aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rust/smb: convert parser to nom7 functions (DCERPC records)

Browse Source
pull/6705/head
Pierre Chifflier 4 years ago committed by Victor Julien
parent 8d77ce1ffc
commit 895a54cea4
1 changed files with 135 additions and 130 deletions
Show Stats Download Patch File Download Diff File

265
rust/src/smb/dcerpc_records.rs
Unescape Escape View File

@ -16,11 +16,15 @@
*/ */
use crate::smb::error::SmbError; use crate::smb::error::SmbError;
use nom; use nom7::bits::{bits, streaming::take as take_bits};
use nom::IResult; use nom7::bytes::streaming::take;
use nom::combinator::rest; use nom7::combinator::{cond, rest};
use nom::number::Endianness; use nom7::error::Error;
use nom::number::streaming::{be_u16, le_u8, le_u16, le_u32}; use nom7::multi::count;
use nom7::number::Endianness;
use nom7::number::streaming::{be_u16, le_u8, le_u16, le_u32, u16, u32};
use nom7::sequence::tuple;
use nom7::IResult;
#[derive(Debug,PartialEq)] #[derive(Debug,PartialEq)]
pub struct DceRpcResponseRecord<'a> { pub struct DceRpcResponseRecord<'a> {
@ -30,7 +34,7 @@ pub struct DceRpcResponseRecord<'a> {
/// parse a packet type 'response' DCERPC record. Implemented /// parse a packet type 'response' DCERPC record. Implemented
/// as function to be able to pass the fraglen in. /// as function to be able to pass the fraglen in.
pub fn parse_dcerpc_response_record(i:&[u8], frag_len: u16 ) pub fn parse_dcerpc_response_record(i:&[u8], frag_len: u16 )
-> IResult<&[u8], DceRpcResponseRecord, SmbError> -> nom::IResult<&[u8], DceRpcResponseRecord, SmbError>
{ {
if frag_len < 24 { if frag_len < 24 {
return Err(nom::Err::Error(SmbError::RecordTooSmall)); return Err(nom::Err::Error(SmbError::RecordTooSmall));
@ -53,8 +57,9 @@ pub struct DceRpcRequestRecord<'a> {
/// parse a packet type 'request' DCERPC record. Implemented /// parse a packet type 'request' DCERPC record. Implemented
/// as function to be able to pass the fraglen in. /// as function to be able to pass the fraglen in.
pub fn parse_dcerpc_request_record(i:&[u8], frag_len: u16, little: bool) pub fn parse_dcerpc_request_record(i:&[u8], frag_len: u16, little: bool)
-> IResult<&[u8], DceRpcRequestRecord, SmbError> -> nom::IResult<&[u8], DceRpcRequestRecord, SmbError>
{ {
use nom::number::Endianness;
if frag_len < 24 { if frag_len < 24 {
return Err(nom::Err::Error(SmbError::RecordTooSmall)); return Err(nom::Err::Error(SmbError::RecordTooSmall));
} }
@ -77,37 +82,37 @@ pub struct DceRpcBindIface<'a> {
pub ver_min: u16, pub ver_min: u16,
} }
named!(pub parse_dcerpc_bind_iface<DceRpcBindIface>, pub fn parse_dcerpc_bind_iface(i: &[u8]) -> IResult<&[u8], DceRpcBindIface> {
do_parse!( let (i, _ctx_id) = le_u16(i)?;
_ctx_id: le_u16 let (i, _num_trans_items) = le_u8(i)?;
>> _num_trans_items: le_u8 let (i, _) = take(1_usize)(i)?; // reserved
>> take!(1) // reserved let (i, interface) = take(16_usize)(i)?;
>> interface: take!(16) let (i, ver) = le_u16(i)?;
>> ver: le_u16 let (i, ver_min) = le_u16(i)?;
>> ver_min: le_u16 let (i, _) = take(20_usize)(i)?;
>> take!(20) let res = DceRpcBindIface {
>> (DceRpcBindIface { iface:interface,
iface:interface, ver,
ver:ver, ver_min,
ver_min:ver_min, };
}) Ok((i, res))
)); }
named!(pub parse_dcerpc_bind_iface_big<DceRpcBindIface>, pub fn parse_dcerpc_bind_iface_big(i: &[u8]) -> IResult<&[u8], DceRpcBindIface> {
