aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Revert yesterday's dcerpc commits as there were to many corner cases for it to go into 1.0.1.

Browse Source
remotes/origin/master-1.0.x
Victor Julien 15 years ago
parent 6299fbfb0f
commit f081577fe4
3 changed files with 96 additions and 592 deletions
Show Stats Download Patch File Download Diff File

5
src/app-layer-dcerpc-common.h
Unescape Escape View File

@ -150,8 +150,6 @@ typedef struct DCERPCBindBindAck_ {
uint16_t versionminor;
DCERPCUuidEntry *uuid_entry;
TAILQ_HEAD(, DCERPCUuidEntry_) uuid_list;
/* hold a count of uuids that don't belong to the first frag */
uint16_t non_first_frag_uuids_count;
uint16_t secondaryaddrlen;
uint16_t secondaryaddrlenleft;
uint16_t result;
@ -185,9 +183,6 @@ typedef struct DCERPC_ {
uint8_t pad;
uint16_t padleft;
uint16_t transaction_id;
/* indicates if the dcerpc pdu state is in the middle of processing
* a fragmented pdu */
uint8_t pdu_fragged;
} DCERPC;
typedef struct DCERPCUDP_ {

534
src/app-layer-dcerpc.c
Unescape Escape View File

@ -145,7 +145,7 @@ void printUUID(char *type, DCERPCUuidEntry *uuid) {
static uint32_t DCERPCParseSecondaryAddr(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
SCEnter();
uint8_t *p = input;
while (input_len-- && dcerpc->dcerpcbindbindack.secondaryaddrlenleft--) {
while (dcerpc->dcerpcbindbindack.secondaryaddrlenleft-- && input_len--) {
SCLogDebug("0x%02x ", *p);
p++;
}
@ -236,8 +236,8 @@ static uint32_t DCERPCParseBINDCTXItem(DCERPC *dcerpc, uint8_t *input, uint32_t
dcerpc->dcerpcbindbindack.version |= *(p + 21) << 8;
dcerpc->dcerpcbindbindack.versionminor = *(p + 22);
dcerpc->dcerpcbindbindack.versionminor |= *(p + 23) << 8;
//if (dcerpc->dcerpcbindbindack.ctxid == dcerpc->dcerpcbindbindack.numctxitems
// - dcerpc->dcerpcbindbindack.numctxitemsleft) {
if (dcerpc->dcerpcbindbindack.ctxid == dcerpc->dcerpcbindbindack.numctxitems
- dcerpc->dcerpcbindbindack.numctxitemsleft) {
dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *) SCCalloc(1,
sizeof(DCERPCUuidEntry));
if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) {
@ -259,16 +259,13 @@ static uint32_t DCERPCParseBINDCTXItem(DCERPC *dcerpc, uint8_t *input, uint32_t
dcerpc->dcerpcbindbindack.numctxitemsleft--;
dcerpc->bytesprocessed += (44);
dcerpc->dcerpcbindbindack.ctxbytesprocessed += (44);
if (!(dcerpc->dcerpchdr.pfc_flags & PFC_FIRST_FRAG)) {
dcerpc->dcerpcbindbindack.non_first_frag_uuids_count++;
}
SCReturnUInt(44U);
}
//} else {
// SCLogDebug("ctxitem %u, expected %u\n", dcerpc->dcerpcbindbindack.ctxid,
// dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft);
// SCReturnUInt(0);
//}
} else {
SCLogDebug("ctxitem %u, expected %u\n", dcerpc->dcerpcbindbindack.ctxid,
dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft);
SCReturnUInt(0);
}
} else {
dcerpc->dcerpcbindbindack.ctxid = *(p++);
if (!(--input_len))
@ -447,8 +444,7 @@ static uint32_t DCERPCParseBINDCTXItem(DCERPC *dcerpc, uint8_t *input, uint32_t
case 43:
p++;
--input_len;
//if (dcerpc->dcerpcbindbindack.ctxid ==
// (dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft)) {
if (dcerpc->dcerpcbindbindack.ctxid == dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft) {
dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *) SCCalloc(1,
sizeof(DCERPCUuidEntry));
if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) {
@ -472,11 +468,11 @@ static uint32_t DCERPCParseBINDCTXItem(DCERPC *dcerpc, uint8_t *input, uint32_t
dcerpc->dcerpcbindbindack.ctxbytesprocessed += (p - input);
SCReturnUInt((uint32_t)(p - input));
}
//} else {
// SCLogDebug("ctxitem %u, expected %u\n", dcerpc->dcerpcbindbindack.ctxid,
// dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft);
// SCReturnUInt(0);
//}
} else {
SCLogDebug("ctxitem %u, expected %u\n", dcerpc->dcerpcbindbindack.ctxid,
dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft);
SCReturnUInt(0);
}
break;
}
}
@ -639,17 +635,12 @@ static uint32_t DCERPCParseBINDACKCTXItem(DCERPC *dcerpc, uint8_t *input, uint32
static uint32_t DCERPCParseBIND(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
SCEnter();
DCERPCUuidEntry *item;
uint8_t *p = input;
if (input_len) {
switch (dcerpc->bytesprocessed) {
case 16:
dcerpc->dcerpcbindbindack.numctxitems = 0;
if (input_len >= 12) {
while ((item = TAILQ_FIRST(&dcerpc->dcerpcbindbindack.uuid_list))) {
TAILQ_REMOVE(&dcerpc->dcerpcbindbindack.uuid_list, item, next);
SCFree(item);
}
TAILQ_INIT(&dcerpc->dcerpcbindbindack.uuid_list);
dcerpc->dcerpcbindbindack.numctxitems = *(p + 8);
dcerpc->dcerpcbindbindack.numctxitemsleft = dcerpc->dcerpcbindbindack.numctxitems;
@ -697,10 +688,6 @@ static uint32_t DCERPCParseBIND(DCERPC *dcerpc, uint8_t *input, uint32_t input_l
if (!(--input_len))
break;
case 24:
while ((item = TAILQ_FIRST(&dcerpc->dcerpcbindbindack.uuid_list))) {
TAILQ_REMOVE(&dcerpc->dcerpcbindbindack.uuid_list, item, next);
SCFree(item);
}
dcerpc->dcerpcbindbindack.numctxitems = *(p++);
dcerpc->dcerpcbindbindack.numctxitemsleft = dcerpc->dcerpcbindbindack.numctxitems;
TAILQ_INIT(&dcerpc->dcerpcbindbindack.uuid_list);
@ -791,13 +778,13 @@ static uint32_t DCERPCParseBINDACK(DCERPC *dcerpc, uint8_t *input, uint32_t inpu
if (!(--input_len))
break;
case 24:
dcerpc->dcerpcbindbindack.secondaryaddrlen = *(p++) << 8;
dcerpc->dcerpcbindbindack.secondaryaddrlen = *(p++);
if (!(--input_len))
break;
case 25:
dcerpc->dcerpcbindbindack.secondaryaddrlen |= *(p++);
if (dcerpc->dcerpchdr.packed_drep[0] == 0x10) {
dcerpc->dcerpcbindbindack.secondaryaddrlen = SCByteSwap16(dcerpc->dcerpcbindbindack.secondaryaddrlen);
dcerpc->dcerpcbindbindack.secondaryaddrlen |= *(p++) << 8;
if (dcerpc->dcerpchdr.packed_drep[0] == 0x01) {
SCByteSwap16(dcerpc->dcerpcbindbindack.secondaryaddrlen);
}
dcerpc->dcerpcbindbindack.secondaryaddrlenleft = dcerpc->dcerpcbindbindack.secondaryaddrlen;
SCLogDebug("secondaryaddrlen %u 0x%04x\n", dcerpc->dcerpcbindbindack.secondaryaddrlen,
@ -917,11 +904,8 @@ static uint32_t StubDataParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_le
/* if the frag is the the first frag irrespective of it being a part of
* a multi frag PDU or not, it indicates the previous PDU's stub would
* have been buffered and processed and we can use the buffer to hold
* frags from a fresh request/response. Also if the state is in the
* process of processing a fragmented pdu, we should append to the
* existing stub and not reset the stub buffer */
if (dcerpc->dcerpchdr.pfc_flags & PFC_FIRST_FRAG &&
!dcerpc->pdu_fragged) {
* frags from a fresh request/response */
if (dcerpc->dcerpchdr.pfc_flags & PFC_FIRST_FRAG) {
*stub_data_buffer_len = 0;
}
@ -1080,10 +1064,10 @@ static int DCERPCParseHeader(DCERPC *dcerpc, uint8_t *input, uint32_t input_len)
break;
case 15:
dcerpc->dcerpchdr.call_id |= *(p++);
if (dcerpc->dcerpchdr.packed_drep[0] == 0x10) {
dcerpc->dcerpchdr.frag_length = SCByteSwap16(dcerpc->dcerpchdr.frag_length);
dcerpc->dcerpchdr.auth_length = SCByteSwap16(dcerpc->dcerpchdr.auth_length);
dcerpc->dcerpchdr.call_id = SCByteSwap32(dcerpc->dcerpchdr.call_id);
if (dcerpc->dcerpchdr.packed_drep[0] == 0x01) {
SCByteSwap16(dcerpc->dcerpchdr.frag_length);
SCByteSwap16(dcerpc->dcerpchdr.auth_length);
SCByteSwap32(dcerpc->dcerpchdr.call_id);
}
--input_len;
break;
@ -1106,25 +1090,11 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
dcerpc->dcerpcrequest.stub_data_fresh = 0;
dcerpc->dcerpcresponse.stub_data_fresh = 0;
/* temporary use. we will get rid of this later, once we have ironed out
* all the endless loops cases */
int counter = 0;
while(input_len) {
/* we haven't covered a couple of corner cases with fragmented pdus.
