sstate->dcerpc.dcerpchdrudp.opnum = *(p + 68); - sstate->dcerpc.dcerpchdrudp.opnum |= *(p + 69) << 8; - sstate->dcerpc.dcerpchdrudp.ihint = *(p + 70); - sstate->dcerpc.dcerpchdrudp.ihint |= *(p + 71) << 8; - sstate->dcerpc.dcerpchdrudp.ahint = *(p + 72); - sstate->dcerpc.dcerpchdrudp.ahint |= *(p + 73) << 8; - sstate->dcerpc.dcerpchdrudp.fraglen = *(p + 74); - sstate->dcerpc.dcerpchdrudp.fraglen |= *(p + 75) << 8; - sstate->dcerpc.dcerpchdrudp.fragnum = *(p + 76); - sstate->dcerpc.dcerpchdrudp.fragnum |= *(p + 77) << 8; - } else { - sstate->dcerpc.dcerpchdrudp.server_boot = (uint32_t) *(p + 56) << 24; - sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 57) << 16; - sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 58) << 8; - sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 59); - sstate->dcerpc.dcerpchdrudp.if_vers = (uint32_t) *(p + 60) << 24; - sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 61) << 16; - sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 62) << 8; - sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 63); - sstate->dcerpc.dcerpchdrudp.seqnum = (uint32_t) *(p + 64) << 24; - sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 65) << 16; - sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 66) << 8; - sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 67); - sstate->dcerpc.dcerpchdrudp.opnum = *(p + 68) << 8; - sstate->dcerpc.dcerpchdrudp.opnum |= *(p + 69); - sstate->dcerpc.dcerpchdrudp.ihint = *(p + 70) << 8; - sstate->dcerpc.dcerpchdrudp.ihint |= *(p + 71); - sstate->dcerpc.dcerpchdrudp.ahint = *(p + 72) << 8; - sstate->dcerpc.dcerpchdrudp.ahint |= *(p + 73); - sstate->dcerpc.dcerpchdrudp.fraglen = *(p + 74) << 8; - sstate->dcerpc.dcerpchdrudp.fraglen |= *(p + 75); - sstate->dcerpc.dcerpchdrudp.fragnum = *(p + 76) << 8; - sstate->dcerpc.dcerpchdrudp.fragnum |= *(p + 77); - } - sstate->fraglenleft = sstate->dcerpc.dcerpchdrudp.fraglen; - sstate->dcerpc.dcerpchdrudp.auth_proto = *(p + 78); - sstate->dcerpc.dcerpchdrudp.serial_lo = *(p + 79); - sstate->bytesprocessed = DCERPC_UDP_HDR_LEN; - sstate->uuid_entry = (DCERPCUuidEntry *) SCCalloc(1, - sizeof(DCERPCUuidEntry)); - if (sstate->uuid_entry == NULL) { - SCReturnUInt(-1); - } else { - memcpy(sstate->uuid_entry->uuid, - sstate->dcerpc.dcerpchdrudp.activityuuid, - sizeof(sstate->dcerpc.dcerpchdrudp.activityuuid)); - TAILQ_INSERT_HEAD(&sstate->uuid_list, sstate->uuid_entry, - next); -#ifdef UNITTESTS - if (RunmodeIsUnittests()) { - printUUID("DCERPC UDP", sstate->uuid_entry); - - } -#endif - } - SCReturnUInt(80); - break; - } else { - sstate->dcerpc.dcerpchdrudp.rpc_vers = *(p++); - if (sstate->dcerpc.dcerpchdrudp.rpc_vers != 4) { - SCLogDebug("DCERPC UDP Header did not validate"); - SCReturnInt(-1); - } - if (!(--input_len)) - break; - /* We fall through to the next case if we still have input. - * Same applies for other cases as well */ - } - /* fall through */ - case 1: - sstate->dcerpc.dcerpchdrudp.type = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 2: - sstate->dcerpc.dcerpchdrudp.flags1 = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 3: - sstate->dcerpc.dcerpchdrudp.flags2 = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 4: - sstate->dcerpc.dcerpchdrudp.drep[0] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 5: - sstate->dcerpc.dcerpchdrudp.drep[1] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 6: - sstate->dcerpc.dcerpchdrudp.drep[2] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 7: - sstate->dcerpc.dcerpchdrudp.serial_hi = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 8: - sstate->dcerpc.dcerpchdrudp.objectuuid[3] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 9: - sstate->dcerpc.dcerpchdrudp.objectuuid[2] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 10: - sstate->dcerpc.dcerpchdrudp.objectuuid[1] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 11: - sstate->dcerpc.dcerpchdrudp.objectuuid[0] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 12: - sstate->dcerpc.dcerpchdrudp.objectuuid[5] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 13: - sstate->dcerpc.dcerpchdrudp.objectuuid[4] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 14: - sstate->dcerpc.dcerpchdrudp.objectuuid[7] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 15: - sstate->dcerpc.dcerpchdrudp.objectuuid[6] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 16: - sstate->dcerpc.dcerpchdrudp.objectuuid[8] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 17: - sstate->dcerpc.dcerpchdrudp.objectuuid[9] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 18: - sstate->dcerpc.dcerpchdrudp.objectuuid[10] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 19: - sstate->dcerpc.dcerpchdrudp.objectuuid[11] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 20: - sstate->dcerpc.dcerpchdrudp.objectuuid[12] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 21: - sstate->dcerpc.dcerpchdrudp.objectuuid[13] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 22: - sstate->dcerpc.dcerpchdrudp.objectuuid[14] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 23: - sstate->dcerpc.dcerpchdrudp.objectuuid[15] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 24: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[3] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 25: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[2] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 26: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[1] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 27: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[0] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 28: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[5] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 29: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[4] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 30: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[7] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 31: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[6] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 32: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[8] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 33: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[9] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 34: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[10] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 35: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[11] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 36: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[12] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 37: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[13] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 38: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[14] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 39: - sstate->dcerpc.dcerpchdrudp.interfaceuuid[15] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 40: - sstate->dcerpc.dcerpchdrudp.activityuuid[3] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 41: - sstate->dcerpc.dcerpchdrudp.activityuuid[2] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 42: - sstate->dcerpc.dcerpchdrudp.activityuuid[1] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 43: - sstate->dcerpc.dcerpchdrudp.activityuuid[0] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 44: - sstate->dcerpc.dcerpchdrudp.activityuuid[5] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 45: - sstate->dcerpc.dcerpchdrudp.activityuuid[4] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 46: - sstate->dcerpc.dcerpchdrudp.activityuuid[7] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 47: - sstate->dcerpc.dcerpchdrudp.activityuuid[6] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 48: - sstate->dcerpc.dcerpchdrudp.activityuuid[8] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 49: - sstate->dcerpc.dcerpchdrudp.activityuuid[9] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 50: - sstate->dcerpc.dcerpchdrudp.activityuuid[10] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 51: - sstate->dcerpc.dcerpchdrudp.activityuuid[11] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 52: - sstate->dcerpc.dcerpchdrudp.activityuuid[12] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 53: - sstate->dcerpc.dcerpchdrudp.activityuuid[13] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 54: - sstate->dcerpc.dcerpchdrudp.activityuuid[14] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 55: - sstate->dcerpc.dcerpchdrudp.activityuuid[15] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 56: - sstate->dcerpc.dcerpchdrudp.server_boot = (uint32_t) *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 57: - sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 58: - sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p++) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 59: - sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p++) << 24; - if (!(--input_len)) - break; - /* fall through */ - case 60: - sstate->dcerpc.dcerpchdrudp.if_vers = (uint32_t) *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 61: - sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 62: - sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p++) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 63: - sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p++) << 24; - if (!(--input_len)) - break; - /* fall through */ - case 64: - sstate->dcerpc.dcerpchdrudp.seqnum = (uint32_t) *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 65: - sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 66: - sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p++) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 67: - sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p++) << 24; - if (!(--input_len)) - break; - /* fall through */ - case 68: - sstate->dcerpc.dcerpchdrudp.opnum = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 69: - sstate->dcerpc.dcerpchdrudp.opnum |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 70: - sstate->dcerpc.dcerpchdrudp.ihint = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 71: - sstate->dcerpc.dcerpchdrudp.ihint |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 72: - sstate->dcerpc.dcerpchdrudp.ahint = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 73: - sstate->dcerpc.dcerpchdrudp.ahint |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 74: - sstate->dcerpc.dcerpchdrudp.fraglen = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 75: - sstate->dcerpc.dcerpchdrudp.fraglen |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 76: - sstate->dcerpc.dcerpchdrudp.fragnum = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 77: - sstate->dcerpc.dcerpchdrudp.fragnum |= *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 78: - sstate->dcerpc.dcerpchdrudp.auth_proto = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 79: - sstate->dcerpc.dcerpchdrudp.serial_lo = *(p++); - if (sstate->dcerpc.dcerpchdrudp.drep[0] != 0x10) { - sstate->dcerpc.dcerpchdrudp.server_boot = SCByteSwap32(sstate->dcerpc.dcerpchdrudp.server_boot); - sstate->dcerpc.dcerpchdrudp.if_vers= SCByteSwap32(sstate->dcerpc.dcerpchdrudp.if_vers); - sstate->dcerpc.dcerpchdrudp.seqnum= SCByteSwap32(sstate->dcerpc.dcerpchdrudp.seqnum); - sstate->dcerpc.dcerpchdrudp.opnum = SCByteSwap16(sstate->dcerpc.dcerpchdrudp.opnum); - sstate->dcerpc.dcerpchdrudp.ihint= SCByteSwap16(sstate->dcerpc.dcerpchdrudp.ihint); - sstate->dcerpc.dcerpchdrudp.ahint = SCByteSwap16(sstate->dcerpc.dcerpchdrudp.ahint); - sstate->dcerpc.dcerpchdrudp.fraglen = SCByteSwap16(sstate->dcerpc.dcerpchdrudp.fraglen); - sstate->dcerpc.dcerpchdrudp.fragnum = SCByteSwap16(sstate->dcerpc.dcerpchdrudp.fragnum); - } - sstate->fraglenleft = sstate->dcerpc.dcerpchdrudp.fraglen; - sstate->uuid_entry = (DCERPCUuidEntry *) SCCalloc(1, - sizeof(DCERPCUuidEntry)); - if (sstate->uuid_entry == NULL) { - SCReturnUInt(-1); - } else { - memcpy(sstate->uuid_entry->uuid, - sstate->dcerpc.dcerpchdrudp.activityuuid, - sizeof(sstate->dcerpc.dcerpchdrudp.activityuuid)); - TAILQ_INSERT_HEAD(&sstate->uuid_list, sstate->uuid_entry, - next); -#ifdef UNITTESTS - if (RunmodeIsUnittests()) { - printUUID("DCERPC UDP", sstate->uuid_entry); - } -#endif - } - --input_len; - break; - } - } - sstate->bytesprocessed += (p - input); - SCReturnInt((p - input)); -} - -static AppLayerResult DCERPCUDPParse(Flow *f, void *dcerpc_state, +static AppLayerResult RustDCERPCUDPParse(Flow *f, void *dcerpc_state, AppLayerParserState *pstate, const uint8_t *input, uint32_t input_len, void *local_data, const uint8_t flags) { - uint32_t retval = 0; - uint32_t parsed = 0; - int hdrretval = 0; - SCEnter(); - - if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { - SCReturnStruct(APP_LAYER_OK); - } else if (input == NULL || input_len == 0) { - SCReturnStruct(APP_LAYER_ERROR); - } - - DCERPCUDPState *sstate = (DCERPCUDPState *) dcerpc_state; - while (sstate->bytesprocessed < DCERPC_UDP_HDR_LEN && input_len) { - hdrretval = DCERPCUDPParseHeader(f, dcerpc_state, pstate, input, - input_len); - if (hdrretval == -1 || hdrretval > (int32_t)input_len) { - sstate->bytesprocessed = 0; - SCReturnStruct(APP_LAYER_ERROR); - } else { - parsed += hdrretval; - input_len -= hdrretval; - } - } - -#if 0 - printf("Done with DCERPCUDPParseHeader bytesprocessed %u/%u left %u\n", - sstate->bytesprocessed, sstate->dcerpc.dcerpchdrudp.fraglen, input_len); - printf("\nDCERPC Version:\t%u\n", sstate->dcerpc.dcerpchdrudp.rpc_vers); - printf("DCERPC Type:\t%u\n", sstate->dcerpc.dcerpchdrudp.ptype); - printf("DCERPC Flags1:\t0x%02x\n", sstate->dcerpc.dcerpchdrudp.flags1); - printf("DCERPC Flags2:\t0x%02x\n", sstate->dcerpc.dcerpchdrudp.flags2); - printf("DCERPC Packed Drep:\t%02x %02x %02x\n", - sstate->dcerpc.dcerpchdrudp.drep[0], sstate->dcerpc.dcerpchdrudp.drep[1], - sstate->dcerpc.dcerpchdrudp.drep[2]); - printf("DCERPC Frag Length:\t0x%04x %u\n", sstate->dcerpc.dcerpchdrudp.fraglen, - sstate->dcerpc.dcerpchdrudp.fraglen); - printf("DCERPC Frag Number:\t0x%04x\n", sstate->dcerpc.dcerpchdrudp.fragnum); - printf("DCERPC OpNum:\t0x%04x\n", sstate->dcerpc.dcerpchdrudp.opnum); -#endif - - while (sstate->bytesprocessed >= DCERPC_UDP_HDR_LEN - && sstate->bytesprocessed < sstate->dcerpc.dcerpchdrudp.fraglen - && input_len) { - retval = FragmentDataParser(f, dcerpc_state, pstate, input + parsed, - input_len); - if (retval || retval > input_len) { - parsed += retval; - input_len -= retval; - } else if (input_len) { - SCLogDebug("Error parsing DCERPC UDP Fragment Data"); - parsed -= input_len; - input_len = 0; - sstate->bytesprocessed = 0; - } - } - - if (sstate->bytesprocessed == sstate->dcerpc.dcerpchdrudp.fraglen) { - sstate->bytesprocessed = 0; - } - if (pstate == NULL) - SCReturnStruct(APP_LAYER_ERROR); - - SCReturnStruct(APP_LAYER_OK); + return rs_dcerpc_udp_parse(f, dcerpc_state, pstate, input, input_len, + local_data, flags); } -static void *DCERPCUDPStateAlloc(void) +static void *RustDCERPCUDPStateNew(void) { - void *s = SCMalloc(sizeof(DCERPCUDPState)); - if (unlikely(s == NULL)) - return NULL; - - memset(s, 0, sizeof(DCERPCUDPState)); - return s; + return rs_dcerpc_udp_state_new(); } -static void DCERPCUDPStateFree(void *s) +static void RustDCERPCUDPStateFree(void *s) { - DCERPCUDPState *sstate = (DCERPCUDPState *) s; - - DCERPCUuidEntry *item; - - while ((item = TAILQ_FIRST(&sstate->uuid_list))) { - //printUUID("Free", item); - TAILQ_REMOVE(&sstate->uuid_list, item, next); - SCFree(item); - } - if (sstate->dcerpc.dcerpcrequest.stub_data_buffer != NULL) { - SCFree(sstate->dcerpc.dcerpcrequest.stub_data_buffer); - sstate->dcerpc.dcerpcrequest.stub_data_buffer = NULL; - sstate->dcerpc.dcerpcrequest.stub_data_buffer_len = 0; - } - if (sstate->dcerpc.dcerpcresponse.stub_data_buffer != NULL) { - SCFree(sstate->dcerpc.dcerpcresponse.stub_data_buffer); - sstate->dcerpc.dcerpcresponse.stub_data_buffer = NULL; - sstate->dcerpc.dcerpcresponse.stub_data_buffer_len = 0; - } - - if (sstate->de_state != NULL) { - DetectEngineStateFree(sstate->de_state); - } - - SCFree(s); + return rs_dcerpc_udp_state_free(s); } -static int DCERPCUDPSetTxDetectState(void *vtx, DetectEngineState *de_state) +static int RustDCERPCUDPSetTxDetectState(void *vtx, DetectEngineState *de_state) { - DCERPCUDPState *dce_state = (DCERPCUDPState *)vtx; - dce_state->de_state = de_state; - return 0; + return rs_dcerpc_udp_set_tx_detect_state(vtx, de_state); } -static DetectEngineState *DCERPCUDPGetTxDetectState(void *vtx) +static DetectEngineState *RustDCERPCUDPGetTxDetectState(void *vtx) { - DCERPCUDPState *dce_state = (DCERPCUDPState *)vtx; - return dce_state->de_state; + return rs_dcerpc_udp_get_tx_detect_state(vtx); } -static void DCERPCUDPStateTransactionFree(void *state, uint64_t tx_id) +static void RustDCERPCUDPStateTransactionFree(void *state, uint64_t tx_id) { - /* do nothing */ + return rs_dcerpc_udp_state_transaction_free(state, tx_id); } -static void *DCERPCUDPGetTx(void *state, uint64_t tx_id) +static void *RustDCERPCUDPGetTx(void *state, uint64_t tx_id) { - DCERPCUDPState *dce_state = (DCERPCUDPState *)state; - return dce_state; + return rs_dcerpc_udp_get_tx(state, tx_id); } -static uint64_t DCERPCUDPGetTxCnt(void *state) +static uint64_t RustDCERPCUDPGetTxCnt(void *state) { - /* single tx */ - return 1; + return rs_dcerpc_udp_get_tx_cnt(state); } -static int DCERPCUDPGetAlstateProgressCompletionStatus(uint8_t direction) +static int RustDCERPCUDPGetAlstateProgressCompletionStatus(uint8_t direction) { - return 1; + return rs_dcerpc_udp_get_alstate_progress_completion_status(direction); } -static int DCERPCUDPGetAlstateProgress(void *tx, uint8_t direction) +static int RustDCERPCUDPGetAlstateProgress(void *tx, uint8_t direction) { - return 0; + return rs_dcerpc_udp_get_alstate_progress(tx, direction); } static int DCERPCUDPRegisterPatternsForProtocolDetection(void) @@ -890,300 +129,30 @@ void RegisterDCERPCUDPParsers(void) if (AppLayerParserConfParserEnabled("udp", "dcerpc")) { AppLayerParserRegisterParser(IPPROTO_UDP, ALPROTO_DCERPC, STREAM_TOSERVER, - DCERPCUDPParse); + RustDCERPCUDPParse); AppLayerParserRegisterParser(IPPROTO_UDP, ALPROTO_DCERPC, STREAM_TOCLIENT, - DCERPCUDPParse); - AppLayerParserRegisterStateFuncs(IPPROTO_UDP, ALPROTO_DCERPC, DCERPCUDPStateAlloc, - DCERPCUDPStateFree); + RustDCERPCUDPParse); + AppLayerParserRegisterStateFuncs(IPPROTO_UDP, ALPROTO_DCERPC, RustDCERPCUDPStateNew, + RustDCERPCUDPStateFree); AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_UDP, ALPROTO_DCERPC, STREAM_TOSERVER); - AppLayerParserRegisterTxFreeFunc(IPPROTO_UDP, ALPROTO_DCERPC, DCERPCUDPStateTransactionFree); + AppLayerParserRegisterTxFreeFunc(IPPROTO_UDP, ALPROTO_DCERPC, RustDCERPCUDPStateTransactionFree); AppLayerParserRegisterDetectStateFuncs(IPPROTO_UDP, ALPROTO_DCERPC, - DCERPCUDPGetTxDetectState, DCERPCUDPSetTxDetectState); + RustDCERPCUDPGetTxDetectState, RustDCERPCUDPSetTxDetectState); - AppLayerParserRegisterGetTx(IPPROTO_UDP, ALPROTO_DCERPC, DCERPCUDPGetTx); + AppLayerParserRegisterGetTx(IPPROTO_UDP, ALPROTO_DCERPC, RustDCERPCUDPGetTx); - AppLayerParserRegisterGetTxCnt(IPPROTO_UDP, ALPROTO_DCERPC, DCERPCUDPGetTxCnt); + AppLayerParserRegisterGetTxCnt(IPPROTO_UDP, ALPROTO_DCERPC, RustDCERPCUDPGetTxCnt); - AppLayerParserRegisterGetStateProgressFunc(IPPROTO_UDP, ALPROTO_DCERPC, DCERPCUDPGetAlstateProgress); + AppLayerParserRegisterGetStateProgressFunc(IPPROTO_UDP, ALPROTO_DCERPC, RustDCERPCUDPGetAlstateProgress); AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_DCERPC, - DCERPCUDPGetAlstateProgressCompletionStatus); + RustDCERPCUDPGetAlstateProgressCompletionStatus); } else { SCLogInfo("Parsed disabled for %s protocol. Protocol detection" "still on.", "dcerpc"); } -#ifdef UNITTESTS - AppLayerParserRegisterProtocolUnittests(IPPROTO_UDP, ALPROTO_DCERPC, DCERPCUDPParserRegisterTests); -#endif return; } - -/* UNITTESTS */ -#ifdef UNITTESTS -/** \test DCERPC UDP Header Parsing and UUID handling - */ - -static int DCERPCUDPParserTest01(void) -{ - int result = 1; - Flow f; - uint8_t dcerpcrequest[] = { - 0x04, 0x00, 0x2c, 0x00, 0x10, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xa0, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, - 0x3f, 0x98, 0xf0, 0x5c, 0xd9, 0x63, 0xcc, 0x46, - 0xc2, 0x74, 0x51, 0x6c, 0x8a, 0x53, 0x7d, 0x6f, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0xff, 0xff, - 0xff, 0xff, 0x70, 0x05, 0x00, 0x00, 0x00, 0x00, - 0x05, 0x00, 0x06, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x32, 0x24, 0x58, 0xfd, - 0xcc, 0x45, 0x64, 0x49, 0xb0, 0x70, 0xdd, 0xae, - 0x74, 0x2c, 0x96, 0xd2, 0x60, 0x5e, 0x0d, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x70, 0x5e, 0x0d, 0x00, 0x02, 0x00, 0x00, 0x00, - 0x7c, 0x5e, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x10, 0x00, 0x00, 0x00, 0x80, 0x96, 0xf1, 0xf1, - 0x2a, 0x4d, 0xce, 0x11, 0xa6, 0x6a, 0x00, 0x20, - 0xaf, 0x6e, 0x72, 0xf4, 0x0c, 0x00, 0x00, 0x00, - 0x4d, 0x41, 0x52, 0x42, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x0d, 0xf0, 0xad, 0xba, - 0x00, 0x00, 0x00, 0x00, 0xa8, 0xf4, 0x0b, 0x00, - 0x10, 0x09, 0x00, 0x00, 0x10, 0x09, 0x00, 0x00, - 0x4d, 0x45, 0x4f, 0x57, 0x04, 0x00, 0x00, 0x00, - 0xa2, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, - 0x38, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, - 0x00, 0x00, 0x00, 0x00, 0xe0, 0x08, 0x00, 0x00, - 0xd8, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, - 0xc8, 0x00, 0x00, 0x00, 0x4d, 0x45, 0x4f, 0x57, - 0xd8, 0x08, 0x00, 0x00, 0xd8, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, - 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xc4, 0x28, 0xcd, 0x00, - 0x64, 0x29, 0xcd, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x07, 0x00, 0x00, 0x00, 0xb9, 0x01, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x46, 0xab, 0x01, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x46, 0xa5, 0x01, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x46, 0xa6, 0x01, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x46, 0xa4, 0x01, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x46, 0xad, 0x01, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x46, 0xaa, 0x01, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x46, 0x07, 0x00, 0x00, 0x00, - 0x60, 0x00, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, - 0x90, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, - 0x20, 0x00, 0x00, 0x00, 0x28, 0x06, 0x00, 0x00, - 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, - 0x50, 0x00, 0x00, 0x00, 0x4f, 0xb6, 0x88, 0x20, - 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, - 0x48, 0x00, 0x00, 0x00, 0x07, 0x00, 0x66, 0x00, - 0x06, 0x09, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, - 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x78, 0x19, 0x0c, 0x00, - 0x58, 0x00, 0x00, 0x00, 0x05, 0x00, 0x06, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x70, 0xd8, 0x98, 0x93, - 0x98, 0x4f, 0xd2, 0x11, 0xa9, 0x3d, 0xbe, 0x57, - 0xb2, 0x00, 0x00, 0x00, 0x32, 0x00, 0x31, 0x00, - 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, - 0x80, 0x00, 0x00, 0x00, 0x0d, 0xf0, 0xad, 0xba, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x18, 0x43, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, - 0x4d, 0x45, 0x4f, 0x57, 0x04, 0x00, 0x00, 0x00, - 0xc0, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, - 0x3b, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, - 0x00, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x01, 0x00, 0x81, 0xc5, 0x17, 0x03, - 0x80, 0x0e, 0xe9, 0x4a, 0x99, 0x99, 0xf1, 0x8a, - 0x50, 0x6f, 0x7a, 0x85, 0x02, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, - 0x30, 0x00, 0x00, 0x00, 0x78, 0x00, 0x6e, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xd8, 0xda, 0x0d, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x20, 0x2f, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, - 0x46, 0x00, 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, - 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x2e, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, - 0x68, 0x00, 0x00, 0x00, 0x0e, 0x00, 0xff, 0xff, - 0x68, 0x8b, 0x0b, 0x00, 0x02, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xfe, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xfe, 0x02, 0x00, 0x00, 0x5c, 0x00, 0x5c, 0x00, - 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, - 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, - 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, - 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, - 0x31, 0x00, 0x31, 0x00, 0x9d, 0x13, 0x00, 0x01, - 0xcc, 0xe0, 0xfd, 0x7f, 0xcc, 0xe0, 0xfd, 0x7f, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, - 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90}; - uint32_t requestlen = sizeof(dcerpcrequest); - - TcpSession ssn; - DCERPCUuidEntry *uuid_entry; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_UDP; - f.protomap = FlowGetProtoMapping(f.proto); - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER | STREAM_START, - dcerpcrequest, - requestlen); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCUDPState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - if (dcerpc_state->dcerpc.dcerpchdrudp.rpc_vers != 4) { - printf("expected dcerpc version 0x04, got 0x%02x : ", - dcerpc_state->dcerpc.dcerpchdrudp.rpc_vers); - result = 0; - goto end; - } - - if (dcerpc_state->dcerpc.dcerpchdrudp.fraglen != 1392) { - printf("expected dcerpc fraglen 0x%02x , got 0x%02x : ", 1392, dcerpc_state->dcerpc.dcerpchdrudp.fraglen); - result = 0; - goto end; - } - - if (dcerpc_state->dcerpc.dcerpchdrudp.opnum != 4) { - printf("expected dcerpc opnum 0x%02x , got 0x%02x : ", 4, dcerpc_state->dcerpc.dcerpchdrudp.opnum); - result = 0; - goto end; - } - - TAILQ_FOREACH(uuid_entry, &dcerpc_state->uuid_list, next) { - printUUID("REQUEST", uuid_entry); - } - -end: - if (alp_tctx != NULL) { - AppLayerParserThreadCtxFree(alp_tctx); - } - StreamTcpFreeConfig(TRUE); - return result; -} - -void DCERPCUDPParserRegisterTests(void) -{ - UtRegisterTest("DCERPCUDPParserTest01", DCERPCUDPParserTest01); -} -#endif diff --git a/src/app-layer-dcerpc-udp.h b/src/app-layer-dcerpc-udp.h index c8b7b6816c..d60bc1667c 100644 --- a/src/app-layer-dcerpc-udp.h +++ b/src/app-layer-dcerpc-udp.h @@ -1,31 +1,23 @@ -/* - * Copyright (c) 2009,2010 Open Information Security Foundation +/* Copyright (C) 2017 Open Information Security Foundation * - * \author Kirby Kuehl + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. */ -#ifndef __APP_LAYER_DCERPC_UDP_H__ -#define __APP_LAYER_DCERPC_UDP_H__ - -#include "app-layer-protos.h" -#include "app-layer-parser.h" -#include "app-layer-dcerpc-common.h" -#include "flow.h" -#include "queue.h" -#include "util-byte.h" - -typedef struct DCERPCUDPState_ { - DCERPCUDP dcerpc; - uint16_t bytesprocessed; - uint16_t fraglenleft; - uint8_t *frag_data; - DCERPCUuidEntry *uuid_entry; - TAILQ_HEAD(, DCERPCUuidEntry_) uuid_list; - DetectEngineState *de_state; -} DCERPCUDPState; +#ifndef __APP_LAYER_DCERPC_UDP_RUST_H__ +#define __APP_LAYER_DCERPC_UDP_RUST_H__ void RegisterDCERPCUDPParsers(void); -void DCERPCUDPParserTests(void); -void DCERPCUDPParserRegisterTests(void); -#endif /* __APP_LAYER_DCERPC_UDP_H__ */ +#endif /* !