aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Return 0 instead of -1 when SMB and DCERPC encounter non fatal errors to clean up errors emitted in AppLayerParse.

Browse Source
remotes/origin/master-1.0.x
root 16 years ago committed by Victor Julien
parent 7d63fbdaea
commit 73c6fb16ba
3 changed files with 110 additions and 56 deletions
Show Stats Download Patch File Download Diff File

2
src/app-layer-dcerpc-common.h
Unescape Escape View File

@ -176,7 +176,7 @@ typedef struct DCERPC_ {
#define NO_PSAP_AVAILABLE 7 /* not used */ #define NO_PSAP_AVAILABLE 7 /* not used */
int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len); int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len);
void hexdump(const void *buf, size_t len); void hexdump(Flow *f, const void *buf, size_t len);
void printUUID(char *type, DCERPCUuidEntry *uuid); void printUUID(char *type, DCERPCUuidEntry *uuid);
#endif /* __APP_LAYER_DCERPC_COMMON_H__ */ #endif /* __APP_LAYER_DCERPC_COMMON_H__ */

77
src/app-layer-dcerpc.c
Unescape Escape View File

@ -58,13 +58,30 @@ enum {
}; };
/* \brief hexdump function from libdnet, used for debugging only */ /* \brief hexdump function from libdnet, used for debugging only */
void hexdump(const void *buf, size_t len) { void hexdump(Flow *f, const void *buf, size_t len) {
/* dumps len bytes of *buf to stdout. Looks like: /* dumps len bytes of *buf to stdout. Looks like:
* [0000] 75 6E 6B 6E 6F 77 6E 20 * [0000] 75 6E 6B 6E 6F 77 6E 20
* 30 FF 00 00 00 00 39 00 unknown 0.....9. * 30 FF 00 00 00 00 39 00 unknown 0.....9.
* (in a single line of course) * (in a single line of course)
*/ */
if (f->src.family == AF_INET) {
char src[16];
char dst[16];
inet_ntop(AF_INET, (const void*)&f->src.addr_data32[0], src,
sizeof (src));
inet_ntop(AF_INET, (const void*)&f->dst.addr_data32[0], dst,
sizeof (dst));
printf("%s:%d -> %s:%d\n", src, f->sp, dst, f->dp);
} else {
char dst6[46];
char src6[46];
inet_ntop(AF_INET6, (const void*)&f->src.addr_data32, src6,
sizeof (src6));
inet_ntop(AF_INET6, (const void*)&f->dst.addr_data32, dst6,
sizeof (dst6));
printf("%s:%d -> %s:%d\n", src6, f->sp, dst6, f->dp);
}
const unsigned char *p = buf; const unsigned char *p = buf;
unsigned char c; unsigned char c;
size_t n; size_t n;
@ -237,6 +254,7 @@ static uint32_t DCERPCParseBINDCTXItem(DCERPC *dcerpc, uint8_t *input, uint32_t
dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *) SCCalloc(1, dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *) SCCalloc(1,
sizeof(DCERPCUuidEntry)); sizeof(DCERPCUuidEntry));
if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) { if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) {
SCLogDebug("UUID Entry is NULL\n");
SCReturnUInt(0); SCReturnUInt(0);
} else { } else {
memcpy(dcerpc->dcerpcbindbindack.uuid_entry->uuid, dcerpc->dcerpcbindbindack.uuid, memcpy(dcerpc->dcerpcbindbindack.uuid_entry->uuid, dcerpc->dcerpcbindbindack.uuid,
@ -443,6 +461,7 @@ static uint32_t DCERPCParseBINDCTXItem(DCERPC *dcerpc, uint8_t *input, uint32_t
dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *) SCCalloc(1, dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *) SCCalloc(1,
sizeof(DCERPCUuidEntry)); sizeof(DCERPCUuidEntry));
if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) { if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) {
SCLogDebug("UUID Entry is NULL\n");
SCReturnUInt(0); SCReturnUInt(0);
} else { } else {
memcpy(dcerpc->dcerpcbindbindack.uuid_entry->uuid, dcerpc->dcerpcbindbindack.uuid, memcpy(dcerpc->dcerpcbindbindack.uuid_entry->uuid, dcerpc->dcerpcbindbindack.uuid,
