dce_iface, dce_opnum, dce_stub_data keyword support

src/Makefile.am

@@ -92,6 +92,9 @@ detect-icode.c detect-icode.h \
 detect-http-cookie.c detect-http-cookie.h \
 detect-tls-version.c detect-tls-version.h \
 detect-icmp-id.c detect-icmp-id.h \
+detect-dce-iface.c detect-dce-iface.h \
+detect-dce-opnum.c detect-dce-opnum.h \
+detect-dce-stub-data.c detect-dce-stub-data.h \
 util-print.c util-print.h \
 util-mpm.c util-mpm.h \
 util-binsearch.c util-binsearch.h \

src/app-layer-dcerpc.c

@@ -119,7 +119,7 @@ static int DCERPCParseCTXItem(Flow *f, void *dcerpc_state, AppLayerParserState *
                 }
                 printf("\n");
 #endif
-                //	TAILQ_INSERT_TAIL(&sstate->head, sstate->item, entries);
+                //     TAILQ_INSERT_TAIL(&sstate->head, sstate->item, entries);
                 if (!(--input_len)) break;
             case 20:
                 p++;

src/detect-dce-iface.c

@@ -0,0 +1,610 @@
+/** Copyright (c) 2009 Open Information Security Foundation.
+ *  \author Anoop Saldanha <poonaatsoc@gmail.com>
+ */
+
+#include "suricata-common.h"
+#include "detect.h"
+#include "detect-parse.h"
+#include "detect-dce-iface.h"
+#include "app-layer-dcerpc.h"
+#include "queue.h"
+
+#include "util-debug.h"
+#include "util-unittest.h"
+
+#define DETECT_DCE_IFACE_PCRE_PARSE_ARGS "^\\s*([0-9a-zA-Z]{8}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{12})(?:\\s*,(<|>|=|!)([0-9]{1,5}))?(?:\\s*,(any_frag))?\\s*$"
+
+static pcre *parse_regex = NULL;
+static pcre_extra *parse_regex_study = NULL;
+
+int DetectDceIfaceMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t,
+                        void *, Signature *, SigMatch *);
+int DetectDceIfaceSetup(DetectEngineCtx *, Signature *s, SigMatch *m, char *arg);
+void DetectDceIfaceFree(void *);
+
+/**
+ * \brief Registers the keyword handlers for the "dce_iface" keyword.
+ */
+void DetectDceIfaceRegister(void)
+{
+    const char *eb;
+    int eo;
+    int opts = 0;
+
+    sigmatch_table[DETECT_DCE_IFACE].name = "dce_iface";
+    sigmatch_table[DETECT_DCE_IFACE].Match = NULL;
+    sigmatch_table[DETECT_DCE_IFACE].AppLayerMatch = DetectDceIfaceMatch;
+    sigmatch_table[DETECT_DCE_IFACE].Setup = DetectDceIfaceSetup;
+    sigmatch_table[DETECT_DCE_IFACE].Free  = DetectDceIfaceFree;
+    sigmatch_table[DETECT_DCE_IFACE].RegisterTests = DetectDceIfaceRegisterTests;
+
+    parse_regex = pcre_compile(DETECT_DCE_IFACE_PCRE_PARSE_ARGS, opts, &eb,
+                               &eo, NULL);
+    if (parse_regex == NULL) {
+        SCLogDebug("pcre compile of \"%s\" failed at offset %" PRId32 ": %s",
+                   DETECT_DCE_IFACE_PCRE_PARSE_ARGS, eo, eb);
+        goto error;
+    }
+
+    parse_regex_study = pcre_study(parse_regex, 0, &eb);
+    if (eb != NULL) {
+        SCLogDebug("pcre study failed: %s", eb);
+        goto error;
+    }
+
+    return;
+
+ error:
+    /* we need to handle error?! */
+    return;
+}
+
+/**
+ * \internal
+ * \brief Parses the argument sent along with the "dce_iface" keyword.
+ *
+ * \param arg Pointer to the string containing the argument to be parsed.
+ *
+ * \retval did Pointer to a DetectDceIfaceData instance that holds the data
+ *             from the parsed arg.
+ */
+static inline DetectDceIfaceData *DetectDceIfaceArgParse(const char *arg)
+{
+    DetectDceIfaceData *did = NULL;
+#define MAX_SUBSTRINGS 30
+    int ret = 0, res = 0;
+    int ov[MAX_SUBSTRINGS];
+    uint8_t hex_value;
+    const char *pcre_sub_str = NULL;
+    int i = 0, j = 0;
+    int len = 0;
+    char temp_str[3];
+    int version;
+
+    ret = pcre_exec(parse_regex, parse_regex_study, arg, strlen(arg), 0, 0, ov,
+                    MAX_SUBSTRINGS);
+    if (ret < 2) {
+        SCLogDebug("pcre_exec parse error, ret %" PRId32 ", string %s", ret, arg);
+        goto error;
+    }
+
+    if ( (did = malloc(sizeof(DetectDceIfaceData))) == NULL) {
+        SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
+        goto error;
+    }
+    memset(did, 0, sizeof(DetectDceIfaceData));
+
+    res = pcre_get_substring(arg, ov, MAX_SUBSTRINGS, 1, &pcre_sub_str);
+    if (res < 0) {
+        SCLogError(SC_PCRE_GET_SUBSTRING_FAILED, "pcre_get_substring failed");
+        goto error;
+    }
+
+    len = strlen(pcre_sub_str);
+    j = 0;
+    temp_str[2] = '\0';
+    for (i = 0; i < len; ) {
+        if (pcre_sub_str[i] == '-') {
+            i++;
+            continue;
+        }
+
+        temp_str[0] = pcre_sub_str[i];