__APP_LAYER_DCERPC_UDP_RUST_H__ */ diff --git a/src/app-layer-dcerpc.c b/src/app-layer-dcerpc.c index f9002824da..d8bca5e398 100644 --- a/src/app-layer-dcerpc.c +++ b/src/app-layer-dcerpc.c @@ -15,29 +15,6 @@ * 02110-1301, USA. */ -/** - * \file - * - * \author Kirby Kuehl - * \author Anoop Saldanha - * - * \file DCE/RPC parser and decoder - * - * \todo Remove all the unnecessary per byte incremental loops with a full one - * time jump, i.e. - * - * input[0], input_len - * for (i = 0; i < x; i++) - * input++; - * - * with - * - * input += x; - * - * You'll be surprised at how many such cases we have here. We also need - * to do the same for htp parser. Should speed up the engine drastically. - */ - #include "suricata-common.h" #include "suricata.h" @@ -65,1867 +42,25 @@ #include "util-spm.h" #include "util-unittest.h" +#include "app-layer-dcerpc-common.h" #include "app-layer-dcerpc.h" -enum { - DCERPC_FIELD_NONE = 0, - DCERPC_PARSE_DCERPC_HEADER, - DCERPC_PARSE_DCERPC_BIND, - DCERPC_PARSE_DCERPC_BIND_ACK, - DCERPC_PARSE_DCERPC_REQUEST, - /* must be last */ - DCERPC_FIELD_MAX, -}; - -void DCERPCUuidListFree(DCERPCUuidEntryList *list); - -/* \brief hexdump function from libdnet, used for debugging only */ -void hexdump(/*Flow *f,*/ const void *buf, size_t len) -{ - /* dumps len bytes of *buf to stdout. Looks like: - * [0000] 75 6E 6B 6E 6F 77 6E 20 - * 30 FF 00 00 00 00 39 00 unknown 0.....9. - * (in a single line of course) - */ - - const unsigned char *p = buf; - unsigned char c; - size_t n; - char bytestr[4] = {0}; - char addrstr[17] = {0}; - char hexstr[ 16*3 + 5] = {0}; - char charstr[16*1 + 5] = {0}; - for (n=1; n<=len; n++) { - if (n%16 == 1) { - /* store address for this line */ -#if __WORDSIZE == 64 - snprintf(addrstr, sizeof(addrstr), "%.4"PRIx64, - ((uint64_t)p-(uint64_t)buf) ); -#else - snprintf(addrstr, sizeof(addrstr), "%.4"PRIx32, - ((uint32_t)p-(uint32_t)buf) ); -#endif - } - - c = *p; - if (isalnum(c) == 0) { - c = '.'; - } - - /* store hex str (for left side) */ - snprintf(bytestr, sizeof(bytestr), "%02X ", *p); - strlcat(hexstr, bytestr, sizeof(hexstr)-strlen(hexstr)-1); - - /* store char str (for right side) */ - snprintf(bytestr, sizeof(bytestr), "%c", c); - strlcat(charstr, bytestr, sizeof(charstr)-strlen(charstr)-1); - - if(n%16 == 0) { - /* line completed */ - printf("[%4.4s] %-50.50s %s\n", addrstr, hexstr, charstr); - hexstr[0] = 0; - charstr[0] = 0; - } else if(n%8 == 0) { - /* half line: add whitespaces */ - strlcat(hexstr, " ", sizeof(hexstr)-strlen(hexstr)-1); - strlcat(charstr, " ", sizeof(charstr)-strlen(charstr)-1); - } - p++; /* next byte */ - } - - if (strlen(hexstr) > 0) { - /* print rest of buffer if not empty */ - printf("[%4.4s] %-50.50s %s\n", addrstr, hexstr, charstr); - } -} - -/** - * \brief printUUID function used to print UUID, Major and Minor Version Number - * and if it was Accepted or Rejected in the BIND_ACK. - */ -void printUUID(const char *type, DCERPCUuidEntry *uuid) -{ - uint8_t i = 0; - if (uuid == NULL) { - return; - } - printf("%s UUID [%2u] %s ", type, uuid->ctxid, - (uuid->result == 0) ? "Accepted" : "Rejected"); - for (i = 0; i < 16; i++) { - printf("%02x", uuid->uuid[i]); - } - printf(" Major Version 0x%04x Minor Version 0x%04x\n", uuid->version, - uuid->versionminor); -} - -/** - * \brief DCERPCParseSecondaryAddr reads secondaryaddrlen bytes from the BIND_ACK - * DCERPC call. - */ -static uint32_t DCERPCParseSecondaryAddr(DCERPC *dcerpc, const uint8_t *input, uint32_t input_len) -{ - SCEnter(); - const uint8_t *p = input; - while (dcerpc->dcerpcbindbindack.secondaryaddrlenleft-- && input_len--) { - SCLogDebug("0x%02x ", *p); - p++; - } - dcerpc->bytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); -} - -static uint32_t PaddingParser(DCERPC *dcerpc, const uint8_t *input, uint32_t input_len) -{ - SCEnter(); - const uint8_t *p = input; - while (dcerpc->padleft-- && input_len--) { - SCLogDebug("0x%02x ", *p); - p++; - } - dcerpc->bytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); -} - -static uint32_t DCERPCGetCTXItems(DCERPC *dcerpc, const uint8_t *input, uint32_t input_len) -{ - SCEnter(); - const uint8_t *p = input; - if (input_len) { - switch (dcerpc->dcerpcbindbindack.ctxbytesprocessed) { - case 0: - if (input_len >= 4) { - dcerpc->dcerpcbindbindack.numctxitems = *p; - dcerpc->dcerpcbindbindack.numctxitemsleft = dcerpc->dcerpcbindbindack.numctxitems; - dcerpc->dcerpcbindbindack.ctxbytesprocessed += 4; - dcerpc->bytesprocessed += 4; - SCReturnUInt(4U); - } else { - dcerpc->dcerpcbindbindack.numctxitems = *(p++); - dcerpc->dcerpcbindbindack.numctxitemsleft = dcerpc->dcerpcbindbindack.numctxitems; - if (!(--input_len)) - break; - } - /* fall through */ - case 1: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 2: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 3: - p++; - input_len--; - break; - } - } - dcerpc->dcerpcbindbindack.ctxbytesprocessed += (p - input); - dcerpc->bytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); -} - -/** - * \brief DCERPCParseBINDCTXItem is called for each CTXItem found the DCERPC BIND call. - * each UUID is added to a TAILQ. - */ - -static uint32_t DCERPCParseBINDCTXItem(DCERPC *dcerpc, const uint8_t *input, uint32_t input_len) -{ - SCEnter(); - const uint8_t *p = input; - - if (input_len) { - switch (dcerpc->dcerpcbindbindack.ctxbytesprocessed) { - case 0: - if (input_len >= 44) { - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.ctxid = *(p); - dcerpc->dcerpcbindbindack.ctxid |= *(p + 1) << 8; - dcerpc->dcerpcbindbindack.uuid[3] = *(p + 4); - dcerpc->dcerpcbindbindack.uuid[2] = *(p + 5); - dcerpc->dcerpcbindbindack.uuid[1] = *(p + 6); - dcerpc->dcerpcbindbindack.uuid[0] = *(p + 7); - dcerpc->dcerpcbindbindack.uuid[5] = *(p + 8); - dcerpc->dcerpcbindbindack.uuid[4] = *(p + 9); - dcerpc->dcerpcbindbindack.uuid[7] = *(p + 10); - dcerpc->dcerpcbindbindack.uuid[6] = *(p + 11); - dcerpc->dcerpcbindbindack.uuid[8] = *(p + 12); - dcerpc->dcerpcbindbindack.uuid[9] = *(p + 13); - dcerpc->dcerpcbindbindack.uuid[10] = *(p + 14); - dcerpc->dcerpcbindbindack.uuid[11] = *(p + 15); - dcerpc->dcerpcbindbindack.uuid[12] = *(p + 16); - dcerpc->dcerpcbindbindack.uuid[13] = *(p + 17); - dcerpc->dcerpcbindbindack.uuid[14] = *(p + 18); - dcerpc->dcerpcbindbindack.uuid[15] = *(p + 19); - dcerpc->dcerpcbindbindack.version = *(p + 20); - dcerpc->dcerpcbindbindack.version |= *(p + 21) << 8; - dcerpc->dcerpcbindbindack.versionminor = *(p + 22); - dcerpc->dcerpcbindbindack.versionminor |= *(p + 23) << 8; - } else { /* Big Endian */ - dcerpc->dcerpcbindbindack.ctxid = *(p) << 8; - dcerpc->dcerpcbindbindack.ctxid |= *(p + 1); - dcerpc->dcerpcbindbindack.uuid[0] = *(p + 4); - dcerpc->dcerpcbindbindack.uuid[1] = *(p + 5); - dcerpc->dcerpcbindbindack.uuid[2] = *(p + 6); - dcerpc->dcerpcbindbindack.uuid[3] = *(p + 7); - dcerpc->dcerpcbindbindack.uuid[4] = *(p + 8); - dcerpc->dcerpcbindbindack.uuid[5] = *(p + 9); - dcerpc->dcerpcbindbindack.uuid[6] = *(p + 10); - dcerpc->dcerpcbindbindack.uuid[7] = *(p + 11); - dcerpc->dcerpcbindbindack.uuid[8] = *(p + 12); - dcerpc->dcerpcbindbindack.uuid[9] = *(p + 13); - dcerpc->dcerpcbindbindack.uuid[10] = *(p + 14); - dcerpc->dcerpcbindbindack.uuid[11] = *(p + 15); - dcerpc->dcerpcbindbindack.uuid[12] = *(p + 16); - dcerpc->dcerpcbindbindack.uuid[13] = *(p + 17); - dcerpc->dcerpcbindbindack.uuid[14] = *(p + 18); - dcerpc->dcerpcbindbindack.uuid[15] = *(p + 19); - dcerpc->dcerpcbindbindack.version = *(p + 20) << 8; - dcerpc->dcerpcbindbindack.version |= *(p + 21); - dcerpc->dcerpcbindbindack.versionminor = *(p + 22) << 8; - dcerpc->dcerpcbindbindack.versionminor |= *(p + 23); - } - //if (dcerpc->dcerpcbindbindack.ctxid == dcerpc->dcerpcbindbindack.numctxitems - // - dcerpc->dcerpcbindbindack.numctxitemsleft) { - - dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *)SCCalloc(1, sizeof(DCERPCUuidEntry)); - if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) { - SCLogDebug("UUID Entry is NULL"); - SCReturnUInt(0); - } - - dcerpc->dcerpcbindbindack.uuid_entry->internal_id = dcerpc->dcerpcbindbindack.uuid_internal_id++; - - memcpy(dcerpc->dcerpcbindbindack.uuid_entry->uuid, - dcerpc->dcerpcbindbindack.uuid, - sizeof(dcerpc->dcerpcbindbindack.uuid)); - - dcerpc->dcerpcbindbindack.uuid_entry->ctxid = dcerpc->dcerpcbindbindack.ctxid; - dcerpc->dcerpcbindbindack.uuid_entry->version = dcerpc->dcerpcbindbindack.version; - dcerpc->dcerpcbindbindack.uuid_entry->versionminor = dcerpc->dcerpcbindbindack.versionminor; - - /* store the first frag flag in the uuid as pfc_flags will - * be overwritten by new packets. */ - if (dcerpc->dcerpchdr.pfc_flags & PFC_FIRST_FRAG) { - dcerpc->dcerpcbindbindack.uuid_entry->flags |= DCERPC_UUID_ENTRY_FLAG_FF; - } - - TAILQ_INSERT_HEAD(&dcerpc->dcerpcbindbindack.uuid_list, - dcerpc->dcerpcbindbindack.uuid_entry, - next); - -#ifdef UNITTESTS - if (RunmodeIsUnittests()) { - printUUID("BIND", dcerpc->dcerpcbindbindack.uuid_entry); - } -#endif - dcerpc->dcerpcbindbindack.numctxitemsleft--; - dcerpc->bytesprocessed += (44); - dcerpc->dcerpcbindbindack.ctxbytesprocessed += (44); - SCReturnUInt(44U); - - //} else { - // SCLogDebug("ctxitem %u, expected %u\n", dcerpc->dcerpcbindbindack.ctxid, - // dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft); - // SCReturnUInt(0); - //} - } else { - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.ctxid = *(p++); - } else { - dcerpc->dcerpcbindbindack.ctxid = *(p++) << 8; - } - if (!(--input_len)) - break; - } - /* fall through */ - case 1: - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.ctxid |= *(p++) << 8; - } else { - dcerpc->dcerpcbindbindack.ctxid |= *(p++); - } - if (!(--input_len)) - break; - /* fall through */ - case 2: - /* num transact items */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 3: - /* reserved */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 4: - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.uuid[3] = *(p++); - } else { - dcerpc->dcerpcbindbindack.uuid[0] = *(p++); - } - if (!(--input_len)) - break; - /* fall through */ - case 5: - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.uuid[2] = *(p++); - } else { - dcerpc->dcerpcbindbindack.uuid[1] = *(p++); - } - if (!(--input_len)) - break; - /* fall through */ - case 6: - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.uuid[1] = *(p++); - } else { - dcerpc->dcerpcbindbindack.uuid[2] = *(p++); - } - if (!(--input_len)) - break; - /* fall through */ - case 7: - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.uuid[0] = *(p++); - } else { - dcerpc->dcerpcbindbindack.uuid[3] = *(p++); - } - if (!(--input_len)) - break; - /* fall through */ - case 8: - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.uuid[5] = *(p++); - } else { - dcerpc->dcerpcbindbindack.uuid[4] = *(p++); - } - if (!(--input_len)) - break; - /* fall through */ - case 9: - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.uuid[4] = *(p++); - } else { - dcerpc->dcerpcbindbindack.uuid[5] = *(p++); - } - if (!(--input_len)) - break; - /* fall through */ - case 10: - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.uuid[7] = *(p++); - } else { - dcerpc->dcerpcbindbindack.uuid[6] = *(p++); - } - if (!(--input_len)) - break; - /* fall through */ - case 11: - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.uuid[6] = *(p++); - } else { - dcerpc->dcerpcbindbindack.uuid[7] = *(p++); - } - if (!(--input_len)) - break; - /* fall through */ - case 12: - /* The following bytes are in the same order for both big and little endian */ - dcerpc->dcerpcbindbindack.uuid[8] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 13: - dcerpc->dcerpcbindbindack.uuid[9] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 14: - dcerpc->dcerpcbindbindack.uuid[10] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 15: - dcerpc->dcerpcbindbindack.uuid[11] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 16: - dcerpc->dcerpcbindbindack.uuid[12] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 17: - dcerpc->dcerpcbindbindack.uuid[13] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 18: - dcerpc->dcerpcbindbindack.uuid[14] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 19: - dcerpc->dcerpcbindbindack.uuid[15] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 20: - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.version = *(p++); - } else { - dcerpc->dcerpcbindbindack.version = *(p++) << 8; - } - if (!(--input_len)) - break; - /* fall through */ - case 21: - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.version |= *(p++) << 8; - } else { - dcerpc->dcerpcbindbindack.version |= *(p++); - } - if (!(--input_len)) - break; - /* fall through */ - case 22: - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.versionminor = *(p++); - } else { - dcerpc->dcerpcbindbindack.versionminor = *(p++) << 8; - } - if (!(--input_len)) - break; - /* fall through */ - case 23: - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.versionminor |= *(p++) << 8; - } else { - dcerpc->dcerpcbindbindack.versionminor |= *(p++); - } - if (!(--input_len)) - break; - /* fall through */ - case 24: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 25: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 26: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 27: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 28: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 29: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 30: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 31: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 32: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 33: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 34: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 35: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 36: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 37: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 38: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 39: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 40: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 41: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 42: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 43: - p++; - --input_len; - //if (dcerpc->dcerpcbindbindack.ctxid == dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft) { - dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *) - SCCalloc(1, sizeof(DCERPCUuidEntry)); - if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) { - SCLogDebug("UUID Entry is NULL\n"); - SCReturnUInt(0); - } - - dcerpc->dcerpcbindbindack.uuid_entry->internal_id = - dcerpc->dcerpcbindbindack.uuid_internal_id++; - memcpy(dcerpc->dcerpcbindbindack.uuid_entry->uuid, - dcerpc->dcerpcbindbindack.uuid, - sizeof(dcerpc->dcerpcbindbindack.uuid)); - dcerpc->dcerpcbindbindack.uuid_entry->ctxid = dcerpc->dcerpcbindbindack.ctxid; - dcerpc->dcerpcbindbindack.uuid_entry->version = dcerpc->dcerpcbindbindack.version; - dcerpc->dcerpcbindbindack.uuid_entry->versionminor = dcerpc->dcerpcbindbindack.versionminor; - - /* store the first frag flag in the uuid as pfc_flags will - * be overwritten by new packets. */ - if (dcerpc->dcerpchdr.pfc_flags & PFC_FIRST_FRAG) { - dcerpc->dcerpcbindbindack.uuid_entry->flags |= DCERPC_UUID_ENTRY_FLAG_FF; - } - - TAILQ_INSERT_HEAD(&dcerpc->dcerpcbindbindack.uuid_list, - dcerpc->dcerpcbindbindack.uuid_entry, - next); -#ifdef UNITTESTS - if (RunmodeIsUnittests()) { - printUUID("BINDACK", dcerpc->dcerpcbindbindack.uuid_entry); - } -#endif - dcerpc->dcerpcbindbindack.numctxitemsleft--; - dcerpc->bytesprocessed += (p - input); - dcerpc->dcerpcbindbindack.ctxbytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); - - //} else { - // SCLogDebug("ctxitem %u, expected %u\n", dcerpc->dcerpcbindbindack.ctxid, - // dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft); - // SCReturnUInt(0); - //} - break; - } - } - dcerpc->dcerpcbindbindack.ctxbytesprocessed += (p - input); - dcerpc->bytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); -} - -/** - * \brief DCERPCParseBINDACKCTXItem is called for each CTXItem found in - * the BIND_ACK call. The result (Accepted or Rejected) is added to the - * correct UUID from the BIND call. - */ -static uint32_t DCERPCParseBINDACKCTXItem(DCERPC *dcerpc, const uint8_t *input, uint32_t input_len) -{ - SCEnter(); - const uint8_t *p = input; - DCERPCUuidEntry *uuid_entry; - - if (input_len) { - switch (dcerpc->dcerpcbindbindack.ctxbytesprocessed) { - case 0: - if (input_len >= 24) { - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.result = *p; - dcerpc->dcerpcbindbindack.result |= *(p + 1) << 8; - } else { - dcerpc->dcerpcbindbindack.result = *p << 8; - dcerpc->dcerpcbindbindack.result |= *(p + 1); - } - TAILQ_FOREACH(uuid_entry, &dcerpc->dcerpcbindbindack.uuid_list, next) { - if (uuid_entry->internal_id == dcerpc->dcerpcbindbindack.uuid_internal_id) { - uuid_entry->result = dcerpc->dcerpcbindbindack.result; -#ifdef UNITTESTS - if (RunmodeIsUnittests()) { - printUUID("BIND_ACK", uuid_entry); - } -#endif - if (uuid_entry->result != 0) - break; - - dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *) - SCCalloc(1, sizeof(DCERPCUuidEntry)); - if (dcerpc->dcerpcbindbindack.uuid_entry != NULL) { - memcpy(dcerpc->dcerpcbindbindack.uuid_entry, - uuid_entry, - sizeof(DCERPCUuidEntry)); - TAILQ_INSERT_HEAD(&dcerpc->dcerpcbindbindack.accepted_uuid_list, - dcerpc->dcerpcbindbindack.uuid_entry, - next); - } - break; - } - } - dcerpc->dcerpcbindbindack.uuid_internal_id++; - dcerpc->dcerpcbindbindack.numctxitemsleft--; - dcerpc->bytesprocessed += (24); - dcerpc->dcerpcbindbindack.ctxbytesprocessed += (24); - SCReturnUInt(24U); - } else { - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.result = *(p++); - } else { - dcerpc->dcerpcbindbindack.result = *(p++) << 8; - } - if (!(--input_len)) - break; - } - /* fall through */ - case 1: - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.result |= *(p++) << 8; - } else { - dcerpc->dcerpcbindbindack.result |= *(p++); - } - if (!(--input_len)) - break; - /* fall through */ - case 2: - /* num transact items */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 3: - /* reserved */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 4: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 5: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 6: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 7: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 8: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 9: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 10: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 11: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 12: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 13: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 14: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 15: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 16: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 17: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 18: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 19: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 20: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 21: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 22: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 23: - TAILQ_FOREACH(uuid_entry, &dcerpc->dcerpcbindbindack.uuid_list, next) { - if (uuid_entry->internal_id == dcerpc->dcerpcbindbindack.uuid_internal_id) { - uuid_entry->result = dcerpc->dcerpcbindbindack.result; -#ifdef UNITTESTS - if (RunmodeIsUnittests()) { - printUUID("BIND_ACK", uuid_entry); - } -#endif - if (uuid_entry->result != 0) - break; - - dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *) - SCCalloc(1, sizeof(DCERPCUuidEntry)); - if (dcerpc->dcerpcbindbindack.uuid_entry != NULL) { - memcpy(dcerpc->dcerpcbindbindack.uuid_entry, - uuid_entry, - sizeof(DCERPCUuidEntry)); - TAILQ_INSERT_HEAD(&dcerpc->dcerpcbindbindack.accepted_uuid_list, - dcerpc->dcerpcbindbindack.uuid_entry, - next); - } - break; - } - } - dcerpc->dcerpcbindbindack.uuid_internal_id++; - dcerpc->dcerpcbindbindack.numctxitemsleft--; - p++; - --input_len; - break; - - } - } - dcerpc->dcerpcbindbindack.ctxbytesprocessed += (p - input); - dcerpc->bytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); -} - -static uint32_t DCERPCParseBIND(DCERPC *dcerpc, const uint8_t *input, uint32_t input_len) -{ - SCEnter(); - const uint8_t *p = input; - if (input_len) { - switch (dcerpc->bytesprocessed) { - case 16: - dcerpc->dcerpcbindbindack.numctxitems = 0; - if (input_len >= 12) { - DCERPCUuidListFree(&dcerpc->dcerpcbindbindack.uuid_list); - if (dcerpc->dcerpchdr.type == BIND) { - DCERPCUuidListFree(&dcerpc->dcerpcbindbindack.accepted_uuid_list); - } - dcerpc->dcerpcbindbindack.uuid_internal_id = 0; - dcerpc->dcerpcbindbindack.numctxitems = *(p + 8); - dcerpc->dcerpcbindbindack.numctxitemsleft = dcerpc->dcerpcbindbindack.numctxitems; - dcerpc->bytesprocessed += 12; - SCReturnUInt(12U); - } else { - /* max_xmit_frag */ - p++; - if (!(--input_len)) - break; - } - /* fall through */ - case 17: - /* max_xmit_frag */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 18: - /* max_recv_frag */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 19: - /* max_recv_frag */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 20: - /* assoc_group_id */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 21: - /* assoc_group_id */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 22: - /* assoc_group_id */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 23: - /* assoc_group_id */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 24: - DCERPCUuidListFree(&dcerpc->dcerpcbindbindack.uuid_list); - if (dcerpc->dcerpchdr.type == BIND) { - DCERPCUuidListFree(&dcerpc->dcerpcbindbindack.accepted_uuid_list); - } - dcerpc->dcerpcbindbindack.uuid_internal_id = 0; - dcerpc->dcerpcbindbindack.numctxitems = *(p++); - dcerpc->dcerpcbindbindack.numctxitemsleft = dcerpc->dcerpcbindbindack.numctxitems; - if (!(--input_len)) - break; - /* fall through */ - case 25: - /* pad byte 1 */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 26: - /* pad byte 2 */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 27: - /* pad byte 3 */ - p++; - --input_len; - break; - /* fall through */ - default: - dcerpc->bytesprocessed++; - SCReturnUInt(1); - break; - } - } - dcerpc->bytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); -} - -static uint32_t DCERPCParseBINDACK(DCERPC *dcerpc, const uint8_t *input, uint32_t input_len) -{ - SCEnter(); - const uint8_t *p = input; - - switch (dcerpc->bytesprocessed) { - case 16: - dcerpc->dcerpcbindbindack.uuid_internal_id = 0; - dcerpc->dcerpcbindbindack.numctxitems = 0; - if (input_len >= 10) { - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.secondaryaddrlen = *(p + 8); - dcerpc->dcerpcbindbindack.secondaryaddrlen |= *(p + 9) << 8; - } else { - dcerpc->dcerpcbindbindack.secondaryaddrlen = *(p + 8) << 8; - dcerpc->dcerpcbindbindack.secondaryaddrlen |= *(p + 9); - } - dcerpc->dcerpcbindbindack.secondaryaddrlenleft = dcerpc->dcerpcbindbindack.secondaryaddrlen; - dcerpc->bytesprocessed += 10; - SCReturnUInt(10U); - } else { - /* max_xmit_frag */ - p++; - if (!(--input_len)) - break; - } - /* fall through */ - case 17: - /* max_xmit_frag */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 18: - /* max_recv_frag */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 19: - /* max_recv_frag */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 20: - /* assoc_group_id */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 21: - /* assoc_group_id */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 22: - /* assoc_group_id */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 23: - /* assoc_group_id */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 24: - dcerpc->dcerpcbindbindack.secondaryaddrlen = *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 25: - dcerpc->dcerpcbindbindack.secondaryaddrlen |= *(p++); - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcbindbindack.secondaryaddrlen = SCByteSwap16(dcerpc->dcerpcbindbindack.secondaryaddrlen); - } - dcerpc->dcerpcbindbindack.secondaryaddrlenleft = dcerpc->dcerpcbindbindack.secondaryaddrlen; - SCLogDebug("secondaryaddrlen %u 0x%04x\n", dcerpc->dcerpcbindbindack.secondaryaddrlen, - dcerpc->dcerpcbindbindack.secondaryaddrlen); - --input_len; - break; - default: - dcerpc->bytesprocessed++; - SCReturnUInt(1); - break; - } - dcerpc->bytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); -} - -static uint32_t DCERPCParseREQUEST(DCERPC *dcerpc, const uint8_t *input, uint32_t input_len) -{ - SCEnter(); - const uint8_t *p = input; - - switch (dcerpc->bytesprocessed) { - case 16: - dcerpc->dcerpcbindbindack.numctxitems = 0; - if (input_len >= 8) { - if (dcerpc->dcerpchdr.type == REQUEST) { - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpcrequest.ctxid = *(p + 4); - dcerpc->dcerpcrequest.ctxid |= *(p + 5) << 8; - dcerpc->dcerpcrequest.opnum = *(p + 6); - dcerpc->dcerpcrequest.opnum |= *(p + 7) << 8; - } else { - dcerpc->dcerpcrequest.ctxid = *(p + 4) << 8; - dcerpc->dcerpcrequest.ctxid |= *(p + 5); - dcerpc->dcerpcrequest.opnum = *(p + 6) << 8; - dcerpc->dcerpcrequest.opnum |= *(p + 7); - } - dcerpc->dcerpcrequest.first_request_seen = 1; - } - dcerpc->bytesprocessed += 8; - SCReturnUInt(8U); - } else { - /* alloc hint 1 */ - p++; - if (!(--input_len)) - break; - } - /* fall through */ - case 17: - /* alloc hint 2 */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 18: - /* alloc hint 3 */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 19: - /* alloc hint 4 */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 20: - /* context id 1 */ - dcerpc->dcerpcrequest.ctxid = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 21: - /* context id 2 */ - dcerpc->dcerpcrequest.ctxid |= *(p++) << 8; - if (!