@ -702,6 +721,10 @@ static uint32_t DCERPCParseBIND(DCERPC *dcerpc, uint8_t *input, uint32_t input_l
p++; p++;
--input_len; --input_len;
break; break;
default:
dcerpc->bytesprocessed++;
SCReturnUInt(1);
break;
} }
} }
dcerpc->bytesprocessed += (p - input); dcerpc->bytesprocessed += (p - input);
@ -781,6 +804,10 @@ static uint32_t DCERPCParseBINDACK(DCERPC *dcerpc, uint8_t *input, uint32_t inpu
dcerpc->dcerpcbindbindack.secondaryaddrlen); dcerpc->dcerpcbindbindack.secondaryaddrlen);
--input_len; --input_len;
break; break;
default:
dcerpc->bytesprocessed++;
SCReturnUInt(1);
break;
} }
dcerpc->bytesprocessed += (p - input); dcerpc->bytesprocessed += (p - input);
SCReturnUInt((uint32_t)(p - input)); SCReturnUInt((uint32_t)(p - input));
@ -855,6 +882,10 @@ static uint32_t DCERPCParseREQUEST(DCERPC *dcerpc, uint8_t *input, uint32_t inpu
} }
--input_len; --input_len;
break; break;
default:
dcerpc->bytesprocessed++;
SCReturnUInt(1);
break;
} }
dcerpc->bytesprocessed += (p - input); dcerpc->bytesprocessed += (p - input);
SCReturnUInt((uint32_t)(p - input)); SCReturnUInt((uint32_t)(p - input));
@ -892,8 +923,8 @@ static int DCERPCParseHeader(DCERPC *dcerpc, uint8_t *input, uint32_t input_len)
if ((dcerpc->dcerpchdr.rpc_vers != 5) || if ((dcerpc->dcerpchdr.rpc_vers != 5) ||
((dcerpc->dcerpchdr.rpc_vers_minor != 0) && ((dcerpc->dcerpchdr.rpc_vers_minor != 0) &&
(dcerpc->dcerpchdr.rpc_vers_minor != 1))) { (dcerpc->dcerpchdr.rpc_vers_minor != 1))) {
SCLogDebug("DCERPC Header did not validate"); SCLogDebug("DCERPC Header did not validate");
SCReturnInt(-1); SCReturnInt(-1);
} }
dcerpc->dcerpchdr.type = *(p + 2); dcerpc->dcerpchdr.type = *(p + 2);
dcerpc->dcerpchdr.pfc_flags = *(p + 3); dcerpc->dcerpchdr.pfc_flags = *(p + 3);
@ -933,8 +964,8 @@ static int DCERPCParseHeader(DCERPC *dcerpc, uint8_t *input, uint32_t input_len)
if ((dcerpc->dcerpchdr.rpc_vers != 5) || if ((dcerpc->dcerpchdr.rpc_vers != 5) ||
((dcerpc->dcerpchdr.rpc_vers_minor != 0) && ((dcerpc->dcerpchdr.rpc_vers_minor != 0) &&
(dcerpc->dcerpchdr.rpc_vers_minor != 1))) { (dcerpc->dcerpchdr.rpc_vers_minor != 1))) {
SCLogDebug("DCERPC Header did not validate"); SCLogDebug("DCERPC Header did not validate");
SCReturnInt(-1); SCReturnInt(-1);
} }
if (!(--input_len)) if (!(--input_len))
break; break;
@ -999,6 +1030,9 @@ static int DCERPCParseHeader(DCERPC *dcerpc, uint8_t *input, uint32_t input_len)
} }
--input_len; --input_len;
break; break;
default:
dcerpc->bytesprocessed++;
SCReturnInt(1);
} }
} }
dcerpc->bytesprocessed += (p - input); dcerpc->bytesprocessed += (p - input);
@ -1015,7 +1049,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
hdrretval = DCERPCParseHeader(dcerpc, input, input_len); hdrretval = DCERPCParseHeader(dcerpc, input, input_len);
if (hdrretval == -1) { if (hdrretval == -1) {
dcerpc->bytesprocessed = 0; dcerpc->bytesprocessed = 0;
SCReturnInt(hdrretval); SCReturnInt(0);
} else { } else {
parsed += hdrretval; parsed += hdrretval;
input_len -= hdrretval; input_len -= hdrretval;
@ -1050,8 +1084,8 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
} else if (input_len) { } else if (input_len) {
SCLogDebug("Error Parsing DCERPC BIND"); SCLogDebug("Error Parsing DCERPC %s\n", (dcerpc->dcerpchdr.type == BIND) ? "BIND" : "ALTER_CONTEXT");
parsed -= input_len; parsed = 0;
input_len = 0; input_len = 0;
} }
} }
@ -1073,8 +1107,9 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcbindbindack.numctxitemsleft, dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcbindbindack.numctxitemsleft,
dcerpc->dcerpcbindbindack.numctxitems); dcerpc->dcerpcbindbindack.numctxitems);