* temporary fix so that we don'd endlesslessy loop here */
if (counter++ == 200) {
dcerpc->bytesprocessed = 0;
dcerpc->pdu_fragged = 0;
dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0;
SCReturnInt(0);
}
while (dcerpc->bytesprocessed < DCERPC_HDR_LEN && input_len) {
hdrretval = DCERPCParseHeader(dcerpc, input + parsed, input_len);
if (hdrretval == -1) {
dcerpc->bytesprocessed = 0;
dcerpc->pdu_fragged = 0;
SCReturnInt(0);
} else {
parsed += hdrretval;
@ -1152,9 +1122,6 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
switch (dcerpc->dcerpchdr.type) {
case BIND:
case ALTER_CONTEXT:
if (!dcerpc->pdu_fragged) {
dcerpc->dcerpcbindbindack.non_first_frag_uuids_count = 0;
}
while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 12
&& dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length
&& input_len) {
@ -1165,10 +1132,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
} else if (input_len) {
SCLogDebug("Error Parsing DCERPC %s", (dcerpc->dcerpchdr.type == BIND) ? "BIND" : "ALTER_CONTEXT");
parsed = 0;
dcerpc->bytesprocessed = 0;
dcerpc->pdu_fragged = 0;
input_len = 0;
SCReturnInt(0);
}
}
SCLogDebug(
@ -1193,19 +1157,12 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
parsed = 0;
SCLogDebug("Error Parsing CTX Item %u\n", parsed);
input_len = 0;
dcerpc->bytesprocessed = 0;
dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0;
dcerpc->dcerpcbindbindack.numctxitemsleft = 0;
dcerpc->pdu_fragged = 0;
SCReturnInt(0);
}
}
if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) {
dcerpc->bytesprocessed = 0;
dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0;
dcerpc->pdu_fragged = 0;
} else {
dcerpc->pdu_fragged = 1;
}
break;
@ -1224,9 +1181,6 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
SCLogDebug("Error parsing %s\n", (dcerpc->dcerpchdr.type == BIND_ACK) ? "BIND_ACK" : "ALTER_CONTEXT_RESP");
parsed = 0;
input_len = 0;
dcerpc->bytesprocessed = 0;
dcerpc->pdu_fragged = 0;
SCReturnInt(0);
}
}
@ -1245,9 +1199,6 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
SCLogDebug("Error parsing Secondary Address");
parsed = 0;
input_len = 0;
dcerpc->pdu_fragged = 0;
dcerpc->bytesprocessed = 0;
SCReturnInt(0);
}
}
@ -1273,9 +1224,6 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
SCLogDebug("Error parsing DCERPC Padding");
parsed = 0;
input_len = 0;
dcerpc->bytesprocessed = 0;
dcerpc->pdu_fragged = 0;
SCReturnInt(0);
}
}
@ -1293,9 +1241,6 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
SCLogDebug("Error parsing CTX Items");
parsed = 0;
input_len = 0;
dcerpc->bytesprocessed = 0;
dcerpc->pdu_fragged = 0;
SCReturnInt(0);
}
}
@ -1318,9 +1263,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
parsed = 0;
input_len = 0;
dcerpc->dcerpcbindbindack.numctxitemsleft = 0;
dcerpc->bytesprocessed = 0;
dcerpc->pdu_fragged = 0;
SCReturnInt(0);
}
}
SCLogDebug("BINDACK processed %u/%u input_len left %u", dcerpc->bytesprocessed,
@ -1328,7 +1271,6 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) {
dcerpc->bytesprocessed = 0;
dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0;
dcerpc->pdu_fragged = 0;
/* response and request done */
if (dcerpc->dcerpchdr.type == BIND_ACK) {
@ -1337,8 +1279,6 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