+        temp_str[1] = pcre_sub_str[i + 1];
+
+        hex_value = strtol(temp_str, NULL, 16);
+        did->uuid[j] = hex_value;
+        i += 2;
+        j++;
+    }
+
+    if (ret == 3 || ret == 5)
+        did->any_frag = 1;
+
+    if (ret == 4 || ret == 5) {
+        res = pcre_get_substring(arg, ov, MAX_SUBSTRINGS, 2, &pcre_sub_str);
+        if (res < 0) {
+            SCLogError(SC_PCRE_GET_SUBSTRING_FAILED, "pcre_get_substring failed");
+            goto error;
+        }
+
+        switch (pcre_sub_str[0]) {
+            case '<':
+                did->op = DETECT_DCE_IFACE_OP_LT;
+                break;
+            case '>':
+                did->op = DETECT_DCE_IFACE_OP_GT;
+                break;
+            case '=':
+                did->op = DETECT_DCE_IFACE_OP_EQ;
+                break;
+            case '!':
+                did->op = DETECT_DCE_IFACE_OP_NE;
+                break;
+        }
+
+        res = pcre_get_substring(arg, ov, MAX_SUBSTRINGS, 3, &pcre_sub_str);
+        if (res < 0) {
+            SCLogError(SC_PCRE_GET_SUBSTRING_FAILED, "pcre_get_substring failed");
+            goto error;
+        }
+
+        version = atoi(pcre_sub_str);
+        if (version > 65535) {
+            SCLogError(SC_ERR_INVALID_SIGNATURE, "DCE_IFACE interface version "
+                       "invalid: %d\n", version);
+            goto error;
+        }
+        did->version = version;
+    }
+
+    return did;
+
+ error:
+    if (did != NULL)
+        free(did);
+    return NULL;
+}
+
+int DetectDceIfaceMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f,
+                        uint8_t flags, void *state, Signature *s, SigMatch *m)
+{
+    int ret = 1;
+    struct entry *item = NULL;
+    DetectDceIfaceData *dce_data = (DetectDceIfaceData *)m->ctx;
+    DCERPCState *dcerpc_state = (DCERPCState *)state;
+    if (dce_rpc_state == NULL) {
+        SCLogDebug("No DCERPCState for the flow");
+        return 0;
+    }
+
+    SCMutexLock(&f->m);
+    int i = 0;
+
+    TAILQ_FOREACH(item, &dcerpc_state->head, entries) {
+        for (i = 0; i < 16; i++) {
+            if (dce_data->uuid[i] != item->uuid[i]) {
+                ret = 0;
+                break;
+            }
+        }
+    }
+
+    return 1;
+}
+
+/**
+ * \brief Creates a SigMatch for the "dce_iface" keyword being sent as argument,
+ *        and appends it to the Signature(s).
+ *
+ * \param de_ctx Pointer to the detection engine context.
+ * \param s      Pointer to signature for the current Signature being parsed
+ *               from the rules.
+ * \param m      Pointer to the head of the SigMatchs for the current rule
+ *               being parsed.
+ * \param arg    Pointer to the string holding the keyword value.
+ *
+ * \retval 0 on success, -1 on failure.
+ */
+
+int DetectDceIfaceSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *m,
+                        char *arg)
+{
+    DetectDceIfaceData *did = NULL;
+    SigMatch *sm = NULL;
+
+    did = DetectDceIfaceArgParse(arg);
+    if (did == NULL) {
+        SCLogError(SC_ERR_INVALID_SIGNATURE, "Error parsing dec_iface option in "
+                   "signature");
+        goto error;
+    }
+
+    sm = SigMatchAlloc();
+    if (sm == NULL)
+        goto error;
+
+    sm->type = DETECT_DCE_IFACE;
+    sm->ctx = (void *)did;
+
+    SigMatchAppend(s, m, sm);
+
+    return 0;
+
+ error:
+    DetectDceIfaceFree(did);
+    if (sm != NULL)
+        free(sm);
+    return -1;
+}
+
+void DetectDceIfaceFree(void *ptr)
+{
+    free(ptr);
+
+    return;
+}
+
+/************************************Unittests*********************************/
+
+#ifdef UNITTESTS
+
+static int DetectDceIfaceTestParse01(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceIfaceData *did = NULL;
+    uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
+                           0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
+    SigMatch *temp = NULL;
+    int i = 0;
+
+    result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        did = temp->ctx;
+        result &= 1;
+        for (i = 0; i < 16; i++) {
+            if (did->uuid[i] != test_uuid[i]) {
+                result = 0;
+                break;
+            }
+        }
+    }
+
+    result &= (did->version == 0);
+    result &= (did->op == 0);
+    result &= (did->any_frag == 0);
+
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceIfaceTestParse02(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceIfaceData *did = NULL;
