aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/dcerpc: move dcepayload unit tests to SV

Browse Source 
Ticket: 8391
pull/15278/head
Philippe Antoine 3 months ago committed by Victor Julien
parent cfb1626212
commit ef884b009a
7 changed files with 0 additions and 615 deletions
Show Stats Download Patch File Download Diff File

2
src/Makefile.am
Unescape Escape View File

@ -134,7 +134,6 @@ noinst_HEADERS = \
detect-engine-buffer.h \
detect-engine-build.h \
detect-engine-content-inspection.h \
detect-engine-dcepayload.h \
detect-engine-event.h \
detect-engine-file.h \
detect-engine-frame.h \
@ -713,7 +712,6 @@ libsuricata_c_a_SOURCES = \
detect-engine-buffer.c \
detect-engine-build.c \
detect-engine-content-inspection.c \
detect-engine-dcepayload.c \
detect-engine-event.c \
detect-engine-file.c \
detect-engine-frame.c \

576
src/detect-engine-dcepayload.c
Unescape Escape View File

@ -1,576 +0,0 @@
/* Copyright (C) 2007-2010 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
*/
#include "suricata-common.h"
#include "suricata.h"
#include "decode.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-parse.h"
#include "detect-pcre.h"
#include "detect-isdataat.h"
#include "detect-bytetest.h"
#include "detect-bytejump.h"
#include "detect-byte-extract.h"
#include "detect-content.h"
#include "detect-engine-content-inspection.h"
#include "detect-engine-dcepayload.h"
#include "detect-engine-build.h"
#include "app-layer-parser.h"
#include "stream-tcp.h"
#include "app-layer.h"
#include "flow-util.h"
#include "util-debug.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
static int g_dce_stub_data_buffer_id = 0;
/**************************************Unittests*******************************/
#ifdef UNITTESTS
#include "detect-engine-alert.h"
/**
* \test Test the working of byte_test endianness.
*/
static int DcePayloadTest15(void)
{
uint8_t request1[] = {
0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00,
0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00,
0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x37, 0x00,
0x31, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00,
0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00,
0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00
};
uint32_t request1_len = sizeof(request1);
const char *sig1 = "alert tcp any any -> any any "
"(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
"byte_test:2,=,14080,0,relative,dce; sid:1;)";
const char *sig2 = "alert tcp any any -> any any "
"(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
"byte_test:2,=,46,5,relative,dce; sid:2;)";
TcpSession ssn;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
Flow f;
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
memset(&tv, 0, sizeof(ThreadVars));
StatsThreadInit(&tv.stats);
memset(&f, 0, sizeof(Flow));
memset(&ssn, 0, sizeof(TcpSession));
Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
p->flow = &f;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_ESTABLISHED;
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.proto = IPPROTO_TCP;
f.flags |= FLOW_IPV4;
f.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(true);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET;
Signature *s = DetectEngineAppendSig(de_ctx, sig1);
FAIL_IF_NULL(s);
s = DetectEngineAppendSig(de_ctx, sig2);
FAIL_IF_NULL(s);
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
/* request 1 */
int r = AppLayerParserParse(
NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len);
FAIL_IF(r != 0);
/* detection phase */
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
FAIL_IF_NOT(PacketAlertCheck(p, 1));
FAIL_IF_NOT(PacketAlertCheck(p, 2));
FLOW_DESTROY(&f);
UTHFreePackets(&p, 1);
AppLayerParserThreadCtxFree(alp_tctx);
DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamTcpFreeConfig(true);
StatsThreadCleanup(&tv.stats);
PASS;
}
/**
* \test Test the working of byte_test endianness.
*/
static int DcePayloadTest16(void)
{
uint8_t request1[] = {
0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00,
0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00,
0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x37, 0x00,
0x31, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00,
0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00,
0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00
};
uint32_t request1_len = sizeof(request1);
const char *sig1 = "alert tcp any any -> any any "
"(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
"byte_test:2,=,55,0,relative; sid:1;)";
const char *sig2 = "alert tcp any any -> any any "
"(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
"byte_test:2,=,11776,5,relative; sid:2;)";
TcpSession ssn;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
Flow f;
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
memset(&tv, 0, sizeof(ThreadVars));
StatsThreadInit(&tv.stats);
memset(&f, 0, sizeof(Flow));
memset(&ssn, 0, sizeof(TcpSession));
Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
p->flow = &f;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_ESTABLISHED;
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.proto = IPPROTO_TCP;
f.flags |= FLOW_IPV4;
f.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(true);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET;
Signature *s = DetectEngineAppendSig(de_ctx, sig1);
FAIL_IF_NULL(s);
s = DetectEngineAppendSig(de_ctx, sig2);
FAIL_IF_NULL(s);
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
/* request 1 */
int r = AppLayerParserParse(
NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len);
FAIL_IF(r != 0);
/* detection phase */
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
FAIL_IF_NOT(PacketAlertCheck(p, 1));
FAIL_IF_NOT(PacketAlertCheck(p, 2));
FLOW_DESTROY(&f);
UTHFreePackets(&p, 1);
AppLayerParserThreadCtxFree(alp_tctx);
DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamTcpFreeConfig(true);
StatsThreadCleanup(&tv.stats);
PASS;
}
/**
* \test Test the working of byte_test endianness.
*/
static int DcePayloadTest17(void)
{
uint8_t request1[] = {
0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00,
0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00,
0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x37, 0x00,
0x31, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00,
0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00,
0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00
};
uint32_t request1_len = sizeof(request1);
const char *sig1 = "alert tcp any any -> any any "
"(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
"byte_test:2,=,55,0,relative,big; sid:1;)";
const char *sig2 = "alert tcp any any -> any any "
"(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
"byte_test:2,=,46,5,relative,little; sid:2;)";
TcpSession ssn;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
Flow f;
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
memset(&tv, 0, sizeof(ThreadVars));
StatsThreadInit(&tv.stats);
memset(&f, 0, sizeof(Flow));
memset(&ssn, 0, sizeof(TcpSession));
Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
p->flow = &f;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_ESTABLISHED;
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.proto = IPPROTO_TCP;
f.flags |= FLOW_IPV4;
f.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(true);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET;
Signature *s = DetectEngineAppendSig(de_ctx, sig1);
FAIL_IF_NULL(s);
s = DetectEngineAppendSig(de_ctx, sig2);