SCLogDebug("transaction_id updated to %"PRIu16,
dcerpc->transaction_id);
}
} else {
dcerpc->pdu_fragged = 1;
}
break;
@ -1358,9 +1298,6 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
parsed = 0;
dcerpc->padleft = 0;
input_len = 0;
dcerpc->bytesprocessed = 0;
dcerpc->pdu_fragged = 0;
SCReturnInt(0);
}
}
@ -1376,8 +1313,6 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
parsed = 0;
input_len = 0;
dcerpc->bytesprocessed = 0;
dcerpc->pdu_fragged = 0;
SCReturnInt(0);
}
}
@ -1391,9 +1326,6 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) {
dcerpc->bytesprocessed = 0;
dcerpc->pdu_fragged = 0;
} else {
dcerpc->pdu_fragged = 1;
}
/* response and request done */
@ -1408,13 +1340,9 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
default:
SCLogDebug("DCERPC Type 0x%02x not implemented yet", dcerpc->dcerpchdr.type);
dcerpc->bytesprocessed = 0;
dcerpc->pdu_fragged = 0;
/* reset type to REQUEST. Yeah, that's cool. Just like how we would
* otherwise behave if this is the first dce payload the parser is
* seeing */
dcerpc->dcerpchdr.type = 0;
break;
}
dcerpc->bytesprocessed = 0;
}
SCReturnInt(parsed);
}
@ -3684,422 +3612,12 @@ end:
return result;
}
/**
* \test DCERPC fragmented bind PDU(one PDU which is frag'ed)
*/
int DCERPCParserTest05(void) {
int result = 1;
Flow f;
int r = 0;
uint8_t bind1[] = {
0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00,
0xdc, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00,
0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
0xc7, 0x70, 0x0d, 0x3e, 0x71, 0x37, 0x39, 0x0d,
0x3a, 0x4f, 0xd3, 0xdc, 0xca, 0x49, 0xe8, 0xa3,
0x05, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
0x01, 0x00, 0x01, 0x00, 0x84, 0xb6, 0x55, 0x75,
0xdb, 0x9e, 0xba, 0x54, 0x56, 0xd3, 0x45, 0x10,
0xb7, 0x7a, 0x2a, 0xe2, 0x04, 0x00, 0x01, 0x00,
0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00,
0x6e, 0x39, 0x21, 0x24, 0x70, 0x6f, 0x41, 0x57,
0x54, 0x70, 0xb8, 0xc3, 0x5e, 0x89, 0x3b, 0x43,
0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
0x03, 0x00, 0x01, 0x00, 0x39, 0x6a, 0x86, 0x5d,
0x24, 0x0f, 0xd2, 0xf7, 0xb6, 0xce, 0x95, 0x9c,
0x54, 0x1d, 0x3a, 0xdb, 0x02, 0x00, 0x01, 0x00,
0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x01, 0x00,
0x12, 0xa5, 0xdd, 0xc5, 0x55, 0xce, 0xc3, 0x46,
0xbd, 0xa0, 0x94, 0x39, 0x3c, 0x0d, 0x9b, 0x5b,
0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
0x05, 0x00, 0x01, 0x00, 0x87, 0x1c, 0x8b, 0x6e,
0x11, 0xa8, 0x67, 0x98, 0xd4, 0x5d, 0xf6, 0x8a,
0x2f, 0x33, 0x24, 0x7b, 0x05, 0x00, 0x03, 0x00,
0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
0x02, 0x00, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00,
0x9b, 0x82, 0x13, 0xd1, 0x28, 0xe0, 0x63, 0xf3,
0x62, 0xee, 0x76, 0x73, 0xf9, 0xac, 0x3d, 0x2e,
0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
0x07, 0x00, 0x01, 0x00, 0xa9, 0xd4, 0x73, 0xf2,
0xed, 0xad, 0xe8, 0x82, 0xf8, 0xcf, 0x9d, 0x9f,
0x66, 0xe6, 0x43, 0x37, 0x02, 0x00, 0x01, 0x00,
0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
0x02, 0x00, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00,
0x06, 0x2b, 0x85, 0x38, 0x4f, 0x73, 0x96, 0xb1,
0x73, 0xe1, 0x59, 0xbe, 0x9d, 0xe2, 0x6c, 0x07,
0x05, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a,