+    uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
+                           0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
+    SigMatch *temp = NULL;
+    int i = 0;
+
+    result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>1") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        did = temp->ctx;
+        result &= 1;
+        for (i = 0; i < 16; i++) {
+            if (did->uuid[i] != test_uuid[i]) {
+                result = 0;
+                break;
+            }
+        }
+    }
+
+    result &= (did->version == 1);
+    result &= (did->op == DETECT_DCE_IFACE_OP_GT);
+    result &= (did->any_frag == 0);
+
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceIfaceTestParse03(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceIfaceData *did = NULL;
+    uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
+                           0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
+    SigMatch *temp = NULL;
+    int i = 0;
+
+    result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,<10") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        did = temp->ctx;
+        result &= 1;
+        for (i = 0; i < 16; i++) {
+            if (did->uuid[i] != test_uuid[i]) {
+                result = 0;
+                break;
+            }
+        }
+    }
+
+    result &= (did->version == 10);
+    result &= (did->op == DETECT_DCE_IFACE_OP_LT);
+    result &= (did->any_frag == 0);
+
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceIfaceTestParse04(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceIfaceData *did = NULL;
+    uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
+                           0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
+    SigMatch *temp = NULL;
+    int i = 0;
+
+    result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,!10") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        did = temp->ctx;
+        result &= 1;
+        for (i = 0; i < 16; i++) {
+            if (did->uuid[i] != test_uuid[i]) {
+                result = 0;
+                break;
+            }
+        }
+    }
+
+    result &= (did->version == 10);
+    result &= (did->op == DETECT_DCE_IFACE_OP_NE);
+    result &= (did->any_frag == 0);
+
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceIfaceTestParse05(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceIfaceData *did = NULL;
+    uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
+                           0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
+    SigMatch *temp = NULL;
+    int i = 0;
+
+    result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,=10") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        did = temp->ctx;
+        result &= 1;
+        for (i = 0; i < 16; i++) {
+            if (did->uuid[i] != test_uuid[i]) {
+                result = 0;
+                break;
+            }
+        }
+    }
+
+    result &= (did->version == 10);
+    result &= (did->op == DETECT_DCE_IFACE_OP_EQ);
+    result &= (did->any_frag == 0);
+
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceIfaceTestParse06(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceIfaceData *did = NULL;
+    uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
+                           0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
+    SigMatch *temp = NULL;
+    int i = 0;
+
+    result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,any_frag") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        did = temp->ctx;
+        result &= 1;
+        for (i = 0; i < 16; i++) {
+            if (did->uuid[i] != test_uuid[i]) {
+                result = 0;
+                break;
+            }
+        }
+    }
+
+    result &= (did->version == 0);
+    result &= (did->op == 0);
+    result &= (did->any_frag == 1);
+
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceIfaceTestParse07(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceIfaceData *did = NULL;
+    uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
+                           0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
+    SigMatch *temp = NULL;
+    int i = 0;
+
+    result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>1,any_frag") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        did = temp->ctx;
+        result &= 1;
+        for (i = 0; i < 16; i++) {
+            if (did->uuid[i] != test_uuid[i]) {
