aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

dcerpc/smb/smb2: more robust error checking, cosmetic code updates.

Browse Source
remotes/origin/HEAD
Victor Julien 14 years ago
parent fc15cc7de1
commit 2055b509a3
4 changed files with 428 additions and 298 deletions
Show Stats Download Patch File Download Diff File

9
src/app-layer-dcerpc-udp.c
Unescape Escape View File

@ -630,14 +630,15 @@ static int DCERPCUDPParse(Flow *f, void *dcerpc_state,
while (sstate->bytesprocessed < DCERPC_UDP_HDR_LEN && input_len) {
hdrretval = DCERPCUDPParseHeader(f, dcerpc_state, pstate, input,
input_len, output);
if(hdrretval == -1) {
if (hdrretval == -1 || hdrretval > (int32_t)input_len) {
sstate->bytesprocessed = 0;
SCReturnInt(hdrretval);
} else {
parsed += retval;
input_len -= retval;
parsed += hdrretval;
input_len -= hdrretval;
}
}
#if 0
printf("Done with DCERPCUDPParseHeader bytesprocessed %u/%u left %u\n",
sstate->bytesprocessed, sstate->dcerpc.dcerpchdrudp.fraglen, input_len);
@ -659,7 +660,7 @@ static int DCERPCUDPParse(Flow *f, void *dcerpc_state,
&& input_len) {
retval = FragmentDataParser(f, dcerpc_state, pstate, input + parsed,
input_len, output);
if (retval) {
if (retval || retval > (int32_t)input_len) {
parsed += retval;
input_len -= retval;
} else if (input_len) {