(dcerpc->dcerpchdr.packed_drep[0] & 0x10)) { - dcerpc->dcerpcrequest.ctxid = SCByteSwap16(dcerpc->dcerpcrequest.ctxid); - } - dcerpc->dcerpcrequest.first_request_seen = 1; - if (!(--input_len)) - break; - /* fall through */ - case 22: - if (dcerpc->dcerpchdr.type == REQUEST) { - dcerpc->dcerpcrequest.opnum = *(p++); - } else { - p++; - } - if (!(--input_len)) - break; - /* fall through */ - case 23: - if (dcerpc->dcerpchdr.type == REQUEST) { - dcerpc->dcerpcrequest.opnum |= *(p++) << 8; - if (!(dcerpc->dcerpchdr.packed_drep[0] & 0x10)) { - dcerpc->dcerpcrequest.opnum = SCByteSwap16(dcerpc->dcerpcrequest.opnum); - } - } else { - p++; - } - --input_len; - break; - default: - dcerpc->bytesprocessed++; - SCReturnUInt(1); - break; - } - dcerpc->bytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); -} - -/** \internal - * \retval stub_len or 0 in case of error */ -static uint32_t StubDataParser(DCERPC *dcerpc, const uint8_t *input, uint32_t input_len) -{ - SCEnter(); - uint8_t **stub_data_buffer = NULL; - uint32_t *stub_data_buffer_len = NULL; - - SCLogDebug("input_len %u", input_len); - - /* request PDU. Retrieve the request stub buffer */ - if (dcerpc->dcerpchdr.type == REQUEST) { - stub_data_buffer = &dcerpc->dcerpcrequest.stub_data_buffer; - stub_data_buffer_len = &dcerpc->dcerpcrequest.stub_data_buffer_len; - - SCLogDebug("REQUEST stub_data_buffer_len %u", *stub_data_buffer_len); - - /* response PDU. Retrieve the response stub buffer */ - } else { - stub_data_buffer = &dcerpc->dcerpcresponse.stub_data_buffer; - stub_data_buffer_len = &dcerpc->dcerpcresponse.stub_data_buffer_len; - - SCLogDebug("RESPONSE stub_data_buffer_len %u", *stub_data_buffer_len); - } - if (*stub_data_buffer_len > (1024 * 1024)) { - SCFree(*stub_data_buffer); - *stub_data_buffer = NULL; - SCReturnUInt(0); - } - - uint32_t stub_len = MIN(dcerpc->padleft, input_len); - if (stub_len == 0) { - SCReturnInt(0); - } - SCLogDebug("stub_len %u input_len %u", stub_len, input_len); - - const uint8_t f = dcerpc->dcerpchdr.pfc_flags & (PFC_FIRST_FRAG|PFC_LAST_FRAG); - SCLogDebug("f %02x, FIRST %s LAST %s", f, - f & PFC_FIRST_FRAG ? "true" : "false", - f & PFC_LAST_FRAG ? "true" : "false"); - if (stub_len == dcerpc->padleft && ((f == 0) || (f & PFC_LAST_FRAG))) { - if (dcerpc->dcerpchdr.type == REQUEST) { - dcerpc->dcerpcrequest.stub_data_buffer_reset = true; - SCLogDebug("REQUEST reset stub"); - } else { - dcerpc->dcerpcresponse.stub_data_buffer_reset = true; - SCLogDebug("RESPONSE reset stub"); - } - } - - void *ptmp = SCRealloc(*stub_data_buffer, *stub_data_buffer_len + stub_len); - if (ptmp == NULL) { - SCFree(*stub_data_buffer); - *stub_data_buffer = NULL; - SCReturnUInt(0); - } - *stub_data_buffer = ptmp; - - memcpy(*stub_data_buffer + *stub_data_buffer_len, input, stub_len); - - /* length of the buffered stub */ - *stub_data_buffer_len += stub_len; - /* To see the total reassembled stubdata */ - //hexdump(*stub_data_buffer, *stub_data_buffer_len); - - dcerpc->padleft -= stub_len; - dcerpc->bytesprocessed += stub_len; - - SCLogDebug("padleft %u bytesprocessed %u", dcerpc->padleft, dcerpc->bytesprocessed); - -#ifdef DEBUG - if (SCLogDebugEnabled()) { - uint32_t i = 0; - for (i = 0; i < stub_len; i++) { - SCLogDebug("0x%02x ", input[i]); - } - } -#endif - SCReturnUInt((uint32_t)stub_len); -} - -/** - * \brief DCERPCParseHeader parses the 16 byte DCERPC header - * A fast path for normal decoding is used when there is enough bytes - * present to parse the entire header. A slow path is used to parse - * fragmented packets. - * \retval -1 if DCERPC Header does not validate - * \retval Number of bytes processed - */ -static int DCERPCParseHeader(DCERPC *dcerpc, const uint8_t *input, uint32_t input_len) -{ - SCEnter(); - const uint8_t *p = input; - - if (input_len) { - SCLogDebug("dcerpc->bytesprocessed %u", dcerpc->bytesprocessed); - switch (dcerpc->bytesprocessed) { - case 0: - if (input_len >= DCERPC_HDR_LEN) { - dcerpc->dcerpchdr.rpc_vers = *p; - dcerpc->dcerpchdr.rpc_vers_minor = *(p + 1); - if ((dcerpc->dcerpchdr.rpc_vers != 5) || - ((dcerpc->dcerpchdr.rpc_vers_minor != 0) && - (dcerpc->dcerpchdr.rpc_vers_minor != 1))) { - SCLogDebug("DCERPC Header did not validate"); - SCReturnInt(-1); - } - dcerpc->dcerpchdr.type = *(p + 2); - SCLogDebug("dcerpc->dcerpchdr.type %02x", - dcerpc->dcerpchdr.type); - dcerpc->dcerpchdr.pfc_flags = *(p + 3); - dcerpc->dcerpchdr.packed_drep[0] = *(p + 4); - dcerpc->dcerpchdr.packed_drep[1] = *(p + 5); - dcerpc->dcerpchdr.packed_drep[2] = *(p + 6); - dcerpc->dcerpchdr.packed_drep[3] = *(p + 7); - if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { - dcerpc->dcerpchdr.frag_length = *(p + 8); - dcerpc->dcerpchdr.frag_length |= *(p + 9) << 8; - dcerpc->dcerpchdr.auth_length = *(p + 10); - dcerpc->dcerpchdr.auth_length |= *(p + 11) << 8; - dcerpc->dcerpchdr.call_id = (uint32_t) *(p + 12) << 24; - dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 13) << 16; - dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 14) << 8; - dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 15); - } else { - dcerpc->dcerpchdr.frag_length = *(p + 8) << 8; - dcerpc->dcerpchdr.frag_length |= *(p + 9); - dcerpc->dcerpchdr.auth_length = *(p + 10) << 8; - dcerpc->dcerpchdr.auth_length |= *(p + 11); - dcerpc->dcerpchdr.call_id = (uint32_t) *(p + 12); - dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 13) << 8; - dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 14) << 16; - dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 15) << 24; - } - dcerpc->bytesprocessed = DCERPC_HDR_LEN; - SCReturnInt(16); - break; - } else { - dcerpc->dcerpchdr.rpc_vers = *(p++); - if (!(--input_len)) - break; - } - /* fall through */ - case 1: - dcerpc->dcerpchdr.rpc_vers_minor = *(p++); - if ((dcerpc->dcerpchdr.rpc_vers != 5) || - ((dcerpc->dcerpchdr.rpc_vers_minor != 0) && - (dcerpc->dcerpchdr.rpc_vers_minor != 1))) { - SCLogDebug("DCERPC Header did not validate"); - SCReturnInt(-1); - } - if (!(--input_len)) - break; - /* fall through */ - case 2: - dcerpc->dcerpchdr.type = *(p++); - SCLogDebug("dcerpc->dcerpchdr.type %02x", - dcerpc->dcerpchdr.type); - if (!(--input_len)) - break; - /* fall through */ - case 3: - dcerpc->dcerpchdr.pfc_flags = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 4: - dcerpc->dcerpchdr.packed_drep[0] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 5: - dcerpc->dcerpchdr.packed_drep[1] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 6: - dcerpc->dcerpchdr.packed_drep[2] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 7: - dcerpc->dcerpchdr.packed_drep[3] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 8: - dcerpc->dcerpchdr.frag_length = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 9: - dcerpc->dcerpchdr.frag_length |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 10: - dcerpc->dcerpchdr.auth_length = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 11: - dcerpc->dcerpchdr.auth_length |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 12: - dcerpc->dcerpchdr.call_id = (uint32_t) *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 13: - dcerpc->dcerpchdr.call_id |= (uint32_t) *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 14: - dcerpc->dcerpchdr.call_id |= (uint32_t) *(p++) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 15: - dcerpc->dcerpchdr.call_id |= (uint32_t) *(p++) << 24; - if (!(dcerpc->dcerpchdr.packed_drep[0] & 0x10)) { - dcerpc->dcerpchdr.frag_length = SCByteSwap16(dcerpc->dcerpchdr.frag_length); - dcerpc->dcerpchdr.auth_length = SCByteSwap16(dcerpc->dcerpchdr.auth_length); - dcerpc->dcerpchdr.call_id = SCByteSwap32(dcerpc->dcerpchdr.call_id); - } - --input_len; - break; - default: - dcerpc->bytesprocessed++; - SCReturnInt(1); - } - } - dcerpc->bytesprocessed += (p - input); - SCReturnInt((p - input)); -} - -static inline void DCERPCResetParsingState(DCERPC *dcerpc) -{ - dcerpc->bytesprocessed = 0; - dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0; - - return; -} - -static inline void DCERPCResetStub(DCERPC *dcerpc) -{ - if (dcerpc->dcerpchdr.type == REQUEST) { - SCLogDebug("REQUEST resetting stub"); - dcerpc->dcerpcrequest.stub_data_buffer_len = 0; - dcerpc->dcerpcrequest.stub_data_buffer_reset = false; - } else if (dcerpc->dcerpchdr.type == RESPONSE) { - SCLogDebug("RESPONSE resetting stub"); - dcerpc->dcerpcresponse.stub_data_buffer_len = 0; - dcerpc->dcerpcresponse.stub_data_buffer_reset = false; - } - - return; -} - -static inline int DCERPCThrowOutExtraData(DCERPC *dcerpc, const uint8_t *input, - uint16_t input_len) -{ - int parsed = 0; - /* the function always assumes that - * dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length */ - if (input_len > (dcerpc->dcerpchdr.frag_length - dcerpc->bytesprocessed)) { - parsed = dcerpc->dcerpchdr.frag_length - dcerpc->bytesprocessed; - } else { - parsed = input_len; - } - dcerpc->bytesprocessed += parsed; - - return parsed; -} - -/** - * \todo - Currently the parser is very generic. Enable target based - * reassembly. - * - Disable reiniting tailq for mid and last bind/alter_context pdus. - * - Use a PM to search for subsequent 05 00 when we see an inconsistent - * pdu. This should be done for each platform based on how it handles - * a condition where it has receives a segment with 2 pdus, while the - * first pdu in the segment is corrupt. - */ -int32_t DCERPCParser(DCERPC *dcerpc, const uint8_t *input, uint32_t input_len) -{ - SCEnter(); - - uint32_t retval = 0; - uint32_t parsed = 0; - int hdrretval = 0; - - /* temporary use. we will get rid of this later, once we have ironed out - * all the endless loops cases */ - int counter = 0; - - while (input_len) { - /* in case we have any corner cases remainging, we have this */ - if (counter++ == 30) { - SCLogDebug("Somehow seem to be stuck inside the dce " - "parser for quite sometime. Let's get out of here."); - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } - - while (dcerpc->bytesprocessed < DCERPC_HDR_LEN && input_len) { - hdrretval = DCERPCParseHeader(dcerpc, input + parsed, input_len); - if (hdrretval == -1 || hdrretval > (int32_t)input_len) { - SCLogDebug("Error parsing dce header. Discarding " - "PDU and reseting parsing state to parse next PDU"); - /* error parsing pdu header. Let's clear the dce state */ - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } else { - parsed += hdrretval; - input_len -= hdrretval; - } - } - SCLogDebug("Done with DCERPCParseHeader bytesprocessed %u/%u left %u", - dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len); -#if 0 - printf("Done with DCERPCParseHeader bytesprocessed %u/%u input_len left %u\n", - dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len); - printf("\nDCERPC Version:\t%u\n", dcerpc->dcerpchdr.rpc_vers); - printf("DCERPC Version Minor:\t%u\n", dcerpc->dcerpchdr.rpc_vers_minor); - printf("DCERPC Type:\t%u\n", dcerpc->dcerpchdr.type); - printf("DCERPC Flags:\t0x%02x\n", dcerpc->dcerpchdr.pfc_flags); - printf("DCERPC Packed Drep:\t%02x %02x %02x %02x\n", - dcerpc->dcerpchdr.packed_drep[0], dcerpc->dcerpchdr.packed_drep[1], - dcerpc->dcerpchdr.packed_drep[2], dcerpc->dcerpchdr.packed_drep[3]); - printf("DCERPC Frag Length:\t0x%04x %u\n", - dcerpc->dcerpchdr.frag_length, dcerpc->dcerpchdr.frag_length); - printf("DCERPC Auth Length:\t0x%04x\n", dcerpc->dcerpchdr.auth_length); - printf("DCERPC Call Id:\t0x%08x\n", dcerpc->dcerpchdr.call_id); -#endif - - /* check if we have parsed the entire input passed in the header parser. - * If we have, time to leave */ - if (input_len == 0) { - if (dcerpc->bytesprocessed < 10) { - - } else { - if (dcerpc->bytesprocessed >= dcerpc->dcerpchdr.frag_length) { - SCLogDebug("Weird DCE PDU"); - DCERPCResetParsingState(dcerpc); - } - } - SCReturnInt(parsed); - } - switch (dcerpc->dcerpchdr.type) { - case BIND: - case ALTER_CONTEXT: - while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 12 - && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length - && input_len) { - retval = DCERPCParseBIND(dcerpc, input + parsed, input_len); - if (retval && retval <= input_len) { - parsed += retval; - input_len -= retval; - } else if (input_len) { - SCLogDebug("Error Parsing DCERPC %s PDU", - (dcerpc->dcerpchdr.type == BIND) ? - "BIND" : "ALTER_CONTEXT"); - parsed = 0; - (void)parsed; /* for scan-build */ - input_len = 0; - (void)input_len; /* for scan-build */ - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } - } - SCLogDebug("Done with DCERPCParseBIND bytesprocessed %u/%u numctxitems %u", - dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, - dcerpc->dcerpcbindbindack.numctxitems); - while (dcerpc->dcerpcbindbindack.numctxitemsleft && dcerpc->bytesprocessed - < dcerpc->dcerpchdr.frag_length && input_len) { - retval = DCERPCParseBINDCTXItem(dcerpc, input + parsed, input_len); - if (retval && retval <= input_len) { - if (dcerpc->dcerpcbindbindack.ctxbytesprocessed == 44) { - dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0; - } - parsed += retval; - input_len -= retval; - SCLogDebug("BIND processed %u/%u ctxitems %u/%u input_len left %u\n", - dcerpc->bytesprocessed, - dcerpc->dcerpchdr.frag_length, - dcerpc->dcerpcbindbindack.numctxitemsleft, - dcerpc->dcerpcbindbindack.numctxitems, input_len); - } else if (input_len) { - //parsed -= input_len; - SCLogDebug("Error Parsing CTX Item %u\n", parsed); - parsed = 0; - (void)parsed; /* for scan-build */ - input_len = 0; - (void)input_len; /* for scan-build */ - dcerpc->dcerpcbindbindack.numctxitemsleft = 0; - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } - } - if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) { - DCERPCResetParsingState(dcerpc); - } else if (dcerpc->bytesprocessed > dcerpc->dcerpchdr.frag_length) { - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } else { - /* temporary fix */ - if (input_len) { - retval = DCERPCThrowOutExtraData(dcerpc, input + parsed, - input_len); - if (retval && retval <= input_len) { - input_len -= retval; - parsed += retval; - if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) { - DCERPCResetParsingState(dcerpc); - } - } else { - SCLogDebug("Error Parsing DCERPC"); - parsed = 0; - (void)parsed; /* for scan-build */ - input_len = 0; - (void)input_len; /* for scan-build */ - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } - } - } - break; - - case BIND_ACK: - case ALTER_CONTEXT_RESP: - while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 9 - && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length - && input_len) { - retval = DCERPCParseBINDACK(dcerpc, input + parsed, input_len); - if (retval && retval <= input_len) { - parsed += retval; - input_len -= retval; - SCLogDebug("DCERPCParseBINDACK processed %u/%u input_len left %u", - dcerpc->bytesprocessed, - dcerpc->dcerpchdr.frag_length, input_len); - } else if (input_len) { - SCLogDebug("Error parsing %s\n", - (dcerpc->dcerpchdr.type == BIND_ACK) ? - "BIND_ACK" : "ALTER_CONTEXT_RESP"); - parsed = 0; - (void)parsed; /* for scan-build */ - input_len = 0; - (void)input_len; /* for scan-build */ - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } - } - - while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 10 - + dcerpc->dcerpcbindbindack.secondaryaddrlen - && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) { - retval = DCERPCParseSecondaryAddr(dcerpc, input + parsed, input_len); - if (retval && retval <= input_len) { - parsed += retval; - input_len -= retval; - SCLogDebug("DCERPCParseSecondaryAddr %u/%u left %u secondaryaddr len(%u)", - dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len, - dcerpc->dcerpcbindbindack.secondaryaddrlen); - } else if (input_len) { - SCLogDebug("Error parsing Secondary Address"); - parsed = 0; - (void)parsed; /* for scan-build */ - input_len = 0; - (void)input_len; /* for scan-build */ - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } - } - - if (dcerpc->bytesprocessed == DCERPC_HDR_LEN + 10 - + dcerpc->dcerpcbindbindack.secondaryaddrlen) { - if (dcerpc->bytesprocessed % 4) { - dcerpc->pad = (4 - dcerpc->bytesprocessed % 4); - dcerpc->padleft = dcerpc->pad; - } - } - - while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 10 - + dcerpc->dcerpcbindbindack.secondaryaddrlen + dcerpc->pad - && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) { - retval = PaddingParser(dcerpc, input + parsed, input_len); - if (retval && retval <= input_len) { - parsed += retval; - input_len -= retval; - SCLogDebug("PaddingParser %u/%u left %u pad(%u)", - dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len, - dcerpc->pad); - } else if (input_len) { - SCLogDebug("Error parsing DCERPC Padding"); - parsed = 0; - (void)parsed; /* for scan-build */ - input_len = 0; - (void)input_len; /* for scan-build */ - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } - } - - while (dcerpc->bytesprocessed >= DCERPC_HDR_LEN + 10 + dcerpc->pad - + dcerpc->dcerpcbindbindack.secondaryaddrlen && dcerpc->bytesprocessed - < DCERPC_HDR_LEN + 14 + dcerpc->pad + dcerpc->dcerpcbindbindack.secondaryaddrlen - && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) { - retval = DCERPCGetCTXItems(dcerpc, input + parsed, input_len); - if (retval && retval <= input_len) { - parsed += retval; - input_len -= retval; - SCLogDebug("DCERPCGetCTXItems %u/%u (%u)", dcerpc->bytesprocessed, - dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcbindbindack.numctxitems); - } else if (input_len) { - SCLogDebug("Error parsing CTX Items"); - parsed = 0; - (void)parsed; /* for scan-build */ - input_len = 0; - (void)input_len; /* for scan-build */ - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } - } - - if (dcerpc->bytesprocessed == DCERPC_HDR_LEN + 14 + dcerpc->pad - + dcerpc->dcerpcbindbindack.secondaryaddrlen) { - dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0; - } - - while (dcerpc->dcerpcbindbindack.numctxitemsleft && dcerpc->bytesprocessed - < dcerpc->dcerpchdr.frag_length && input_len) { - retval = DCERPCParseBINDACKCTXItem(dcerpc, input + parsed, input_len); - if (retval && retval <= input_len) { - if (dcerpc->dcerpcbindbindack.ctxbytesprocessed == 24) { - dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0; - } - parsed += retval; - input_len -= retval; - } else if (input_len) { - SCLogDebug("Error parsing CTX Items"); - parsed = 0; - (void)parsed; /* for scan-build */ - input_len = 0; - (void)input_len; /* for scan-build */ - dcerpc->dcerpcbindbindack.numctxitemsleft = 0; - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } - } - SCLogDebug("BINDACK processed %u/%u input_len left %u", - dcerpc->bytesprocessed, - dcerpc->dcerpchdr.frag_length, input_len); - - if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) { - /* response and request done */ - if (dcerpc->dcerpchdr.type == BIND_ACK) { - /* update transaction id */ - dcerpc->transaction_id++; - SCLogDebug("transaction_id updated to %"PRIu16, - dcerpc->transaction_id); - } - DCERPCResetParsingState(dcerpc); - } else if (dcerpc->bytesprocessed > dcerpc->dcerpchdr.frag_length) { - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } else { - /* temporary fix */ - if (input_len) { - retval = DCERPCThrowOutExtraData(dcerpc, input + parsed, - input_len); - if (retval && retval <= input_len) { - input_len -= retval; - parsed += retval; - if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) { - DCERPCResetParsingState(dcerpc); - } - } else { - SCLogDebug("Error Parsing DCERPC"); - parsed = 0; - (void)parsed; /* for scan-build */ - input_len = 0; - (void)input_len; /* for scan-build */ - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } - } - } - break; - - case REQUEST: - case RESPONSE: - SCLogDebug("parsing DCERPC %s", - (dcerpc->dcerpchdr.type == REQUEST) ? "REQUEST" : "RESPONSE"); - if ((dcerpc->dcerpchdr.type == REQUEST && - dcerpc->dcerpcrequest.stub_data_buffer_reset) || - (dcerpc->dcerpchdr.type == RESPONSE && - dcerpc->dcerpcresponse.stub_data_buffer_reset)) - { - DCERPCResetStub(dcerpc); - } - - while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 8 - && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length - && input_len) { - retval = DCERPCParseREQUEST(dcerpc, input + parsed, input_len); - if (retval && retval <= input_len) { - parsed += retval; - input_len -= retval; - dcerpc->padleft = dcerpc->dcerpchdr.frag_length - dcerpc->bytesprocessed; - } else if (input_len) { - SCLogDebug("Error parsing DCERPC %s", - (dcerpc->dcerpchdr.type == REQUEST) ? "REQUEST" : "RESPONSE"); - parsed = 0; - (void)parsed; /* for scan-build */ - dcerpc->padleft = 0; - input_len = 0; - (void)input_len; /* for scan-build */ - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } - } - - while (dcerpc->bytesprocessed >= DCERPC_HDR_LEN + 8 - && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length - && dcerpc->padleft && input_len) { - retval = StubDataParser(dcerpc, input + parsed, input_len); - if (retval && retval <= input_len) { - parsed += retval; - input_len -= retval; - } else if (input_len) { - SCLogDebug("Error parsing DCERPC Stub Data"); - parsed = 0; - (void)parsed; /* for scan-build */ - input_len = 0; - (void)input_len; /* for scan-build */ - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } - } - - if (dcerpc->dcerpchdr.type == REQUEST) { - SCLogDebug("REQUEST processed %u frag length %u opnum %u input_len %u", dcerpc->bytesprocessed, - dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcrequest.opnum, input_len); - } else { - SCLogDebug("RESPONSE processed %u frag length %u opnum %u input_len %u", dcerpc->bytesprocessed, - dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcrequest.opnum, input_len); - } - - /* don't see how we could break the parser for request pdus, by - * pusing bytesprocessed beyond frag_length. Let's have the - * check anyways */ - if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) { - DCERPCResetParsingState(dcerpc); - } else if (dcerpc->bytesprocessed > dcerpc->dcerpchdr.frag_length) { - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } else { - /* temporary fix */ - if (input_len) { - retval = DCERPCThrowOutExtraData(dcerpc, input + parsed, - input_len); - if (retval && retval <= input_len) { - input_len -= retval; - parsed += retval; - if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) { - DCERPCResetParsingState(dcerpc); - } - } else { - SCLogDebug("Error Parsing DCERPC"); - parsed = 0; - (void)parsed; /* for scan-build */ - input_len = 0; - (void)input_len; /* for scan-build */ - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } - } - } - - /* response and request done */ - if (dcerpc->dcerpchdr.type == RESPONSE) { - /* update transaction id */ - dcerpc->transaction_id++; - SCLogDebug("transaction_id updated to %"PRIu16, - dcerpc->transaction_id); - } - break; - - default: - SCLogDebug("DCERPC Type 0x%02x not implemented yet", dcerpc->dcerpchdr.type); - retval = DCERPCThrowOutExtraData(dcerpc, input + parsed, - input_len); - if (retval && retval <= input_len) { - input_len -= retval; - parsed += retval; - if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) { - DCERPCResetParsingState(dcerpc); - } - } else { - SCLogDebug("Error Parsing DCERPC"); - parsed = 0; - (void)parsed; /* for scan-build */ - input_len = 0; - (void)input_len; /* for scan-build */ - DCERPCResetParsingState(dcerpc); - SCReturnInt(0); - } - break; - } - } - - SCReturnInt(parsed); -} - -static AppLayerResult DCERPCParse(Flow *f, void *dcerpc_state, - AppLayerParserState *pstate, - const uint8_t *input, uint32_t input_len, - void *local_data, int dir) -{ - SCEnter(); - - int32_t retval = 0; - DCERPCState *sstate = (DCERPCState *) dcerpc_state; - - if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { - SCReturnStruct(APP_LAYER_OK); - } else if (input == NULL || input_len == 0) { - SCReturnStruct(APP_LAYER_ERROR); - } - - if (sstate->dcerpc.bytesprocessed != 0 && sstate->data_needed_for_dir != dir) { - SCReturnStruct(APP_LAYER_ERROR); - } - - retval = DCERPCParser(&sstate->dcerpc, input, input_len); - if (retval == -1) { - SCReturnStruct(APP_LAYER_OK); - } - - sstate->data_needed_for_dir = dir; - - if (pstate == NULL) - SCReturnStruct(APP_LAYER_ERROR); - - SCReturnStruct(APP_LAYER_OK); -} - static AppLayerResult DCERPCParseRequest(Flow *f, void *dcerpc_state, AppLayerParserState *pstate, const uint8_t *input, uint32_t input_len, void *local_data, const uint8_t flags) { - return DCERPCParse(f, dcerpc_state, pstate, input, input_len, - local_data, 0); + if (input == NULL && input_len > 0) { + AppLayerResult res = rs_parse_dcerpc_request_gap(dcerpc_state, input_len); + SCLogDebug("DCERPC request GAP of %u bytes, retval %d", input_len, res.status); + SCReturnStruct(res); + } else { + AppLayerResult res = rs_dcerpc_parse_request(f, dcerpc_state, pstate, input, input_len, + local_data, 0x04); + SCLogDebug("DCERPC request%s of %u bytes, retval %d", + (input == NULL && input_len > 0) ? " is GAP" : "", input_len, res.status); + SCReturnStruct(res); + } } static AppLayerResult DCERPCParseResponse(Flow *f, void *dcerpc_state, @@ -1933,130 +68,72 @@ static AppLayerResult DCERPCParseResponse(Flow *f, void *dcerpc_state, const uint8_t *input, uint32_t input_len, void *local_data, const uint8_t flags) { - return DCERPCParse(f, dcerpc_state, pstate, input, input_len, - local_data, 1); -} - -void DCERPCInit(DCERPC *dcerpc) -{ - dcerpc->transaction_id = 1; - - TAILQ_INIT(&dcerpc->dcerpcbindbindack.uuid_list); - TAILQ_INIT(&dcerpc->dcerpcbindbindack.accepted_uuid_list); -} - -static void *DCERPCStateAlloc(void) -{ - SCEnter(); - - DCERPCState *s = SCCalloc(1, sizeof(DCERPCState)); - if (unlikely(s == NULL)) { - SCReturnPtr(NULL, "void"); - } - - DCERPCInit(&s->dcerpc); - - SCReturnPtr((void *)s, "void"); -} - -void DCERPCUuidListFree(DCERPCUuidEntryList *list) -{ - DCERPCUuidEntry *entry; - - while ((entry = TAILQ_FIRST(list))) { - TAILQ_REMOVE(list, entry, next); - SCFree(entry); + if (input == NULL && input_len > 0) { + AppLayerResult res = rs_parse_dcerpc_response_gap(dcerpc_state, input_len); + SCLogDebug("DCERPC response GAP of %u bytes, retval %d", input_len, res.status); + SCReturnStruct(res); + } else { + AppLayerResult res = rs_dcerpc_parse_response(f, dcerpc_state, pstate, input, input_len, + local_data, 0x08); + SCLogDebug("DCERPC response%s of %u bytes, retval %d", + (input == NULL && input_len > 0) ? " is