+                result = 0;
+                break;
+            }
+        }
+    }
+
+    result &= (did->version == 1);
+    result &= (did->op == DETECT_DCE_IFACE_OP_GT);
+    result &= (did->any_frag == 1);
+
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceIfaceTestParse08(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceIfaceData *did = NULL;
+    uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
+                           0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
+    SigMatch *temp = NULL;
+    int i = 0;
+
+    result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,<1,any_frag") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        did = temp->ctx;
+        result &= 1;
+        for (i = 0; i < 16; i++) {
+            if (did->uuid[i] != test_uuid[i]) {
+                result = 0;
+                break;
+            }
+        }
+    }
+
+    result &= (did->version == 1);
+    result &= (did->op == DETECT_DCE_IFACE_OP_LT);
+    result &= (did->any_frag == 1);
+
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceIfaceTestParse09(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceIfaceData *did = NULL;
+    uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
+                           0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
+    SigMatch *temp = NULL;
+    int i = 0;
+
+    result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,=1,any_frag") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        did = temp->ctx;
+        result &= 1;
+        for (i = 0; i < 16; i++) {
+            if (did->uuid[i] != test_uuid[i]) {
+                result = 0;
+                break;
+            }
+        }
+    }
+
+    result &= (did->version == 1);
+    result &= (did->op == DETECT_DCE_IFACE_OP_EQ);
+    result &= (did->any_frag == 1);
+
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceIfaceTestParse10(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceIfaceData *did = NULL;
+    uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
+                           0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
+    SigMatch *temp = NULL;
+    int i = 0;
+
+    result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,!1,any_frag") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        did = temp->ctx;
+        result &= 1;
+        for (i = 0; i < 16; i++) {
+            if (did->uuid[i] != test_uuid[i]) {
+                result = 0;
+                break;
+            }
+        }
+    }
+
+    result &= (did->version == 1);
+    result &= (did->op == DETECT_DCE_IFACE_OP_NE);
+    result &= (did->any_frag == 1);
+
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceIfaceTestParse11(void)
+{
+    Signature *s = SigAlloc();
+    int result = 1;
+
+    result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>1,ay_frag") == -1);
+    result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-12345679ABC,>1,any_frag") == -1);
+    result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-134-123456789ABC,>1,any_frag") == -1);
+    result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-123-124-1234-123456789ABC,>1,any_frag") == -1);
+    result &= (DetectDceIfaceSetup(NULL, s, NULL, "1234568-1234-1234-1234-123456789ABC,>1,any_frag") == -1);
+    result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>65536,any_frag") == -1);
+    result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>=1,any_frag") == -1);
+
+    SigFree(s);
+    return result;
+}
+
+#endif
+
+void DetectDceIfaceRegisterTests(void)
+{
+
+#ifdef UNITTESTS
+
+    UtRegisterTest("DetectDceIfaceTestParse01", DetectDceIfaceTestParse01, 1);
+    UtRegisterTest("DetectDceIfaceTestParse02", DetectDceIfaceTestParse02, 1);
+    UtRegisterTest("DetectDceIfaceTestParse03", DetectDceIfaceTestParse03, 1);
+    UtRegisterTest("DetectDceIfaceTestParse04", DetectDceIfaceTestParse04, 1);
+    UtRegisterTest("DetectDceIfaceTestParse05", DetectDceIfaceTestParse05, 1);
+    UtRegisterTest("DetectDceIfaceTestParse06", DetectDceIfaceTestParse06, 1);
+    UtRegisterTest("DetectDceIfaceTestParse07", DetectDceIfaceTestParse07, 1);
+    UtRegisterTest("DetectDceIfaceTestParse08", DetectDceIfaceTestParse08, 1);
+    UtRegisterTest("DetectDceIfaceTestParse09", DetectDceIfaceTestParse09, 1);
+    UtRegisterTest("DetectDceIfaceTestParse10", DetectDceIfaceTestParse10, 1);
+    UtRegisterTest("DetectDceIfaceTestParse11", DetectDceIfaceTestParse11, 1);
+
+#endif
+
+}

