aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

dcerpc request smb transact and fix for dcerpc bindack

Browse Source
remotes/origin/master-1.0.x
Kirby Kuehl 16 years ago committed by Victor Julien
parent 8f00718b0d
commit 90b42232fa
6 changed files with 1544 additions and 902 deletions
Show Stats Download Patch File Download Diff File

1506
src/app-layer-dcerpc.c
View File

File diff suppressed because it is too large Load Diff

84
src/app-layer-dcerpc.h
Unescape Escape View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2009 Open Information Security Foundation
* Copyright (c) 2009,2010 Open Information Security Foundation
* app-layer-dcerpc.h
*
* \author Kirby Kuehl <kkuehl@gmail.com>
@ -11,6 +11,7 @@
#include "app-layer-parser.h"
#include "flow.h"
#include "queue.h"
#include <byteswap.h>
void RegisterDCERPCParsers(void);
void DCERPCParserTests(void);
@ -77,24 +78,24 @@ typedef struct {
#define RESERVED_80 0x80
typedef struct dcerpc_hdr_ {
uint8_t rpc_vers; /* 00:01 RPC version should be 5 */
uint8_t rpc_vers_minor; /* 01:01 minor version */
uint8_t type; /* 02:01 packet type */
uint8_t pfc_flags; /* 03:01 flags (see PFC_... ) */
uint8_t packed_drep[4]; /* 04:04 NDR data representation format label */
uint16_t frag_length; /* 08:02 total length of fragment */
uint16_t auth_length; /* 10:02 length of auth_value */
uint32_t call_id; /* 12:04 call identifier */
uint8_t rpc_vers; /* 00:01 RPC version should be 5 */
uint8_t rpc_vers_minor; /* 01:01 minor version */
uint8_t type; /* 02:01 packet type */
uint8_t pfc_flags; /* 03:01 flags (see PFC_... ) */
uint8_t packed_drep[4]; /* 04:04 NDR data representation format label */
uint16_t frag_length; /* 08:02 total length of fragment */
uint16_t auth_length; /* 10:02 length of auth_value */
uint32_t call_id; /* 12:04 call identifier */
}dcerpc_t;
#define DCERPC_HDR_LEN 16
struct uuid_entry {
uint16_t ctxid;
uint16_t result;
uint8_t uuid[16];
uint16_t version;
uint16_t versionminor;
uint16_t ctxid;
uint16_t result;
uint8_t uuid[16];
uint16_t version;
uint16_t versionminor;
TAILQ_ENTRY(uuid_entry) next;
};
@ -104,17 +105,18 @@ typedef struct DCERPCState_ {
uint8_t numctxitems;
uint8_t numctxitemsleft;
uint8_t ctxbytesprocessed;
uint16_t ctxid;
uint16_t result;
uint8_t uuid[16];
uint16_t version;
uint16_t versionminor;
uint8_t pad;
uint8_t padleft;
uint16_t ctxid;
uint16_t result;
uint8_t uuid[16];
uint16_t version;
uint16_t versionminor;
uint8_t pad;
uint8_t padleft;
struct uuid_entry *uuid_entry;
TAILQ_HEAD(, uuid_entry) uuid_list;
uint16_t secondaryaddrlen;
uint16_t secondaryaddrlenleft;
uint16_t opnum;
}DCERPCState;
@ -123,16 +125,16 @@ typedef struct DCERPCState_ {
#define PFC_PENDING_CANCEL 0x04/* Cancel was pending at sender */
#define PFC_RESERVED_1 0x08
#define PFC_CONC_MPX 0x10/* supports concurrent multiplexing
* of a single connection. */
* of a single connection. */
#define PFC_DID_NOT_EXECUTE 0x20/* only meaningful on `fault' packet;
* if true, guaranteed call did not
* execute. */
* if true, guaranteed call did not
* execute. */
#define PFC_MAYBE 0x40/* `maybe' call semantics requested */
#define PFC_OBJECT_UUID 0x80/* if true, a non-nil object UUID
* was specified in the handle, and
* is present in the optional object
* field. If false, the object field
* is omitted. */
* was specified in the handle, and
* is present in the optional object
* field. If false, the object field
* is omitted. */
#define REASON_NOT_SPECIFIED 0
#define TEMPORARY_CONGESTION 1
#define LOCAL_LIMIT_EXCEEDED 2
@ -142,20 +144,20 @@ typedef struct DCERPCState_ {
#define USER_DATA_NOT_READABLE 6 /* not used */
#define NO_PSAP_AVAILABLE 7 /* not used */
/*
typedef uint16_t p_context_id_t;
typedef struct {
uuid_t if_uuid;
uint32_t if_version;
} p_syntax_id_t;
typedef uint16_t p_context_id_t;
typedef struct {
uuid_t if_uuid;
uint32_t if_version;
} p_syntax_id_t;
typedef struct {
p_context_id_t p_cont_id;
uint8_t n_transfer_syn; // number of items
uint8_t reserved; // alignment pad, m.b.z.
p_syntax_id_t abstract_syntax; // transfer syntax list
p_syntax_id_t [size_is(n_transfer_syn)] transfer_syntaxes[];
} p_cont_elem_t;
*/
typedef struct {
p_context_id_t p_cont_id;
uint8_t n_transfer_syn; // number of items
uint8_t reserved; // alignment pad, m.b.z.
p_syntax_id_t abstract_syntax; // transfer syntax list
p_syntax_id_t [size_is(n_transfer_syn)] transfer_syntaxes[];
} p_cont_elem_t;
*/
#endif /* APPLAYERDCERPC_H_ */