54
src/app-layer-dcerpc.c
Unescape Escape View File

@ -1173,8 +1173,8 @@ end:
static int DCERPCParseHeader(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
SCEnter();
uint8_t *p = input;
if (input_len) {
if (input_len) {
SCLogDebug("dcerpc->bytesprocessed %u", dcerpc->bytesprocessed);
switch (dcerpc->bytesprocessed) {
case 0:
@ -1370,7 +1370,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
while (dcerpc->bytesprocessed < DCERPC_HDR_LEN && input_len) {
hdrretval = DCERPCParseHeader(dcerpc, input + parsed, input_len);
if (hdrretval == -1) {
if (hdrretval == -1 || hdrretval > (int32_t)input_len) {
SCLogDebug("Error parsing dce header. Discarding "
"PDU and reseting parsing state to parse next PDU");
/* error parsing pdu header. Let's clear the dce state */
@ -1431,7 +1431,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
&& dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length
&& input_len) {
retval = DCERPCParseBIND(dcerpc, input + parsed, input_len);
if (retval) {
if (retval && retval <= input_len) {
parsed += retval;
input_len -= retval;
} else if (input_len) {
@ -1450,7 +1450,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
while (dcerpc->dcerpcbindbindack.numctxitemsleft && dcerpc->bytesprocessed
< dcerpc->dcerpchdr.frag_length && input_len) {
retval = DCERPCParseBINDCTXItem(dcerpc, input + parsed, input_len);
if (retval) {
if (retval && retval <= input_len) {
if (dcerpc->dcerpcbindbindack.ctxbytesprocessed == 44) {
dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0;
}
@ -1481,6 +1481,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
if (input_len) {
retval = DCERPCThrowOutExtraData(dcerpc, input + parsed,
input_len);
if (retval && retval <= input_len) {
input_len -= retval;
parsed += retval;
if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) {
@ -1488,6 +1489,13 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
} else {
dcerpc->pdu_fragged = 1;
}
} else {
SCLogDebug("Error Parsing DCERPC");
parsed = 0;
input_len = 0;
DCERPCResetParsingState(dcerpc);
SCReturnInt(0);
}
} else {
dcerpc->pdu_fragged = 1;
}
@ -1500,7 +1508,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
&& dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length
&& input_len) {
retval = DCERPCParseBINDACK(dcerpc, input + parsed, input_len);
if (retval) {
if (retval && retval <= input_len) {
parsed += retval;
input_len -= retval;
SCLogDebug("DCERPCParseBINDACK processed %u/%u input_len left %u",
@ -1521,7 +1529,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
+ dcerpc->dcerpcbindbindack.secondaryaddrlen
&& dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) {
retval = DCERPCParseSecondaryAddr(dcerpc, input + parsed, input_len);
if (retval) {
if (retval && retval <= input_len) {
parsed += retval;
input_len -= retval;
SCLogDebug("DCERPCParseSecondaryAddr %u/%u left %u secondaryaddr len(%u)",
@ -1548,7 +1556,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
+ dcerpc->dcerpcbindbindack.secondaryaddrlen + dcerpc->pad
&& dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) {
retval = PaddingParser(dcerpc, input + parsed, input_len);
if (retval) {
if (retval && retval <= input_len) {
parsed += retval;
input_len -= retval;
SCLogDebug("PaddingParser %u/%u left %u pad(%u)",