src/detect-dce-iface.h

@@ -0,0 +1,25 @@
+/** Copyright (c) 2009 Open Information Security Foundation.
+ *  \author Anoop Saldanha <poonaatsoc@gmail.com>
+ */
+
+#ifndef __DETECT_DCE_IFACE_H__
+#define __DETECT_DCE_IFACE_H__
+
+typedef enum DetectDceIfaceOperators_ {
+    DETECT_DCE_IFACE_OP_LT = 1,
+    DETECT_DCE_IFACE_OP_GT,
+    DETECT_DCE_IFACE_OP_EQ,
+    DETECT_DCE_IFACE_OP_NE,
+} DetectDceIfaceOperators;
+
+typedef struct DetectDceIfaceData_ {
+    uint8_t uuid[16];
+    uint8_t op;
+    uint16_t version;
+    uint8_t any_frag;
+} DetectDceIfaceData;
+
+void DetectDceIfaceRegister(void);
+void DetectDceIfaceRegisterTests(void);
+
+#endif /* __DETECT_DCE_IFACE_H__ */

src/detect-dce-opnum.c

@@ -0,0 +1,601 @@
+/** Copyright (c) 2009 Open Information Security Foundation.
+ *  \author Anoop Saldanha <poonaatsoc@gmail.com>
+ */
+
+#include "suricata-common.h"
+#include "detect.h"
+#include "detect-parse.h"
+#include "detect-dce-opnum.h"
+
+#include "util-debug.h"
+#include "util-unittest.h"
+
+#define DETECT_DCE_OPNUM_PCRE_PARSE_ARGS "^\\s*([0-9]{1,5}(\\s*-\\s*[0-9]{1,5}\\s*)?)(,\\s*[0-9]{1,5}(\\s*-\\s*[0-9]{1,5})?\\s*)*$"
+
+static pcre *parse_regex = NULL;
+static pcre_extra *parse_regex_study = NULL;
+
+int DetectDceOpnumMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t,
+                        void *, Signature *, SigMatch *);
+int DetectDceOpnumSetup(DetectEngineCtx *, Signature *s, SigMatch *m, char *arg);
+void DetectDceOpnumFree(void *);
+
+/**
+ * \brief Registers the keyword handlers for the "dce_opnum" keyword.
+ */
+void DetectDceOpnumRegister(void)
+{
+    const char *eb;
+    int eo;
+    int opts = 0;
+
+    sigmatch_table[DETECT_DCE_OPNUM].name = "dce_iface";
+    sigmatch_table[DETECT_DCE_OPNUM].Match = NULL;
+    sigmatch_table[DETECT_DCE_OPNUM].AppLayerMatch = DetectDceOpnumMatch;
+    sigmatch_table[DETECT_DCE_OPNUM].Setup = DetectDceOpnumSetup;
+    sigmatch_table[DETECT_DCE_OPNUM].Free  = DetectDceOpnumFree;
+    sigmatch_table[DETECT_DCE_OPNUM].RegisterTests = DetectDceOpnumRegisterTests;
+
+    parse_regex = pcre_compile(DETECT_DCE_OPNUM_PCRE_PARSE_ARGS, opts, &eb,
+                               &eo, NULL);
+    if (parse_regex == NULL) {
+        SCLogDebug("pcre compile of \"%s\" failed at offset %" PRId32 ": %s",
+                   DETECT_DCE_OPNUM_PCRE_PARSE_ARGS, eo, eb);
+        goto error;
+    }
+
+    parse_regex_study = pcre_study(parse_regex, 0, &eb);
+    if (eb != NULL) {
+        SCLogDebug("pcre study failed: %s", eb);
+        goto error;
+    }
+
+    return;
+
+ error:
+    /* we need to handle error?! */
+    return;
+}
+
+/**
+ * \internal
+ * \brief Creates and returns a new instance of DetectDceOpnumRange.
+ *
+ * \retval dor Pointer to the new instance DetectDceOpnumRange.
+ */
+static inline DetectDceOpnumRange *DetectDceOpnumAllocDetectDceOpnumRange(void)
+{
+    DetectDceOpnumRange *dor = NULL;
+
+    if ( (dor = malloc(sizeof(DetectDceOpnumRange))) == NULL) {
+        SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
+        exit(EXIT_FAILURE);
+    }
+    memset(dor, 0, sizeof(DetectDceOpnumRange));
+    dor->range1 = dor->range2 = -1;
+
+    return dor;
+}
+
+/**
+ * \internal
+ * \brief Parses the argument sent along with the "dce_opnum" keyword.
+ *
+ * \param arg Pointer to the string containing the argument to be parsed.
+ *
+ * \retval did Pointer to a DetectDceIfaceData instance that holds the data
+ *             from the parsed arg.
+ */
+static inline DetectDceOpnumData *DetectDceOpnumArgParse(const char *arg)
+{
+    DetectDceOpnumData *dod = NULL;
+
+    DetectDceOpnumRange *dor = NULL;
+    DetectDceOpnumRange *prev_dor = NULL;
+
+#define MAX_SUBSTRINGS 30
+    int ret = 0, res = 0;
+    int ov[MAX_SUBSTRINGS];
+    const char *pcre_sub_str = NULL;
+
+    char *dup_str = NULL;
+    char *dup_str_temp = NULL;
+    char *dup_str_head = NULL;
+    char *comma_token = NULL;
+    char *hyphen_token = NULL;
+
+    ret = pcre_exec(parse_regex, parse_regex_study, arg, strlen(arg), 0, 0, ov,
+                    MAX_SUBSTRINGS);
+    if (ret < 2) {
+        SCLogDebug("pcre_exec parse error, ret %" PRId32 ", string %s", ret, arg);
+        goto error;
+    }
+
+    res = pcre_get_substring(arg, ov, MAX_SUBSTRINGS, 0, &pcre_sub_str);
+    if (res < 0) {
+        SCLogError(SC_PCRE_GET_SUBSTRING_FAILED, "pcre_get_substring failed");
+        goto error;
+    }
+
+    if ( (dod = malloc(sizeof(DetectDceOpnumData))) == NULL) {
+        SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
+        goto error;
+    }
+    memset(dod, 0, sizeof(DetectDceOpnumRange));
+
+    if ( (dup_str = strdup(pcre_sub_str)) == NULL) {
+        SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
+        exit(EXIT_FAILURE);
+    }
+
+    /* keep a copy of the strdup string in dup_str_head so that we can free it
+     * once we are done using it */
+    dup_str_head = dup_str;
+    dup_str_temp = dup_str;
+    while ( (comma_token = index(dup_str, ',')) != NULL) {
+        comma_token[0] = '\0';
+        dup_str = comma_token + 1;
+
+        dor = DetectDceOpnumAllocDetectDceOpnumRange();