} else if (input_len) { } else if (input_len) {
SCLogDebug("Error Parsing CTX Item"); //parsed -= input_len;
parsed -= input_len; parsed = 0;
SCLogDebug("Error Parsing CTX Item %u\n", parsed);
input_len = 0; input_len = 0;
dcerpc->dcerpcbindbindack.numctxitemsleft = 0; dcerpc->dcerpcbindbindack.numctxitemsleft = 0;
} }
@ -1096,8 +1131,8 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
SCLogDebug("DCERPCParseBINDACK processed %u/%u left %u\n", SCLogDebug("DCERPCParseBINDACK processed %u/%u left %u\n",
dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len); dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len);
} else if (input_len) { } else if (input_len) {
SCLogDebug("Error parsing BIND_ACK"); SCLogDebug("Error parsing %s\n", (dcerpc->dcerpchdr.type == BIND_ACK) ? "BIND_ACK" : "ALTER_CONTEXT_RESP");
parsed -= input_len; parsed = 0;
input_len = 0; input_len = 0;
} }
} }
@ -1115,7 +1150,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
dcerpc->dcerpcbindbindack.secondaryaddrlen); dcerpc->dcerpcbindbindack.secondaryaddrlen);
} else if (input_len) { } else if (input_len) {
SCLogDebug("Error parsing Secondary Address"); SCLogDebug("Error parsing Secondary Address");
parsed -= input_len; parsed = 0;
input_len = 0; input_len = 0;
} }
} }
@ -1140,7 +1175,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
dcerpc->pad); dcerpc->pad);
} else if (input_len) { } else if (input_len) {
SCLogDebug("Error parsing DCERPC Padding"); SCLogDebug("Error parsing DCERPC Padding");
parsed -= input_len; parsed = 0;
input_len = 0; input_len = 0;
} }
} }
@ -1157,7 +1192,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcbindbindack.numctxitems); dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcbindbindack.numctxitems);
} else if (input_len) { } else if (input_len) {
SCLogDebug("Error parsing CTX Items"); SCLogDebug("Error parsing CTX Items");
parsed -= input_len; parsed = 0;
input_len = 0; input_len = 0;
} }
} }
@ -1178,7 +1213,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
input_len -= retval; input_len -= retval;
} else if (input_len) { } else if (input_len) {
SCLogDebug("Error parsing CTX Items"); SCLogDebug("Error parsing CTX Items");
parsed -= input_len; parsed = 0;
input_len = 0; input_len = 0;
dcerpc->dcerpcbindbindack.numctxitemsleft = 0; dcerpc->dcerpcbindbindack.numctxitemsleft = 0;
@ -1202,8 +1237,8 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
input_len -= retval; input_len -= retval;
dcerpc->padleft = dcerpc->dcerpchdr.frag_length - dcerpc->bytesprocessed; dcerpc->padleft = dcerpc->dcerpchdr.frag_length - dcerpc->bytesprocessed;
} else if (input_len) { } else if (input_len) {
SCLogDebug("Error parsing DCERPC Request"); SCLogDebug("Error parsing DCERPC %s\n", (dcerpc->dcerpchdr.type == REQUEST) ? "REQUEST" : "RESPONSE");
parsed -= input_len; parsed = 0;
dcerpc->padleft = 0; dcerpc->padleft = 0;
input_len = 0; input_len = 0;
} }
@ -1217,7 +1252,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
input_len -= retval; input_len -= retval;
} else if (input_len) { } else if (input_len) {
SCLogDebug("Error parsing DCERPC Stub Data"); SCLogDebug("Error parsing DCERPC Stub Data");
parsed -= input_len; parsed = 0;
input_len = 0; input_len = 0;
dcerpc->bytesprocessed = 0; dcerpc->bytesprocessed = 0;
} }
@ -1246,7 +1281,7 @@ static int DCERPCParse(Flow *f, void *dcerpc_state,
retval = DCERPCParser(&sstate->dcerpc, input, input_len); retval = DCERPCParser(&sstate->dcerpc, input, input_len);
if (retval == -1) { if (retval == -1) {
SCReturnInt(-1); SCReturnInt(0);
} }
if (pstate == NULL) if (pstate == NULL)
SCReturnInt(-1); SCReturnInt(-1);