GAP" : "", input_len, res.status); + SCReturnStruct(res); } } -void DCERPCCleanup(DCERPC *dcerpc) +static void *RustDCERPCStateNew(void) { - DCERPCUuidListFree(&dcerpc->dcerpcbindbindack.uuid_list); - DCERPCUuidListFree(&dcerpc->dcerpcbindbindack.accepted_uuid_list); - - if (dcerpc->dcerpcrequest.stub_data_buffer != NULL) { - SCFree(dcerpc->dcerpcrequest.stub_data_buffer); - dcerpc->dcerpcrequest.stub_data_buffer = NULL; - dcerpc->dcerpcrequest.stub_data_buffer_len = 0; - } - if (dcerpc->dcerpcresponse.stub_data_buffer != NULL) { - SCFree(dcerpc->dcerpcresponse.stub_data_buffer); - dcerpc->dcerpcresponse.stub_data_buffer = NULL; - dcerpc->dcerpcresponse.stub_data_buffer_len = 0; - } + return rs_dcerpc_state_new(); } static void DCERPCStateFree(void *s) { - DCERPCState *sstate = (DCERPCState *) s; - - DCERPCCleanup(&sstate->dcerpc); - - if (sstate->de_state != NULL) { - DetectEngineStateFree(sstate->de_state); - } - - SCFree(s); + return rs_dcerpc_state_free(s); } static int DCERPCSetTxDetectState(void *vtx, DetectEngineState *de_state) { - DCERPCState *dce_state = (DCERPCState *)vtx; - dce_state->de_state = de_state; - return 0; + return rs_dcerpc_set_tx_detect_state(vtx, de_state); } static DetectEngineState *DCERPCGetTxDetectState(void *vtx) { - DCERPCState *dce_state = (DCERPCState *)vtx; - return dce_state->de_state; + return rs_dcerpc_get_tx_detect_state(vtx); } static void DCERPCStateTransactionFree(void *state, uint64_t tx_id) { - /* do nothing */ + return rs_dcerpc_state_transaction_free(state, tx_id); } static void *DCERPCGetTx(void *state, uint64_t tx_id) { - DCERPCState *dce_state = (DCERPCState *)state; - return dce_state; + return rs_dcerpc_get_tx(state, tx_id); } static uint64_t DCERPCGetTxCnt(void *state) { - /* single tx */ - return 1; + return rs_dcerpc_get_tx_cnt(state); } static int DCERPCGetAlstateProgressCompletionStatus(uint8_t direction) { - return 1; + return rs_dcerpc_get_alstate_progress_completion_status(direction); } static int DCERPCGetAlstateProgress(void *tx, uint8_t direction) { - return 0; + return rs_dcerpc_get_alstate_progress(tx, direction); } static void DCERPCSetTxDetectFlags(void *vtx, uint8_t dir, uint64_t flags) { - DCERPCState *dcerpc_state = (DCERPCState *)vtx; - if (dir & STREAM_TOSERVER) { - dcerpc_state->detect_flags_ts = flags; - } else { - dcerpc_state->detect_flags_tc = flags; - } + return rs_dcerpc_set_tx_detect_flags(vtx, dir, flags); } static uint64_t DCERPCGetTxDetectFlags(void *vtx, uint8_t dir) { - DCERPCState *dcerpc_state = (DCERPCState *)vtx; - if (dir & STREAM_TOSERVER) { - return dcerpc_state->detect_flags_ts; - } else { - return dcerpc_state->detect_flags_tc; - } + return rs_dcerpc_get_tx_detect_flags(vtx, dir); } static int DCERPCRegisterPatternsForProtocolDetection(void) @@ -2094,7 +171,7 @@ void RegisterDCERPCParsers(void) DCERPCParseRequest); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_DCERPC, STREAM_TOCLIENT, DCERPCParseResponse); - AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_DCERPC, DCERPCStateAlloc, + AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_DCERPC, RustDCERPCStateNew, DCERPCStateFree); AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_DCERPC, STREAM_TOSERVER); @@ -2118,3000 +195,5 @@ void RegisterDCERPCParsers(void) SCLogInfo("Parsed disabled for %s protocol. Protocol detection" "still on.", proto_name); } -#ifdef UNITTESTS - AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_DCERPC, DCERPCParserRegisterTests); -#endif - - return; -} - -/* UNITTESTS */ -#ifdef UNITTESTS -/** \test DCERPC Header Parsing and BIND / BIND_ACK multiple UUID handling -*/ - -/* set this to 1 to see problem */ - -static int DCERPCParserTest01(void) -{ - int result = 1; - Flow f; - uint8_t dcerpcbind[] = { - 0x05, 0x00, - 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x3c, 0x04, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, - 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x2c, 0xd0, - 0x28, 0xda, 0x76, 0x91, 0xf6, 0x6e, 0xcb, 0x0f, - 0xbf, 0x85, 0xcd, 0x9b, 0xf6, 0x39, 0x01, 0x00, - 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, - 0x01, 0x00, 0x2c, 0x75, 0xce, 0x7e, 0x82, 0x3b, - 0x06, 0xac, 0x1b, 0xf0, 0xf5, 0xb7, 0xa7, 0xf7, - 0x28, 0xaf, 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0xe3, 0xb2, - 0x10, 0xd1, 0xd0, 0x0c, 0xcc, 0x3d, 0x2f, 0x80, - 0x20, 0x7c, 0xef, 0xe7, 0x09, 0xe0, 0x04, 0x00, - 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x03, 0x00, - 0x01, 0x00, 0xde, 0x85, 0x70, 0xc4, 0x02, 0x7c, - 0x60, 0x23, 0x67, 0x0c, 0x22, 0xbf, 0x18, 0x36, - 0x79, 0x17, 0x01, 0x00, 0x02, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, 0x41, 0x65, - 0x29, 0x51, 0xaa, 0xe7, 0x7b, 0xa8, 0xf2, 0x37, - 0x0b, 0xd0, 0x3f, 0xb3, 0x36, 0xed, 0x05, 0x00, - 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x05, 0x00, - 0x01, 0x00, 0x14, 0x96, 0x80, 0x01, 0x2e, 0x78, - 0xfb, 0x5d, 0xb4, 0x3c, 0x14, 0xb3, 0x3d, 0xaa, - 0x02, 0xfb, 0x06, 0x00, 0x00, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, 0x3b, 0x04, - 0x68, 0x3e, 0x63, 0xfe, 0x9f, 0xd8, 0x64, 0x55, - 0xcd, 0xe7, 0x39, 0xaf, 0x98, 0x9f, 0x03, 0x00, - 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x07, 0x00, - 0x01, 0x00, 0x16, 0x7a, 0x4f, 0x1b, 0xdb, 0x25, - 0x92, 0x55, 0xdd, 0xae, 0x9e, 0x5b, 0x3e, 0x93, - 0x66, 0x93, 0x04, 0x00, 0x01, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0xe8, 0xa4, - 0x8a, 0xcf, 0x95, 0x6c, 0xc7, 0x8f, 0x14, 0xcc, - 0x56, 0xfc, 0x7b, 0x5f, 0x4f, 0xe8, 0x04, 0x00, - 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x09, 0x00, - 0x01, 0x00, 0xd8, 0xda, 0xfb, 0xbc, 0xa2, 0x55, - 0x6f, 0x5d, 0xc0, 0x2d, 0x88, 0x6f, 0x00, 0x17, - 0x52, 0x8d, 0x06, 0x00, 0x03, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x0a, 0x00, 0x01, 0x00, 0x3f, 0x17, - 0x55, 0x0c, 0xf4, 0x23, 0x3c, 0xca, 0xe6, 0xa0, - 0xaa, 0xcc, 0xb5, 0xe3, 0xf9, 0xce, 0x04, 0x00, - 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0b, 0x00, - 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, - 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, - 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x0c, 0x00, 0x01, 0x00, 0xc9, 0x9f, - 0x3e, 0x6e, 0x82, 0x0a, 0x2b, 0x28, 0x37, 0x78, - 0xe1, 0x13, 0x70, 0x05, 0x38, 0x4d, 0x01, 0x00, - 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0d, 0x00, - 0x01, 0x00, 0x11, 0xaa, 0x4b, 0x15, 0xdf, 0xa6, - 0x86, 0x3f, 0xfb, 0xe0, 0x09, 0xb7, 0xf8, 0x56, - 0xd2, 0x3f, 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x0e, 0x00, 0x01, 0x00, 0xee, 0x99, - 0xc4, 0x25, 0x11, 0xe4, 0x95, 0x62, 0x29, 0xfa, - 0xfd, 0x26, 0x57, 0x02, 0xf1, 0xce, 0x03, 0x00, - 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0f, 0x00, - 0x01, 0x00, 0xba, 0x81, 0x9e, 0x1a, 0xdf, 0x2b, - 0xba, 0xe4, 0xd3, 0x17, 0x41, 0x60, 0x6d, 0x2d, - 0x9e, 0x28, 0x03, 0x00, 0x03, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x10, 0x00, 0x01, 0x00, 0xa0, 0x24, - 0x03, 0x9a, 0xa9, 0x99, 0xfb, 0xbe, 0x49, 0x11, - 0xad, 0x77, 0x30, 0xaa, 0xbc, 0xb6, 0x02, 0x00, - 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x11, 0x00, - 0x01, 0x00, 0x32, 0x04, 0x7e, 0xae, 0xec, 0x28, - 0xd1, 0x55, 0x83, 0x4e, 0xc3, 0x47, 0x5d, 0x1d, - 0xc6, 0x65, 0x02, 0x00, 0x03, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x12, 0x00, 0x01, 0x00, 0xc6, 0xa4, - 0x81, 0x48, 0x66, 0x2a, 0x74, 0x7d, 0x56, 0x6e, - 0xc5, 0x1d, 0x19, 0xf2, 0xb5, 0xb6, 0x03, 0x00, - 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x13, 0x00, - 0x01, 0x00, 0xcb, 0xae, 0xb3, 0xc0, 0x0c, 0xf4, - 0xa4, 0x5e, 0x91, 0x72, 0xdd, 0x53, 0x24, 0x70, - 0x89, 0x02, 0x05, 0x00, 0x03, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x14, 0x00, 0x01, 0x00, 0xb8, 0xd0, - 0xa0, 0x1a, 0x5e, 0x7a, 0x2d, 0xfe, 0x35, 0xc6, - 0x7d, 0x08, 0x0d, 0x33, 0x73, 0x18, 0x02, 0x00, - 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x15, 0x00, - 0x01, 0x00, 0x21, 0xd3, 0xaa, 0x09, 0x03, 0xa7, - 0x0b, 0xc2, 0x06, 0x45, 0xd9, 0x6c, 0x75, 0xc2, - 0x15, 0xa8, 0x01, 0x00, 0x03, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x16, 0x00, 0x01, 0x00, 0xe1, 0xbd, - 0x59, 0xfc, 0xbc, 0xa9, 0x95, 0xc2, 0x68, 0x79, - 0xf3, 0x75, 0xe0, 0xae, 0x6c, 0xe5, 0x04, 0x00, - 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x17, 0x00, - 0x01, 0x00, 0x06, 0x52, 0xb4, 0x71, 0x70, 0x15, - 0x4e, 0xf5, 0x7f, 0x08, 0x86, 0x14, 0xe6, 0x17, - 0xd5, 0x97, 0x04, 0x00, 0x00, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00}; - - uint8_t dcerpcbindack[] = { - 0x05, 0x00, 0x0c, 0x03, - 0x10, 0x00, 0x00, 0x00, 0x6c, 0x02, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, - 0xce, 0x47, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, - 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, - 0x73, 0x00, 0xf6, 0x6e, 0x18, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; - - uint8_t dcerpcrequest[] = { - 0x05, 0x00, 0x00, 0x00, 0x10, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0xe8, 0x03, 0x00, 0x00, 0x0b, - 0x00, 0x09, 0x00, 0x45, 0x00, 0x2c, 0x00, 0x4d, - 0x00, 0x73, 0x00, 0x53, 0x00, 0x59, 0x00, 0x2a, - 0x00, 0x4a, 0x00, 0x7a, 0x00, 0x3e, 0x00, 0x58, - 0x00, 0x21, 0x00, 0x4a, 0x00, 0x30, 0x00, 0x41, - 0x00, 0x4b, 0x00, 0x4b, 0x00, 0x3c, 0x00, 0x48, - 0x00, 0x24, 0x00, 0x38, 0x00, 0x54, 0x00, 0x60, - 0x00, 0x2d, 0x00, 0x29, 0x00, 0x64, 0x00, 0x5b, - 0x00, 0x77, 0x00, 0x3a, 0x00, 0x4c, 0x00, 0x24, - 0x00, 0x23, 0x00, 0x66, 0x00, 0x43, 0x00, 0x68, - 0x00, 0x22, 0x00, 0x55, 0x00, 0x29, 0x00, 0x2c, - 0x00, 0x4f, 0x00, 0x5a, 0x00, 0x50, 0x00, 0x61, - 0x00, 0x2a, 0x00, 0x6f, 0x00, 0x2f, 0x00, 0x4d, - 0x00, 0x68, 0x00, 0x3a, 0x00, 0x5c, 0x00, 0x67, - 0x00, 0x68, 0x00, 0x68, 0x00, 0x49, 0x00, 0x45, - 0x00, 0x4c, 0x00, 0x72, 0x00, 0x53, 0x00, 0x4c, - 0x00, 0x25, 0x00, 0x4d, 0x00, 0x67, 0x00, 0x2e, - 0x00, 0x4f, 0x00, 0x64, 0x00, 0x61, 0x00, 0x73, - 0x00, 0x24, 0x00, 0x46, 0x00, 0x35, 0x00, 0x2e, - 0x00, 0x45, 0x00, 0x6f, 0x00, 0x40, 0x00, 0x41, - 0x00, 0x33, 0x00, 0x38, 0x00, 0x47, 0x00, 0x71, - 0x00, 0x5a, 0x00, 0x37, 0x00, 0x7a, 0x00, 0x35, - 0x00, 0x6b, 0x00, 0x3c, 0x00, 0x26, 0x00, 0x37, - 0x00, 0x69, 0x00, 0x75, 0x00, 0x36, 0x00, 0x37, - 0x00, 0x47, 0x00, 0x21, 0x00, 0x2d, 0x00, 0x69, - 0x00, 0x37, 0x00, 0x78, 0x00, 0x5f, 0x00, 0x72, - 0x00, 0x4b, 0x00, 0x5c, 0x00, 0x74, 0x00, 0x3e, - 0x00, 0x52, 0x00, 0x7a, 0x00, 0x49, 0x00, 0x31, - 0x00, 0x5a, 0x00, 0x7b, 0x00, 0x29, 0x00, 0x3b, - 0x00, 0x78, 0x00, 0x3b, 0x00, 0x55, 0x00, 0x3e, - 0x00, 0x35, 0x00, 0x2b, 0x00, 0x4e, 0x00, 0x4f, - 0x00, 0x59, 0x00, 0x38, 0x00, 0x2a, 0x00, 0x59, - 0x00, 0x6b, 0x00, 0x42, 0x00, 0x4c, 0x00, 0x3e, - 0x00, 0x6a, 0x00, 0x49, 0x00, 0x2c, 0x00, 0x79, - 0x00, 0x6e, 0x00, 0x35, 0x00, 0x4f, 0x00, 0x49, - 0x00, 0x55, 0x00, 0x35, 0x00, 0x61, 0x00, 0x72, - 0x00, 0x77, 0x00, 0x38, 0x00, 0x32, 0x00, 0x24, - 0x00, 0x46, 0x00, 0x32, 0x00, 0x32, 0x00, 0x27, - 0x00, 0x64, 0x00, 0x5a, 0x00, 0x77, 0x00, 0x2e, - 0x00, 0x37, 0x00, 0x77, 0x00, 0x2e, 0x00, 0x28, - 0x00, 0x63, 0x00, 0x4f, 0x00, 0x67, 0x00, 0x64, - 0x00, 0x39, 0x00, 0x37, 0x00, 0x31, 0x00, 0x30, - 0x00, 0x28, 0x00, 0x2e, 0x00, 0x6f, 0x00, 0x3e, - 0x00, 0x59, 0x00, 0x28, 0x00, 0x67, 0x00, 0x52, - 0x00, 0x35, 0x00, 0x5a, 0x00, 0x7c, 0x00, 0x56, - 0x00, 0x6a, 0x00, 0x5c, 0x00, 0x3c, 0x00, 0x30, - 0x00, 0x59, 0x00, 0x5c, 0x00, 0x5e, 0x00, 0x38, - 0x00, 0x54, 0x00, 0x5c, 0x00, 0x5b, 0x00, 0x42, - 0x00, 0x62, 0x00, 0x70, 0x00, 0x34, 0x00, 0x5c, - 0x00, 0x57, 0x00, 0x7a, 0x00, 0x4b, 0x00, 0x2f, - 0x00, 0x6b, 0x00, 0x6a, 0x00, 0x4f, 0x00, 0x41, - 0x00, 0x33, 0x00, 0x52, 0x00, 0x36, 0x00, 0x27, - 0x00, 0x30, 0x00, 0x6d, 0x00, 0x4a, 0x00, 0x30, - 0x00, 0x78, 0x00, 0x46, 0x00, 0x65, 0x00, 0x4e, - 0x00, 0x29, 0x00, 0x66, 0x00, 0x3f, 0x00, 0x72, - 0x00, 0x71, 0x00, 0x75, 0x00, 0x4c, 0x00, 0x2b, - 0x00, 0x5c, 0x00, 0x46, 0x00, 0x52, 0x00, 0x7b, - 0x00, 0x5c, 0x00, 0x69, 0x00, 0x66, 0x00, 0x56, - 0x00, 0x31, 0x00, 0x2d, 0x00, 0x72, 0x00, 0x61, - 0x00, 0x68, 0x00, 0x28, 0x00, 0x7d, 0x00, 0x58, - 0x00, 0x2a, 0x00, 0x7b, 0x00, 0x28, 0x00, 0x5b, - 0x00, 0x54, 0x00, 0x3a, 0x00, 0x26, 0x00, 0x52, - 0x00, 0x44, 0x00, 0x60, 0x00, 0x50, 0x00, 0x65, - 0x00, 0x48, 0x00, 0x7d, 0x00, 0x2a, 0x00, 0x74, - 0x00, 0x49, 0x00, 0x7b, 0x00, 0x21, 0x00, 0x61, - 0x00, 0x52, 0x00, 0x43, 0x00, 0x5f, 0x00, 0x5a, - 0x00, 0x74, 0x00, 0x5c, 0x00, 0x62, 0x00, 0x68, - 0x00, 0x6c, 0x00, 0x6c, 0x00, 0x2b, 0x00, 0x6f, - 0x00, 0x7c, 0x00, 0x42, 0x00, 0x67, 0x00, 0x32, - 0x00, 0x58, 0x00, 0x35, 0x00, 0x30, 0x00, 0x2f, - 0x00, 0x2d, 0x00, 0x60, 0x00, 0x62, 0x00, 0x51, - 0x00, 0x2a, 0x00, 0x30, 0x00, 0x31, 0x00, 0x48, - 0x00, 0x5b, 0x00, 0x5b, 0x00, 0x5d, 0x00, 0x25, - 0x00, 0x58, 0x00, 0x4a, 0x00, 0x76, 0x00, 0x32, - 0x00, 0x62, 0x00, 0x27, 0x00, 0x42, 0x00, 0x40, - 0x00, 0x53, 0x00, 0x7c, 0x00, 0x7d, 0x00, 0x50, - 0x00, 0x3d, 0x00, 0x40, 0x00, 0x76, 0x00, 0x38, - 0x00, 0x58, 0x00, 0x39, 0x00, 0x63, 0x00, 0x3c, - 0x00, 0x5b, 0x00, 0x23, 0x00, 0x53, 0x00, 0x7a, - 0x00, 0x54, 0x00, 0x74, 0x00, 0x61, 0x00, 0x76, - 0x00, 0x4a, 0x00, 0x3e, 0x00, 0x33, 0x00, 0x75, - 0x00, 0x66, 0x00, 0x2d, 0x00, 0x48, 0x00, 0x33, - 0x00, 0x71, 0x00, 0x76, 0x00, 0x48, 0x00, 0x71, - 0x00, 0x41, 0x00, 0x6f, 0x00, 0x2a, 0x00, 0x67, - 0x00, 0x70, 0x00, 0x21, 0x00, 0x70, 0x00, 0x4b, - 0x00, 0x52, 0x00, 0x58, 0x00, 0x68, 0x00, 0x23, - 0x00, 0x39, 0x00, 0x46, 0x00, 0x4d, 0x00, 0x51, - 0x00, 0x57, 0x00, 0x3a, 0x00, 0x79, 0x00, 0x7b, - 0x00, 0x6c, 0x00, 0x55, 0x00, 0x33, 0x00, 0x65, - 0x00, 0x49, 0x00, 0x72, 0x00, 0x30, 0x00, 0x4f, - 0x00, 0x41, 0x00, 0x6e, 0x00, 0x31, 0x00, 0x4a, - 0x00, 0x60, 0x00, 0x79, 0x00, 0x70, 0x00, 0x4f, - 0x00, 0x58, 0x00, 0x75, 0x00, 0x44, 0x00, 0x59, - 0x00, 0x58, 0x00, 0x46, 0x00, 0x3d, 0x00, 0x46, - 0x00, 0x74, 0x00, 0x51, 0x00, 0x57, 0x00, 0x6e, - 0x00, 0x2d, 0x00, 0x47, 0x00, 0x23, 0x00, 0x45, - 0x00, 0x60, 0x00, 0x4c, 0x00, 0x72, 0x00, 0x4e, - 0x00, 0x74, 0x00, 0x40, 0x00, 0x76, 0x00, 0x75, - 0x00, 0x74, 0x00, 0x56, 0x00, 0x44, 0x00, 0x29, - 0x00, 0x62, 0x00, 0x58, 0x00, 0x31, 0x00, 0x78, - 0x00, 0x32, 0x00, 0x52, 0x00, 0x4a, 0x00, 0x6b, - 0x00, 0x55, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x6f, - 0x00, 0x4a, 0x00, 0x54, 0x00, 0x7d, 0x00, 0x68, - 0x00, 0x3f, 0x00, 0x28, 0x00, 0x21, 0x00, 0x53, - 0x00, 0x48, 0x00, 0x5a, 0x00, 0x34, 0x00, 0x36, - 0x00, 0x35, 0x00, 0x64, 0x00, 0x4e, 0x00, 0x75, - 0x00, 0x69, 0x00, 0x23, 0x00, 0x75, 0x00, 0x55, - 0x00, 0x43, 0x00, 0x75, 0x00, 0x2f, 0x00, 0x73, - 0x00, 0x62, 0x00, 0x6f, 0x00, 0x37, 0x00, 0x4e, - 0x00, 0x25, 0x00, 0x25, 0x00, 0x21, 0x00, 0x3d, - 0x00, 0x3c, 0x00, 0x71, 0x00, 0x3e, 0x00, 0x3f, - 0x00, 0x30, 0x00, 0x36, 0x00, 0x62, 0x00, 0x63, - 0x00, 0x53, 0x00, 0x54, 0x00, 0x5d, 0x00, 0x61, - 0x00, 0x4c, 0x00, 0x28, 0x00, 0x2b, 0x00, 0x4c, - 0x00, 0x4e, 0x00, 0x66, 0x00, 0x5f, 0x00, 0x4b, - 0x00, 0x43, 0x00, 0x75, 0x00, 0x45, 0x00, 0x37, - 0x00, 0x28, 0x00, 0x56, 0x00, 0x36, 0x00, 0x6a, - 0x00, 0x3e, 0x00, 0x64, 0x00, 0x34, 0x00, 0x6a, - 0x00, 0x7d, 0x00, 0x4a, 0x00, 0x66, 0x00, 0x7a, - 0x00, 0x3e, 0x00, 0x75, 0x00, 0x38, 0x00, 0x7b, - 0x00, 0x42, 0x00, 0x76, 0x00, 0x29, 0x00, 0x4c, - 0x00, 0x65, 0x00, 0x2e, 0x00, 0x32, 0x00, 0x4b, - 0x00, 0x2b, 0x00, 0x51, 0x00, 0x47, 0x00, 0x22, - 0x00, 0x48, 0x00, 0x3d, 0x00, 0x49, 0x00, 0x44, - 0x00, 0x5d, 0x00, 0x59, 0x00, 0x63, 0x00, 0x5c, - 0x00, 0x24, 0x00, 0x35, 0x00, 0x34, 0x00, 0x70, - 0x00, 0x69, 0x00}; - uint32_t requestlen = sizeof(dcerpcrequest); - - uint32_t bindlen = sizeof(dcerpcbind); - uint32_t bindacklen = sizeof(dcerpcbindack); - TcpSession ssn; - DCERPCUuidEntry *uuid_entry; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER | STREAM_START, dcerpcbind, - bindlen); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - if (dcerpc_state->dcerpc.dcerpchdr.rpc_vers != 5) { - printf("expected dcerpc version 0x05, got 0x%02x : ", - dcerpc_state->dcerpc.dcerpchdr.rpc_vers); - result = 0; - goto end; - } - - if (dcerpc_state->dcerpc.dcerpchdr.type != BIND) { - printf("expected dcerpc type 0x%02x , got 0x%02x : ", BIND, dcerpc_state->dcerpc.dcerpchdr.type); - result = 0; - goto end; - } - - if (dcerpc_state->dcerpc.dcerpchdr.frag_length != 1084) { - printf("expected dcerpc frag_length 0x%02x , got 0x%02x : ", 1084, dcerpc_state->dcerpc.dcerpchdr.frag_length); - result = 0; - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, dcerpcbindack, bindacklen); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - if (dcerpc_state->dcerpc.dcerpchdr.type != BIND_ACK) { - printf("expected dcerpc type 0x%02x , got 0x%02x : ", BIND_ACK, dcerpc_state->dcerpc.dcerpchdr.type); - result = 0; - goto end; - } - - if (dcerpc_state->dcerpc.dcerpchdr.frag_length != 620) { - printf("expected dcerpc frag_length 0x%02x , got 0x%02x : ", 620, dcerpc_state->dcerpc.dcerpchdr.frag_length); - result = 0; - goto end; - } - TAILQ_FOREACH(uuid_entry, &dcerpc_state->dcerpc.dcerpcbindbindack.uuid_list, next) { - printUUID("BIND_ACK", uuid_entry); - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER | STREAM_EOF, dcerpcrequest, - requestlen); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - if (dcerpc_state->dcerpc.dcerpchdr.type != REQUEST) { - printf("expected dcerpc type 0x%02x , got 0x%02x : ", REQUEST, dcerpc_state->dcerpc.dcerpchdr.type); - result = 0; - goto end; - } -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** \test DCERPC Request decoding and opnum parsing. -*/ -static int DCERPCParserTest02(void) -{ - int result = 1; - Flow f; - uint8_t dcerpcrequest[] = { - 0x05, 0x00, 0x00, 0x00, 0x10, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0xe8, 0x03, 0x00, 0x00, 0x0b, - 0x00, 0x09, 0x00, 0x45, 0x00, 0x2c, 0x00, 0x4d, - 0x00, 0x73, 0x00, 0x53, 0x00, 0x59, 0x00, 0x2a, - 0x00, 0x4a, 0x00, 0x7a, 0x00, 0x3e, 0x00, 0x58, - 0x00, 0x21, 0x00, 0x4a, 0x00, 0x30, 0x00, 0x41, - 0x00, 0x4b, 0x00, 0x4b, 0x00, 0x3c, 0x00, 0x48, - 0x00, 0x24, 0x00, 0x38, 0x00, 0x54, 0x00, 0x60, - 0x00, 0x2d, 0x00, 0x29, 0x00, 0x64, 0x00, 0x5b, - 0x00, 0x77, 0x00, 0x3a, 0x00, 0x4c, 0x00, 0x24, - 0x00, 0x23, 0x00, 0x66, 0x00, 0x43, 0x00, 0x68, - 0x00, 0x22, 0x00, 0x55, 0x00, 0x29, 0x00, 0x2c, - 0x00, 0x4f, 0x00, 0x5a, 0x00, 0x50, 0x00, 0x61, - 0x00, 0x2a, 0x00, 0x6f, 0x00, 0x2f, 0x00, 0x4d, - 0x00, 0x68, 0x00, 0x3a, 0x00, 0x5c, 0x00, 0x67, - 0x00, 0x68, 0x00, 0x68, 0x00, 0x49, 0x00, 0x45, - 0x00, 0x4c, 0x00, 0x72, 0x00, 0x53, 0x00, 0x4c, - 0x00, 0x25, 0x00, 0x4d, 0x00, 0x67, 0x00, 0x2e, - 0x00, 0x4f, 0x00, 0x64, 0x00, 0x61, 0x00, 0x73, - 0x00, 0x24, 0x00, 0x46, 0x00, 0x35, 0x00, 0x2e, - 0x00, 0x45, 0x00, 0x6f, 0x00, 0x40, 0x00, 0x41, - 0x00, 0x33, 0x00, 0x38, 0x00, 0x47, 0x00, 0x71, - 0x00, 0x5a, 0x00, 0x37, 0x00, 0x7a, 0x00, 0x35, - 0x00, 0x6b, 0x00, 0x3c, 0x00, 0x26, 0x00, 0x37, - 0x00, 0x69, 0x00, 0x75, 0x00, 0x36, 0x00, 0x37, - 0x00, 0x47, 0x00, 0x21, 0x00, 0x2d, 0x00, 0x69, - 0x00, 0x37, 0x00, 0x78, 0x00, 0x5f, 0x00, 0x72, - 0x00, 0x4b, 0x00, 0x5c, 0x00, 0x74, 0x00, 0x3e, - 0x00, 0x52, 0x00, 0x7a, 0x00, 0x49, 0x00, 0x31, - 0x00, 0x5a, 0x00, 0x7b, 0x00, 0x29, 0x00, 0x3b, - 0x00, 0x78, 0x00, 0x3b, 0x00, 0x55, 0x00, 0x3e, - 0x00, 0x35, 0x00, 0x2b, 0x00, 0x4e, 0x00, 0x4f, - 0x00, 0x59, 0x00, 0x38, 0x00, 0x2a, 0x00, 0x59, - 0x00, 0x6b, 0x00, 0x42, 0x00, 0x4c, 0x00, 0x3e, - 0x00, 0x6a, 0x00, 0x49, 0x00, 0x2c, 0x00, 0x79, - 0x00, 0x6e, 0x00, 0x35, 0x00, 0x4f, 0x00, 0x49, - 0x00, 0x55, 0x00, 0x35, 0x00, 0x61, 0x00, 0x72, - 0x00, 0x77, 0x00, 0x38, 0x00, 0x32, 0x00, 0x24, - 0x00, 0x46, 0x00, 0x32, 0x00, 0x32, 0x00, 0x27, - 0x00, 0x64, 0x00, 0x5a, 0x00, 0x77, 0x00, 0x2e, - 0x00, 0x37, 0x00, 0x77, 0x00, 0x2e, 0x00, 0x28, - 0x00, 0x63, 0x00, 0x4f, 0x00, 0x67, 0x00, 0x64, - 0x00, 0x39, 0x00, 0x37, 0x00, 0x31, 0x00, 0x30, - 0x00, 0x28, 0x00, 0x2e, 0x00, 0x6f, 0x00, 0x3e, - 0x00, 0x59, 0x00, 0x28, 0x00, 0x67, 0x00, 0x52, - 0x00, 0x35, 0x00, 0x5a, 0x00, 0x7c, 0x00, 0x56, - 0x00, 0x6a, 0x00, 0x5c, 0x00, 0x3c, 0x00, 0x30, - 0x00, 0x59, 0x00, 0x5c, 0x00, 0x5e, 0x00, 0x38, - 0x00, 0x54, 0x00, 0x5c, 0x00, 0x5b, 0x00, 0x42, - 0x00, 0x62, 0x00, 0x70, 0x00, 0x34, 0x00, 0x5c, - 0x00, 0x57, 0x00, 0x7a, 0x00, 0x4b, 0x00, 0x2f, - 0x00, 0x6b, 0x00, 0x6a, 0x00, 0x4f, 0x00, 0x41, - 0x00, 0x33, 0x00, 0x52, 0x00, 0x36, 0x00, 0x27, - 0x00, 0x30, 0x00, 0x6d, 0x00, 0x4a, 0x00, 0x30, - 0x00, 0x78, 0x00, 0x46, 0x00, 0x65, 0x00, 0x4e, - 0x00, 0x29, 0x00, 0x66, 0x00, 0x3f, 0x00, 0x72, - 0x00, 0x71, 0x00, 0x75, 0x00, 0x4c, 0x00, 0x2b, - 0x00, 0x5c, 0x00, 0x46, 0x00, 0x52, 0x00, 0x7b, - 0x00, 0x5c, 0x00, 0x69, 0x00, 0x66, 0x00, 0x56, - 0x00, 0x31, 0x00, 0x2d, 0x00, 0x72, 0x00, 0x61, - 0x00, 0x68, 0x00, 0x28, 0x00, 0x7d, 0x00, 0x58, - 0x00, 0x2a, 0x00, 0x7b, 0x00, 0x28, 0x00, 0x5b, - 0x00, 0x54, 0x00, 0x3a, 0x00, 0x26, 0x00, 0x52, - 0x00, 0x44, 0x00, 0x60, 0x00, 0x50, 0x00, 0x65, - 0x00, 0x48, 0x00, 0x7d, 0x00, 0x2a, 0x00, 0x74, - 0x00, 0x49, 0x00, 0x7b, 0x00, 0x21, 0x00, 0x61, - 0x00, 0x52, 0x00, 0x43, 0x00, 0x5f, 0x00, 0x5a, - 0x00, 0x74, 0x00, 0x5c, 0x00, 0x62, 0x00, 0x68, - 0x00, 0x6c, 0x00, 0x6c, 0x00, 0x2b, 0x00, 0x6f, - 0x00, 0x7c, 0x00, 0x42, 0x00, 0x67, 0x00, 0x32, - 0x00, 0x58, 0x00, 0x35, 0x00, 0x30, 0x00, 0x2f, - 0x00, 0x2d, 0x00, 0x60, 0x00, 0x62, 0x00, 0x51, - 0x00, 0x2a, 0x00, 0x30, 0x00, 0x31, 0x00, 0x48, - 0x00, 0x5b, 0x00, 0x5b, 0x00, 0x5d, 0x00, 0x25, - 0x00, 0x58, 0x00, 0x4a, 0x00, 0x76, 0x00, 0x32, - 0x00, 0x62, 0x00, 0x27, 0x00, 0x42, 0x00, 0x40, - 0x00, 0x53, 0x00, 0x7c, 0x00, 0x7d, 0x00, 0x50, - 0x00, 0x3d, 0x00, 0x40, 0x00, 0x76, 0x00, 0x38, - 0x00, 0x58, 0x00, 0x39, 0x00, 0x63, 0x00, 0x3c, - 0x00, 0x5b, 0x00, 0x23, 0x00, 0x53, 0x00, 0x7a, - 0x00, 0x54, 0x00, 0x74, 0x00, 0x61, 0x00, 0x76, - 0x00, 0x4a, 0x00, 0x3e, 0x00, 0x33, 0x00, 0x75, - 0x00, 0x66, 0x00, 0x2d, 0x00, 0x48, 0x00, 0x33, - 0x00, 0x71, 0x00, 0x76, 0x00, 0x48, 0x00, 0x71, - 0x00, 0x41, 0x00, 0x6f, 0x00, 0x2a, 0x00, 0x67, - 0x00, 0x70, 0x00, 0x21, 0x00, 0x70, 0x00, 0x4b, - 0x00, 0x52, 0x00, 0x58, 0x00, 0x68, 0x00, 0x23, - 0x00, 0x39, 0x00, 0x46, 0x00, 0x4d, 0x00, 0x51, - 0x00, 0x57, 0x00, 0x3a, 0x00, 0x79, 0x00, 0x7b, - 0x00, 0x6c, 0x00, 0x55, 0x00, 0x33, 0x00, 0x65, - 0x00, 0x49, 0x00, 0x72, 0x00, 0x30, 0x00, 0x4f, - 0x00, 0x41, 0x00, 0x6e, 0x00, 0x31, 0x00, 0x4a, - 0x00, 0x60, 0x00, 0x79, 0x00, 0x70, 0x00, 0x4f, - 0x00, 0x58, 0x00, 0x75, 0x00, 0x44, 0x00, 0x59, - 0x00, 0x58, 0x00, 0x46, 0x00, 0x3d, 0x00, 0x46, - 0x00, 0x74, 0x00, 0x51, 0x00, 0x57, 0x00, 0x6e, - 0x00, 0x2d, 0x00, 0x47, 0x00, 0x23, 0x00, 0x45, - 0x00, 0x60, 0x00, 0x4c, 0x00, 0x72, 0x00, 0x4e, - 0x00, 0x74, 0x00, 0x40, 0x00, 0x76, 0x00, 0x75, - 0x00, 0x74, 0x00, 0x56, 0x00, 0x44, 0x00, 0x29, - 0x00, 0x62, 0x00, 0x58, 0x00, 0x31, 0x00, 0x78, - 0x00, 0x32, 0x00, 0x52, 0x00, 0x4a, 0x00, 0x6b, - 0x00, 0x55, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x6f, - 0x00, 0x4a, 0x00, 0x54, 0x00, 0x7d, 0x00, 0x68, - 0x00, 0x3f, 0x00, 0x28, 0x00, 0x21, 0x00, 0x53, - 0x00, 0x48, 0x00, 0x5a, 0x00, 0x34, 0x00, 0x36, - 0x00, 0x35, 0x00, 0x64, 0x00, 0x4e, 0x00, 0x75, - 0x00, 0x69, 0x00, 0x23, 0x00, 0x75, 0x00, 0x55, - 0x00, 0x43, 0x00, 0x75, 0x00, 0x2f, 0x00, 0x73, - 0x00, 0x62, 0x00, 0x6f, 0x00, 0x37, 0x00, 0x4e, - 0x00, 0x25, 0x00, 0x25, 0x00, 0x21, 0x00, 0x3d, - 0x00, 0x3c, 0x00, 0x71, 0x00, 0x3e, 0x00, 0x3f, - 0x00, 0x30, 0x00, 0x36, 0x00, 0x62, 0x00, 0x63, - 0x00, 0x53, 0x00, 0x54, 0x00, 0x5d, 0x00, 0x61, - 0x00, 0x4c, 0x00, 0x28, 0x00, 0x2b, 0x00, 0x4c, - 0x00, 0x4e, 0x00, 0x66, 0x00, 0x5f, 0x00, 0x4b, - 0x00, 0x43, 0x00, 0x75, 0x00, 0x45, 0x00, 0x37, - 0x00, 0x28, 0x00, 0x56, 0x00, 0x36, 0x00, 0x6a, - 0x00, 0x3e, 0x00, 0x64, 0x00, 0x34, 0x00, 0x6a, - 0x00, 0x7d, 0x00, 0x4a, 0x00, 0x66, 0x00, 0x7a, - 0x00, 0x3e, 0x00, 0x75, 0x00, 0x38, 0x00, 0x7b, - 0x00, 0x42, 0x00, 0x76, 0x00, 0x29, 0x00, 0x4c, - 0x00, 0x65, 0x00, 0x2e, 0x00, 0x32, 0x00, 0x4b, - 0x00, 0x2b, 0x00, 0x51, 0x00, 0x47, 0x00, 0x22, - 0x00, 0x48, 0x00, 0x3d, 0x00, 0x49, 0x00, 0x44, - 0x00, 0x5d, 0x00, 0x59, 0x00, 0x63, 0x00, 0x5c, - 0x00, 0x24, 0x00, 0x35, 0x00, 0x34, 0x00, 0x70, - 0x00, 0x69, 0x00}; - uint32_t requestlen = sizeof(dcerpcrequest); - - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER | STREAM_START, - dcerpcrequest, - requestlen); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - if (dcerpc_state->dcerpc.dcerpchdr.rpc_vers != 5) { - printf("expected dcerpc version 0x05, got 0x%02x : ", - dcerpc_state->dcerpc.dcerpchdr.rpc_vers); - result = 0; - goto end; - } - - if (dcerpc_state->dcerpc.dcerpchdr.type != REQUEST) { - printf("expected dcerpc type 0x%02x , got 0x%02x : ", REQUEST, dcerpc_state->dcerpc.dcerpchdr.type); - result = 0; - goto end; - } - - if (dcerpc_state->dcerpc.dcerpchdr.frag_length != 1024) { - printf("expected dcerpc frag_length 0x%02x , got 0x%02x : ", 1024, dcerpc_state->dcerpc.dcerpchdr.frag_length); - result = 0; - goto end; - } - - if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 9) { - printf("expected dcerpc opnum 0x%02x , got 0x%02x : ", 9, dcerpc_state->dcerpc.dcerpcrequest.opnum); - result = 0; - goto end; - } - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** \test Test endianness handling -*/ -static int DCERPCParserTest03(void) -{ - int result = 1; - Flow f; - uint8_t dcerpcrequest[] = { - 0x05, 0x00, 0x00, 0x00, 0x01, - 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0xe8, 0x03, 0x00, 0x00, 0x00, - 0x0b, 0x00, 0x09, 0x45, 0x00, 0x2c, 0x00, 0x4d, - 0x00, 0x73, 0x00, 0x53, 0x00, 0x59, 0x00, 0x2a, - 0x00, 0x4a, 0x00, 0x7a, 0x00, 0x3e, 0x00, 0x58, - 0x00, 0x21, 0x00, 0x4a, 0x00, 0x30, 0x00, 0x41, - 0x00, 0x4b, 0x00, 0x4b, 0x00, 0x3c, 0x00, 0x48, - 0x00, 0x24, 0x00, 0x38, 0x00, 0x54, 0x00, 0x60, - 0x00, 0x2d, 0x00, 0x29, 0x00, 0x64, 0x00, 0x5b, - 0x00, 0x77, 0x00, 0x3a, 0x00, 0x4c, 0x00, 0x24, - 0x00, 0x23, 0x00, 0x66, 0x00, 0x43, 0x00, 0x68, - 0x00, 0x22, 0x00, 0x55, 0x00, 0x29, 0x00, 0x2c, - 0x00, 0x4f, 0x00, 0x5a, 0x00, 0x50, 0x00, 0x61, - 0x00, 0x2a, 0x00, 0x6f, 0x00, 0x2f, 0x00, 0x4d, - 0x00, 0x68, 0x00, 0x3a, 0x00, 0x5c, 0x00, 0x67, - 0x00, 0x68, 0x00, 0x68, 0x00, 0x49, 0x00, 0x45, - 0x00, 0x4c, 0x00, 0x72, 0x00, 0x53, 0x00, 0x4c, - 0x00, 0x25, 0x00, 0x4d, 0x00, 0x67, 0x00, 0x2e, - 0x00, 0x4f, 0x00, 0x64, 0x00, 0x61, 0x00, 0x73, - 0x00, 0x24, 0x00, 0x46, 0x00, 0x35, 0x00, 0x2e, - 0x00, 0x45, 0x00, 0x6f, 0x00, 0x40, 0x00, 0x41, - 0x00, 0x33, 0x00, 0x38, 0x00, 0x47, 0x00, 0x71, - 0x00, 0x5a, 0x00, 0x37, 0x00, 0x7a, 0x00, 0x35, - 0x00, 0x6b, 0x00, 0x3c, 0x00, 0x26, 0x00, 0x37, - 0x00, 0x69, 0x00, 0x75, 0x00, 0x36, 0x00, 0x37, - 0x00, 0x47, 0x00, 0x21, 0x00, 0x2d, 0x00, 0x69, - 0x00, 0x37, 0x00, 0x78, 0x00, 0x5f, 0x00, 0x72, - 0x00, 0x4b, 0x00, 0x5c, 0x00, 0x74, 0x00, 0x3e, - 0x00, 0x52, 0x00, 0x7a, 0x00, 0x49, 0x00, 0x31, - 0x00, 0x5a, 0x00, 0x7b, 0x00, 0x29, 0x00, 0x3b, - 0x00, 0x78, 0x00, 0x3b, 0x00, 0x55, 0x00, 0x3e, - 0x00, 0x35, 0x00, 0x2b, 0x00, 0x4e, 0x00, 0x4f, - 0x00, 0x59, 0x00, 