+
+        if ( (hyphen_token = index(dup_str_temp, '-')) != NULL) {
+            hyphen_token[0] = '\0';
+            hyphen_token++;
+            dor->range1 = atoi(dup_str_temp);
+            if (dor->range1 > 65535)
+                goto error;
+            dor->range2 = atoi(hyphen_token);
+            if (dor->range2 > 65535)
+                goto error;
+            if (dor->range1 > dor->range2)
+                goto error;
+        }
+        dor->range1 = atoi(dup_str_temp);
+        if (dor->range1 > 65535)
+            goto error;
+
+        if (prev_dor == NULL) {
+            prev_dor = dor;
+            dod->range = dor;
+        } else {
+            prev_dor->next = dor;
+            prev_dor = dor;
+        }
+
+        dup_str_temp = dup_str;
+    }
+
+    dor = DetectDceOpnumAllocDetectDceOpnumRange();
+
+    if ( (hyphen_token = index(dup_str, '-')) != NULL) {
+        hyphen_token[0] = '\0';
+        hyphen_token++;
+        dor->range1 = atoi(dup_str);
+        if (dor->range1 > 65535)
+            goto error;
+        dor->range2 = atoi(hyphen_token);
+        if (dor->range2 > 65535)
+            goto error;
+        if (dor->range1 > dor->range2)
+            goto error;
+    }
+    dor->range1 = atoi(dup_str);
+    if (dor->range1 > 65535)
+        goto error;
+
+    if (prev_dor == NULL) {
+        prev_dor = dor;
+        dod->range = dor;
+    } else {
+        prev_dor->next = dor;
+        prev_dor = dor;
+    }
+
+    if (dup_str_head != NULL)
+        free(dup_str_head);
+
+    return dod;
+
+ error:
+    if (dup_str_head != NULL)
+        free(dup_str_head);
+    DetectDceOpnumFree(dod);
+    return NULL;
+}
+
+int DetectDceOpnumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f,
+                        uint8_t flags, void *state, Signature *s, SigMatch *m)
+{
+    return 1;
+}
+
+/**
+ * \brief Creates a SigMatch for the "dce_opnum" keyword being sent as argument,
+ *        and appends it to the Signature(s).
+ *
+ * \param de_ctx Pointer to the detection engine context.
+ * \param s      Pointer to signature for the current Signature being parsed
+ *               from the rules.
+ * \param m      Pointer to the head of the SigMatchs for the current rule
+ *               being parsed.
+ * \param arg    Pointer to the string holding the keyword value.
+ *
+ * \retval 0 on success, -1 on failure
+ */
+
+int DetectDceOpnumSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *m,
+                        char *arg)
+{
+    DetectDceOpnumData *dod = NULL;
+    SigMatch *sm = NULL;
+
+    dod = DetectDceOpnumArgParse(arg);
+    if (dod == NULL) {
+        SCLogError(SC_ERR_INVALID_SIGNATURE, "Error parsing dce_opnum option in "
+                   "signature");
+        goto error;
+    }
+
+    sm = SigMatchAlloc();
+    if (sm == NULL)
+        goto error;
+
+    sm->type = DETECT_DCE_OPNUM;
+    sm->ctx = (void *)dod;
+
+    SigMatchAppend(s, m, sm);
+
+    return 0;
+
+ error:
+    DetectDceOpnumFree(dod);
+    if (sm != NULL)
+        free(sm);
+    return -1;
+}
+
+void DetectDceOpnumFree(void *ptr)
+{
+    DetectDceOpnumData *dod = ptr;
+    DetectDceOpnumRange *dor = NULL;
+    DetectDceOpnumRange *dor_temp = NULL;
+
+    if (dod != NULL) {
+        dor = dod->range;
+        dor_temp = dod->range;
+        while (dor != NULL) {
+            dor_temp = dor;
+            dor = dor->next;
+            free(dor_temp);
+        }
+        free(dod);
+    }
+
+    return;
+}
+
+/************************************Unittests*********************************/
+
+#ifdef UNITTESTS
+
+static int DetectDceOpnumTestParse01(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+
+    memset(s, 0, sizeof(Signature));
+
+    result = (DetectDceOpnumSetup(NULL, s, NULL, "12") == 0);
+    result &= (DetectDceOpnumSetup(NULL, s, NULL, "12,24") == 0);
+    result &= (DetectDceOpnumSetup(NULL, s, NULL, "12,12-24") == 0);
+    result &= (DetectDceOpnumSetup(NULL, s, NULL, "12-14,12,121,62-78") == 0);
+    result &= (DetectDceOpnumSetup(NULL, s, NULL, "12,26,62,61,6513-6666") == 0);
+    result &= (DetectDceOpnumSetup(NULL, s, NULL, "12,26,62,61,6513--") == -1);
+    result &= (DetectDceOpnumSetup(NULL, s, NULL, "12-14,12,121,62-8") == -1);
+
+    if (s->match != NULL) {
+        SigFree(s);
+        result &= 1;
+    }
+
+    return result;
+}
+
+static int DetectDceOpnumTestParse02(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceOpnumData *dod = NULL;
+    DetectDceOpnumRange *dor = NULL;
+    SigMatch *temp = NULL;
+
+    memset(s, 0, sizeof(Signature));
+
+    result = (DetectDceOpnumSetup(NULL, s, NULL, "12") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        dod = temp->ctx;
+        if (dod == NULL)
+            goto end;
+        dor = dod->range;
+        result &= (dor->range1 == 12 && dor->range2 == -1);
+        result &= (dor->next == NULL);
+    }
+
+ end:
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceOpnumTestParse03(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceOpnumData *dod = NULL;
+    DetectDceOpnumRange *dor = NULL;
+    SigMatch *temp = NULL;
+