720
src/app-layer-smb.c
View File

File diff suppressed because it is too large Load Diff

80
src/app-layer-smb.h
Unescape Escape View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2009 Open Information Security Foundation
* Copyright (c) 2009,2010 Open Information Security Foundation
* app-layer-smb.h
*
* \author Kirby Kuehl <kkuehl@gmail.com>
@ -13,21 +13,21 @@
#include "stream.h"
#include <stdint.h>
/*
http://ubiqx.org/cifs/rfc-draft/rfc1002.html#s4.3
All session packets are of the following general structure:
http://ubiqx.org/cifs/rfc-draft/rfc1002.html#s4.3
All session packets are of the following general structure:
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TYPE | FLAGS | LENGTH |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
/ TRAILER (Packet Type Dependent) /
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TYPE | FLAGS | LENGTH |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
/ TRAILER (Packet Type Dependent) /
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The TYPE, FLAGS, and LENGTH fields are present in every session
packet.
The TYPE, FLAGS, and LENGTH fields are present in every session
packet.
*/
#define NBSS_SESSION_MESSAGE 0x00
#define NBSS_SESSION_REQUEST 0x81
@ -37,39 +37,39 @@
#define NBSS_SESSION_KEEP_ALIVE 0x85
typedef struct nbss_hdr_ {
uint8_t type;
uint8_t flags;
uint32_t length;
uint8_t type;
uint8_t flags;
uint32_t length;
}nbss_hdr_t, *pnbss_hdr_t;
#define NBSS_HDR_LEN 4
typedef struct smb_hdr_ {
uint8_t protocol[4];
uint8_t command;
uint32_t status;
uint8_t flags;
uint16_t flags2;
uint16_t pidhigh;
uint64_t securitysignature;
uint16_t unused;
uint16_t tid;
uint16_t pid;
uint16_t uid;
uint16_t mid;
uint8_t protocol[4];
uint8_t command;
uint32_t status;
uint8_t flags;
uint16_t flags2;
uint16_t pidhigh;
uint64_t securitysignature;
uint16_t unused;
uint16_t tid;
uint16_t pid;
uint16_t uid;
uint16_t mid;
}smb_hdr_t, *psmb_hdr_t;
#define SMB_HDR_LEN 32
#define MINIMUM_SMB_LEN 35
#define NBSS_SMB_HDRS_LEN 36
typedef struct wordcount_ {
uint8_t wordcount;
uint8_t *words;
uint8_t wordcount;
uint8_t *words;
}wordcount_t, *pwordcount_t;
typedef struct bytecount_ {
uint8_t bytecountbytes;
uint16_t bytecount;
uint8_t *bytes;
uint8_t bytecountbytes;
uint16_t bytecount;
uint8_t *bytes;
}bytecount_t, *pbytyecount_t;
typedef struct andxcount_ {
@ -83,12 +83,12 @@ typedef struct andxcount_ {
}andx_t, *pandx_t;
typedef struct SMBState_ {
nbss_hdr_t nbss;
smb_hdr_t smb;
wordcount_t wordcount;
bytecount_t bytecount;
andx_t andx;
uint16_t bytesprocessed;
nbss_hdr_t nbss;
smb_hdr_t smb;
wordcount_t wordcount;
bytecount_t bytecount;
andx_t andx;
uint16_t bytesprocessed;
}SMBState;
#define SMB_FLAGS_SERVER_TO_REDIR 0x80