87
src/app-layer-smb.c
Unescape Escape View File

@ -217,6 +217,10 @@ static uint32_t SMBParseWriteAndX(Flow *f, void *smb_state,
sstate->andx.dataoffset |= (uint64_t) *(p++) << 32; sstate->andx.dataoffset |= (uint64_t) *(p++) << 32;
--input_len; --input_len;
break; break;
default:
sstate->bytesprocessed++;
SCReturnUInt(1);
break;
} }
sstate->bytesprocessed += (p - input); sstate->bytesprocessed += (p - input);
SCReturnUInt((uint32_t)(p - input)); SCReturnUInt((uint32_t)(p - input));
@ -334,6 +338,11 @@ static uint32_t SMBParseReadAndX(Flow *f, void *smb_state,
p++; p++;
--input_len; --input_len;
break; break;
default:
sstate->bytesprocessed++;
SCReturnUInt(1);
break;
} }
sstate->bytesprocessed += (p - input); sstate->bytesprocessed += (p - input);
SCReturnUInt((uint32_t)(p - input)); SCReturnUInt((uint32_t)(p - input));
@ -511,6 +520,13 @@ static uint32_t SMBParseTransact(Flow *f, void *smb_state,
p++; p++;
--input_len; --input_len;
break; break;
default:
SCLogDebug("SMB_COM_TRANSACTION AndX bytes processed is greater than 31 %u\n", sstate->andx.andxbytesprocessed);
sstate->bytesprocessed++;
sstate->andx.andxbytesprocessed++;
SCReturnUInt(1);
break;
} }
sstate->bytesprocessed += (p - input); sstate->bytesprocessed += (p - input);
sstate->andx.andxbytesprocessed += (p - input); sstate->andx.andxbytesprocessed += (p - input);
@ -628,32 +644,25 @@ static uint32_t SMBParseWordCount(Flow *f, void *smb_state,
SMBState *sstate = (SMBState *) smb_state; SMBState *sstate = (SMBState *) smb_state;
uint8_t *p = input; uint8_t *p = input;
uint32_t retval = 0; uint32_t retval = 0;
uint32_t parsed = 0;
if ((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) && sstate->smb.command if ((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) && sstate->smb.command
== SMB_COM_READ_ANDX) { == SMB_COM_READ_ANDX) {
retval = SMBParseReadAndX(f, sstate, pstate, input + parsed, input_len, retval = SMBParseReadAndX(f, sstate, pstate, input, input_len,
output); output);
parsed += retval;
input_len -= retval;
sstate->wordcount.wordcountleft -= retval; sstate->wordcount.wordcountleft -= retval;
SCLogDebug("SMB_COM_READ_ANDX %u bytes at offset %"PRIu64"\n", sstate->andx.datalength, sstate->andx.dataoffset); SCLogDebug("SMB_COM_READ_ANDX returned %d - %u bytes at offset %"PRIu64"\n", retval, sstate->andx.datalength, sstate->andx.dataoffset);
SCReturnUInt(retval); SCReturnUInt(retval);
} else if (((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) == 0) } else if (((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) == 0)
&& sstate->smb.command == SMB_COM_WRITE_ANDX) { && sstate->smb.command == SMB_COM_WRITE_ANDX) {
retval = SMBParseWriteAndX(f, sstate, pstate, input + parsed, retval = SMBParseWriteAndX(f, sstate, pstate, input,
input_len, output); input_len, output);
parsed += retval;
input_len -= retval;
sstate->wordcount.wordcountleft -= retval; sstate->wordcount.wordcountleft -= retval;
SCLogDebug("SMB_COM_WRITE_ANDX %u bytes at offset %"PRIu64"\n", sstate->andx.datalength, sstate->andx.dataoffset); SCLogDebug("SMB_COM_WRITE_ANDX returned %d - %u bytes at offset %"PRIu64"\n", retval, sstate->andx.datalength, sstate->andx.dataoffset);
SCReturnUInt(retval); SCReturnUInt(retval);
} else if (sstate->smb.command == SMB_COM_TRANSACTION) { } else if (sstate->smb.command == SMB_COM_TRANSACTION) {
retval = SMBParseTransact(f, sstate, pstate, input + parsed, input_len, retval = SMBParseTransact(f, sstate, pstate, input, input_len,
output); output);
parsed += retval;
input_len -= retval;
sstate->wordcount.wordcountleft -= retval; sstate->wordcount.wordcountleft -= retval;