0x38, 0x00, 0x2a, 0x00, 0x59, - 0x00, 0x6b, 0x00, 0x42, 0x00, 0x4c, 0x00, 0x3e, - 0x00, 0x6a, 0x00, 0x49, 0x00, 0x2c, 0x00, 0x79, - 0x00, 0x6e, 0x00, 0x35, 0x00, 0x4f, 0x00, 0x49, - 0x00, 0x55, 0x00, 0x35, 0x00, 0x61, 0x00, 0x72, - 0x00, 0x77, 0x00, 0x38, 0x00, 0x32, 0x00, 0x24, - 0x00, 0x46, 0x00, 0x32, 0x00, 0x32, 0x00, 0x27, - 0x00, 0x64, 0x00, 0x5a, 0x00, 0x77, 0x00, 0x2e, - 0x00, 0x37, 0x00, 0x77, 0x00, 0x2e, 0x00, 0x28, - 0x00, 0x63, 0x00, 0x4f, 0x00, 0x67, 0x00, 0x64, - 0x00, 0x39, 0x00, 0x37, 0x00, 0x31, 0x00, 0x30, - 0x00, 0x28, 0x00, 0x2e, 0x00, 0x6f, 0x00, 0x3e, - 0x00, 0x59, 0x00, 0x28, 0x00, 0x67, 0x00, 0x52, - 0x00, 0x35, 0x00, 0x5a, 0x00, 0x7c, 0x00, 0x56, - 0x00, 0x6a, 0x00, 0x5c, 0x00, 0x3c, 0x00, 0x30, - 0x00, 0x59, 0x00, 0x5c, 0x00, 0x5e, 0x00, 0x38, - 0x00, 0x54, 0x00, 0x5c, 0x00, 0x5b, 0x00, 0x42, - 0x00, 0x62, 0x00, 0x70, 0x00, 0x34, 0x00, 0x5c, - 0x00, 0x57, 0x00, 0x7a, 0x00, 0x4b, 0x00, 0x2f, - 0x00, 0x6b, 0x00, 0x6a, 0x00, 0x4f, 0x00, 0x41, - 0x00, 0x33, 0x00, 0x52, 0x00, 0x36, 0x00, 0x27, - 0x00, 0x30, 0x00, 0x6d, 0x00, 0x4a, 0x00, 0x30, - 0x00, 0x78, 0x00, 0x46, 0x00, 0x65, 0x00, 0x4e, - 0x00, 0x29, 0x00, 0x66, 0x00, 0x3f, 0x00, 0x72, - 0x00, 0x71, 0x00, 0x75, 0x00, 0x4c, 0x00, 0x2b, - 0x00, 0x5c, 0x00, 0x46, 0x00, 0x52, 0x00, 0x7b, - 0x00, 0x5c, 0x00, 0x69, 0x00, 0x66, 0x00, 0x56, - 0x00, 0x31, 0x00, 0x2d, 0x00, 0x72, 0x00, 0x61, - 0x00, 0x68, 0x00, 0x28, 0x00, 0x7d, 0x00, 0x58, - 0x00, 0x2a, 0x00, 0x7b, 0x00, 0x28, 0x00, 0x5b, - 0x00, 0x54, 0x00, 0x3a, 0x00, 0x26, 0x00, 0x52, - 0x00, 0x44, 0x00, 0x60, 0x00, 0x50, 0x00, 0x65, - 0x00, 0x48, 0x00, 0x7d, 0x00, 0x2a, 0x00, 0x74, - 0x00, 0x49, 0x00, 0x7b, 0x00, 0x21, 0x00, 0x61, - 0x00, 0x52, 0x00, 0x43, 0x00, 0x5f, 0x00, 0x5a, - 0x00, 0x74, 0x00, 0x5c, 0x00, 0x62, 0x00, 0x68, - 0x00, 0x6c, 0x00, 0x6c, 0x00, 0x2b, 0x00, 0x6f, - 0x00, 0x7c, 0x00, 0x42, 0x00, 0x67, 0x00, 0x32, - 0x00, 0x58, 0x00, 0x35, 0x00, 0x30, 0x00, 0x2f, - 0x00, 0x2d, 0x00, 0x60, 0x00, 0x62, 0x00, 0x51, - 0x00, 0x2a, 0x00, 0x30, 0x00, 0x31, 0x00, 0x48, - 0x00, 0x5b, 0x00, 0x5b, 0x00, 0x5d, 0x00, 0x25, - 0x00, 0x58, 0x00, 0x4a, 0x00, 0x76, 0x00, 0x32, - 0x00, 0x62, 0x00, 0x27, 0x00, 0x42, 0x00, 0x40, - 0x00, 0x53, 0x00, 0x7c, 0x00, 0x7d, 0x00, 0x50, - 0x00, 0x3d, 0x00, 0x40, 0x00, 0x76, 0x00, 0x38, - 0x00, 0x58, 0x00, 0x39, 0x00, 0x63, 0x00, 0x3c, - 0x00, 0x5b, 0x00, 0x23, 0x00, 0x53, 0x00, 0x7a, - 0x00, 0x54, 0x00, 0x74, 0x00, 0x61, 0x00, 0x76, - 0x00, 0x4a, 0x00, 0x3e, 0x00, 0x33, 0x00, 0x75, - 0x00, 0x66, 0x00, 0x2d, 0x00, 0x48, 0x00, 0x33, - 0x00, 0x71, 0x00, 0x76, 0x00, 0x48, 0x00, 0x71, - 0x00, 0x41, 0x00, 0x6f, 0x00, 0x2a, 0x00, 0x67, - 0x00, 0x70, 0x00, 0x21, 0x00, 0x70, 0x00, 0x4b, - 0x00, 0x52, 0x00, 0x58, 0x00, 0x68, 0x00, 0x23, - 0x00, 0x39, 0x00, 0x46, 0x00, 0x4d, 0x00, 0x51, - 0x00, 0x57, 0x00, 0x3a, 0x00, 0x79, 0x00, 0x7b, - 0x00, 0x6c, 0x00, 0x55, 0x00, 0x33, 0x00, 0x65, - 0x00, 0x49, 0x00, 0x72, 0x00, 0x30, 0x00, 0x4f, - 0x00, 0x41, 0x00, 0x6e, 0x00, 0x31, 0x00, 0x4a, - 0x00, 0x60, 0x00, 0x79, 0x00, 0x70, 0x00, 0x4f, - 0x00, 0x58, 0x00, 0x75, 0x00, 0x44, 0x00, 0x59, - 0x00, 0x58, 0x00, 0x46, 0x00, 0x3d, 0x00, 0x46, - 0x00, 0x74, 0x00, 0x51, 0x00, 0x57, 0x00, 0x6e, - 0x00, 0x2d, 0x00, 0x47, 0x00, 0x23, 0x00, 0x45, - 0x00, 0x60, 0x00, 0x4c, 0x00, 0x72, 0x00, 0x4e, - 0x00, 0x74, 0x00, 0x40, 0x00, 0x76, 0x00, 0x75, - 0x00, 0x74, 0x00, 0x56, 0x00, 0x44, 0x00, 0x29, - 0x00, 0x62, 0x00, 0x58, 0x00, 0x31, 0x00, 0x78, - 0x00, 0x32, 0x00, 0x52, 0x00, 0x4a, 0x00, 0x6b, - 0x00, 0x55, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x6f, - 0x00, 0x4a, 0x00, 0x54, 0x00, 0x7d, 0x00, 0x68, - 0x00, 0x3f, 0x00, 0x28, 0x00, 0x21, 0x00, 0x53, - 0x00, 0x48, 0x00, 0x5a, 0x00, 0x34, 0x00, 0x36, - 0x00, 0x35, 0x00, 0x64, 0x00, 0x4e, 0x00, 0x75, - 0x00, 0x69, 0x00, 0x23, 0x00, 0x75, 0x00, 0x55, - 0x00, 0x43, 0x00, 0x75, 0x00, 0x2f, 0x00, 0x73, - 0x00, 0x62, 0x00, 0x6f, 0x00, 0x37, 0x00, 0x4e, - 0x00, 0x25, 0x00, 0x25, 0x00, 0x21, 0x00, 0x3d, - 0x00, 0x3c, 0x00, 0x71, 0x00, 0x3e, 0x00, 0x3f, - 0x00, 0x30, 0x00, 0x36, 0x00, 0x62, 0x00, 0x63, - 0x00, 0x53, 0x00, 0x54, 0x00, 0x5d, 0x00, 0x61, - 0x00, 0x4c, 0x00, 0x28, 0x00, 0x2b, 0x00, 0x4c, - 0x00, 0x4e, 0x00, 0x66, 0x00, 0x5f, 0x00, 0x4b, - 0x00, 0x43, 0x00, 0x75, 0x00, 0x45, 0x00, 0x37, - 0x00, 0x28, 0x00, 0x56, 0x00, 0x36, 0x00, 0x6a, - 0x00, 0x3e, 0x00, 0x64, 0x00, 0x34, 0x00, 0x6a, - 0x00, 0x7d, 0x00, 0x4a, 0x00, 0x66, 0x00, 0x7a, - 0x00, 0x3e, 0x00, 0x75, 0x00, 0x38, 0x00, 0x7b, - 0x00, 0x42, 0x00, 0x76, 0x00, 0x29, 0x00, 0x4c, - 0x00, 0x65, 0x00, 0x2e, 0x00, 0x32, 0x00, 0x4b, - 0x00, 0x2b, 0x00, 0x51, 0x00, 0x47, 0x00, 0x22, - 0x00, 0x48, 0x00, 0x3d, 0x00, 0x49, 0x00, 0x44, - 0x00, 0x5d, 0x00, 0x59, 0x00, 0x63, 0x00, 0x5c, - 0x00, 0x24, 0x00, 0x35, 0x00, 0x34, 0x00, 0x70, - 0x00, 0x69, 0x00}; - uint32_t requestlen = sizeof(dcerpcrequest); - - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER | STREAM_START, - dcerpcrequest, - requestlen); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - if (dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] != 0x01) { - printf("expected dcerpc data representation 0x01, got 0x%02x : ", - dcerpc_state->dcerpc.dcerpchdr.packed_drep[0]); - result = 0; - goto end; - } - - if (dcerpc_state->dcerpc.dcerpchdr.frag_length != 1024) { - printf("expected dcerpc frag_length 0x%02x , got 0x%02x : ", 1024, dcerpc_state->dcerpc.dcerpchdr.frag_length); - result = 0; - goto end; - } - - if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 9) { - printf("expected dcerpc opnum 0x%02x , got 0x%02x : ", 9, dcerpc_state->dcerpc.dcerpcrequest.opnum); - result = 0; - goto end; - } -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** - * \test General test. - */ -static int DCERPCParserTest05(void) -{ - int result = 1; - Flow f; - int r = 0; - uint8_t bind1[] = { - 0x05, 0x00, 0x0b, 0x01, 0x10, 0x00, 0x00, 0x00, - 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, - 0xb8, 0x4a, 0x9f, 0x4d, 0x1c, 0x7d, 0xcf, 0x11, - 0x86, 0x1e, 0x00, 0x20, 0xaf, 0x6e, 0x7c, 0x57, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 - }; - uint32_t bind1_len = sizeof(bind1); - - uint8_t bind2[] = { - 0x05, 0x00, 0x0b, 0x02, 0x10, 0x00, 0x00, 0x00, - 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, - 0xb8, 0x4a, 0x9f, 0x4d, 0x1c, 0x7d, 0xcf, 0x11, - 0x86, 0x1e, 0x00, 0x20, 0xaf, 0x6e, 0x7c, 0x67, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 - }; - uint32_t bind2_len = sizeof(bind2); - - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER | STREAM_START, bind1, bind1_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - DCERPCUuidEntry *item = NULL; - int m = 0; - TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.uuid_list, next) { - printf("%d ", m); - printUUID("BIND",item); - m++; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, bind2, bind2_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - item = NULL; - m = 0; - TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.uuid_list, next) { - printf("%d ", m); - printUUID("BIND",item); - m++; - } - - /* we will need this test later for fragged bind pdus. keep it */ - result = 1; - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** - * \test DCERPC fragmented bind PDU(one PDU which is frag'ed) - */ -static int DCERPCParserTest06(void) -{ - int result = 1; - Flow f; - int r = 0; - uint8_t bind1[] = { - 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, - 0xdc, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, - 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, - 0xc7, 0x70, 0x0d, 0x3e, 0x71, 0x37, 0x39, 0x0d, - 0x3a, 0x4f, 0xd3, 0xdc, 0xca, 0x49, 0xe8, 0xa3, - 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x01, 0x00, 0x84, 0xb6, 0x55, 0x75, - 0xdb, 0x9e, 0xba, 0x54, 0x56, 0xd3, 0x45, 0x10, - 0xb7, 0x7a, 0x2a, 0xe2, 0x04, 0x00, 0x01, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x6e, 0x39, 0x21, 0x24, 0x70, 0x6f, 0x41, 0x57, - 0x54, 0x70, 0xb8, 0xc3, 0x5e, 0x89, 0x3b, 0x43, - 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x03, 0x00, 0x01, 0x00, 0x39, 0x6a, 0x86, 0x5d, - 0x24, 0x0f, 0xd2, 0xf7, 0xb6, 0xce, 0x95, 0x9c, - 0x54, 0x1d, 0x3a, 0xdb, 0x02, 0x00, 0x01, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, - 0x12, 0xa5, 0xdd, 0xc5, 0x55, 0xce, 0xc3, 0x46, - 0xbd, 0xa0, 0x94, 0x39, 0x3c, 0x0d, 0x9b, 0x5b, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x05, 0x00, 0x01, 0x00, 0x87, 0x1c, 0x8b, 0x6e, - 0x11, 0xa8, 0x67, 0x98, 0xd4, 0x5d, 0xf6, 0x8a, - 0x2f, 0x33, 0x24, 0x7b, 0x05, 0x00, 0x03, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, - 0x9b, 0x82, 0x13, 0xd1, 0x28, 0xe0, 0x63, 0xf3, - 0x62, 0xee, 0x76, 0x73, 0xf9, 0xac, 0x3d, 0x2e, - 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x07, 0x00, 0x01, 0x00, 0xa9, 0xd4, 0x73, 0xf2, - 0xed, 0xad, 0xe8, 0x82, 0xf8, 0xcf, 0x9d, 0x9f, - 0x66, 0xe6, 0x43, 0x37, 0x02, 0x00, 0x01, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, - 0x06, 0x2b, 0x85, 0x38, 0x4f, 0x73, 0x96, 0xb1, - 0x73, 0xe1, 0x59, 0xbe, 0x9d, 0xe2, 0x6c, 0x07, - 0x05, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60}; - uint32_t bind1_len = sizeof(bind1); - - uint8_t bind2[] = { - 0x02, 0x00, 0x00, 0x00, 0x09, 0x00, 0x01, 0x00, - 0xbf, 0xfa, 0xbb, 0xa4, 0x9e, 0x5c, 0x80, 0x61, - 0xb5, 0x8b, 0x79, 0x69, 0xa6, 0x32, 0x88, 0x77, - 0x01, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x0a, 0x00, 0x01, 0x00, 0x39, 0xa8, 0x2c, 0x39, - 0x73, 0x50, 0x06, 0x8d, 0xf2, 0x37, 0x1e, 0x1e, - 0xa8, 0x8f, 0x46, 0x98, 0x02, 0x00, 0x02, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x01, 0x00, - 0x91, 0x13, 0xd0, 0xa7, 0xef, 0xc4, 0xa7, 0x96, - 0x0c, 0x4a, 0x0d, 0x29, 0x80, 0xd3, 0xfe, 0xbf, - 0x00, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x0c, 0x00, 0x01, 0x00, 0xcc, 0x2b, 0x55, 0x1d, - 0xd4, 0xa4, 0x0d, 0xfb, 0xcb, 0x6f, 0x86, 0x36, - 0xa6, 0x57, 0xc3, 0x21, 0x02, 0x00, 0x01, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x01, 0x00, - 0x43, 0x7b, 0x07, 0xee, 0x85, 0xa8, 0xb9, 0x3a, - 0x0f, 0xf9, 0x83, 0x70, 0xe6, 0x0b, 0x4f, 0x33, - 0x02, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x0e, 0x00, 0x01, 0x00, 0x9c, 0x6a, 0x15, 0x8c, - 0xd6, 0x9c, 0xa6, 0xc3, 0xb2, 0x9e, 0x62, 0x9f, - 0x3d, 0x8e, 0x47, 0x73, 0x02, 0x00, 0x02, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x01, 0x00, - 0xc8, 0x4f, 0x32, 0x4b, 0x70, 0x16, 0xd3, 0x01, - 0x12, 0x78, 0x5a, 0x47, 0xbf, 0x6e, 0xe1, 0x88, - 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 - }; - uint32_t bind2_len = sizeof(bind2); - - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER | STREAM_START, bind1, bind1_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - result &= (dcerpc_state->dcerpc.bytesprocessed == 420); - result &= (dcerpc_state->dcerpc.dcerpcbindbindack.ctxbytesprocessed == 40); - result &= (dcerpc_state->dcerpc.dcerpcbindbindack.numctxitems == 16); - result &= (dcerpc_state->dcerpc.dcerpcbindbindack.numctxitemsleft == 8); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, bind2, bind2_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - result &= (dcerpc_state->dcerpc.bytesprocessed == 0); - result &= (dcerpc_state->dcerpc.dcerpcbindbindack.ctxbytesprocessed == 0); - result &= (dcerpc_state->dcerpc.dcerpcbindbindack.numctxitems == 16); - result &= (dcerpc_state->dcerpc.dcerpcbindbindack.numctxitemsleft == 0); - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** - * \test DCERPC fragmented bind PDU(one PDU which is frag'ed). - */ -static int DCERPCParserTest07(void) -{ - uint8_t request1[] = { - 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x2C, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, - 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, - 0x09, 0x0A, 0x0B, 0x0C - }; - uint32_t request1_len = sizeof(request1); - - uint8_t request2[] = { - 0x0D, 0x0E - }; - uint32_t request2_len = sizeof(request2); - - uint8_t request3[] = { - 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14 - }; - uint32_t request3_len = sizeof(request3); - - Flow f; - int r = 0; - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - StreamTcpInitConfig(TRUE); - - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER | STREAM_START, request1, - request1_len); - FAIL_IF(r != 0); - - DCERPCState *dcerpc_state = f.alstate; - FAIL_IF_NULL(dcerpc_state); - - FAIL_IF_NOT(dcerpc_state->dcerpc.bytesprocessed == 36); - FAIL_IF_NOT(dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL); - FAIL_IF_NOT(dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 12); - - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, request2, request2_len); - FAIL_IF(r != 0); - - FAIL_IF_NOT(dcerpc_state->dcerpc.bytesprocessed == 38); - FAIL_IF_NOT(dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL); - FAIL_IF_NOT(dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 14); - - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, request3, request3_len); - FAIL_IF(r != 0); - - FAIL_IF_NOT(dcerpc_state->dcerpc.bytesprocessed == 0); - FAIL_IF_NOT(dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL); - FAIL_IF_NOT(dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 20); - - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - PASS; -} - -/** - * \test DCERPC fragmented bind PDU(one PDU which is frag'ed). - */ -static int DCERPCParserTest08(void) -{ - int result = 1; - Flow f; - int r = 0; - uint8_t request[] = { - 0x05, 0x02, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x2C, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, - 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, - 0x09, 0x0A, 0x0B, 0x0C, - }; - uint32_t request_len = sizeof(request); - - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER | STREAM_START, request, - request_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - result &= (dcerpc_state->dcerpc.bytesprocessed == 0); - result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer == NULL && - dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 0); - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** - * \test DCERPC fragmented bind PDU(one PDU which is frag'ed). - */ -static int DCERPCParserTest09(void) -{ - int result = 1; - Flow f; - int r = 0; - uint8_t request[] = { - 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x2C, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, - 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, - 0x09, 0x0A, 0x0B, 0x0C, - }; - uint32_t request_len = sizeof(request); - - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER | STREAM_START, request, - request_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - result &= (dcerpc_state->dcerpc.bytesprocessed == 36); - result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && - dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 12); - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** - * \test DCERPC fragmented PDU. - */ -static int DCERPCParserTest10(void) -{ - int result = 1; - Flow f; - int r = 0; - - uint8_t fault[] = { - 0x05, 0x00, 0x03, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, - 0xf7, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 - }; - uint32_t fault_len = sizeof(fault); - - uint8_t request1[] = { - 0x05, 0x00 - }; - uint32_t request1_len = sizeof(request1); - - uint8_t request2[] = { - 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x24, 0x00, - 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x02, - 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, - 0x0B, 0x0C - }; - uint32_t request2_len = sizeof(request2); - - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER | STREAM_START, fault, fault_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, request1, request1_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - result &= (dcerpc_state->dcerpc.bytesprocessed == 2); - result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer == NULL); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, request2, request2_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - result &= (dcerpc_state->dcerpc.bytesprocessed == 0); - result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && - dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 12); - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** - * \test DCERPC fragmented PDU. - */ -static int DCERPCParserTest11(void) -{ - int result = 1; - Flow f; - int r = 0; - - uint8_t request1[] = { - 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, - 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, - 0x09, 0x0A, 0x0B, 0x0C - }; - uint32_t request1_len = sizeof(request1); - - uint8_t request2[] = { - 0x05, 0x00 - }; - uint32_t request2_len = sizeof(request2); - - uint8_t request3[] = { - 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x26, 0x00, - 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x02, - 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, - 0x0B, 0x0C, 0xFF, 0xFF - }; - uint32_t request3_len = sizeof(request3); - - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, request1, request1_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - result &= (dcerpc_state->dcerpc.bytesprocessed == 0); - result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && - dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 12); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, request2, request2_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - result &= (dcerpc_state->dcerpc.bytesprocessed == 2); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, request3, request3_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - result &= (dcerpc_state->dcerpc.bytesprocessed == 0); - result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && - dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 14); - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** - * \test DCERPC fragmented PDU. - */ -static int DCERPCParserTest12(void) -{ - int result = 1; - Flow f; - int r = 0; - - uint8_t bind_ack1[] = { - 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xb8, 0x10, 0xb8, 0x10, 0x48, 0x1a, 0x00, 0x00, - }; - uint32_t bind_ack1_len = sizeof(bind_ack1); - - uint8_t bind_ack2[] = { - 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, - 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00 - }; - uint32_t bind_ack2_len = sizeof(bind_ack2); - - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, bind_ack1, bind_ack1_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - result &= (dcerpc_state->dcerpc.bytesprocessed == 24); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, bind_ack2, bind_ack2_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - result &= (dcerpc_state->dcerpc.bytesprocessed == 0); - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** - * \test Check if the parser accepts bind pdus that have context ids starting - * from a non-zero value. - */ -static int DCERPCParserTest13(void) -{ - int result = 1; - Flow f; - int r = 0; - - uint8_t bindbuf[] = { - 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x48, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x00, 0x00, - 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, - 0xa0, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 - }; - uint32_t bindbuf_len = sizeof(bindbuf); - - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, bindbuf, bindbuf_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - result &= (dcerpc_state->dcerpc.bytesprocessed == 0); - result &= (dcerpc_state->dcerpc.dcerpcbindbindack.numctxitems == 1); - if (result == 0) - goto end; - - result = 0; - uint8_t ctx_uuid_from_pcap[16] = { - 0x00, 0x00, 0x01, 0xa0, 0x00, 0x00, 0x00, 0x00, - 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46}; - DCERPCUuidEntry *item = NULL; - int internal_id = 0; - TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.uuid_list, next) { - int i = 0; - /* check the interface uuid */ - for (i = 0; i < 16; i++) { - if (ctx_uuid_from_pcap[i] != item->uuid[i]) { - result = 0; - goto end; - } - } - result = 1; - result &= (item->internal_id == internal_id++); - } - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** - * \test Check for another endless loop with bind pdus. - */ -static int DCERPCParserTest14(void) -{ - int result = 1; - Flow f; - int r = 0; - - uint8_t bindbuf[] = { - 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x4A, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x00, 0x00, - 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, - 0xa0, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, - 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, - 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, - 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, - 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, - 0x01, 0x02, 0x03, 0x04, 0xFF /* ka boom - endless loop */ - }; - uint32_t bindbuf_len = sizeof(bindbuf); - - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, bindbuf, bindbuf_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** - * \test Check for another endless loop for bind_ack pdus. - */ -static int DCERPCParserTest15(void) -{ - int result = 1; - Flow f; - int r = 0; - - uint8_t bind_ack[] = { - 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x3e, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x00, 0x00, - 0xd0, 0x16, 0xd0, 0x16, 0xfd, 0x04, 0x01, 0x00, - 0x04, 0x00, 0x31, 0x33, 0x35, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x01, 0x02, 0x03, 0x04, 0xFF - }; - uint32_t bind_ack_len = sizeof(bind_ack); - - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, bind_ack, bind_ack_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** - * \test Check for correct internal ids for bind_acks. - */ -static int DCERPCParserTest16(void) -{ - int result = 1; - Flow f; - int r = 0; - - uint8_t bind1[] = { - 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x58, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, - 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, - 0x50, 0x08, 0x43, 0x95, 0x43, 0x5a, 0x8b, 0xb2, - 0xf4, 0xc5, 0xb9, 0xee, 0x67, 0x55, 0x7c, 0x19, - 0x00, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x01, 0x00, 0xda, 0xc2, 0xbc, 0x9b, - 0x35, 0x2e, 0xd4, 0xc9, 0x1f, 0x85, 0x01, 0xe6, - 0x4e, 0x5a, 0x5e, 0xd4, 0x04, 0x00, 0x03, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0xb2, 0x97, 0xcc, 0x14, 0x6f, 0x70, 0x0d, 0xa5, - 0x33, 0xd7, 0xf4, 0xe3, 0x8e, 0xb2, 0x2a, 0x1e, - 0x05, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x03, 0x00, 0x01, 0x00, 0x96, 0x4e, 0xa6, 0xf6, - 0xb2, 0x4b, 0xae, 0xb3, 0x21, 0xf4, 0x97, 0x7c, - 0xcd, 0xa7, 0x08, 0xb0, 0x00, 0x00, 0x00, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, - 0xbc, 0xc0, 0xf7, 0x71, 0x3f, 0x71, 0x54, 0x44, - 0x22, 0xa8, 0x55, 0x0f, 0x98, 0x83, 0x1f, 0xfe, - 0x04, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x05, 0x00, 0x01, 0x00, 0xbe, 0x52, 0xf2, 0x58, - 0x4a, 0xc3, 0xb5, 0xd0, 0xba, 0xac, 0xda, 0xf0, - 0x12, 0x99, 0x38, 0x6e, 0x04, 0x00, 0x02, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, - 0xdb, 0xfa, 0x73, 0x01, 0xb3, 0x81, 0x01, 0xd4, - 0x7f, 0xa0, 0x36, 0xb1, 0x97, 0xae, 0x29, 0x7f, - 0x01, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x07, 0x00, 0x01, 0x00, 0x89, 0xbe, 0x41, 0x1d, - 0x38, 0x75, 0xf5, 0xb5, 0xad, 0x27, 0x73, 0xf1, - 0xb0, 0x7a, 0x28, 0x82, 0x05, 0x00, 0x02, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, - 0xf6, 0x87, 0x09, 0x93, 0xb8, 0xa8, 0x20, 0xc4, - 0xb8, 0x63, 0xe6, 0x95, 0xed, 0x59, 0xee, 0x3f, - 0x05, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x09, 0x00, 0x01, 0x00, 0x92, 0x77, 0x92, 0x68, - 0x3e, 0xa4, 0xbc, 0x3f, 0x44, 0x33, 0x0e, 0xb8, - 0x33, 0x0a, 0x2f, 0xdf, 0x01, 0x00, 0x02, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x01, 0x00, - 0xa1, 0x03, 0xd2, 0xa9, 0xd2, 0x16, 0xc9, 0x89, - 0x67, 0x18, 0x3e, 0xb1, 0xee, 0x6b, 0xf9, 0x18, - 0x02, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x0b, 0x00, 0x01, 0x00, 0x2f, 0x09, 0x5e, 0x74, - 0xec, 0xa0, 0xbb, 0xc1, 0x60, 0x18, 0xf1, 0x93, - 0x04, 0x17, 0x11, 0xf9, 0x01, 0x00, 0x03, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x01, 0x00, - 0xc8, 0x4f, 0x32, 0x4b, 0x70, 0x16, 0xd3, 0x01, - 0x12, 0x78, 0x5a, 0x47, 0xbf, 0x6e, 0xe1, 0x88, - 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 - }; - uint32_t bind1_len = sizeof(bind1); - - uint8_t bind_ack1[] = { - 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x64, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xb8, 0x10, 0xb8, 0x10, 0xc1, 0x2b, 0x00, 0x00, - 0x0e, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, - 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x00, - 0x0d, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00 - }; - uint32_t bind_ack1_len = sizeof(bind_ack1); - - uint8_t bind2[] = { - 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, - 0xdc, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, - 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, - 0xc7, 0x70, 0x0d, 0x3e, 0x71, 0x37, 0x39, 0x0d, - 0x3a, 0x4f, 0xd3, 0xdc, 0xca, 0x49, 0xe8, 0xa3, - 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x01, 0x00, 0x84, 0xb6, 0x55, 0x75, - 0xdb, 0x9e, 0xba, 0x54, 0x56, 0xd3, 0x45, 0x10, - 0xb7, 0x7a, 0x2a, 0xe2, 0x04, 0x00, 0x01, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x6e, 0x39, 0x21, 0x24, 0x70, 0x6f, 0x41, 0x57, - 0x54, 0x70, 0xb8, 0xc3, 0x5e, 0x89, 0x3b, 0x43, - 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x03, 0x00, 0x01, 0x00, 0x39, 0x6a, 0x86, 0x5d, - 0x24, 0x0f, 0xd2, 0xf7, 0xb6, 0xce, 0x95, 0x9c, - 0x54, 0x1d, 0x3a, 0xdb, 0x02, 0x00, 0x01, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, - 0x12, 0xa5, 0xdd, 0xc5, 0x55, 0xce, 0xc3, 0x46, - 0xbd, 0xa0, 0x94, 0x39, 0x3c, 0x0d, 0x9b, 0x5b, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x05, 0x00, 0x01, 0x00, 0x87, 0x1c, 0x8b, 0x6e, - 0x11, 0xa8, 0x67, 0x98, 0xd4, 0x5d, 0xf6, 0x8a, - 0x2f, 0x33, 0x24, 0x7b, 0x05, 0x00, 0x03, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, - 0x9b, 0x82, 0x13, 0xd1, 0x28, 0xe0, 0x63, 0xf3, - 0x62, 0xee, 0x76, 0x73, 0xf9, 0xac, 0x3d, 0x2e, - 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x07, 0x00, 0x01, 0x00, 0xa9, 0xd4, 0x73, 0xf2, - 0xed, 0xad, 0xe8, 0x82, 0xf8, 0xcf, 0x9d, 0x9f, - 0x66, 0xe6, 0x43, 0x37, 0x02, 0x00, 0x01, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, - 0x06, 0x2b, 0x85, 0x38, 0x4f, 0x73, 0x96, 0xb1, - 0x73, 0xe1, 0x59, 0xbe, 0x9d, 0xe2, 0x6c, 0x07, - 0x05, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x09, 0x00, 0x01, 0x00, 0xbf, 0xfa, 0xbb, 0xa4, - 0x9e, 0x5c, 0x80, 0x61, 0xb5, 0x8b, 0x79, 0x69, - 0xa6, 0x32, 0x88, 0x77, 0x01, 0x00, 