FAIL_IF_NULL(s);
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
/* request 1 */
int r = AppLayerParserParse(
NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len);
FAIL_IF(r != 0);
/* detection phase */
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
FAIL_IF_NOT(PacketAlertCheck(p, 1));
FAIL_IF_NOT(PacketAlertCheck(p, 2));
FLOW_DESTROY(&f);
UTHFreePackets(&p, 1);
AppLayerParserThreadCtxFree(alp_tctx);
DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamTcpFreeConfig(true);
StatsThreadCleanup(&tv.stats);
PASS;
}
/**
* \test Test the working of byte_jump endianness.
*/
static int DcePayloadTest18(void)
{
uint8_t request1[] = {
0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00,
0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00,
0x5c, 0x00, 0x5c, 0x00, 0x31, 0x03, 0x00, 0x03,
0x00, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00,
0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00,
0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00
};
uint32_t request1_len = sizeof(request1);
const char *sig1 = "alert tcp any any -> any any "
"(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
"byte_jump:2,0,relative,dce; byte_test:2,=,46,0,relative,dce; sid:1;)";
const char *sig2 = "alert tcp any any -> any any "
"(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
"byte_jump:2,2,relative,dce; byte_test:2,=,14080,0,relative; sid:2;)";
TcpSession ssn;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
Flow f;
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
memset(&tv, 0, sizeof(ThreadVars));
StatsThreadInit(&tv.stats);
memset(&f, 0, sizeof(Flow));
memset(&ssn, 0, sizeof(TcpSession));
Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
p->flow = &f;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_ESTABLISHED;
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.proto = IPPROTO_TCP;
f.flags |= FLOW_IPV4;
f.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(true);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET;
Signature *s = DetectEngineAppendSig(de_ctx, sig1);
FAIL_IF_NULL(s);
s = DetectEngineAppendSig(de_ctx, sig2);
FAIL_IF_NULL(s);
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
/* request 1 */
int r = AppLayerParserParse(
NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len);
FAIL_IF(r != 0);
/* detection phase */
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
FAIL_IF_NOT(PacketAlertCheck(p, 1));
FAIL_IF_NOT(PacketAlertCheck(p, 2));
FLOW_DESTROY(&f);
UTHFreePackets(&p, 1);
AppLayerParserThreadCtxFree(alp_tctx);
DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamTcpFreeConfig(true);
StatsThreadCleanup(&tv.stats);
PASS;
}
/**
* \test Test the working of byte_jump endianness.
*/
static int DcePayloadTest19(void)
{
uint8_t request1[] = {
0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00,
0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00,
0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x03, 0x00,
0x03, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00,
0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00,
0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00
};
uint32_t request1_len = sizeof(request1);
const char *sig1 = "alert tcp any any -> any any "
"(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
"byte_jump:2,0,relative; byte_test:2,=,46,0,relative,dce; sid:1;)";
const char *sig2 = "alert tcp any any -> any any "
"(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
"byte_jump:2,2,relative; byte_test:2,=,14080,0,relative; sid:2;)";
TcpSession ssn;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
Flow f;
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
memset(&tv, 0, sizeof(ThreadVars));
StatsThreadInit(&tv.stats);
memset(&f, 0, sizeof(Flow));
memset(&ssn, 0, sizeof(TcpSession));
Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
p->flow = &f;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_ESTABLISHED;
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.proto = IPPROTO_TCP;
f.flags |= FLOW_IPV4;
f.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(true);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET;
Signature *s = DetectEngineAppendSig(de_ctx, sig1);
FAIL_IF_NULL(s);
s = DetectEngineAppendSig(de_ctx, sig2);
FAIL_IF_NULL(s);
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
/* request 1 */
int r = AppLayerParserParse(
NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len);
FAIL_IF(r != 0);
/* detection phase */
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
FAIL_IF_NOT(PacketAlertCheck(p, 1));
FAIL_IF_NOT(PacketAlertCheck(p, 2));
FLOW_DESTROY(&f);
UTHFreePackets(&p, 1);
AppLayerParserThreadCtxFree(alp_tctx);
DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamTcpFreeConfig(true);
StatsThreadCleanup(&tv.stats);
PASS;
}
/**
* \test Test the working of byte_jump endianness.
*/
static int DcePayloadTest20(void)
{
uint8_t request1[] = {
0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00,
0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00,
0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x03, 0x03,
0x00, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00,
0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00,
0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00
};
uint32_t request1_len = sizeof(request1);
const char *sig1 = "alert tcp any any -> any any "
"(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
"byte_jump:2,0,relative,big; byte_test:2,=,46,0,relative,dce; sid:1;)";
const char *sig2 = "alert tcp any any -> any any "
"(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; "
"byte_jump:2,2,little,relative; byte_test:2,=,14080,0,relative; sid:2;)";
TcpSession ssn;
ThreadVars tv;
DetectEngineThreadCtx *det_ctx = NULL;
Flow f;
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
memset(&tv, 0, sizeof(ThreadVars));
StatsThreadInit(&tv.stats);
memset(&f, 0, sizeof(Flow));
memset(&ssn, 0, sizeof(TcpSession));
Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
p->flow = &f;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_ESTABLISHED;
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.proto = IPPROTO_TCP;
f.flags |= FLOW_IPV4;
f.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(true);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
de_ctx->flags |= DE_QUIET;
Signature *s = DetectEngineAppendSig(de_ctx, sig1);
FAIL_IF_NULL(s);
s = DetectEngineAppendSig(de_ctx, sig2);
FAIL_IF_NULL(s);
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
/* request 1 */
int r = AppLayerParserParse(
NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len);
FAIL_IF(r != 0);
/* detection phase */
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
FAIL_IF_NOT(PacketAlertCheck(p, 1));
FAIL_IF_NOT(PacketAlertCheck(p, 2));
FLOW_DESTROY(&f);
UTHFreePackets(&p, 1);
AppLayerParserThreadCtxFree(alp_tctx);
DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamTcpFreeConfig(true);
StatsThreadCleanup(&tv.stats);
PASS;
}
#endif /* UNITTESTS */
void DcePayloadRegisterTests(void)
{
g_dce_stub_data_buffer_id = DetectBufferTypeGetByName("dce_stub_data");
#ifdef UNITTESTS
UtRegisterTest("DcePayloadTest15", DcePayloadTest15);
UtRegisterTest("DcePayloadTest16", DcePayloadTest16);
UtRegisterTest("DcePayloadTest17", DcePayloadTest17);
UtRegisterTest("DcePayloadTest18", DcePayloadTest18);
UtRegisterTest("DcePayloadTest19", DcePayloadTest19);
UtRegisterTest("DcePayloadTest20", DcePayloadTest20);
#endif /* UNITTESTS */
}