SCLogDebug("SMB_COM_TRANSACTION %u bytes at offset %"PRIu64"\n", sstate->andx.datalength, sstate->andx.dataoffset); SCLogDebug("SMB_COM_TRANSACTION returned %d - %u bytes at offset %"PRIu64"\n", retval, sstate->andx.datalength, sstate->andx.dataoffset);
SCReturnUInt(retval); SCReturnUInt(retval);
} else { /* Generic WordCount Handler */ } else { /* Generic WordCount Handler */
while (sstate->wordcount.wordcountleft-- && input_len--) { while (sstate->wordcount.wordcountleft-- && input_len--) {
@ -702,10 +711,10 @@ static uint32_t SMBParseByteCount(Flow *f, void *smb_state,
input_len -= (uint32_t)sres; input_len -= (uint32_t)sres;
} else { /* Did not Validate as DCERPC over SMB */ } else { /* Did not Validate as DCERPC over SMB */
while (sstate->bytecount.bytecountleft-- && input_len--) { while (sstate->bytecount.bytecountleft-- && input_len--) {
SCLogDebug("0x%02x bytecount %"PRIu16"/%"PRIu16" input_len %"PRIu32, *p, SCLogDebug("0x%02x bytecount %"PRIu16"/%"PRIu16" input_len %"PRIu32, *p,
sstate->bytecount.bytecountleft, sstate->bytecount.bytecountleft,
sstate->bytecount.bytecount, input_len); sstate->bytecount.bytecount, input_len);
p++; p++;
} }
sstate->bytesprocessed += (p - input); sstate->bytesprocessed += (p - input);
SCReturnUInt((p - input)); SCReturnUInt((p - input));
@ -765,6 +774,7 @@ static uint32_t NBSSParseHeader(Flow *f, void *smb_state,
} }
sstate->bytesprocessed += (p - input); sstate->bytesprocessed += (p - input);
} }
if ((p - input < 0))
SCReturnUInt((uint32_t)(p - input)); SCReturnUInt((uint32_t)(p - input));
} }
@ -815,24 +825,32 @@ static int SMBParseHeader(Flow *f, void *smb_state,
SCReturnInt(32); SCReturnInt(32);
break; break;
} else { } else {
if (*(p++) != 0xff) if (*(p++) != 0xff) {
SCLogDebug("SMB Header did not validate");
SCReturnInt(-1); SCReturnInt(-1);
}
if (!(--input_len)) if (!(--input_len))
break; break;
} }
case 5: case 5:
if (*(p++) != 'S') if (*(p++) != 'S') {
SCLogDebug("SMB Header did not validate");
SCReturnInt(-1); SCReturnInt(-1);
}
if (!(--input_len)) if (!(--input_len))
break; break;
case 6: case 6:
if (*(p++) != 'M') if (*(p++) != 'M') {
SCLogDebug("SMB Header did not validate");
SCReturnInt(-1); SCReturnInt(-1);
}
if (!(--input_len)) if (!(--input_len))
break; break;
case 7: case 7:
if (*(p++) != 'B') if (*(p++) != 'B') {
SCLogDebug("SMB Header did not validate");
SCReturnInt(-1); SCReturnInt(-1);
}
if (!(--input_len)) if (!(--input_len))
break; break;
case 8: case 8:
@ -963,7 +981,8 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
int hdrretval = 0; int hdrretval = 0;
if (pstate == NULL) { if (pstate == NULL) {
SCReturnInt(-1); SCLogDebug("pstate == NULL");
SCReturnInt(0);
} }
while (input_len && sstate->bytesprocessed < NBSS_HDR_LEN) { while (input_len && sstate->bytesprocessed < NBSS_HDR_LEN) {
retval retval
@ -973,13 +992,13 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
SCLogDebug( SCLogDebug(
"[1] NBSS Header (%u/%u) Type 0x%02x Length 0x%04x parsed %"PRIu64" input_len %u", "[1] NBSS Header (%u/%u) Type 0x%02x Length 0x%04x parsed %"PRIu64" input_len %u\n",
sstate->bytesprocessed, NBSS_HDR_LEN, sstate->nbss.type, sstate->bytesprocessed, NBSS_HDR_LEN, sstate->nbss.type,
sstate->nbss.length, parsed, input_len); sstate->nbss.length, parsed, input_len);
} else if (input_len) { } else if (input_len) {
SCLogDebug("Error parsing NBSS Header\n"); SCLogDebug("Error parsing NBSS Header\n");
sstate->bytesprocessed = 0; sstate->bytesprocessed = 0;
SCReturnInt(-1); SCReturnInt(0);
} }
} }
@ -992,12 +1011,12 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