do_parse!( let (i, _ctx_id) = le_u16(i)?;
_ctx_id: le_u16 let (i, _num_trans_items) = le_u8(i)?;
>> _num_trans_items: le_u8 let (i, _) = take(1_usize)(i)?; // reserved
>> take!(1) // reserved let (i, interface) = take(16_usize)(i)?;
>> interface: take!(16) let (i, ver_min) = be_u16(i)?;
>> ver_min: be_u16 let (i, ver) = be_u16(i)?;
>> ver: be_u16 let (i, _) = take(20_usize)(i)?;
>> take!(20) let res = DceRpcBindIface {
>> (DceRpcBindIface { iface:interface,
iface:interface, ver,
ver:ver, ver_min,
ver_min:ver_min, };
}) Ok((i, res))
)); }
#[derive(Debug,PartialEq)] #[derive(Debug,PartialEq)]
pub struct DceRpcBindRecord<'a> { pub struct DceRpcBindRecord<'a> {
@ -115,33 +120,33 @@ pub struct DceRpcBindRecord<'a> {
pub ifaces: Vec<DceRpcBindIface<'a>>, pub ifaces: Vec<DceRpcBindIface<'a>>,
} }
named!(pub parse_dcerpc_bind_record<DceRpcBindRecord>, pub fn parse_dcerpc_bind_record(i: &[u8]) -> IResult<&[u8], DceRpcBindRecord> {
do_parse!( let (i, _max_xmit_frag) = le_u16(i)?;
_max_xmit_frag: le_u16 let (i, _max_recv_frag) = le_u16(i)?;
>> _max_recv_frag: le_u16 let (i, _assoc_group) = take(4_usize)(i)?;
>> _assoc_group: take!(4) let (i, num_ctx_items) = le_u8(i)?;
>> num_ctx_items: le_u8 let (i, _) = take(3_usize)(i)?; // reserved
>> take!(3) // reserved let (i, ifaces) = count(parse_dcerpc_bind_iface, num_ctx_items as usize)(i)?;
>> ifaces: count!(parse_dcerpc_bind_iface, num_ctx_items as usize) let record = DceRpcBindRecord {
>> (DceRpcBindRecord { num_ctx_items,
num_ctx_items:num_ctx_items, ifaces,
ifaces:ifaces, };
}) Ok((i, record))
)); }
named!(pub parse_dcerpc_bind_record_big<DceRpcBindRecord>, pub fn parse_dcerpc_bind_record_big(i: &[u8]) -> IResult<&[u8], DceRpcBindRecord> {
do_parse!( let (i, _max_xmit_frag) = be_u16(i)?;
_max_xmit_frag: be_u16 let (i, _max_recv_frag) = be_u16(i)?;
>> _max_recv_frag: be_u16 let (i, _assoc_group) = take(4_usize)(i)?;
>> _assoc_group: take!(4) let (i, num_ctx_items) = le_u8(i)?;
>> num_ctx_items: le_u8 let (i, _) = take(3_usize)(i)?; // reserved
>> take!(3) // reserved let (i, ifaces) = count(parse_dcerpc_bind_iface_big, num_ctx_items as usize)(i)?;
>> ifaces: count!(parse_dcerpc_bind_iface_big, num_ctx_items as usize) let record = DceRpcBindRecord {
>> (DceRpcBindRecord { num_ctx_items,
num_ctx_items:num_ctx_items, ifaces,
ifaces:ifaces, };
}) Ok((i, record))
)); }
#[derive(Debug,PartialEq)] #[derive(Debug,PartialEq)]
pub struct DceRpcBindAckResult<'a> { pub struct DceRpcBindAckResult<'a> {
@ -151,19 +156,19 @@ pub struct DceRpcBindAckResult<'a> {
pub syntax_version: u32, pub syntax_version: u32,
} }
named!(pub parse_dcerpc_bindack_result<DceRpcBindAckResult>, pub fn parse_dcerpc_bindack_result(i: &[u8]) -> IResult<&[u8], DceRpcBindAckResult> {
do_parse!( let (i, ack_result) = le_u16(i)?;
ack_result: le_u16 let (i, ack_reason) = le_u16(i)?;
>> ack_reason: le_u16 let (i, transfer_syntax) = take(16_usize)(i)?;
>> transfer_syntax: take!(16) let (i, syntax_version) = le_u32(i)?;
>> syntax_version: le_u32 let res = DceRpcBindAckResult {
>> (DceRpcBindAckResult { ack_result,
ack_result:ack_result, ack_reason,
ack_reason:ack_reason, transfer_syntax,
transfer_syntax:transfer_syntax, syntax_version,
syntax_version:syntax_version, };
}) Ok((i, res))
)); }
#[derive(Debug,PartialEq)] #[derive(Debug,PartialEq)]
pub struct DceRpcBindAckRecord<'a> { pub struct DceRpcBindAckRecord<'a> {