@ -1568,7 +1576,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
< DCERPC_HDR_LEN + 14 + dcerpc->pad + dcerpc->dcerpcbindbindack.secondaryaddrlen
&& dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) {
retval = DCERPCGetCTXItems(dcerpc, input + parsed, input_len);
if (retval) {
if (retval && retval <= input_len) {
parsed += retval;
input_len -= retval;
SCLogDebug("DCERPCGetCTXItems %u/%u (%u)", dcerpc->bytesprocessed,
@ -1590,7 +1598,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
while (dcerpc->dcerpcbindbindack.numctxitemsleft && dcerpc->bytesprocessed
< dcerpc->dcerpchdr.frag_length && input_len) {
retval = DCERPCParseBINDACKCTXItem(dcerpc, input + parsed, input_len);
if (retval) {
if (retval && retval <= input_len) {
if (dcerpc->dcerpcbindbindack.ctxbytesprocessed == 24) {
dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0;
}
@ -1626,6 +1634,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
if (input_len) {
retval = DCERPCThrowOutExtraData(dcerpc, input + parsed,
input_len);
if (retval && retval <= input_len) {
input_len -= retval;
parsed += retval;
if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) {
@ -1633,6 +1642,13 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
} else {
dcerpc->pdu_fragged = 1;
}
} else {
SCLogDebug("Error Parsing DCERPC");
parsed = 0;
input_len = 0;
DCERPCResetParsingState(dcerpc);
SCReturnInt(0);
}
} else {
dcerpc->pdu_fragged = 1;
}
@ -1645,7 +1661,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
&& dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length
&& input_len) {
retval = DCERPCParseREQUEST(dcerpc, input + parsed, input_len);
if (retval) {
if (retval && retval <= input_len) {
parsed += retval;
input_len -= retval;
dcerpc->padleft = dcerpc->dcerpchdr.frag_length - dcerpc->bytesprocessed;
@ -1664,7 +1680,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
&& dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length
&& dcerpc->padleft && input_len) {
retval = StubDataParser(dcerpc, input + parsed, input_len);
if (retval) {
if (retval && retval <= input_len) {
parsed += retval;
input_len -= retval;
} else if (input_len) {
@ -1701,6 +1717,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
if (input_len) {
retval = DCERPCThrowOutExtraData(dcerpc, input + parsed,
input_len);
if (retval && retval <= input_len) {
input_len -= retval;
parsed += retval;
if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) {
@ -1708,6 +1725,13 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
} else {
dcerpc->pdu_fragged = 1;
}
} else {
SCLogDebug("Error Parsing DCERPC");
parsed = 0;
input_len = 0;
DCERPCResetParsingState(dcerpc);
SCReturnInt(0);
}
} else {
dcerpc->pdu_fragged = 1;
}
@ -1726,6 +1750,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
SCLogDebug("DCERPC Type 0x%02x not implemented yet", dcerpc->dcerpchdr.type);
retval = DCERPCThrowOutExtraData(dcerpc, input + parsed,
input_len);
if (retval && retval <= input_len) {
input_len -= retval;
parsed += retval;
if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) {
@ -1733,6 +1758,13 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
} else {
dcerpc->pdu_fragged = 1;
}
} else {
SCLogDebug("Error Parsing DCERPC");
parsed = 0;
input_len = 0;
DCERPCResetParsingState(dcerpc);
SCReturnInt(0);
}
break;
}
}

