|
|
|
@ -238,29 +238,31 @@ static uint32_t DCERPCParseBINDCTXItem(DCERPC *dcerpc, uint8_t *input, uint32_t
|
|
|
|
|
dcerpc->dcerpcbindbindack.versionminor |= *(p + 23) << 8;
|
|
|
|
|
//if (dcerpc->dcerpcbindbindack.ctxid == dcerpc->dcerpcbindbindack.numctxitems
|
|
|
|
|
// - dcerpc->dcerpcbindbindack.numctxitemsleft) {
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *) SCCalloc(1,
|
|
|
|
|
sizeof(DCERPCUuidEntry));
|
|
|
|
|
if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) {
|
|
|
|
|
SCLogDebug("UUID Entry is NULL\n");
|
|
|
|
|
SCReturnUInt(0);
|
|
|
|
|
} else {
|
|
|
|
|
memcpy(dcerpc->dcerpcbindbindack.uuid_entry->uuid, dcerpc->dcerpcbindbindack.uuid,
|
|
|
|
|
sizeof(dcerpc->dcerpcbindbindack.uuid));
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry->ctxid = dcerpc->dcerpcbindbindack.ctxid;
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry->version = dcerpc->dcerpcbindbindack.version;
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry->versionminor = dcerpc->dcerpcbindbindack.versionminor;
|
|
|
|
|
TAILQ_INSERT_HEAD(&dcerpc->dcerpcbindbindack.uuid_list, dcerpc->dcerpcbindbindack.uuid_entry,
|
|
|
|
|
next);
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *)
|
|
|
|
|
SCCalloc(1, sizeof(DCERPCUuidEntry));
|
|
|
|
|
if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) {
|
|
|
|
|
SCLogDebug("UUID Entry is NULL");
|
|
|
|
|
SCReturnUInt(0);
|
|
|
|
|
} else {
|
|
|
|
|
memcpy(dcerpc->dcerpcbindbindack.uuid_entry->uuid,
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid,
|
|
|
|
|
sizeof(dcerpc->dcerpcbindbindack.uuid));
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry->ctxid = dcerpc->dcerpcbindbindack.ctxid;
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry->version = dcerpc->dcerpcbindbindack.version;
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry->versionminor = dcerpc->dcerpcbindbindack.versionminor;
|
|
|
|
|
TAILQ_INSERT_HEAD(&dcerpc->dcerpcbindbindack.uuid_list,
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry,
|
|
|
|
|
next);
|
|
|
|
|
#ifdef UNITTESTS
|
|
|
|
|
if (RunmodeIsUnittests()) {
|
|
|
|
|
printUUID("BIND", dcerpc->dcerpcbindbindack.uuid_entry);
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
dcerpc->dcerpcbindbindack.numctxitemsleft--;
|
|
|
|
|
dcerpc->bytesprocessed += (44);
|
|
|
|
|
dcerpc->dcerpcbindbindack.ctxbytesprocessed += (44);
|
|
|
|
|
SCReturnUInt(44U);
|
|
|
|
|
if (RunmodeIsUnittests()) {
|
|
|
|
|
printUUID("BIND", dcerpc->dcerpcbindbindack.uuid_entry);
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
dcerpc->dcerpcbindbindack.numctxitemsleft--;
|
|
|
|
|
dcerpc->bytesprocessed += (44);
|
|
|
|
|
dcerpc->dcerpcbindbindack.ctxbytesprocessed += (44);
|
|
|
|
|
SCReturnUInt(44U);
|
|
|
|
|
}
|
|
|
|
|
//} else {
|
|
|
|
|
// SCLogDebug("ctxitem %u, expected %u\n", dcerpc->dcerpcbindbindack.ctxid,
|
|
|
|
|
// dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft);
|
|
|
|
@ -445,29 +447,31 @@ static uint32_t DCERPCParseBINDCTXItem(DCERPC *dcerpc, uint8_t *input, uint32_t
|
|
|
|
|
p++;
|
|
|
|
|
--input_len;
|
|
|
|
|
//if (dcerpc->dcerpcbindbindack.ctxid == dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft) {
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *) SCCalloc(1,
|
|
|
|
|
sizeof(DCERPCUuidEntry));
|
|
|
|
|
if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) {
|
|
|
|
|
SCLogDebug("UUID Entry is NULL\n");
|
|
|
|
|
SCReturnUInt(0);
|
|
|
|
|
} else {
|
|
|
|
|
memcpy(dcerpc->dcerpcbindbindack.uuid_entry->uuid, dcerpc->dcerpcbindbindack.uuid,
|
|
|
|
|
sizeof(dcerpc->dcerpcbindbindack.uuid));
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry->ctxid = dcerpc->dcerpcbindbindack.ctxid;
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry->version = dcerpc->dcerpcbindbindack.version;
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry->versionminor = dcerpc->dcerpcbindbindack.versionminor;
|
|
|
|
|
TAILQ_INSERT_HEAD(&dcerpc->dcerpcbindbindack.uuid_list, dcerpc->dcerpcbindbindack.uuid_entry,
|
|
|
|
|
next);
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *)
|
|
|
|
|
SCCalloc(1, sizeof(DCERPCUuidEntry));
|
|
|
|
|
if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) {
|
|
|
|
|
SCLogDebug("UUID Entry is NULL\n");
|
|
|
|
|
SCReturnUInt(0);
|
|
|
|
|
} else {
|
|
|
|
|
memcpy(dcerpc->dcerpcbindbindack.uuid_entry->uuid,
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid,
|
|
|
|
|
sizeof(dcerpc->dcerpcbindbindack.uuid));
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry->ctxid = dcerpc->dcerpcbindbindack.ctxid;
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry->version = dcerpc->dcerpcbindbindack.version;
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry->versionminor = dcerpc->dcerpcbindbindack.versionminor;
|
|
|
|
|
TAILQ_INSERT_HEAD(&dcerpc->dcerpcbindbindack.uuid_list,
|
|
|
|
|
dcerpc->dcerpcbindbindack.uuid_entry,
|
|
|
|
|
next);
|
|
|
|
|
#ifdef UNITTESTS
|
|
|
|
|
if (RunmodeIsUnittests()) {
|
|
|
|
|
printUUID("BINDACK", dcerpc->dcerpcbindbindack.uuid_entry);
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
dcerpc->dcerpcbindbindack.numctxitemsleft--;
|
|
|
|
|
dcerpc->bytesprocessed += (p - input);
|
|
|
|
|
dcerpc->dcerpcbindbindack.ctxbytesprocessed += (p - input);
|
|
|
|
|
SCReturnUInt((uint32_t)(p - input));
|
|
|
|
|
if (RunmodeIsUnittests()) {
|
|
|
|
|
printUUID("BINDACK", dcerpc->dcerpcbindbindack.uuid_entry);
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
dcerpc->dcerpcbindbindack.numctxitemsleft--;
|
|
|
|
|
dcerpc->bytesprocessed += (p - input);
|
|
|
|
|
dcerpc->dcerpcbindbindack.ctxbytesprocessed += (p - input);
|
|
|
|
|
SCReturnUInt((uint32_t)(p - input));
|
|
|
|
|
}
|
|
|
|
|
//} else {
|
|
|
|
|
// SCLogDebug("ctxitem %u, expected %u\n", dcerpc->dcerpcbindbindack.ctxid,
|
|
|
|
|
// dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft);
|
|
|
|
|