+    memset(s, 0, sizeof(Signature));
+
+    result = (DetectDceOpnumSetup(NULL, s, NULL, "12-24") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        dod = temp->ctx;
+        if (dod == NULL)
+            goto end;
+        dor = dod->range;
+        result &= (dor->range1 == 12 && dor->range2 == 24);
+        result &= (dor->next == NULL);
+    }
+
+ end:
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceOpnumTestParse04(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceOpnumData *dod = NULL;
+    DetectDceOpnumRange *dor = NULL;
+    SigMatch *temp = NULL;
+
+    memset(s, 0, sizeof(Signature));
+
+    result = (DetectDceOpnumSetup(NULL, s, NULL, "12-24,24,62-72,623-635,62,25,213-235") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        dod = temp->ctx;
+        if (dod == NULL)
+            goto end;
+        dor = dod->range;
+        result &= (dor->range1 == 12 && dor->range2 == 24);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 24 && dor->range2 == -1);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 62 && dor->range2 == 72);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 623 && dor->range2 == 635);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 62 && dor->range2 == -1);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 25 && dor->range2 == -1);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 213 && dor->range2 == 235);
+        if (result == 0)
+            goto end;
+    }
+
+ end:
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceOpnumTestParse05(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceOpnumData *dod = NULL;
+    DetectDceOpnumRange *dor = NULL;
+    SigMatch *temp = NULL;
+
+    memset(s, 0, sizeof(Signature));
+
+    result = (DetectDceOpnumSetup(NULL, s, NULL, "1,2,3,4,5,6,7") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        dod = temp->ctx;
+        if (dod == NULL)
+            goto end;
+        dor = dod->range;
+        result &= (dor->range1 == 1 && dor->range2 == -1);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 2 && dor->range2 == -1);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 3 && dor->range2 == -1);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 4 && dor->range2 == -1);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 5 && dor->range2 == -1);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 6 && dor->range2 == -1);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 7 && dor->range2 == -1);
+        if (result == 0)
+            goto end;
+    }
+
+ end:
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceOpnumTestParse06(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceOpnumData *dod = NULL;
+    DetectDceOpnumRange *dor = NULL;
+    SigMatch *temp = NULL;
+
+    memset(s, 0, sizeof(Signature));
+
+    result = (DetectDceOpnumSetup(NULL, s, NULL, "1-2,3-4,5-6,7-8") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        dod = temp->ctx;
+        if (dod == NULL)
+            goto end;
+        dor = dod->range;
+        result &= (dor->range1 == 1 && dor->range2 == 2);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 3 && dor->range2 == 4);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 5 && dor->range2 == 6);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 7 && dor->range2 == 8);
+        if (result == 0)
+            goto end;
+
+    }
+
+ end:
+    SigFree(s);
+    return result;
+}
+
+static int DetectDceOpnumTestParse07(void)
+{
+    Signature *s = SigAlloc();
+    int result = 0;
+    DetectDceOpnumData *dod = NULL;
+    DetectDceOpnumRange *dor = NULL;
+    SigMatch *temp = NULL;
+
+    memset(s, 0, sizeof(Signature));
+
+    result = (DetectDceOpnumSetup(NULL, s, NULL, "1-2,3-4,5-6,7-8,9") == 0);
+
+    if (s->match != NULL) {
+        temp = s->match;
+        dod = temp->ctx;
+        if (dod == NULL)
+            goto end;
+        dor = dod->range;
+        result &= (dor->range1 == 1 && dor->range2 == 2);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 3 && dor->range2 == 4);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 5 && dor->range2 == 6);
+        result &= (dor->next != NULL);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 7 && dor->range2 == 8);
+        if (result == 0)
+            goto end;
+
+        dor = dor->next;
+        result &= (dor->range1 == 9 && dor->range2 == -1);
+        if (result == 0)
+            goto end;
+    }
+
+ end:
+    SigFree(s);
+    return result;
+}
+
+#endif
+
+void DetectDceOpnumRegisterTests(void)
+{
+
+#ifdef UNITTESTS
+
+    UtRegisterTest("DetectDceOpnumTestParse01", DetectDceOpnumTestParse01, 1);
+    UtRegisterTest("DetectDceOpnumTestParse02", DetectDceOpnumTestParse02, 1);
+    UtRegisterTest("DetectDceOpnumTestParse03", DetectDceOpnumTestParse03, 1);
+    UtRegisterTest("DetectDceOpnumTestParse04", DetectDceOpnumTestParse04, 1);
+    UtRegisterTest("DetectDceOpnumTestParse05", DetectDceOpnumTestParse05, 1);
+    UtRegisterTest("DetectDceOpnumTestParse06", DetectDceOpnumTestParse06, 1);
+    UtRegisterTest("DetectDceOpnumTestParse07", DetectDceOpnumTestParse07, 1);
+
+#endif
+
+}