@ -171,22 +176,22 @@ pub struct DceRpcBindAckRecord<'a> {
pub results: Vec<DceRpcBindAckResult<'a>>, pub results: Vec<DceRpcBindAckResult<'a>>,
} }
named!(pub parse_dcerpc_bindack_record<DceRpcBindAckRecord>, pub fn parse_dcerpc_bindack_record(i: &[u8]) -> IResult<&[u8], DceRpcBindAckRecord> {
do_parse!( let (i, _max_xmit_frag) = le_u16(i)?;
_max_xmit_frag: le_u16 let (i, _max_recv_frag) = le_u16(i)?;
>> _max_recv_frag: le_u16 let (i, _assoc_group) = take(4_usize)(i)?;
>> _assoc_group: take!(4) let (i, sec_addr_len) = le_u16(i)?;
>> sec_addr_len: le_u16 let (i, _) = take(sec_addr_len)(i)?;
>> take!(sec_addr_len) let (i, _) = cond((sec_addr_len+2) % 4 != 0, take(4 - (sec_addr_len+2) % 4))(i)?;
>> cond!((sec_addr_len+2) % 4 != 0, take!(4 - (sec_addr_len+2) % 4)) let (i, num_results) = le_u8(i)?;
>> num_results: le_u8 let (i, _) = take(3_usize)(i)?; // padding
>> take!(3) // padding let (i, results) = count(parse_dcerpc_bindack_result, num_results as usize)(i)?;
>> results: count!(parse_dcerpc_bindack_result, num_results as usize) let record = DceRpcBindAckRecord {
>> (DceRpcBindAckRecord { num_results,
num_results:num_results, results,
results:results, };
}) Ok((i, record))
)); }
#[derive(Debug,PartialEq)] #[derive(Debug,PartialEq)]
pub struct DceRpcRecord<'a> { pub struct DceRpcRecord<'a> {
@ -207,42 +212,42 @@ pub struct DceRpcRecord<'a> {
} }
fn parse_dcerpc_flags1(i:&[u8]) -> IResult<&[u8],(u8,u8,u8)> { fn parse_dcerpc_flags1(i:&[u8]) -> IResult<&[u8],(u8,u8,u8)> {
bits!(i, bits::<_, _, Error<(&[u8], usize)>, _, _>(tuple((
tuple!( take_bits(6u8),
take_bits!(6u8), take_bits(1u8), // last (1)
take_bits!(1u8), // last (1) take_bits(1u8),
take_bits!(1u8))) // first (2) )))(i)
} }
fn parse_dcerpc_flags2(i:&[u8]) -> IResult<&[u8],(u32,u32,u32)> { fn parse_dcerpc_flags2(i:&[u8]) -> IResult<&[u8],(u32,u32,u32)> {
bits!(i, bits::<_, _, Error<(&[u8], usize)>, _, _>(tuple((
tuple!( take_bits(3u32),
take_bits!(3u32), take_bits(1u32), // endianess
take_bits!(1u32), // endianess take_bits(28u32),
take_bits!(28u32))) )))(i)
} }
named!(pub parse_dcerpc_record<DceRpcRecord>, pub fn parse_dcerpc_record(i: &[u8]) -> IResult<&[u8], DceRpcRecord> {
do_parse!( let (i, version_major) = le_u8(i)?;
version_major: le_u8 let (i, version_minor) = le_u8(i)?;
>> version_minor: le_u8 let (i, packet_type) = le_u8(i)?;
>> packet_type: le_u8 let (i, packet_flags) = parse_dcerpc_flags1(i)?;
>> packet_flags: parse_dcerpc_flags1 let (i, data_rep) = parse_dcerpc_flags2(i)?;
>> data_rep: parse_dcerpc_flags2 let endian = if data_rep.1 == 0 { Endianness::Big } else { Endianness::Little };
>> endian: value!(if data_rep.1 == 0 { Endianness::Big } else { Endianness::Little }) let (i, frag_len) = u16(endian)(i)?;
>> frag_len: u16!(endian) let (i, _auth) = u16(endian)(i)?;
>> _auth: u16!(endian) let (i, call_id) = u32(endian)(i)?;
>> call_id: u32!(endian) let (i, data) = rest(i)?;
>> data:rest let record = DceRpcRecord {
>> (DceRpcRecord { version_major,
version_major:version_major, version_minor,
version_minor:version_minor, packet_type,
packet_type:packet_type, first_frag: packet_flags.2 == 1,
first_frag:packet_flags.2==1, last_frag: packet_flags.1 == 1,
last_frag:packet_flags.1==1, frag_len,
frag_len: frag_len, little_endian: data_rep.1 == 1,
little_endian:data_rep.1==1, call_id,
call_id:call_id, data,
data:data, };
}) Ok((i, record))
)); }

Write Preview
Loading…
Cancel
Save