32
src/detect-engine-dcepayload.h
Unescape Escape View File

@ -1,32 +0,0 @@
/* Copyright (C) 2007-2010 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Victor Julien <victor@inliniac.net>
*/
#ifndef SURICATA_DETECT_ENGINE_DCEPAYLOAD_H
#define SURICATA_DETECT_ENGINE_DCEPAYLOAD_H
// uint8_t DetectEngineInspectDcePayload(DetectEngineCtx *, DetectEngineThreadCtx *,
// const Signature *, Flow *, uint8_t, void *);
void DcePayloadRegisterTests(void);
#endif /* SURICATA_DETECT_ENGINE_DCEPAYLOAD_H */

1
src/detect-engine-file.c
Unescape Escape View File

@ -32,7 +32,6 @@
#include "detect-filestore.h"
#include "detect-engine-dcepayload.h"
#include "detect-engine-file.h"
#include "stream-tcp.h"

1
src/detect-engine-register.c
Unescape Escape View File

@ -45,7 +45,6 @@
#include "rust.h"
#include "detect-engine-payload.h"
#include "detect-engine-dcepayload.h"
#include "detect-dns-name.h"
#include "detect-dns-response.h"
#include "detect-tls-sni.h"

1
src/detect-engine-state.c
Unescape Escape View File

@ -44,7 +44,6 @@
#include "detect-engine.h"
#include "detect-parse.h"
#include "detect-engine-state.h"
#include "detect-engine-dcepayload.h"
#include "detect-engine-build.h"
#include "detect-flowvar.h"

2
src/runmode-unittests.c
Unescape Escape View File

@ -35,7 +35,6 @@
#include "detect-engine-mpm.h"
#include "detect-engine-sigorder.h"
#include "detect-engine-payload.h"
#include "detect-engine-dcepayload.h"
#include "detect-engine-state.h"
#include "detect-engine-tag.h"
#include "detect-fast-pattern.h"
@ -192,7 +191,6 @@ static void RegisterUnittests(void)
SCThresholdConfRegisterTests();
SCRConfRegisterTests();
PayloadRegisterTests();
DcePayloadRegisterTests();
#ifdef PROFILING
SCProfilingRegisterTests();
#endif

Write Preview
Loading…
Cancel
Save