38
src/app-layer-smb.c
Unescape Escape View File

@ -508,23 +508,29 @@ static uint32_t SMBParseTransact(Flow *f, void *smb_state,
/* Data Offset */
sstate->andx.dataoffset |= *(p++) << 8;
if (!(--input_len))
break;
case 26:
/* Setup Count */
p++;
if (!(--input_len))
break;
case 27:
/* Reserved */
p++;
if (!(--input_len))
break;
case 28:
p++;
if (!(--input_len))
break;
case 29:
p++;
if (!(--input_len))
break;
case 30:
p++;
if (!(--input_len))
break;
case 31:
p++;
--input_len;
@ -584,7 +590,7 @@ static int32_t DataParser(void *smb_state, AppLayerParserState *pstate,
if (sstate->andx.paddingparsed) {
parsed = DCERPCParser(&sstate->dcerpc, input, input_len);
if (parsed == -1) {
if (parsed == -1 || parsed > sstate->bytecount.bytecountleft || parsed > (int32_t)input_len) {
SCReturnInt(-1);
} else {
sstate->dcerpc_present = 1;
@ -669,24 +675,36 @@ static uint32_t SMBParseWordCount(Flow *f, void *smb_state,
== SMB_COM_READ_ANDX) {
retval = SMBParseReadAndX(f, sstate, pstate, input, input_len,
output);
if (retval <= sstate->wordcount.wordcountleft) {
sstate->wordcount.wordcountleft -= retval;
SCLogDebug("SMB_COM_READ_ANDX returned %d - %u bytes at offset %"PRIu64"", retval, sstate->andx.datalength, sstate->andx.dataoffset);
SCReturnUInt(retval);
} else {
SCReturnUInt(0U);
}
} else if (((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) == 0)
&& sstate->smb.command == SMB_COM_WRITE_ANDX) {
retval = SMBParseWriteAndX(f, sstate, pstate, input,
input_len, output);
if (retval <= sstate->wordcount.wordcountleft) {
sstate->wordcount.wordcountleft -= retval;
SCLogDebug("SMB_COM_WRITE_ANDX returned %d - %u bytes at offset %"PRIu64"", retval, sstate->andx.datalength, sstate->andx.dataoffset);
SCReturnUInt(retval);
} else {
SCReturnUInt(0U);
}
} else if (sstate->smb.command == SMB_COM_TRANSACTION) {
retval = SMBParseTransact(f, sstate, pstate, input, input_len,
output);
if (retval <= sstate->wordcount.wordcountleft) {
sstate->wordcount.wordcountleft -= retval;
SCLogDebug("SMB_COM_TRANSACTION returned %d - %u bytes at offset %"PRIu64"", retval, sstate->andx.datalength, sstate->andx.dataoffset);
SCReturnUInt(retval);
} else {
SCReturnUInt(0U);
}
} else { /* Generic WordCount Handler */
while (sstate->wordcount.wordcountleft-- && input_len--) {
@ -724,15 +742,19 @@ static uint32_t SMBParseByteCount(Flow *f, void *smb_state,
{
if (sstate->andx.paddingparsed == 0) {
ures = PaddingParser(sstate, pstate, input + parsed, input_len, output);
if (ures <= input_len) {
parsed += ures;
input_len -= ures;
} else {
SCReturnUInt(0U);
}
}
if (sstate->andx.datalength && input_len) {
/* Uncomment the next line to help debug DCERPC over SMB */
//hexdump(f, input + parsed, input_len);
sres = DataParser(sstate, pstate, input + parsed, input_len, output);
if (sres != -1) {
if (sres != -1 && sres <= (int32_t)input_len) {
parsed += (uint32_t)sres;
input_len -= (uint32_t)sres;
} else { /* Did not Validate as DCERPC over SMB */
@ -1051,7 +1073,7 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
while (input_len && sstate->bytesprocessed < NBSS_HDR_LEN) {
retval = NBSSParseHeader(f, smb_state, pstate, input + parsed,
input_len, output);
if (retval) {
if (retval && retval <= input_len) {
parsed += retval;
input_len -= retval;
SCLogDebug("[1] NBSS Header (%u/%u) Type 0x%02x Length 0x%04x "
@ -1073,7 +1095,7 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
/* inside while */
hdrretval = SMBParseHeader(f, smb_state, pstate, input + parsed,
input_len, output);
if (hdrretval == -1) {
if (hdrretval == -1 || hdrretval > (int32_t)input_len) {
SCLogDebug("Error parsing SMB Header");
sstate->bytesprocessed = 0;
SCReturnInt(0);
@ -1093,7 +1115,7 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
/* inside if */
retval = SMBGetWordCount(f, smb_state, pstate, input + parsed,
input_len, output);
if (retval) {
if (retval && retval <= input_len) {
parsed += retval;
input_len -= retval;
} else if (input_len) {
@ -1116,7 +1138,7 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
/* inside while */
retval = SMBParseWordCount(f, smb_state, pstate,
input + parsed, input_len, output);
if (retval) {
if (retval && retval <= input_len) {
parsed += retval;
input_len -= retval;
} else if (input_len) {
@ -1142,7 +1164,7 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
/* inside while */
retval = SMBGetByteCount(f, smb_state, pstate, input + parsed,
input_len, output);
if (retval) {
if (retval && retval <= input_len) {
parsed += retval;
input_len -= retval;
} else if (input_len) {
@ -1172,7 +1194,7 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
/* inside while */
retval = SMBParseByteCount(f, smb_state, pstate,
input + parsed, input_len, output);
if (retval) {
if (retval && retval <= input_len) {
parsed += retval;
input_len -= retval;
} else if (input_len) {