0x01, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x01, 0x00, - 0x39, 0xa8, 0x2c, 0x39, 0x73, 0x50, 0x06, 0x8d, - 0xf2, 0x37, 0x1e, 0x1e, 0xa8, 0x8f, 0x46, 0x98, - 0x02, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x0b, 0x00, 0x01, 0x00, 0x91, 0x13, 0xd0, 0xa7, - 0xef, 0xc4, 0xa7, 0x96, 0x0c, 0x4a, 0x0d, 0x29, - 0x80, 0xd3, 0xfe, 0xbf, 0x00, 0x00, 0x01, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x01, 0x00, - 0xcc, 0x2b, 0x55, 0x1d, 0xd4, 0xa4, 0x0d, 0xfb, - 0xcb, 0x6f, 0x86, 0x36, 0xa6, 0x57, 0xc3, 0x21, - 0x02, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x0d, 0x00, 0x01, 0x00, 0x43, 0x7b, 0x07, 0xee, - 0x85, 0xa8, 0xb9, 0x3a, 0x0f, 0xf9, 0x83, 0x70, - 0xe6, 0x0b, 0x4f, 0x33, 0x02, 0x00, 0x02, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x01, 0x00, - 0x9c, 0x6a, 0x15, 0x8c, 0xd6, 0x9c, 0xa6, 0xc3, - 0xb2, 0x9e, 0x62, 0x9f, 0x3d, 0x8e, 0x47, 0x73, - 0x02, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x0f, 0x00, 0x01, 0x00, 0xc8, 0x4f, 0x32, 0x4b, - 0x70, 0x16, 0xd3, 0x01, 0x12, 0x78, 0x5a, 0x47, - 0xbf, 0x6e, 0xe1, 0x88, 0x03, 0x00, 0x00, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00 - }; - uint32_t bind2_len = sizeof(bind2); - - uint8_t bind_ack2[] = { - 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, - 0xac, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xb8, 0x10, 0xb8, 0x10, 0xc2, 0x2b, 0x00, 0x00, - 0x0e, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, - 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x00, - 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00 - }; - uint32_t bind_ack2_len = sizeof(bind_ack2); - - uint8_t bind3[] = { - 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x2c, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, - 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, - 0xa4, 0x7f, 0x8e, 0xc6, 0xef, 0x56, 0x9b, 0x63, - 0x92, 0xfa, 0x08, 0xb3, 0x35, 0xe2, 0xa5, 0x81, - 0x00, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x01, 0x00, 0x9f, 0xfc, 0x78, 0xd2, - 0x5f, 0x16, 0x0b, 0xbc, 0xc6, 0xdb, 0x5d, 0xef, - 0xde, 0x54, 0xa2, 0x6f, 0x04, 0x00, 0x01, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x78, 0xb8, 0x96, 0xc7, 0x2f, 0xda, 0x11, 0x6b, - 0xd1, 0x28, 0x68, 0xe1, 0xd6, 0x71, 0xac, 0x9d, - 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x03, 0x00, 0x01, 0x00, 0xcf, 0xf4, 0xd7, 0x37, - 0x03, 0xda, 0xcc, 0xe3, 0x3e, 0x34, 0x7f, 0x67, - 0x99, 0x91, 0x41, 0x3d, 0x01, 0x00, 0x02, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, - 0x48, 0xeb, 0x32, 0xf0, 0x27, 0xd5, 0x9d, 0xd0, - 0x1e, 0xc6, 0x48, 0x46, 0x97, 0xe9, 0xdb, 0x09, - 0x05, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x05, 0x00, 0x01, 0x00, 0x82, 0xec, 0x0d, 0x08, - 0xf2, 0x8f, 0x22, 0x57, 0x42, 0x9b, 0xce, 0xa8, - 0x74, 0x16, 0xc6, 0xec, 0x00, 0x00, 0x01, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, - 0x2e, 0x00, 0x70, 0x44, 0xee, 0xc9, 0x30, 0x6b, - 0xf4, 0x34, 0x1e, 0x3d, 0x35, 0x0f, 0xf7, 0xf7, - 0x00, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x07, 0x00, 0x01, 0x00, 0x59, 0x04, 0x39, 0x3f, - 0x59, 0x87, 0x14, 0x0e, 0x76, 0x8d, 0x17, 0xc2, - 0x47, 0xfa, 0x67, 0x7f, 0x04, 0x00, 0x02, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, - 0x30, 0xd6, 0xed, 0x2e, 0x57, 0xfa, 0xf4, 0x72, - 0x6c, 0x10, 0x0d, 0xe5, 0x51, 0x7f, 0xd0, 0x39, - 0x02, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x09, 0x00, 0x01, 0x00, 0xea, 0x8b, 0x84, 0x4d, - 0x44, 0x43, 0xc1, 0x94, 0x75, 0xe2, 0x81, 0x48, - 0xd8, 0x77, 0xd9, 0xce, 0x05, 0x00, 0x00, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x01, 0x00, - 0x89, 0x4f, 0xe7, 0x95, 0xa3, 0xc1, 0x62, 0x36, - 0x26, 0x9e, 0x67, 0xdb, 0x2c, 0x52, 0x89, 0xd3, - 0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x0b, 0x00, 0x01, 0x00, 0x78, 0x56, 0x34, 0x12, - 0x34, 0x12, 0xcd, 0xab, 0xef, 0x00, 0x01, 0x23, - 0x45, 0x67, 0x89, 0xab, 0x01, 0x00, 0x00, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00 - }; - uint32_t bind3_len = sizeof(bind3); - - uint8_t bind_ack3[] = { - 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x4c, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xb8, 0x10, 0xb8, 0x10, 0x1a, 0x33, 0x00, 0x00, - 0x0e, 0x00, 0x5c, 0x70, 0x69, 0x70, 0x65, 0x5c, - 0x73, 0x70, 0x6f, 0x6f, 0x6c, 0x73, 0x73, 0x00, - 0x0c, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00 - }; - uint32_t bind_ack3_len = sizeof(bind_ack3); - - TcpSession ssn; - DCERPCUuidEntry *item = NULL; - int count = 0; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - uint8_t accepted_uuids[3][16] = { - {0x4b, 0x32, 0x4f, 0xc8, 0x16, 0x70, 0x01, 0xd3, - 0x12, 0x78, 0x5a, 0x47, 0xbf, 0x6e, 0xe1, 0x88}, - {0x4b, 0x32, 0x4f, 0xc8, 0x16, 0x70, 0x01, 0xd3, - 0x12, 0x78, 0x5a, 0x47, 0xbf, 0x6e, 0xe1, 0x88}, - {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0xab, 0xcd, - 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab} - }; - - uint16_t accepted_ctxids[3] = {12, 15, 11}; - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, bind1, bind1_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, bind_ack1, bind_ack1_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - count = 0; - TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { - int i = 0; - /* check the interface uuid */ - for (i = 0; i < 16; i++) { - if (accepted_uuids[0][i] != item->uuid[i]) { - result = 0; - goto end; - } - } - if (accepted_ctxids[0] != item->ctxid) { - result = 0; - goto end; - } - count++; - } - if (count != 1) { - result = 0; - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, bind2, bind2_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - count = 0; - TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { - count++; - } - if (count != 0) { - result = 0; - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, bind_ack2, bind_ack2_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - count = 0; - TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { - int i = 0; - /* check the interface uuid */ - for (i = 0; i < 16; i++) { - if (accepted_uuids[1][i] != item->uuid[i]) { - result = 0; - goto end; - } - } - if (accepted_ctxids[1] != item->ctxid) { - result = 0; - goto end; - } - count++; - } - if (count != 1) { - result = 0; - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, bind3, bind3_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - count = 0; - TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { - count++; - } - if (count != 0) { - result = 0; - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, bind_ack3, bind_ack3_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - count = 0; - TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { - int i = 0; - /* check the interface uuid */ - for (i = 0; i < 16; i++) { - if (accepted_uuids[2][i] != item->uuid[i]) { - result = 0; - goto end; - } - } - if (accepted_ctxids[2] != item->ctxid) { - result = 0; - goto end; - } - count++; - } - if (count != 1) { - result = 0; - goto end; - } - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - - -/** - * \test Check for correct internal ids for bind_acks + alter_contexts - */ -static int DCERPCParserTest17(void) -{ - int result = 1; - Flow f; - int r = 0; - - uint8_t bindbuf[] = { - 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, - 0x40, 0xfd, 0x2c, 0x34, 0x6c, 0x3c, 0xce, 0x11, - 0xa8, 0x93, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 - }; - uint32_t bindbuf_len = sizeof(bindbuf); - - uint8_t bind_ack[] = { - 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0xb8, 0x10, 0xb8, 0x10, 0x7d, 0xd8, 0x00, 0x00, - 0x0d, 0x00, 0x5c, 0x70, 0x69, 0x70, 0x65, 0x5c, - 0x6c, 0x6c, 0x73, 0x72, 0x70, 0x63, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00 - }; - uint32_t bind_ack_len = sizeof(bind_ack); - - uint8_t alter_context[] = { - 0x05, 0x00, 0x0e, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, - 0xd0, 0x4c, 0x67, 0x57, 0x00, 0x52, 0xce, 0x11, - 0xa8, 0x97, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d, - 0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 - }; - uint32_t alter_context_len = sizeof(alter_context); - - uint8_t alter_context_resp[] = { - 0x05, 0x00, 0x0f, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x38, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0xb8, 0x10, 0xb8, 0x10, 0x7d, 0xd8, 0x00, 0x00, - 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 - }; - uint32_t alter_context_resp_len = sizeof(alter_context_resp); - - - TcpSession ssn; - DCERPCUuidEntry *item = NULL; - int count = 0; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - uint8_t accepted_uuids[2][16] = { - {0x57, 0x67, 0x4c, 0xd0, 0x52, 0x00, 0x11, 0xce, - 0xa8, 0x97, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d}, - {0x34, 0x2c, 0xfd, 0x40, 0x3c, 0x6c, 0x11, 0xce, - 0xa8, 0x93, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d}, - }; - - uint16_t accepted_ctxids[2] = {1, 0}; - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, bindbuf, bindbuf_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, bind_ack, bind_ack_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - count = 0; - TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { - int i = 0; - /* check the interface uuid */ - for (i = 0; i < 16; i++) { - if (accepted_uuids[1][i] != item->uuid[i]) { - result = 0; - goto end; - } - } - if (accepted_ctxids[1] != item->ctxid) { - result = 0; - goto end; - } - count++; - } - if (count != 1) { - result = 0; - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, alter_context, alter_context_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - count = 0; - TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { - count++; - } - if (count != 1) { - result = 0; - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, alter_context_resp, - alter_context_resp_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - count = 0; - TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { - int i = 0; - /* check the interface uuid */ - for (i = 0; i < 16; i++) { - if (accepted_uuids[count][i] != item->uuid[i]) { - result = 0; - goto end; - } - } - if (accepted_ctxids[count] != item->ctxid) { - result = 0; - goto end; - } - count++; - } - if (count != 2) { - result = 0; - goto end; - } - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** - * \test DCERPC fragmented PDU. - */ -static int DCERPCParserTest18(void) -{ - int result = 1; - Flow f; - int r = 0; - - uint8_t request1[] = { - 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x26, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x0c, 0x00, - }; - uint32_t request1_len = sizeof(request1); - - uint8_t request2[] = { - 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x02, - 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, - 0x0B, 0x0C, 0xFF, 0xFF - }; - uint32_t request2_len = sizeof(request2); - - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, request1, request1_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - result = 0; - goto end; - } - - result &= (dcerpc_state->dcerpc.bytesprocessed == 18); - result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer == NULL); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, request2, request2_len); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - result &= (dcerpc_state->dcerpc.bytesprocessed == 0); - result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && - dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 14); - result &= (dcerpc_state->dcerpc.dcerpcrequest.opnum == 2); - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -static int DCERPCParserTest19(void) -{ - int result = 0; - Flow f; - uint8_t dcerpcbind[] = { - 0x05, 0x00, - 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x3c, 0x04, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, - 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x2c, 0xd0, - 0x28, 0xda, 0x76, 0x91, 0xf6, 0x6e, 0xcb, 0x0f, - 0xbf, 0x85, 0xcd, 0x9b, 0xf6, 0x39, 0x01, 0x00, - 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, - 0x01, 0x00, 0x2c, 0x75, 0xce, 0x7e, 0x82, 0x3b, - 0x06, 0xac, 0x1b, 0xf0, 0xf5, 0xb7, 0xa7, 0xf7, - 0x28, 0xaf, 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0xe3, 0xb2, - 0x10, 0xd1, 0xd0, 0x0c, 0xcc, 0x3d, 0x2f, 0x80, - 0x20, 0x7c, 0xef, 0xe7, 0x09, 0xe0, 0x04, 0x00, - 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x03, 0x00, - 0x01, 0x00, 0xde, 0x85, 0x70, 0xc4, 0x02, 0x7c, - 0x60, 0x23, 0x67, 0x0c, 0x22, 0xbf, 0x18, 0x36, - 0x79, 0x17, 0x01, 0x00, 0x02, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, 0x41, 0x65, - 0x29, 0x51, 0xaa, 0xe7, 0x7b, 0xa8, 0xf2, 0x37, - 0x0b, 0xd0, 0x3f, 0xb3, 0x36, 0xed, 0x05, 0x00, - 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x05, 0x00, - 0x01, 0x00, 0x14, 0x96, 0x80, 0x01, 0x2e, 0x78, - 0xfb, 0x5d, 0xb4, 0x3c, 0x14, 0xb3, 0x3d, 0xaa, - 0x02, 0xfb, 0x06, 0x00, 0x00, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, 0x3b, 0x04, - 0x68, 0x3e, 0x63, 0xfe, 0x9f, 0xd8, 0x64, 0x55, - 0xcd, 0xe7, 0x39, 0xaf, 0x98, 0x9f, 0x03, 0x00, - 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x07, 0x00, - 0x01, 0x00, 0x16, 0x7a, 0x4f, 0x1b, 0xdb, 0x25, - 0x92, 0x55, 0xdd, 0xae, 0x9e, 0x5b, 0x3e, 0x93, - 0x66, 0x93, 0x04, 0x00, 0x01, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0xe8, 0xa4, - 0x8a, 0xcf, 0x95, 0x6c, 0xc7, 0x8f, 0x14, 0xcc, - 0x56, 0xfc, 0x7b, 0x5f, 0x4f, 0xe8, 0x04, 0x00, - 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x09, 0x00, - 0x01, 0x00, 0xd8, 0xda, 0xfb, 0xbc, 0xa2, 0x55, - 0x6f, 0x5d, 0xc0, 0x2d, 0x88, 0x6f, 0x00, 0x17, - 0x52, 0x8d, 0x06, 0x00, 0x03, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x0a, 0x00, 0x01, 0x00, 0x3f, 0x17, - 0x55, 0x0c, 0xf4, 0x23, 0x3c, 0xca, 0xe6, 0xa0, - 0xaa, 0xcc, 0xb5, 0xe3, 0xf9, 0xce, 0x04, 0x00, - 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0b, 0x00, - 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, - 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, - 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x0c, 0x00, 0x01, 0x00, 0xc9, 0x9f, - 0x3e, 0x6e, 0x82, 0x0a, 0x2b, 0x28, 0x37, 0x78, - 0xe1, 0x13, 0x70, 0x05, 0x38, 0x4d, 0x01, 0x00, - 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0d, 0x00, - 0x01, 0x00, 0x11, 0xaa, 0x4b, 0x15, 0xdf, 0xa6, - 0x86, 0x3f, 0xfb, 0xe0, 0x09, 0xb7, 0xf8, 0x56, - 0xd2, 0x3f, 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x0e, 0x00, 0x01, 0x00, 0xee, 0x99, - 0xc4, 0x25, 0x11, 0xe4, 0x95, 0x62, 0x29, 0xfa, - 0xfd, 0x26, 0x57, 0x02, 0xf1, 0xce, 0x03, 0x00, - 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0f, 0x00, - 0x01, 0x00, 0xba, 0x81, 0x9e, 0x1a, 0xdf, 0x2b, - 0xba, 0xe4, 0xd3, 0x17, 0x41, 0x60, 0x6d, 0x2d, - 0x9e, 0x28, 0x03, 0x00, 0x03, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x10, 0x00, 0x01, 0x00, 0xa0, 0x24, - 0x03, 0x9a, 0xa9, 0x99, 0xfb, 0xbe, 0x49, 0x11, - 0xad, 0x77, 0x30, 0xaa, 0xbc, 0xb6, 0x02, 0x00, - 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x11, 0x00, - 0x01, 0x00, 0x32, 0x04, 0x7e, 0xae, 0xec, 0x28, - 0xd1, 0x55, 0x83, 0x4e, 0xc3, 0x47, 0x5d, 0x1d, - 0xc6, 0x65, 0x02, 0x00, 0x03, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x12, 0x00, 0x01, 0x00, 0xc6, 0xa4, - 0x81, 0x48, 0x66, 0x2a, 0x74, 0x7d, 0x56, 0x6e, - 0xc5, 0x1d, 0x19, 0xf2, 0xb5, 0xb6, 0x03, 0x00, - 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x13, 0x00, - 0x01, 0x00, 0xcb, 0xae, 0xb3, 0xc0, 0x0c, 0xf4, - 0xa4, 0x5e, 0x91, 0x72, 0xdd, 0x53, 0x24, 0x70, - 0x89, 0x02, 0x05, 0x00, 0x03, 0x00, 0x04, 0x5d, - 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, - 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, - 0x00, 0x00, 0x14, 0x00, 0x01, 0x00, 0xb8, 0xd0, - 0xa0, 0x1a, 0x5e, 0x7a, 0x2d, 0xfe, 0x35, 0xc6, - 0x7d, 0x08, 0x0d, 0x33, 0x73, 0x18, 0x02, 0x00, - 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - }; - - uint8_t dcerpcbindack[] = { - 0x05, 0x00, 0x0c, 0x03, - 0x10, 0x00, 0x00, 0x00, 0x6c, 0x02, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, - 0xce, 0x47, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, - 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, - 0x73, 0x00, 0xf6, 0x6e, 0x18, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; - - uint32_t bindlen = sizeof(dcerpcbind); - uint32_t bindacklen = sizeof(dcerpcbindack); - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER | STREAM_START, dcerpcbind, - bindlen); - if (r != 0) { - printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - DCERPCState *dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - printf("no dcerpc state: "); - goto end; - } - - if (dcerpc_state->dcerpc.bytesprocessed == 0) { - printf("request - dce parser bytesprocessed should not be 0.\n"); - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, dcerpcbindack, bindacklen); - if (r == 0) { - printf("dce parser didn't return fail\n"); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - result = 1; -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -#endif /* UNITTESTS */ - -void DCERPCParserRegisterTests(void) -{ -#ifdef UNITTESTS - UtRegisterTest("DCERPCParserTest01", DCERPCParserTest01); - UtRegisterTest("DCERPCParserTest02", DCERPCParserTest02); - UtRegisterTest("DCERPCParserTest03", DCERPCParserTest03); - UtRegisterTest("DCERPCParserTest05", DCERPCParserTest05); - UtRegisterTest("DCERPCParserTest06", DCERPCParserTest06); - UtRegisterTest("DCERPCParserTest07", DCERPCParserTest07); - UtRegisterTest("DCERPCParserTest08", DCERPCParserTest08); - UtRegisterTest("DCERPCParserTest09", DCERPCParserTest09); - UtRegisterTest("DCERPCParserTest10", DCERPCParserTest10); - UtRegisterTest("DCERPCParserTest11", DCERPCParserTest11); - UtRegisterTest("DCERPCParserTest12", DCERPCParserTest12); - UtRegisterTest("DCERPCParserTest13", DCERPCParserTest13); - UtRegisterTest("DCERPCParserTest14", DCERPCParserTest14); - UtRegisterTest("DCERPCParserTest15", DCERPCParserTest15); - UtRegisterTest("DCERPCParserTest16", DCERPCParserTest16); - UtRegisterTest("DCERPCParserTest17", DCERPCParserTest17); - UtRegisterTest("DCERPCParserTest18", DCERPCParserTest18); - UtRegisterTest("DCERPCParserTest19", DCERPCParserTest19); -#endif /* UNITTESTS */ - return; } diff --git a/src/app-layer-dcerpc.h b/src/app-layer-dcerpc.h index b52bf4b72d..c1c440a9fd 100644 --- a/src/app-layer-dcerpc.h +++ b/src/app-layer-dcerpc.h @@ -1,4 +1,4 @@ -/* Copyright (C) 2007-2010 Open Information Security Foundation +/* Copyright (C) 2020 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -15,35 +15,10 @@ * 02110-1301, USA. */ -/** - * \file - * - * \author Kirby Kuehl - */ - -#ifndef __APP_LAYER_DCERPC_H__ -#define __APP_LAYER_DCERPC_H__ - -#include "app-layer-protos.h" -#include "app-layer-parser.h" -#include "app-layer-dcerpc-common.h" -#include "flow.h" -#include "queue.h" -#include "util-byte.h" - -typedef struct DCERPCState_ { - DCERPC dcerpc; - uint8_t data_needed_for_dir; - DetectEngineState *de_state; - uint64_t detect_flags_ts; - uint64_t detect_flags_tc; -} DCERPCState; +#ifndef __APP_LAYER_DCERPC_RUST_H__ +#define __APP_LAYER_DCERPC_RUST_H__ -void DCERPCInit(DCERPC *dcerpc); -void DCERPCCleanup(DCERPC *dcerpc); void RegisterDCERPCParsers(void); -void DCERPCParserTests(void); -void DCERPCParserRegisterTests(void); #endif /* __APP_LAYER_DCERPC_H__ */ diff --git a/src/detect-dce-iface.c b/src/detect-dce-iface.c index eda6779626..98e379b84c 100644 --- a/src/detect-dce-iface.c +++ b/src/detect-dce-iface.c @@ -104,159 +104,6 @@ static int InspectDceGeneric(ThreadVars *tv, f, flags, alstate, txv, tx_id); } - -/** - * \internal - * \brief Parses the argument sent along with the "dce_iface" keyword. - * - * \param arg Pointer to the string containing the argument to be parsed. - * - * \retval did Pointer to a DetectDceIfaceData instance that holds the data - * from the parsed arg. - */ -static DetectDceIfaceData *DetectDceIfaceArgParse(const char *arg) -{ - DetectDceIfaceData *did = NULL; - int ret = 0, res = 0; - int ov[MAX_SUBSTRINGS]; - uint8_t hex_value; - char copy_str[128] = ""; - int i = 0, j = 0; - int len = 0; - char temp_str[3] = ""; - int version; - - ret = DetectParsePcreExec(&parse_regex, arg, 0, 0, ov, MAX_SUBSTRINGS); - if (ret < 2) { - SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, arg); - goto error; - } - - if ( (did = SCMalloc(sizeof(DetectDceIfaceData))) == NULL) - goto error; - memset(did, 0, sizeof(DetectDceIfaceData)); - - /* retrieve the iface uuid string. iface uuid is a compulsion in the keyword */ - res = pcre_copy_substring(arg, ov, MAX_SUBSTRINGS, 1, copy_str, sizeof(copy_str)); - if (res < 0) { - SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); - goto error; - } - - /* parse the iface uuid string */ - len = strlen(copy_str); - j = 0; - temp_str[2] = '\0'; - for (i = 0; i < len; ) { - if (copy_str[i] == '-') { - i++; - continue; - } - - temp_str[0] = copy_str[i]; - temp_str[1] = copy_str[i + 1]; - - hex_value = strtol(temp_str, NULL, 16); - did->uuid[j] = hex_value; - i += 2; - j++; - } - - /* if the regex has 3 or 5, any_frag option is present in the signature */ - if (ret == 3 || ret == 5) - did->any_frag = 1; - - /* if the regex has 4 or 5, version/operator is present in the signature */ - if (ret == 4 || ret == 5) { - /* first handle the version number, so that we can do some additional - * validations of the version number, wrt. the operator */ - res = pcre_copy_substring(arg, ov, MAX_SUBSTRINGS, 3, copy_str, sizeof(copy_str)); - if (res < 0) { - SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); - goto error; - } - - version = atoi(copy_str); - if (version > UINT16_MAX) { - SCLogError(SC_ERR_INVALID_SIGNATURE, "DCE_IFACE interface version " - "invalid: %d\n", version); - goto error; - } - did->version = version; - - /* now let us handle the operator supplied with the version number */ - res = pcre_copy_substring(arg, ov, MAX_SUBSTRINGS, 2, copy_str, sizeof(copy_str)); - if (res < 0) { - SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); - goto error; - } - - switch (copy_str[0]) { - case '<': - if (version == 0) { - SCLogError(SC_ERR_INVALID_SIGNATURE, "DCE_IFACE interface " - "version invalid: %d. Version can't be less" - "than 0, with \"<\" operator", version); - goto error; - } - - did->op = DETECT_DCE_IFACE_OP_LT; - break; - case '>': - if (version == UINT16_MAX) { - SCLogError(SC_ERR_INVALID_SIGNATURE, "DCE_IFACE interface " - "version invalid: %d. Version can't be greater" - "than %d, with \">\" operator", version, - UINT16_MAX); - goto error; - } - - did->op = DETECT_DCE_IFACE_OP_GT; - break; - case '=': - did->op = DETECT_DCE_IFACE_OP_EQ; - break; - case '!': - did->op = DETECT_DCE_IFACE_OP_NE; - break; - } - } - - return did; - - error: - if (did != NULL) - SCFree(did); - return NULL; -} - -/** - * \internal - * \brief Internal function that compares the dce interface version for this - * flow, to the signature's interface version specified using the - * dce_iface keyword. - * - * \param version The dce interface version for this flow. - * \param dce_data Pointer to the Signature's dce_iface keyword - * state(DetectDceIfaceData *). - */ -static inline int DetectDceIfaceMatchIfaceVersion(const uint16_t version, - const DetectDceIfaceData *dce_data) -{ - switch (dce_data->op) { - case DETECT_DCE_IFACE_OP_LT: - return (version < dce_data->version); - case DETECT_DCE_IFACE_OP_GT: - return (version > dce_data->version); - case DETECT_DCE_IFACE_OP_EQ: - return (version == dce_data->version); - case DETECT_DCE_IFACE_OP_NE: - return (version != dce_data->version); - default: - return 1; - } -} - /** * \brief App layer match function for the "dce_iface" keyword. * @@ -271,70 +118,6 @@ static inline int DetectDceIfaceMatchIfaceVersion(const uint16_t version, * \retval 1 On Match. * \retval 0 On no match. */ -static int DetectDceIfaceMatch(DetectEngineThreadCtx *det_ctx, - Flow *f, uint8_t flags, void *state, void *txv, - const Signature *s, const SigMatchCtx *m) -{ - SCEnter(); - - int ret = 0; - const DetectDceIfaceData *dce_data = (DetectDceIfaceData *)m; - - DCERPCUuidEntry *item = NULL; - const DCERPCState *dcerpc_state = state; - if (dcerpc_state == NULL) { - SCLogDebug("No DCERPCState for the flow"); - SCReturnInt(0); - } - - /* we still haven't seen a request */ - if (!dcerpc_state->dcerpc.dcerpcrequest.first_request_seen) - goto end; - - if (!(dcerpc_state->dcerpc.dcerpchdr.type == REQUEST || - dcerpc_state->dcerpc.dcerpchdr.type == RESPONSE)) - goto end; - - TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { - SCLogDebug("item %p", item); - ret = 1; - - /* if any_frag is not enabled, we need to match only against the first - * fragment */ - if (!dce_data->any_frag && !