if (hdrretval == -1) { if (hdrretval == -1) {
SCLogDebug("Error parsing SMB Header\n"); SCLogDebug("Error parsing SMB Header\n");
sstate->bytesprocessed = 0; sstate->bytesprocessed = 0;
SCReturnInt(hdrretval); SCReturnInt(0);
} else { } else {
parsed += hdrretval; parsed += hdrretval;
input_len -= hdrretval; input_len -= hdrretval;
SCLogDebug( SCLogDebug(
"[2] SMB Header (%u/%u) Command 0x%02x parsed %"PRIu64" input_len %u", "[2] SMB Header (%u/%u) Command 0x%02x parsed %"PRIu64" input_len %u\n",
sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN, sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN,
sstate->smb.command, parsed, input_len); sstate->smb.command, parsed, input_len);
} }
@ -1014,12 +1033,12 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
} else if (input_len) { } else if (input_len) {
SCLogDebug("Error parsing SMB Word Count\n"); SCLogDebug("Error parsing SMB Word Count\n");
sstate->bytesprocessed = 0; sstate->bytesprocessed = 0;
SCReturnInt(-1); SCReturnInt(0);
} }
SCLogDebug("[3] WordCount (%u/%u) WordCount %u parsed %"PRIu64" input_len %u", SCLogDebug("[3] WordCount (%u/%u) WordCount %u parsed %"PRIu64" input_len %u\n",
sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1, sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1,
sstate->wordcount.wordcount, sstate->wordcount.wordcount,
parsed, input_len); parsed, input_len);
} }
while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN
@ -1031,11 +1050,11 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
} else if (input_len) { } else if (input_len) {
SCLogDebug("Error parsing SMB Word Count Data\n"); SCLogDebug("Error parsing SMB Word Count Data retval %"PRIu64" input_len %u\n", retval, input_len);
sstate->bytesprocessed = 0; sstate->bytesprocessed = 0;
SCReturnInt(-1); SCReturnInt(0);
} }
SCLogDebug("[4] Parsing WordCount (%u/%u) WordCount %u parsed %"PRIu64" input_len %u", SCLogDebug("[4] Parsing WordCount (%u/%u) WordCount %u parsed %"PRIu64" input_len %u\n",
sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount, sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount,
sstate->wordcount.wordcount, sstate->wordcount.wordcount,
parsed, input_len); parsed, input_len);
@ -1053,7 +1072,7 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
} else if (input_len) { } else if (input_len) {
SCLogDebug("Error parsing SMB Byte Count\n"); SCLogDebug("Error parsing SMB Byte Count\n");
sstate->bytesprocessed = 0; sstate->bytesprocessed = 0;
SCReturnInt(-1); SCReturnInt(0);
} }
SCLogDebug("[5] ByteCount (%u/%u) ByteCount %u parsed %"PRIu64" input_len %u", SCLogDebug("[5] ByteCount (%u/%u) ByteCount %u parsed %"PRIu64" input_len %u",
sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 3, sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 3,
@ -1074,9 +1093,9 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
} else if (input_len) { } else if (input_len) {
SCLogDebug("Error parsing SMB Byte Count Data\n"); SCLogDebug("Error parsing SMB Byte Count Data\n");
sstate->bytesprocessed = 0; sstate->bytesprocessed = 0;
SCReturnInt(-1); SCReturnInt(0);
} }
SCLogDebug("[6] Parsing ByteCount (%u/%u) ByteCount %u parsed %"PRIu64" input_len %u", SCLogDebug("[6] Parsing ByteCount (%u/%u) ByteCount %u parsed %"PRIu64" input_len %u\n",
sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount + 2 + sstate->bytecount.bytecount, sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount + 2 + sstate->bytecount.bytecount,
sstate->bytecount.bytecount, parsed, input_len); sstate->bytecount.bytecount, parsed, input_len);
} }

Write Preview
Loading…
Cancel
Save