aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

for now ignore pdus with auth verifier. We will get back to this in the coming iteration

Browse Source
remotes/origin/master-1.1.x
Anoop Saldanha 15 years ago committed by Victor Julien
parent fc37e9d6ee
commit 1aea3e56be
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File

16
src/app-layer-dcerpc.c
Unescape Escape View File

@ -19,6 +19,7 @@
* \file
*
* \author Kirby Kuehl <kkuehl@gmail.com>
* \author Anoop Saldanha <poonaatsoc@gmail.com>
*
* DCE/RPC parser and decoder
*/
@ -1327,6 +1328,11 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
DCERPCResetParsingState(dcerpc);
SCReturnInt(0);
} else {
/* temporary fix */
if (dcerpc->dcerpchdr.auth_length != 0 && input_len) {
DCERPCResetParsingState(dcerpc);
SCReturnInt(0);
}
dcerpc->pdu_fragged = 1;
}
break;
@ -1459,6 +1465,11 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
DCERPCResetParsingState(dcerpc);
SCReturnInt(0);
} else {
/* temporary fix */
if (dcerpc->dcerpchdr.auth_length != 0 && input_len) {
DCERPCResetParsingState(dcerpc);
SCReturnInt(0);
}
dcerpc->pdu_fragged = 1;
}
break;
@ -1521,6 +1532,11 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
dcerpc->dcerpchdr.pfc_flags & PFC_FIRST_FRAG) {
DCERPCResetStub(dcerpc);
}
/* temporary fix */
if (dcerpc->dcerpchdr.auth_length != 0 && input_len) {
DCERPCResetParsingState(dcerpc);
SCReturnInt(0);
}
dcerpc->pdu_fragged = 1;
}

Write Preview
Loading…
Cancel
Save