(item->flags & DCERPC_UUID_ENTRY_FLAG_FF)) - continue; - - /* if the uuid has been rejected(item->result == 1), we skip to the - * next uuid */ - if (item->result != 0) - continue; - - /* check the interface uuid */ - for (int i = 0; i < 16; i++) { - if (dce_data->uuid[i] != item->uuid[i]) { - ret = 0; - break; - } - } - ret &= (item->ctxid == dcerpc_state->dcerpc.dcerpcrequest.ctxid); - if (ret == 0) - continue; - - /* check the interface version */ - if (dce_data->op != DETECT_DCE_IFACE_OP_NONE && - !DetectDceIfaceMatchIfaceVersion(item->version, dce_data)) { - ret &= 0; - } - - /* we have a match. Time to leave with a match */ - if (ret == 1) - goto end; - } - -end: - SCReturnInt(ret); -} - static int DetectDceIfaceMatchRust(DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, void *txv, const Signature *s, const SigMatchCtx *m) @@ -342,14 +125,13 @@ static int DetectDceIfaceMatchRust(DetectEngineThreadCtx *det_ctx, SCEnter(); if (f->alproto == ALPROTO_DCERPC) { - return DetectDceIfaceMatch(det_ctx, f, flags, - state, txv, s, m); + // TODO check if state is NULL + return rs_dcerpc_iface_match(state, (void *)m); } int ret = 0; - DetectDceIfaceData *dce_data = (DetectDceIfaceData *)m; - if (rs_smb_tx_get_dce_iface(f->alstate, txv, dce_data->uuid, 16, dce_data->op, dce_data->version) != 1) { + if (rs_smb_tx_get_dce_iface(f->alstate, txv, (void *)m) != 1) { SCLogDebug("rs_smb_tx_get_dce_iface: didn't match"); } else { SCLogDebug("rs_smb_tx_get_dce_iface: matched!"); @@ -373,7 +155,12 @@ static int DetectDceIfaceMatchRust(DetectEngineThreadCtx *det_ctx, static int DetectDceIfaceSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg) { - DetectDceIfaceData *did = DetectDceIfaceArgParse(arg); + SCEnter(); + + if (DetectSignatureSetAppProto(s, ALPROTO_DCERPC) != 0) { + return -1; + } + void *did = rs_dcerpc_iface_parse(arg); if (did == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Error parsing dce_iface option in " "signature"); @@ -382,473 +169,33 @@ static int DetectDceIfaceSetup(DetectEngineCtx *de_ctx, Signature *s, const char SigMatch *sm = SigMatchAlloc(); if (sm == NULL) { - DetectDceIfaceFree(de_ctx, did); return -1; } sm->type = DETECT_DCE_IFACE; - sm->ctx = (void *)did; + sm->ctx = did; SigMatchAppendSMToList(s, sm, g_dce_generic_list_id); return 0; } static void DetectDceIfaceFree(DetectEngineCtx *de_ctx, void *ptr) -{ - SCFree(ptr); - - return; -} - -/************************************Unittests*********************************/ - -#ifdef UNITTESTS - -static int DetectDceIfaceTestParse01(void) -{ - SCEnter(); - - Signature *s = SigAlloc(); - if (s == NULL) - return 0; - - int result = 0; - DetectDceIfaceData *did = NULL; - uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, - 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; - SigMatch *temp = NULL; - int i = 0; - - result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC") == 0); - - if (s->sm_lists[g_dce_generic_list_id] == NULL) { - SCReturnInt(0); - } - - temp = s->sm_lists[g_dce_generic_list_id]; - did = (DetectDceIfaceData *)temp->ctx; - if (did == NULL) { - SCReturnInt(0); - } - - result &= 1; - for (i = 0; i < 16; i++) { - if (did->uuid[i] != test_uuid[i]) { - result = 0; - break; - } - } - - result &= (did->version == 0); - result &= (did->op == 0); - result &= (did->any_frag == 0); - - SigFree(NULL, s); - SCReturnInt(result); -} - -static int DetectDceIfaceTestParse02(void) -{ - SCEnter(); - - Signature *s = SigAlloc(); - if (s == NULL) - return 0; - - int result = 0; - DetectDceIfaceData *did = NULL; - uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, - 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; - SigMatch *temp = NULL; - int i = 0; - - result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>1") == 0); - - if (s->sm_lists[g_dce_generic_list_id] == NULL) { - SCReturnInt(0); - } - - temp = s->sm_lists[g_dce_generic_list_id]; - did = (DetectDceIfaceData *)temp->ctx; - if (did == NULL) { - SCReturnInt(0); - } - - result &= 1; - for (i = 0; i < 16; i++) { - if (did->uuid[i] != test_uuid[i]) { - result = 0; - break; - } - } - - result &= (did->version == 1); - result &= (did->op == DETECT_DCE_IFACE_OP_GT); - result &= (did->any_frag == 0); - - SigFree(NULL, s); - SCReturnInt(result); -} - -static int DetectDceIfaceTestParse03(void) -{ - SCEnter(); - - Signature *s = SigAlloc(); - if (s == NULL) - return 0; - - int result = 0; - DetectDceIfaceData *did = NULL; - uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, - 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; - SigMatch *temp = NULL; - int i = 0; - - result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,<10") == 0); - - if (s->sm_lists[g_dce_generic_list_id] == NULL) { - SCReturnInt(0); - } - - temp = s->sm_lists[g_dce_generic_list_id]; - did = (DetectDceIfaceData *)temp->ctx; - result &= 1; - for (i = 0; i < 16; i++) { - if (did->uuid[i] != test_uuid[i]) { - result = 0; - break; - } - } - - result &= (did->version == 10); - result &= (did->op == DETECT_DCE_IFACE_OP_LT); - result &= (did->any_frag == 0); - - SigFree(NULL, s); - SCReturnInt(result); -} - -static int DetectDceIfaceTestParse04(void) -{ - SCEnter(); - - Signature *s = SigAlloc(); - if (s == NULL) - return 0; - - int result = 0; - DetectDceIfaceData *did = NULL; - uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, - 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; - SigMatch *temp = NULL; - int i = 0; - - result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,!10") == 0); - - if (s->sm_lists[g_dce_generic_list_id] == NULL) { - SCReturnInt(0); - } - - temp = s->sm_lists[g_dce_generic_list_id]; - did = (DetectDceIfaceData *)temp->ctx; - if (did == NULL) { - SCReturnInt(0); - } - - result &= 1; - for (i = 0; i < 16; i++) { - if (did->uuid[i] != test_uuid[i]) { - result = 0; - break; - } - } - - result &= (did->version == 10); - result &= (did->op == DETECT_DCE_IFACE_OP_NE); - result &= (did->any_frag == 0); - - SigFree(NULL, s); - SCReturnInt(result); -} - -static int DetectDceIfaceTestParse05(void) { SCEnter(); - - Signature *s = SigAlloc(); - int result = 0; - DetectDceIfaceData *did = NULL; - uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, - 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; - SigMatch *temp = NULL; - int i = 0; - - result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,=10") == 0); - - if (s->sm_lists[g_dce_generic_list_id] == NULL) { - SCReturnInt(0); - } - - temp = s->sm_lists[g_dce_generic_list_id]; - did = (DetectDceIfaceData *)temp->ctx; - if (did == NULL) { - SCReturnInt(0); - } - - result &= 1; - for (i = 0; i < 16; i++) { - if (did->uuid[i] != test_uuid[i]) { - result = 0; - break; - } + if (ptr != NULL) { + rs_dcerpc_iface_free(ptr); } - - result &= (did->version == 10); - result &= (did->op == DETECT_DCE_IFACE_OP_EQ); - result &= (did->any_frag == 0); - - SigFree(NULL, s); - SCReturnInt(result); + SCReturn; } -static int DetectDceIfaceTestParse06(void) -{ - SCEnter(); - - Signature *s = SigAlloc(); - if (s == NULL) - return 0; - - int result = 0; - DetectDceIfaceData *did = NULL; - uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, - 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; - SigMatch *temp = NULL; - int i = 0; - - result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,any_frag") == 0); - - if (s->sm_lists[g_dce_generic_list_id] == NULL) { - SCReturnInt(0); - } - - temp = s->sm_lists[g_dce_generic_list_id]; - did = (DetectDceIfaceData *)temp->ctx; - if (did == NULL) { - SCReturnInt(0); - } - - result &= 1; - for (i = 0; i < 16; i++) { - if (did->uuid[i] != test_uuid[i]) { - result = 0; - break; - } - } - - result &= (did->version == 0); - result &= (did->op == 0); - result &= (did->any_frag == 1); - - SigFree(NULL, s); - SCReturnInt(result); -} - -static int DetectDceIfaceTestParse07(void) -{ - SCEnter(); - - Signature *s = SigAlloc(); - if (s == NULL) - return 0; - - int result = 0; - DetectDceIfaceData *did = NULL; - uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, - 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; - SigMatch *temp = NULL; - int i = 0; - - result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>1,any_frag") == 0); - - if (s->sm_lists[g_dce_generic_list_id] == NULL) { - SCReturnInt(0); - } - - temp = s->sm_lists[g_dce_generic_list_id]; - did = (DetectDceIfaceData *)temp->ctx; - if (did == NULL) { - SCReturnInt(0); - } - - result &= 1; - for (i = 0; i < 16; i++) { - if (did->uuid[i] != test_uuid[i]) { - result = 0; - break; - } - } - - result &= (did->version == 1); - result &= (did->op == DETECT_DCE_IFACE_OP_GT); - result &= (did->any_frag == 1); - - SigFree(NULL, s); - SCReturnInt(result); -} - -static int DetectDceIfaceTestParse08(void) -{ - Signature *s = SigAlloc(); - if (s == NULL) - return 0; - - int result = 0; - DetectDceIfaceData *did = NULL; - uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, - 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; - SigMatch *temp = NULL; - int i = 0; - - result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,<1,any_frag") == 0); - - if (s->sm_lists[g_dce_generic_list_id] == NULL) { - SCReturnInt(0); - } - - temp = s->sm_lists[g_dce_generic_list_id]; - did = (DetectDceIfaceData *)temp->ctx; - if (did == NULL) { - SCReturnInt(0); - } - - result &= 1; - for (i = 0; i < 16; i++) { - if (did->uuid[i] != test_uuid[i]) { - result = 0; - break; - } - } - - result &= (did->version == 1); - result &= (did->op == DETECT_DCE_IFACE_OP_LT); - result &= (did->any_frag == 1); - - SigFree(NULL, s); - SCReturnInt(result); -} - -static int DetectDceIfaceTestParse09(void) -{ - SCEnter(); - - Signature *s = SigAlloc(); - if (s == NULL) - return 0; - - int result = 0; - DetectDceIfaceData *did = NULL; - uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, - 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; - SigMatch *temp = NULL; - int i = 0; - - result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,=1,any_frag") == 0); - - temp = s->sm_lists[g_dce_generic_list_id]; - did = (DetectDceIfaceData *)temp->ctx; - if (did == NULL) { - SCReturnInt(0); - } - - result &= 1; - for (i = 0; i < 16; i++) { - if (did->uuid[i] != test_uuid[i]) { - result = 0; - break; - } - } - - result &= (did->version == 1); - result &= (did->op == DETECT_DCE_IFACE_OP_EQ); - result &= (did->any_frag == 1); - - SigFree(NULL, s); - SCReturnInt(result); -} - -static int DetectDceIfaceTestParse10(void) -{ - SCEnter(); - - Signature *s = SigAlloc(); - if (s == NULL) - return 0; - - int result = 0; - DetectDceIfaceData *did = NULL; - uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, - 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; - SigMatch *temp = NULL; - int i = 0; - - result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,!1,any_frag") == 0); - - if (s->sm_lists[g_dce_generic_list_id] == NULL) { - SCReturnInt(0); - } - - temp = s->sm_lists[g_dce_generic_list_id]; - did = (DetectDceIfaceData *)temp->ctx; - if (did == NULL) { - SCReturnInt(0); - } - - result &= 1; - for (i = 0; i < 16; i++) { - if (did->uuid[i] != test_uuid[i]) { - result = 0; - break; - } - } - - result &= (did->version == 1); - result &= (did->op == DETECT_DCE_IFACE_OP_NE); - result &= (did->any_frag == 1); - - SigFree(NULL, s); - SCReturnInt(result); -} - -static int DetectDceIfaceTestParse11(void) -{ - SCEnter(); - - Signature *s = SigAlloc(); - if (s == NULL) - return 0; - - int result = 1; - - result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>1,ay_frag") == -1); - result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-12345679ABC,>1,any_frag") == -1); - result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-134-123456789ABC,>1,any_frag") == -1); - result &= (DetectDceIfaceSetup(NULL, s, "12345678-123-124-1234-123456789ABC,>1,any_frag") == -1); - result &= (DetectDceIfaceSetup(NULL, s, "1234568-1234-1234-1234-123456789ABC,>1,any_frag") == -1); - result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>65536,any_frag") == -1); - result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>=1,any_frag") == -1); - result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,<0,any_frag") == -1); - result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>65535,any_frag") == -1); +/************************************Unittests*********************************/ - SigFree(NULL, s); - return result; -} +#ifdef UNITTESTS /** * \test Test a valid dce_iface entry for a bind and bind_ack */ -static int DetectDceIfaceTestParse12(void) +static int DetectDceIfaceTestParse1(void) { Signature *s = NULL; ThreadVars th_v; @@ -953,7 +300,7 @@ static int DetectDceIfaceTestParse12(void) FAIL_IF(PacketAlertCheck(p, 1)); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, dcerpc_request, + STREAM_TOSERVER, dcerpc_request, dcerpc_request_len); FAIL_IF(r != 0); @@ -1156,7 +503,7 @@ static int DetectDceIfaceTestParse13(void) SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { - printf("sig 1 didn't match after bind request: "); + SCLogDebug("sig 1 didn't match after bind request: "); goto end; } @@ -1175,7 +522,7 @@ static int DetectDceIfaceTestParse13(void) SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { - printf("sig 1 matched again after bind ack: "); + SCLogDebug("sig 1 matched again after bind ack: "); goto end; } @@ -1195,7 +542,7 @@ static int DetectDceIfaceTestParse13(void) SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { - printf("sig 1 didn't match after request1: "); + SCLogDebug("sig 1 didn't match after request1: "); goto end; } @@ -1215,7 +562,7 @@ static int DetectDceIfaceTestParse13(void) SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { - printf("sig 1 matched after response1, but shouldn't: "); + SCLogDebug("sig 1 matched after response1, but shouldn't: "); goto end; } @@ -1235,7 +582,7 @@ static int DetectDceIfaceTestParse13(void) SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { - printf("sig 1 didn't match after request2: "); + SCLogDebug("sig 1 didn't match after request2: "); goto end; } @@ -1253,7 +600,7 @@ static int DetectDceIfaceTestParse13(void) SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { - printf("sig 1 matched after response2, but shouldn't have: "); + SCLogDebug("sig 1 matched after response2, but shouldn't have: "); goto end; } @@ -1271,7 +618,7 @@ static int DetectDceIfaceTestParse13(void) SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { - printf("sig 1 didn't match after request3: "); + SCLogDebug("sig 1 didn't match after request3: "); goto end; } @@ -1289,7 +636,7 @@ static int DetectDceIfaceTestParse13(void) SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { - printf("sig 1 matched after response3, but shouldn't have: "); + SCLogDebug("sig 1 matched after response3, but shouldn't have: "); goto end; } @@ -1314,7 +661,7 @@ static int DetectDceIfaceTestParse13(void) /** * \test Test a valid dce_iface entry for a bind and bind_ack */ -static int DetectDceIfaceTestParse14(void) +static int DetectDceIfaceTestParse2(void) { int result = 0; Signature *s = NULL; @@ -1436,13 +783,13 @@ static int DetectDceIfaceTestParse14(void) SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { - printf("sig 1 matched but shouldn't have: "); + SCLogDebug("sig 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, dcerpc_request, + STREAM_TOSERVER, dcerpc_request, dcerpc_request_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); @@ -1455,322 +802,7 @@ static int DetectDceIfaceTestParse14(void) SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { - printf("sig 1 matched but shouldn't have: "); - goto end; - } - - result = 1; - - end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - SigGroupCleanup(de_ctx); - SigCleanSignatures(de_ctx); - - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); - DetectEngineCtxFree(de_ctx); - - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - UTHFreePackets(&p, 1); - return result; -} - -/** - * \test Test a valid dce_iface entry for a bind and bind_ack - */ -static int DetectDceIfaceTestParse15(void) -{ - int result = 0; - Signature *s = NULL; - ThreadVars th_v; - Packet *p = NULL; - Flow f; - TcpSession ssn; - DetectEngineThreadCtx *det_ctx = NULL; - DetectEngineCtx *de_ctx = NULL; - DCERPCState *dcerpc_state = NULL; - int r = 0; - - uint8_t dcerpc_bind[] = { - 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, - 0x40, 0xfd, 0x2c, 0x34, 0x6c, 0x3c, 0xce, 0x11, - 0xa8, 0x93, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 - }; - uint32_t dcerpc_bind_len = sizeof(dcerpc_bind); - - uint8_t dcerpc_bindack[] = { - 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0xb8, 0x10, 0xb8, 0x10, 0x7d, 0xd8, 0x00, 0x00, - 0x0d, 0x00, 0x5c, 0x70, 0x69, 0x70, 0x65, 0x5c, - 0x6c, 0x6c, 0x73, 0x72, 0x70, 0x63, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00 - }; - uint32_t dcerpc_bindack_len = sizeof(dcerpc_bindack); - - uint8_t dcerpc_alter_context[] = { - 0x05, 0x00, 0x0e, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, - 0xd0, 0x4c, 0x67, 0x57, 0x00, 0x52, 0xce, 0x11, - 0xa8, 0x97, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d, - 0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 - }; - uint32_t dcerpc_alter_context_len = sizeof(dcerpc_alter_context); - - uint8_t dcerpc_alter_context_resp[] = { - 0x05, 0x00, 0x0f, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x38, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0xb8, 0x10, 0xb8, 0x10, 0x7d, 0xd8, 0x00, 0x00, - 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, - 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, - 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 - }; - uint32_t dcerpc_alter_context_resp_len = sizeof(dcerpc_alter_context_resp); - - uint8_t dcerpc_request1[] = { - 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x20, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x20, 0x03, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0xdd, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - }; - uint32_t dcerpc_request1_len = sizeof(dcerpc_request1); - - uint8_t dcerpc_response1[] = { - 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x18, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xf5, 0x66, 0xbf, 0x54, - 0xc4, 0xdb, 0xdb, 0x4f, 0xa0, 0x01, 0x6d, 0xf4, - 0xf6, 0xa8, 0x44, 0xb3, 0x00, 0x00, 0x00, 0x00 - }; - uint32_t dcerpc_response1_len = sizeof(dcerpc_response1); - - uint8_t dcerpc_request2[] = { - 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x20, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0xc6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x07, 0x9f, 0x13, 0xd9, - }; - uint32_t dcerpc_request2_len = sizeof(dcerpc_request2); - - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&th_v, 0, sizeof(th_v)); - memset(&p, 0, sizeof(p)); - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - - p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - p->flow = &f; - p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; - p->flowflags |= FLOW_PKT_TOSERVER; - p->flowflags |= FLOW_PKT_ESTABLISHED; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) - goto end; - - de_ctx->flags |= DE_QUIET; - - s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " - "(msg:\"DCERPC\"; " - "dce_iface:57674cd0-5200-11ce-a897-08002b2e9c6d; " - "sid:1;)"); - if (s == NULL) - goto end; - - s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " - "(msg:\"DCERPC\"; " - "dce_iface:342cfd40-3c6c-11ce-a893-08002b2e9c6d; " - "sid:2;)"); - if (s == NULL) - goto end; - - SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER | STREAM_START, dcerpc_bind, - dcerpc_bind_len); - if (r != 0) { - SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - dcerpc_state = f.alstate; - if (dcerpc_state == NULL) { - SCLogDebug("no dcerpc state: "); - goto end; - } - - /* do detect */ - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); - - if (PacketAlertCheck(p, 1)) - goto end; - if (PacketAlertCheck(p, 2)) - goto end; - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, dcerpc_bindack, - dcerpc_bindack_len); - if (r != 0) { - SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - /* do detect */ - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); - - if (PacketAlertCheck(p, 1)) { - printf("sig 1 matched but shouldn't have: "); - goto end; - } - if (PacketAlertCheck(p, 2)) { - printf("sig 1 matched but shouldn't have: "); - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, dcerpc_alter_context, - dcerpc_alter_context_len); - if (r != 0) { - SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - /* do detect */ - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); - - if (PacketAlertCheck(p, 1)) { - printf("sig 1 matched but shouldn't have: "); - goto end; - } - if (PacketAlertCheck(p, 2)) { - printf("sig 1 matched but shouldn't have: "); - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, dcerpc_alter_context_resp, - dcerpc_alter_context_resp_len); - if (r != 0) { - SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - /* do detect */ - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); - - if (PacketAlertCheck(p, 1)) { - printf("sig 1 matched but shouldn't have: "); - goto end; - } - if (PacketAlertCheck(p, 2)) { - printf("sig 1 matched but shouldn't have: "); - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, dcerpc_request1, - dcerpc_request1_len); - if (r != 0) { - SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - /* do detect */ - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); - - if (!PacketAlertCheck(p, 1)) { - printf("sig 1 matched but shouldn't have: "); - goto end; - } - if (PacketAlertCheck(p, 2)) { - printf("sig 1 matched but shouldn't have: "); - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOCLIENT, dcerpc_response1, - dcerpc_response1_len); - if (r != 0) { - SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - /* do detect */ - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); - - if (PacketAlertCheck(p, 1)) { - printf("sig 1 matched but shouldn't have: "); - goto end; - } - if (PacketAlertCheck(p, 2)) { - printf("sig 1 matched but shouldn't have: "); - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, dcerpc_request2, - dcerpc_request2_len); - if (r != 0) { - SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - /* do detect */ - SigMatchSignatures(&th_v, de_ctx, det_ctx, p); - - if (PacketAlertCheck(p, 1)) { - printf("sig 1 matched but shouldn't have: "); - goto end; - } - if (!PacketAlertCheck(p, 2)) { - printf("sig 1 matched but shouldn't have: "); + SCLogDebug("sig 1 matched but shouldn't have: "); goto end; } @@ -1796,24 +828,12 @@ static int DetectDceIfaceTestParse15(void) static void DetectDceIfaceRegisterTests(void) { #ifdef UNITTESTS - UtRegisterTest("DetectDceIfaceTestParse01", DetectDceIfaceTestParse01); - UtRegisterTest("DetectDceIfaceTestParse02", DetectDceIfaceTestParse02); - UtRegisterTest("DetectDceIfaceTestParse03", DetectDceIfaceTestParse03); - UtRegisterTest("DetectDceIfaceTestParse04", DetectDceIfaceTestParse04); - UtRegisterTest("DetectDceIfaceTestParse05", DetectDceIfaceTestParse05); - UtRegisterTest("DetectDceIfaceTestParse06", DetectDceIfaceTestParse06); - UtRegisterTest("DetectDceIfaceTestParse07", DetectDceIfaceTestParse07); - UtRegisterTest("DetectDceIfaceTestParse08", DetectDceIfaceTestParse08); - UtRegisterTest("DetectDceIfaceTestParse09", DetectDceIfaceTestParse09); - UtRegisterTest("DetectDceIfaceTestParse10", DetectDceIfaceTestParse10); - UtRegisterTest("DetectDceIfaceTestParse11", DetectDceIfaceTestParse11); - UtRegisterTest("DetectDceIfaceTestParse12", DetectDceIfaceTestParse12); + UtRegisterTest("DetectDceIfaceTestParse1", DetectDceIfaceTestParse1); /* Disabled because of bug_753. Would be enabled, once we rewrite * dce parser */ #if 0 UtRegisterTest("DetectDceIfaceTestParse13", DetectDceIfaceTestParse13, 1); #endif - UtRegisterTest("DetectDceIfaceTestParse14", DetectDceIfaceTestParse14); - UtRegisterTest("DetectDceIfaceTestParse15", DetectDceIfaceTestParse15); + UtRegisterTest("DetectDceIfaceTestParse2", DetectDceIfaceTestParse2); #endif } diff --git a/src/detect-dce-iface.h b/src/detect-dce-iface.h index 3eb18b1c72..0cbbb728f7 100644 --- a/src/detect-dce-iface.h +++ b/src/detect-dce-iface.h @@ -15,34 +15,11 @@ * 02110-1301, USA. */ -/** - * \file - * - * \author Anoop Saldanha - */ - #ifndef __DETECT_DCE_IFACE_H__ #define __DETECT_DCE_IFACE_H__ -#include "app-layer-dcerpc.h" - -typedef enum DetectDceIfaceOperators_ { - DETECT_DCE_IFACE_OP_NONE = 0, - DETECT_DCE_IFACE_OP_LT, - DETECT_DCE_IFACE_OP_GT, - DETECT_DCE_IFACE_OP_EQ, - DETECT_DCE_IFACE_OP_NE, -} DetectDceIfaceOperators; - -typedef struct DetectDceIfaceData_ { - uint8_t uuid[16]; - uint8_t op; - uint16_t version; - uint8_t any_frag; -} DetectDceIfaceData; +#include "app-layer-dcerpc-common.h" void DetectDceIfaceRegister(void); -DCERPCState *DetectDceGetState(AppProto alproto, void *alstate); - #endif /* __DETECT_DCE_IFACE_H__ */ diff --git a/src/detect-dce-opnum.c b/src/detect-dce-opnum.c index 3b14838a32..ab46d96a50 100644 --- a/src/detect-dce-opnum.c +++ b/src/detect-dce-opnum.c @@ -79,151 +79,6 @@ void DetectDceOpnumRegister(void) g_dce_generic_list_id = DetectBufferTypeRegister("dce_generic"); } -/** - * \internal - * \brief Creates and returns a new instance of DetectDceOpnumRange. - * - * \retval dor Pointer to the new instance DetectDceOpnumRange. - */ -static DetectDceOpnumRange *DetectDceOpnumAllocDetectDceOpnumRange(void) -{ - DetectDceOpnumRange *dor = NULL; - - if ( (dor = SCCalloc(1, sizeof(DetectDceOpnumRange))) == NULL) - return NULL; - dor->range1 = dor->range2 = DCE_OPNUM_RANGE_UNINITIALIZED; - return dor; -} - -/** - * \internal - * \brief Parses the argument sent along with the "dce_opnum" keyword. - * \param de_ctx Pointer to the detection engine context - * \param arg Pointer to the string containing the argument to be parsed. - * - * \retval did Pointer to a DetectDceIfaceData instance that holds the data - * from the parsed arg. - */ -static DetectDceOpnumData *DetectDceOpnumArgParse(DetectEngineCtx *de_ctx, const char *arg) -{ - DetectDceOpnumData *dod = NULL; - - DetectDceOpnumRange *dor = NULL; - DetectDceOpnumRange *prev_dor = NULL; - - int ret = 0, res = 0; - int ov[MAX_SUBSTRINGS]; - const char *pcre_sub_str = NULL; - - char *dup_str = NULL; - char *dup_str_temp = NULL; - char *dup_str_head = NULL; - char *comma_token = NULL; - char *hyphen_token = NULL; - - if (arg == NULL) { - goto error; - } - - ret = DetectParsePcreExec(&parse_regex, arg, 0, 0, ov, MAX_SUBSTRINGS); - if (ret < 2) { - SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, arg); - goto error; - } - - res = pcre_get_substring(arg, ov, MAX_SUBSTRINGS, 0, &pcre_sub_str); - if (res < 0) { - SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); - goto error; - } - - if ( (dod = SCMalloc(sizeof(DetectDceOpnumData))) == NULL) - goto error; - memset(dod, 0, sizeof(DetectDceOpnumData)); - - if ( (dup_str = SCStrdup(pcre_sub_str)) == NULL) { - SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); - goto error; - } - - /* free the substring */ - pcre_free_substring(pcre_sub_str); - - /* keep a copy of the strdup string in dup_str_head so that we can free it - * once we are done using it */ - dup_str_head = dup_str; - dup_str_temp = dup_str; - while ( (comma_token = strchr(dup_str, ',')) != NULL) { - comma_token[0] = '\0'; - dup_str = comma_token + 1; - - dor = DetectDceOpnumAllocDetectDceOpnumRange(); - if (dor == NULL) - goto error; - if (prev_dor == NULL) { - prev_dor = dor; - dod->range = dor; - } else { - prev_dor->next = dor; - prev_dor = dor; - } - - if ((hyphen_token = strchr(dup_str_temp, '-')) != NULL) { - hyphen_token[0] = '\0'; - hyphen_token++; - dor->range1 = atoi(dup_str_temp); - if (dor->range1 > DCE_OPNUM_RANGE_MAX) - goto error; - dor->range2 = atoi(hyphen_token); - if (dor->range2 > DCE_OPNUM_RANGE_MAX) - goto error; - if (dor->range1 > dor->range2) - goto error; - } - dor->range1 = atoi(dup_str_temp); - if (dor->range1 > DCE_OPNUM_RANGE_MAX) - goto error; - - dup_str_temp = dup_str; - } - - dor = DetectDceOpnumAllocDetectDceOpnumRange(); - if (dor == NULL) - goto error; - if (prev_dor == NULL) { - dod->range = dor; - } else { - prev_dor->next = dor; - } - - if ( (hyphen_token = strchr(dup_str, '-')) != NULL) { - hyphen_token[0] = '\0'; - hyphen_token++; - dor->range1 = atoi(dup_str); - if (dor->range1 > DCE_OPNUM_RANGE_MAX) - goto error; - dor->range2 = atoi(hyphen_token); - if (dor->range2 > DCE_OPNUM_RANGE_MAX) - goto error; - if (dor->range1 > dor->range2) - goto error; - } - dor->range1 = atoi(dup_str); - if (dor->range1 > DCE_OPNUM_RANGE_MAX) - goto error; - - if (dup_str_head != NULL) - SCFree(dup_str_head); - - return dod; - - error: - if (dup_str_head != NULL) - SCFree(dup_str_head); - DetectDceOpnumFree(de_ctx, dod); - return NULL; -} - /** * \brief App layer match function for the "dce_opnum" keyword. * @@ -238,38 +93,6 @@ static DetectDceOpnumData *DetectDceOpnumArgParse(DetectEngineCtx *de_ctx, const * \retval 1 On Match. * \retval 0 On no match. */ -static int DetectDceOpnumMatch(DetectEngineThreadCtx *det_ctx, - Flow *f, uint8_t flags, void *state, void *txv, - const Signature *s, const SigMatchCtx *m) -{ - SCEnter(); - - DetectDceOpnumData *dce_data = (DetectDceOpnumData *)m; - - DCERPCState *dcerpc_state = state; - if (dcerpc_state == NULL) { - SCLogDebug("No DCERPCState for the flow"); - SCReturnInt(0); - } - - uint16_t opnum = dcerpc_state->dcerpc.dcerpcrequest.opnum; - DetectDceOpnumRange *dor = dce_data->range; - for ( ; dor != NULL; dor = dor->next) { - if (dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED) { - if (dor->range1 == opnum) { - SCReturnInt(1); - } - } else { - if (dor->range1 <= opnum && dor->range2 >= opnum) - { - SCReturnInt(1); - } - } - } - - SCReturnInt(0); -} - static int DetectDceOpnumMatchRust(DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, void *txv, const Signature *s, const SigMatchCtx *m) @@ -277,36 +100,19 @@ static int DetectDceOpnumMatchRust(DetectEngineThreadCtx *det_ctx, SCEnter(); if (f->alproto == ALPROTO_DCERPC) { - return DetectDceOpnumMatch(det_ctx, f, flags, - state, txv, s, m); + // TODO check for NULL state + return rs_dcerpc_opnum_match(state, (void *)m); } - const DetectDceOpnumData *dce_data = (DetectDceOpnumData *)m; - const DetectDceOpnumRange *dor = dce_data->range; - - uint16_t opnum; - if (rs_smb_tx_get_dce_opnum(txv, &opnum) != 1) + if (rs_smb_tx_match_dce_opnum(txv, (void *)m) != 1) SCReturnInt(0); - SCLogDebug("(rust) opnum %u", opnum); - - for ( ; dor != NULL; dor = dor->next) { - if (dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED) { - if (dor->range1 == opnum) { - SCReturnInt(1); - } - } else { - if (dor->range1 <= opnum && dor->range2 >= opnum) { - SCReturnInt(1); - } - } - } - SCReturnInt(0); + SCReturnInt(1); } /** * \brief Creates a SigMatch for the "dce_opnum" keyword being sent as argument, - * and appends it to the Signature(s). + * and appends it to the rs_dcerpc_opnum_matchSignature(s). * * \param de_ctx Pointer to the detection engine context. * \param s Pointer to signature for the current Signature being parsed @@ -324,7 +130,7 @@ static int DetectDceOpnumSetup(DetectEngineCtx *de_ctx, Signature *s, const char return -1; } - DetectDceOpnumData *dod = DetectDceOpnumArgParse(de_ctx, arg); + void *dod = rs_dcerpc_opnum_parse(arg); if (dod == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Error parsing dce_opnum option in " "signature"); @@ -346,331 +152,21 @@ static int DetectDceOpnumSetup(DetectEngineCtx *de_ctx, Signature *s, const char static void DetectDceOpnumFree(DetectEngineCtx *de_ctx, void *ptr) { - DetectDceOpnumData *dod = ptr; - DetectDceOpnumRange *dor = NULL; - DetectDceOpnumRange *dor_temp = NULL; - - if (dod != NULL) { - dor = dod->range; - while (dor != NULL) { - dor_temp = dor; - dor = dor->next; - SCFree(dor_temp); - } - SCFree(dod); + SCEnter(); + if (ptr != NULL) { + rs_dcerpc_opnum_free(ptr); } - - return; + SCReturn; } /************************************Unittests*********************************/ #ifdef UNITTESTS -static int DetectDceOpnumTestParse01(void) -{ - Signature *s = SigAlloc(); - int result = 0; - - result = (DetectDceOpnumSetup(NULL, s, "12") == 0); - result &= (DetectDceOpnumSetup(NULL, s, "12,24") == 0); - result &= (DetectDceOpnumSetup(NULL, s, "12,12-24") == 0); - result &= (DetectDceOpnumSetup(NULL, s, "12-14,12,121,62-78") == 0); - result &= (DetectDceOpnumSetup(NULL, s, "12,26,62,61,6513-6666") == 0); - result &= (DetectDceOpnumSetup(NULL, s, "12,26,62,61,6513--") == -1); - result &= (DetectDceOpnumSetup(NULL, s, "12-14,12,121,62-8") == -1); - - if (s->sm_lists[g_dce_generic_list_id] != NULL) { - SigFree(NULL, s); - result &= 1; - } - - return result; -} - -static int DetectDceOpnumTestParse02(void) -{ - Signature *s = SigAlloc(); - int result = 0; - DetectDceOpnumData *dod = NULL; - DetectDceOpnumRange *dor = NULL; - SigMatch *temp = NULL; - - result = (DetectDceOpnumSetup(NULL, s, "12") == 0); - - if (s->sm_lists[g_dce_generic_list_id] != NULL) { - temp = s->sm_lists[g_dce_generic_list_id]; - dod = (DetectDceOpnumData *)temp->ctx; - if (dod == NULL) - goto end; - dor = dod->range; - result &= (dor->range1 == 12 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); - result &= (dor->next == NULL); - } else { - result = 0; - } - - end: - SigFree(NULL, s); - return result; -} - -static int DetectDceOpnumTestParse03(void) -{ - Signature *s = SigAlloc(); - int result = 0; - DetectDceOpnumData *dod = NULL; - DetectDceOpnumRange *dor = NULL; - SigMatch *temp = NULL; - - result = (DetectDceOpnumSetup(NULL, s, "12-24") == 0); - - if (s->sm_lists[g_dce_generic_list_id] != NULL) { - temp = s->sm_lists[g_dce_generic_list_id]; - dod = (DetectDceOpnumData *)temp->ctx; - if (dod == NULL) - goto end; - dor = dod->range; - result &= (dor->range1 == 12 && dor->range2 == 24); - result &= (dor->next == NULL); - } else { - result = 0; - } - - end: - SigFree(NULL, s); - return result; -} - -static int DetectDceOpnumTestParse04(void) -{ - Signature *s = SigAlloc(); - int result = 0; - DetectDceOpnumData *dod = NULL; - DetectDceOpnumRange *dor = NULL; - SigMatch *temp = NULL; - - result = (DetectDceOpnumSetup(NULL, s, "12-24,24,62-72,623-635,62,25,213-235") == 0); - - if (s->sm_lists[g_dce_generic_list_id] != NULL) { - temp = s->sm_lists[g_dce_generic_list_id]; - dod = (DetectDceOpnumData *)temp->ctx; - if (dod == NULL) - goto end; - dor = dod->range; - result &= (dor->range1 == 12 && dor->range2 == 24); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 24 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 62 && dor->range2 == 72); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 623 && dor->range2 == 635); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 62 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 25 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 213 && dor->range2 == 235); - if (result == 0) - goto end; - } else { - result = 0; - } - - end: - SigFree(NULL, s); - return result; -} - -static int DetectDceOpnumTestParse05(void) -{ - Signature *s = SigAlloc(); - int result = 0; - DetectDceOpnumData *dod = NULL; - DetectDceOpnumRange *dor = NULL; - SigMatch *temp = NULL; - - result = (DetectDceOpnumSetup(NULL, s, "1,2,3,4,5,6,7") == 0); - - if (s->sm_lists[g_dce_generic_list_id] != NULL) { - temp = s->sm_lists[g_dce_generic_list_id]; - dod = (DetectDceOpnumData *)temp->ctx; - if (dod == NULL) - goto end; - dor = dod->range; - result &= (dor->range1 == 1 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 2 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 3 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 4 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 5 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 6 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 7 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); - if (result == 0) - goto end; - } else { - result = 0; - } - - end: - SigFree(NULL, s); - return result; -} - -static int DetectDceOpnumTestParse06(void) -{ - Signature *s = SigAlloc(); - int result = 0; - DetectDceOpnumData *dod = NULL; - DetectDceOpnumRange *dor = NULL; - SigMatch *temp = NULL; - - result = (DetectDceOpnumSetup(NULL, s, "1-2,3-4,5-6,7-8") == 0); - - if (s->sm_lists[g_dce_generic_list_id] != NULL) { - temp = s->sm_lists[g_dce_generic_list_id]; - dod = (DetectDceOpnumData *)temp->ctx; - if (dod == NULL) - goto end; - dor = dod->range; - result &= (dor->range1 == 1 && dor->range2 == 2); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 3 && dor->range2 == 4); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 5 && dor->range2 == 6); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 7 && dor->range2 == 8); - if (result == 0) - goto end; - } else { - result = 0; - } - - end: - SigFree(NULL, s); - return result; -} - -static int DetectDceOpnumTestParse07(void) -{ - Signature *s = SigAlloc(); - int result = 0; - DetectDceOpnumData *dod = NULL; - DetectDceOpnumRange *dor = NULL; - SigMatch *temp = NULL; - - result = (DetectDceOpnumSetup(NULL, s, "1-2,3-4,5-6,7-8,9") == 0); - - if (s->sm_lists[g_dce_generic_list_id] != NULL) { - temp = s->sm_lists[g_dce_generic_list_id]; - dod = (DetectDceOpnumData *)temp->ctx; - if (dod == NULL) - goto end; - dor = dod->range; - result &= (dor->range1 == 1 && dor->range2 == 2); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 3 && dor->range2 == 4); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 5 && dor->range2 == 6); - result &= (dor->next != NULL); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 7 && dor->range2 == 8); - if (result == 0) - goto end; - - dor = dor->next; - result &= (dor->range1 == 9 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); - if (result == 0) - goto end; - } else { - result = 0; - } - - end: - SigFree(NULL, s); - return result; -} - /** * \test Test a valid dce_opnum entry with a bind, bind_ack and a request. */ -static int DetectDceOpnumTestParse08(void) +static int DetectDceOpnumTestParse01(void) { int result = 0; Signature *s = NULL; @@ -1238,7 +734,7 @@ static int DetectDceOpnumTestParse08(void) /** * \test Test a valid dce_opnum entry with only a request frag. */ -static int DetectDceOpnumTestParse09(void) +static int DetectDceOpnumTestParse02(void) { int result = 0; Signature *s = NULL; @@ -2914,13 +2410,6 @@ static void DetectDceOpnumRegisterTests(void) #ifdef UNITTESTS UtRegisterTest("DetectDceOpnumTestParse01", DetectDceOpnumTestParse01); UtRegisterTest("DetectDceOpnumTestParse02", DetectDceOpnumTestParse02); - UtRegisterTest("DetectDceOpnumTestParse03", DetectDceOpnumTestParse03); - UtRegisterTest("DetectDceOpnumTestParse04", DetectDceOpnumTestParse04); - UtRegisterTest("DetectDceOpnumTestParse05", DetectDceOpnumTestParse05); - UtRegisterTest("DetectDceOpnumTestParse06", DetectDceOpnumTestParse06); - UtRegisterTest("DetectDceOpnumTestParse07", DetectDceOpnumTestParse07); - UtRegisterTest("DetectDceOpnumTestParse08", DetectDceOpnumTestParse08); - UtRegisterTest("DetectDceOpnumTestParse09", DetectDceOpnumTestParse09); /* Disabled because of bug_753. Would be enabled, once we rewrite * dce parser */ #if 0 diff --git a/src/detect-dce-opnum.h b/src/detect-dce-opnum.h index 7316ab75f5..5f3db11802 100644 --- a/src/detect-dce-opnum.h +++ b/src/detect-dce-opnum.h @@ -24,18 +24,7 @@ #ifndef __DETECT_DCE_OPNUM_H__ #define __DETECT_DCE_OPNUM_H__ -#define DCE_OPNUM_RANGE_MAX 65535 -#define DCE_OPNUM_RANGE_UNINITIALIZED 100000 - -typedef struct DetectDceOpnumRange_ { - uint32_t range1; - uint32_t range2; - struct DetectDceOpnumRange_ *next; -} DetectDceOpnumRange; - -typedef struct DetectDceOpnumData_ { - DetectDceOpnumRange *range; -} DetectDceOpnumData; +#include "app-layer-dcerpc-common.h" void DetectDceOpnumRegister(void); diff --git a/src/detect-dce-stub-data.c b/src/detect-dce-stub-data.c index 66b94dc04c..3c7e146fb8 100644 --- a/src/detect-dce-stub-data.c +++ b/src/detect-dce-stub-data.c @@ -91,20 +91,14 @@ static InspectionBuffer *GetDCEData(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); if (buffer->inspect == NULL) { uint32_t data_len = 0; - uint8_t *data = NULL; + const uint8_t *data = NULL; + uint8_t endianness; - DCERPCState *dcerpc_state = txv; - if (dcerpc_state == NULL) + rs_dcerpc_get_stub_data(txv, &data, &data_len, &endianness, flow_flags); + if (data == NULL || data_len == 0) return NULL; - if (flow_flags & STREAM_TOSERVER) { - data_len = dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len; - data = dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer; - } else if (flow_flags & STREAM_TOCLIENT) { - data_len = dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer_len; - data = dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer; - } - if (dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] & 0x10) { + if (endianness > 0) { buffer->flags = DETECT_CI_FLAGS_DCE_LE; } else { buffer->flags |= DETECT_CI_FLAGS_DCE_BE; @@ -1550,7 +1544,6 @@ static int DetectDceStubDataTestParse04(void) if (PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2) || PacketAlertCheck(p, 3)) goto end; - /* request3 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, diff --git a/src/detect-dce-stub-data.h b/src/detect-dce-stub-data.h index 80c82145c0..13de6ff56a 100644 --- a/src/detect-dce-stub-data.h +++ b/src/detect-dce-stub-data.h @@ -24,6 +24,8 @@ #ifndef __DETECT_DCE_STUB_DATA_H__ #define __DETECT_DCE_STUB_DATA_H__ +#include "app-layer-dcerpc-common.h" + void DetectDceStubDataRegister(void); #endif /* __DETECT_DCE_STUB_DATA_H__ */ diff --git a/src/detect-engine-dcepayload.c b/src/detect-engine-dcepayload.c index 152f79e89e..6b2ea9e5bf 100644 --- a/src/detect-engine-dcepayload.c +++ b/src/detect-engine-dcepayload.c @@ -759,313 +759,6 @@ end: return result; } -/** - * \test Test the working of consecutive relative matches. - */ -static int DcePayloadTest21(void) -{ - int result = 0; - - uint8_t request1[] = { - 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, - 0x6e, 0x6f, 0x77, 0x20, 0x74, 0x68, 0x69, 0x73, /* "now this" */ - 0x20, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x62, /* " is is b" */ - 0x69, 0x67, 0x20, 0x62, 0x69, 0x67, 0x20, 0x73, /* "ig big s" */ - 0x74, 0x72, 0x69, 0x6e, 0x67, 0x20, 0x6e, 0x6f, /* "tring no" */ - 0x77 }; /* "w" */ - uint32_t request1_len = sizeof(request1); - - TcpSession ssn; - Packet *p = NULL; - ThreadVars tv; - DetectEngineCtx *de_ctx = NULL; - DetectEngineThreadCtx *det_ctx = NULL; - Flow f; - int r; - - const char *sig1 = "alert tcp any any -> any any " - "(msg:\"testing dce consecutive relative matches\"; dce_stub_data; " - "content:\"this\"; distance:0; content:\"is\"; within:6; content:\"big\"; within:8; " - "content:\"string\"; within:8; sid:1;)"; - - Signature *s; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&tv, 0, sizeof(ThreadVars)); - memset(&f, 0, sizeof(Flow)); - memset(&ssn, 0, sizeof(TcpSession)); - - p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); - p->flow = &f; - p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; - p->flowflags |= FLOW_PKT_TOSERVER; - p->flowflags |= FLOW_PKT_ESTABLISHED; - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.flags |= FLOW_IPV4; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) - goto end; - de_ctx->flags |= DE_QUIET; - - de_ctx->sig_list = SigInit(de_ctx, sig1); - s = de_ctx->sig_list; - if (s == NULL) - goto end; - - SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); - - /* request 1 */ - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, request1, request1_len); - if (r != 0) { - printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - /* detection phase */ - SigMatchSignatures(&tv, de_ctx, det_ctx, p); - if (!(PacketAlertCheck(p, 1))) { - printf("sid 1 didn't match but should have for packet: "); - goto end; - } - - result = 1; - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - if (de_ctx != NULL) { - SigGroupCleanup(de_ctx); - SigCleanSignatures(de_ctx); - - DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); - DetectEngineCtxFree(de_ctx); - } - - StreamTcpFreeConfig(TRUE); - - UTHFreePackets(&p, 1); - return result; -} - -/** - * \test Test the working of consecutive relative matches. - */ -static int DcePayloadTest22(void) -{ - int result = 0; - - uint8_t request1[] = { - 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, - 0x6e, 0x6f, 0x77, 0x20, 0x74, 0x68, 0x69, 0x73, /* "now this" */ - 0x20, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x69, /* " is is i" */ - 0x73, 0x20, 0x62, 0x69, 0x67, 0x20, 0x62, 0x69, /* "s big bi" */ - 0x67, 0x20, 0x62, 0x69, 0x67, 0x20, 0x73, 0x74, /* "g big st" */ - 0x72, 0x69, 0x6e, 0x67, 0x20, 0x6e, 0x6f, 0x77 }; /* "ring now" */ - uint32_t request1_len = sizeof(request1); - - TcpSession ssn; - Packet *p = NULL; - ThreadVars tv; - DetectEngineCtx *de_ctx = NULL; - DetectEngineThreadCtx *det_ctx = NULL; - Flow f; - int r; - - const char *sig1 = "alert tcp any any -> any any " - "(msg:\"testing dce consecutive relative matches\"; dce_stub_data; " - "content:\"this\"; distance:0; content:\"is\"; within:9; content:\"big\"; within:12; " - "content:\"string\"; within:8; sid:1;)"; - - Signature *s; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&tv, 0, sizeof(ThreadVars)); - memset(&f, 0, sizeof(Flow)); - memset(&ssn, 0, sizeof(TcpSession)); - - p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); - p->flow = &f; - p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; - p->flowflags |= FLOW_PKT_TOSERVER; - p->flowflags |= FLOW_PKT_ESTABLISHED; - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.flags |= FLOW_IPV4; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) - goto end; - de_ctx->flags |= DE_QUIET; - - de_ctx->sig_list = SigInit(de_ctx, sig1); - s = de_ctx->sig_list; - if (s == NULL) - goto end; - - SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); - - /* request 1 */ - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, request1, request1_len); - if (r != 0) { - printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - /* detection phase */ - SigMatchSignatures(&tv, de_ctx, det_ctx, p); - if (!(PacketAlertCheck(p, 1))) { - printf("sid 1 didn't match but should have for packet: "); - goto end; - } - - result = 1; - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - if (de_ctx != NULL) { - SigGroupCleanup(de_ctx); - SigCleanSignatures(de_ctx); - - DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); - DetectEngineCtxFree(de_ctx); - } - - StreamTcpFreeConfig(TRUE); - - UTHFreePackets(&p, 1); - return result; -} - -/** - * \test Test the working of consecutive relative matches. - */ -static int DcePayloadTest23(void) -{ - int result = 0; - - uint8_t request1[] = { - 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, - 0x74, 0x68, 0x69, 0x73, 0x20, 0x74, 0x68, 0x69, /* "this thi" */ - 0x73, 0x20, 0x6e, 0x6f, 0x77, 0x20, 0x69, 0x73, /* "s now is" */ - 0x20, 0x69, 0x73, 0x20, 0x20, 0x20, 0x20, 0x20, /* " is " */ - 0x62, 0x69, 0x67, 0x20, 0x73, 0x74, 0x72, 0x69, /* "big stri" */ - 0x6e, 0x67, 0x20, 0x6e, 0x6f, 0x77 }; /* "ng now" */ - uint32_t request1_len = sizeof(request1); - - TcpSession ssn; - Packet *p = NULL; - ThreadVars tv; - DetectEngineCtx *de_ctx = NULL; - DetectEngineThreadCtx *det_ctx = NULL; - Flow f; - int r; - - const char *sig1 = "alert tcp any any -> any any " - "(msg:\"testing dce consecutive relative matches\"; dce_stub_data; " - "content:\"now\"; distance:0; content:\"this\"; distance:-20; " - "content:\"is\"; within:12; content:\"big\"; within:8; " - "content:\"string\"; within:8; sid:1;)"; - - Signature *s; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&tv, 0, sizeof(ThreadVars)); - memset(&f, 0, sizeof(Flow)); - memset(&ssn, 0, sizeof(TcpSession)); - - p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); - p->flow = &f; - p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; - p->flowflags |= FLOW_PKT_TOSERVER; - p->flowflags |= FLOW_PKT_ESTABLISHED; - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.flags |= FLOW_IPV4; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) - goto end; - de_ctx->flags |= DE_QUIET; - - de_ctx->sig_list = SigInit(de_ctx, sig1); - s = de_ctx->sig_list; - if (s == NULL) - goto end; - - SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); - - /* request 1 */ - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, request1, request1_len); - if (r != 0) { - printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - /* detection phase */ - SigMatchSignatures(&tv, de_ctx, det_ctx, p); - if (!(PacketAlertCheck(p, 1))) { - printf("sid 1 didn't match but should have for packet: "); - goto end; - } - - result = 1; - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - if (de_ctx != NULL) { - SigGroupCleanup(de_ctx); - SigCleanSignatures(de_ctx); - - DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); - DetectEngineCtxFree(de_ctx); - } - - StreamTcpFreeConfig(TRUE); - - UTHFreePackets(&p, 1); - return result; -} - /** * \test Test content for dce sig. */ @@ -3180,212 +2873,6 @@ static int DcePayloadParseTest41(void) return result; } -/** - * \test Test the working of consecutive relative matches with a negated content. - */ -static int DcePayloadTest42(void) -{ - int result = 0; - - uint8_t request1[] = { - 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, - 0x77, 0x65, 0x20, 0x6e, 0x65, 0x65, 0x64, 0x20, /* "we need " */ - 0x74, 0x6f, 0x20, 0x66, 0x69, 0x78, 0x20, 0x74, /* "to fix t" */ - 0x68, 0x69, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, /* "his and " */ - 0x79, 0x65, 0x73, 0x20, 0x66, 0x69, 0x78, 0x20, /* "yes fix " */ - 0x74, 0x68, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x77 /* "this now" */ - }; - uint32_t request1_len = sizeof(request1); - - TcpSession ssn; - Packet *p = NULL; - ThreadVars tv; - DetectEngineCtx *de_ctx = NULL; - DetectEngineThreadCtx *det_ctx = NULL; - Flow f; - int r; - - const char *sig1 = "alert tcp any any -> any any " - "(msg:\"testing dce consecutive relative matches\"; dce_stub_data; " - "content:\"fix\"; distance:0; content:\"this\"; within:6; " - "content:!\"and\"; distance:0; sid:1;)"; - - Signature *s; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&tv, 0, sizeof(ThreadVars)); - memset(&f, 0, sizeof(Flow)); - memset(&ssn, 0, sizeof(TcpSession)); - - p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); - p->flow = &f; - p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; - p->flowflags |= FLOW_PKT_TOSERVER; - p->flowflags |= FLOW_PKT_ESTABLISHED; - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.flags |= FLOW_IPV4; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) - goto end; - de_ctx->flags |= DE_QUIET; - - de_ctx->sig_list = SigInit(de_ctx, sig1); - s = de_ctx->sig_list; - if (s == NULL) - goto end; - - SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); - - /* request 1 */ - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, request1, request1_len); - if (r != 0) { - printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - /* detection phase */ - SigMatchSignatures(&tv, de_ctx, det_ctx, p); - if (!(PacketAlertCheck(p, 1))) { - printf("sid 1 matched but shouldn't have for packet: "); - goto end; - } - - result = 1; - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - if (de_ctx != NULL) { - SigGroupCleanup(de_ctx); - SigCleanSignatures(de_ctx); - - DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); - DetectEngineCtxFree(de_ctx); - } - - StreamTcpFreeConfig(TRUE); - - UTHFreePackets(&p, 1); - return result; -} - -/** - * \test Test the working of consecutive relative pcres. - */ -static int DcePayloadTest43(void) -{ - int result = 0; - - uint8_t request1[] = { - 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, - 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, - 0x61, 0x20, 0x73, 0x75, 0x70, 0x65, 0x72, 0x20, - 0x64, 0x75, 0x70, 0x65, 0x72, 0x20, 0x6e, 0x6f, - 0x76, 0x61, 0x20, 0x69, 0x6e, 0x20, 0x73, 0x75, - 0x70, 0x65, 0x72, 0x20, 0x6e, 0x6f, 0x76, 0x61, - 0x20, 0x6e, 0x6f, 0x77 - }; - uint32_t request1_len = sizeof(request1); - - TcpSession ssn; - Packet *p = NULL; - ThreadVars tv; - DetectEngineCtx *de_ctx = NULL; - DetectEngineThreadCtx *det_ctx = NULL; - Flow f; - int r; - - const char *sig1 = "alert tcp any any -> any any " - "(msg:\"testing dce consecutive relative matches\"; dce_stub_data; " - "pcre:/super/R; content:\"nova\"; within:7; sid:1;)"; - - Signature *s; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&tv, 0, sizeof(ThreadVars)); - memset(&f, 0, sizeof(Flow)); - memset(&ssn, 0, sizeof(TcpSession)); - - p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); - p->flow = &f; - p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; - p->flowflags |= FLOW_PKT_TOSERVER; - p->flowflags |= FLOW_PKT_ESTABLISHED; - - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.flags |= FLOW_IPV4; - f.alproto = ALPROTO_DCERPC; - - StreamTcpInitConfig(TRUE); - - de_ctx = DetectEngineCtxInit(); - if (de_ctx == NULL) - goto end; - de_ctx->flags |= DE_QUIET; - - de_ctx->sig_list = SigInit(de_ctx, sig1); - s = de_ctx->sig_list; - if (s == NULL) - goto end; - - SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); - - /* request 1 */ - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, - STREAM_TOSERVER, request1, request1_len); - if (r != 0) { - printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - /* detection phase */ - SigMatchSignatures(&tv, de_ctx, det_ctx, p); - if ( !(PacketAlertCheck(p, 1))) { - printf("sid 1 didn't match but should have: "); - goto end; - } - - result = 1; - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - if (de_ctx != NULL) { - SigGroupCleanup(de_ctx); - SigCleanSignatures(de_ctx); - - DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); - DetectEngineCtxFree(de_ctx); - } - - StreamTcpFreeConfig(TRUE); - - UTHFreePackets(&p, 1); - return result; -} - /** * \test Test content for dce sig. */ @@ -3711,9 +3198,6 @@ void DcePayloadRegisterTests(void) UtRegisterTest("DcePayloadTest18", DcePayloadTest18); UtRegisterTest("DcePayloadTest19", DcePayloadTest19); UtRegisterTest("DcePayloadTest20", DcePayloadTest20); - UtRegisterTest("DcePayloadTest21", DcePayloadTest21); - UtRegisterTest("DcePayloadTest22", DcePayloadTest22); - UtRegisterTest("DcePayloadTest23", DcePayloadTest23); UtRegisterTest("DcePayloadParseTest25", DcePayloadParseTest25); UtRegisterTest("DcePayloadParseTest26", DcePayloadParseTest26); @@ -3733,9 +3217,6 @@ void DcePayloadRegisterTests(void) UtRegisterTest("DcePayloadParseTest40", DcePayloadParseTest40); UtRegisterTest("DcePayloadParseTest41", DcePayloadParseTest41); - UtRegisterTest("DcePayloadTest42", DcePayloadTest42); - UtRegisterTest("DcePayloadTest43", DcePayloadTest43); - UtRegisterTest("DcePayloadParseTest44", DcePayloadParseTest44); UtRegisterTest("DcePayloadParseTest45", DcePayloadParseTest45); UtRegisterTest("DcePayloadParseTest46", DcePayloadParseTest46);