src/detect-dce-opnum.h

@@ -0,0 +1,21 @@
+/** Copyright (c) 2009 Open Information Security Foundation.
+ *  \author Anoop Saldanha <poonaatsoc@gmail.com>
+ */
+
+#ifndef __DETECT_DCE_OPNUM_H__
+#define __DETECT_DCE_OPNUM_H__
+
+typedef struct DetectDceOpnumRange_ {
+    uint32_t range1;
+    uint32_t range2;
+    struct DetectDceOpnumRange_ *next;
+} DetectDceOpnumRange;
+
+typedef struct DetectDceOpnumData_ {
+    DetectDceOpnumRange *range;
+} DetectDceOpnumData;
+
+void DetectDceOpnumRegister(void);
+void DetectDceOpnumRegisterTests(void);
+
+#endif /* __DETECT_DCE_OPNUM_H__ */

src/detect-dce-stub-data.c

@@ -0,0 +1,105 @@
+/** Copyright (c) 2009 Open Information Security Foundation.
+ *  \author Anoop Saldanha <poonaatsoc@gmail.com>
+ */
+
+#include "suricata-common.h"
+#include "detect.h"
+#include "detect-parse.h"
+#include "detect-dce-stub-data.h"
+
+#include "util-debug.h"
+#include "util-unittest.h"
+
+int DetectDceStubDataMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t,
+                           void *, Signature *, SigMatch *);
+int DetectDceStubDataSetup(DetectEngineCtx *, Signature *s, SigMatch *m, char *arg);
+
+/**
+ * \brief Registers the keyword handlers for the "dce_stub_data" keyword.
+ */
+void DetectDceStubDataRegister(void)
+{
+    sigmatch_table[DETECT_DCE_STUB_DATA].name = "dce_stub_data";
+    sigmatch_table[DETECT_DCE_STUB_DATA].Match = NULL;
+    sigmatch_table[DETECT_DCE_STUB_DATA].AppLayerMatch = DetectDceStubDataMatch;
+    sigmatch_table[DETECT_DCE_STUB_DATA].Setup = DetectDceStubDataSetup;
+    sigmatch_table[DETECT_DCE_STUB_DATA].Free  = NULL;
+    sigmatch_table[DETECT_DCE_STUB_DATA].RegisterTests = DetectDceStubDataRegisterTests;
+
+    return;
+}
+
+int DetectDceStubDataMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f,
+                           uint8_t flags, void *state, Signature *s, SigMatch *m)
+{
+    return 1;
+}
+
+/**
+ * \brief Creates a SigMatch for the "dce_stub_data" keyword being sent as argument,
+ *        and appends it to the Signature(s).
+ *
+ * \param de_ctx Pointer to the detection engine context
+ * \param s      Pointer to signature for the current Signature being parsed
+ *               from the rules
+ * \param m      Pointer to the head of the SigMatchs for the current rule
+ *               being parsed
+ * \param arg    Pointer to the string holding the keyword value
+ *
+ * \retval 0 on success, -1 on failure
+ */
+
+int DetectDceStubDataSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *m,
+                           char *arg)
+{
+    SigMatch *sm = NULL;
+
+    sm = SigMatchAlloc();
+    if (sm == NULL)
+        goto error;
+
+    sm->type = DETECT_DCE_STUB_DATA;
+    sm->ctx = NULL;
+
+    SigMatchAppend(s, m, sm);
+
+    return 0;
+
+ error:
+    if (sm != NULL)
+        free(sm);
+    return -1;
+}
+
+/************************************Unittests*********************************/
+
+#ifdef UNITTESTS
+
+static int DetectDceStubDataTestParse01(void)
+{
+    Signature s;
+    int result = 0;
+
+    memset(&s, 0, sizeof(Signature));
+
+    result = (DetectDceStubDataSetup(NULL, &s, NULL, NULL) == 0);
+
+    if (s.match != NULL) {
+        result = 1;
+    }
+
+    return result;
+}
+
+#endif
+
+void DetectDceStubDataRegisterTests(void)
+{
+
+#ifdef UNITTESTS
+
+    UtRegisterTest("DetectDceStubDataTestParse01", DetectDceStubDataTestParse01, 1);
+
+#endif
+
+}

src/detect-dce-stub-data.h

@@ -0,0 +1,11 @@
+/** Copyright (c) 2009 Open Information Security Foundation.
+ *  \author Anoop Saldanha <poonaatsoc@gmail.com>
+ */
+
+#ifndef __DETECT_DCE_STUB_DATA_H__
+#define __DETECT_DCE_STUB_DATA_H__
+
+void DetectDceStubDataRegister(void);
+void DetectDceStubDataRegisterTests(void);
+
+#endif /* __DETECT_DCE_STUB_DATA_H__ */

src/detect.c

@@ -69,6 +69,9 @@
 #include "detect-itype.h"
 #include "detect-icode.h"
 #include "detect-icmp-id.h"
+#include "detect-dce-iface.h"
+#include "detect-dce-opnum.h"
+#include "detect-dce-stub-data.h"
 
 #include "util-rule-vars.h"
 
@@ -2995,6 +2998,9 @@ void SigTableSetup(void) {
     DetectICodeRegister();
     DetectHttpCookieRegister();
     DetectIcmpIdRegister();
+    DetectDceIfaceRegister();
+    DetectDceOpnumRegister();
+    DetectDceStubDataRegister();
 
     DetectTlsVersionRegister();
 

src/detect.h

@@ -497,6 +497,9 @@ enum {
 
     DETECT_AL_TLS_VERSION,
     DETECT_AL_HTTP_COOKIE,
+    DETECT_DCE_IFACE,
+    DETECT_DCE_OPNUM,
+    DETECT_DCE_STUB_DATA,
 
     /* make sure this stays last */
     DETECT_TBLSIZE,