22
src/app-layer-smb2.c
Unescape Escape View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2009 Open Information Security Foundation
* Copyright (c) 2009,2010 Open Information Security Foundation
* app-layer-smb.c
*
* \author Kirby Kuehl <kkuehl@gmail.com>
@ -37,7 +37,7 @@ enum {
static uint32_t NBSSParseHeader(void *smb2_state, AppLayerParserState *pstate,
uint8_t *input, uint32_t input_len, AppLayerParserResult *output) {
SCEnter();
SCEnter();
SMB2State *sstate = (SMB2State *) smb2_state;
uint8_t *p = input;
@ -74,7 +74,7 @@ static uint32_t NBSSParseHeader(void *smb2_state, AppLayerParserState *pstate,
static uint32_t SMB2ParseHeader(void *smb2_state, AppLayerParserState *pstate,
uint8_t *input, uint32_t input_len, AppLayerParserResult *output) {
SCEnter();
SCEnter();
SMB2State *sstate = (SMB2State *) smb2_state;
uint8_t *p = input;
if (input_len) {
@ -358,7 +358,7 @@ static uint32_t SMB2ParseHeader(void *smb2_state, AppLayerParserState *pstate,
static int SMB2Parse(Flow *f, void *smb2_state, AppLayerParserState *pstate,
uint8_t *input, uint32_t input_len, AppLayerParserResult *output) {
SCEnter();
SCEnter();
SMB2State *sstate = (SMB2State *) smb2_state;
uint32_t retval = 0;
uint32_t parsed = 0;
@ -427,13 +427,13 @@ int SMB2ParserTest01(void) {
int result = 1;
Flow f;
uint8_t smb2buf[] =
"\x00\x00\x00\x66" // NBSS
"\xfe\x53\x4d\x42\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00" // SMB2
"\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x24\x00\x01\x00x00\x00\x00\x00\x00\x00\x0\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x02";
"\x00\x00\x00\x66" // NBSS
"\xfe\x53\x4d\x42\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00" // SMB2
"\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x24\x00\x01\x00x00\x00\x00\x00\x00\x00\x0\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x02";
uint32_t smb2len = sizeof(smb2buf) - 1;
TcpSession ssn;

34
src/app-layer-smb2.h
Unescape Escape View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2009 Open Information Security Foundation
* Copyright (c) 2009,2010 Open Information Security Foundation
* app-layer-smb2.h
*
* \author Kirby Kuehl <kkuehl@gmail.com>
@ -15,27 +15,27 @@
#include <stdint.h>
typedef struct smb2_hdr {
uint32_t Protocol; // Contains 0xFE,'SMB'
uint16_t StructureSize;
uint16_t CreditCharge;
uint32_t Status;
uint16_t Command;
uint16_t CreditRequestResponse;
uint32_t Flags;
uint32_t NextCommand;
uint64_t MessageId;
uint32_t ProcessId;
uint32_t TreeId;
uint64_t SessionId;
uint8_t Signature[16];
uint32_t Protocol; // Contains 0xFE,'SMB'
uint16_t StructureSize;
uint16_t CreditCharge;
uint32_t Status;
uint16_t Command;
uint16_t CreditRequestResponse;
uint32_t Flags;
uint32_t NextCommand;
uint64_t MessageId;
uint32_t ProcessId;
uint32_t TreeId;
uint64_t SessionId;
uint8_t Signature[16];
}smb2_hdr_t, *psmb2_hdr_t;
#define SMB2_HDR_LEN 64
typedef struct SMB2State_ {
nbss_hdr_t nbss;
smb2_hdr_t smb2;
uint16_t bytesprocessed;
nbss_hdr_t nbss;
smb2_hdr_t smb2;
uint16_t bytesprocessed;
}SMB2State;
/* http://msdn.microsoft.com/en-us/library/cc246528(PROT.13).aspx */

Write Preview
Loading…
Cancel
Save