205
src/app-layer-smb2.c
Unescape Escape View File

@ -75,14 +75,17 @@ static uint32_t NBSSParseHeader(void *smb2_state, AppLayerParserState *pstate,
SCReturnUInt(4U);
} else {
sstate->nbss.type = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
}
case 1:
sstate->nbss.length = (*(p++) & 0x01) << 16;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 2:
sstate->nbss.length |= *(p++) << 8;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 3:
sstate->nbss.length |= *(p++);
--input_len;
@ -96,8 +99,10 @@ static uint32_t NBSSParseHeader(void *smb2_state, AppLayerParserState *pstate,
static uint32_t SMB2ParseHeader(void *smb2_state, AppLayerParserState *pstate,
uint8_t *input, uint32_t input_len, AppLayerParserResult *output) {
SCEnter();
SMB2State *sstate = (SMB2State *) smb2_state;
uint8_t *p = input;
if (input_len) {
switch (sstate->bytesprocessed) {
case 4:
@ -185,194 +190,256 @@ static uint32_t SMB2ParseHeader(void *smb2_state, AppLayerParserState *pstate,
//sstate->smb2.protocol[1] = *(p++);
if (*(p++) != 'S')
return 0;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 6:
//sstate->smb2.protocol[2] = *(p++);
if (*(p++) != 'M')
return 0;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 7:
//sstate->smb2.protocol[3] = *(p++);
if (*(p++) != 'B')
return 0;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 8:
sstate->smb2.StructureSize = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 9:
sstate->smb2.StructureSize |= *(p++) << 8;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 10:
sstate->smb2.CreditCharge = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 11:
sstate->smb2.CreditCharge |= *(p++) << 8;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 12:
sstate->smb2.Status = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 13:
sstate->smb2.Status |= *(p++) << 8;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 14:
sstate->smb2.Status |= *(p++) << 16;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 15:
sstate->smb2.Status |= *(p++) << 24;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 16:
sstate->smb2.Command = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 17:
sstate->smb2.Command |= *(p++) << 8;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 18:
sstate->smb2.CreditRequestResponse = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 19:
sstate->smb2.CreditRequestResponse |= *(p++) << 8;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 20:
sstate->smb2.Flags = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 21:
sstate->smb2.Flags |= *(p++) << 8;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 22:
sstate->smb2.Flags |= *(p++) << 16;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 23:
sstate->smb2.Flags |= *(p++) << 24;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 24:
sstate->smb2.NextCommand = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 25:
sstate->smb2.NextCommand |= *(p++) << 8;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 26:
sstate->smb2.NextCommand |= *(p++) << 16;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 27:
sstate->smb2.NextCommand |= *(p++) << 24;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 28:
sstate->smb2.MessageId = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 29:
sstate->smb2.MessageId = *(p++) << 8;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 30:
sstate->smb2.MessageId = *(p++) << 16;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 31:
sstate->smb2.MessageId = (uint64_t) *(p++) << 24;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 32:
sstate->smb2.MessageId = (uint64_t) *(p++) << 32;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 33:
sstate->smb2.MessageId = (uint64_t) *(p++) << 40;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 34:
sstate->smb2.MessageId = (uint64_t) *(p++) << 48;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 35:
sstate->smb2.MessageId = (uint64_t) *(p++) << 56;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 36:
sstate->smb2.ProcessId = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 37:
sstate->smb2.ProcessId |= *(p++) << 8;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 38:
sstate->smb2.ProcessId |= *(p++) << 16;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 39:
sstate->smb2.ProcessId |= *(p++) << 24;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 40:
sstate->smb2.TreeId = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 41:
sstate->smb2.TreeId |= *(p++) << 8;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 42:
sstate->smb2.TreeId |= *(p++) << 16;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 43:
sstate->smb2.TreeId |= *(p++) << 24;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 44:
sstate->smb2.SessionId = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 45:
sstate->smb2.SessionId |= *(p++) << 8;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 46:
sstate->smb2.SessionId |= *(p++) << 16;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 47:
sstate->smb2.SessionId |= (uint64_t) *(p++) << 24;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 48:
sstate->smb2.SessionId |= (uint64_t) *(p++) << 32;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 49:
sstate->smb2.SessionId |= (uint64_t) *(p++) << 40;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 50:
sstate->smb2.SessionId |= (uint64_t) *(p++) << 48;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 51:
sstate->smb2.SessionId |= (uint64_t) *(p++) << 56;
if (!(--input_len)) break;
if (!(--input_len))
break;
case 52:
sstate->smb2.Signature[0] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 53:
sstate->smb2.Signature[1] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 54:
sstate->smb2.Signature[2] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 55:
sstate->smb2.Signature[3] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 56:
sstate->smb2.Signature[4] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 57:
sstate->smb2.Signature[5] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 58:
sstate->smb2.Signature[6] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 59:
sstate->smb2.Signature[7] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 60:
sstate->smb2.Signature[8] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 61:
sstate->smb2.Signature[9] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 62:
sstate->smb2.Signature[10] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 63:
sstate->smb2.Signature[11] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 64:
sstate->smb2.Signature[12] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 65:
sstate->smb2.Signature[13] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 66:
sstate->smb2.Signature[14] = *(p++);
if (!(--input_len)) break;
if (!(--input_len))
break;
case 67:
sstate->smb2.Signature[15] = *(p++);
--input_len;
@ -396,8 +463,12 @@ static int SMB2Parse(Flow *f, void *smb2_state, AppLayerParserState *pstate,
while (sstate->bytesprocessed < NBSS_HDR_LEN && input_len) {
retval = NBSSParseHeader(smb2_state, pstate, input, input_len, output);
if (retval <= input_len) {
parsed += retval;
input_len -= retval;
} else {
return -1;
}
SCLogDebug("NBSS Header (%u/%u) Type 0x%02x Length 0x%04x parsed %u input_len %u",
sstate->bytesprocessed, NBSS_HDR_LEN, sstate->nbss.type,
@ -409,8 +480,12 @@ static int SMB2Parse(Flow *f, void *smb2_state, AppLayerParserState *pstate,
while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN &&
sstate->bytesprocessed < NBSS_HDR_LEN + SMB2_HDR_LEN)) {
retval = SMB2ParseHeader(smb2_state, pstate, input + parsed, input_len, output);
if (retval <= input_len) {
parsed += retval;
input_len -= retval;
} else {
return -1;
}
SCLogDebug("SMB2 Header (%u/%u) Command 0x%04x parsed %u input_len %u",
sstate->bytesprocessed, NBSS_HDR_LEN + SMB2_HDR_LEN,

Write Preview
Loading…
Cancel
Save