0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
0x2b, 0x10, 0x48, 0x60};
uint32_t bind1_len = sizeof(bind1);
uint8_t bind2[] = {
0x02, 0x00, 0x00, 0x00, 0x09, 0x00, 0x01, 0x00,
0xbf, 0xfa, 0xbb, 0xa4, 0x9e, 0x5c, 0x80, 0x61,
0xb5, 0x8b, 0x79, 0x69, 0xa6, 0x32, 0x88, 0x77,
0x01, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a,
0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
0x0a, 0x00, 0x01, 0x00, 0x39, 0xa8, 0x2c, 0x39,
0x73, 0x50, 0x06, 0x8d, 0xf2, 0x37, 0x1e, 0x1e,
0xa8, 0x8f, 0x46, 0x98, 0x02, 0x00, 0x02, 0x00,
0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
0x02, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x01, 0x00,
0x91, 0x13, 0xd0, 0xa7, 0xef, 0xc4, 0xa7, 0x96,
0x0c, 0x4a, 0x0d, 0x29, 0x80, 0xd3, 0xfe, 0xbf,
0x00, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a,
0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
0x0c, 0x00, 0x01, 0x00, 0xcc, 0x2b, 0x55, 0x1d,
0xd4, 0xa4, 0x0d, 0xfb, 0xcb, 0x6f, 0x86, 0x36,
0xa6, 0x57, 0xc3, 0x21, 0x02, 0x00, 0x01, 0x00,
0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
0x02, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x01, 0x00,
0x43, 0x7b, 0x07, 0xee, 0x85, 0xa8, 0xb9, 0x3a,
0x0f, 0xf9, 0x83, 0x70, 0xe6, 0x0b, 0x4f, 0x33,
0x02, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a,
0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
0x0e, 0x00, 0x01, 0x00, 0x9c, 0x6a, 0x15, 0x8c,
0xd6, 0x9c, 0xa6, 0xc3, 0xb2, 0x9e, 0x62, 0x9f,
0x3d, 0x8e, 0x47, 0x73, 0x02, 0x00, 0x02, 0x00,
0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
0x02, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x01, 0x00,
0xc8, 0x4f, 0x32, 0x4b, 0x70, 0x16, 0xd3, 0x01,
0x12, 0x78, 0x5a, 0x47, 0xbf, 0x6e, 0xe1, 0x88,
0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00
};
uint32_t bind2_len = sizeof(bind2);
TcpSession ssn;
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
FlowL7DataPtrInit(&f);
r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER|STREAM_START,
bind1, bind1_len);
if (r != 0) {
printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
result = 0;
goto end;
}
DCERPCState *dcerpc_state = f.aldata[AlpGetStateIdx(ALPROTO_DCERPC)];
if (dcerpc_state == NULL) {
printf("no dcerpc state: ");
result = 0;
goto end;
}
result &= (dcerpc_state->dcerpc.bytesprocessed == 420);
result &= (dcerpc_state->dcerpc.dcerpcbindbindack.ctxbytesprocessed == 40);
result &= (dcerpc_state->dcerpc.dcerpcbindbindack.numctxitems == 16);
result &= (dcerpc_state->dcerpc.dcerpcbindbindack.numctxitemsleft == 8);
r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER,
bind2, bind2_len);
if (r != 0) {
printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
result = 0;
goto end;
}
result &= (dcerpc_state->dcerpc.bytesprocessed == 0);
result &= (dcerpc_state->dcerpc.dcerpcbindbindack.ctxbytesprocessed == 0);
result &= (dcerpc_state->dcerpc.dcerpcbindbindack.numctxitems == 16);
result &= (dcerpc_state->dcerpc.dcerpcbindbindack.numctxitemsleft == 0);
end:
FlowL7DataPtrFree(&f);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
return result;
}
/**
* \test DCERPC fragmented bind PDU(one PDU which is frag'ed).
*/
int DCERPCParserTest06(void) {
int result = 1;
Flow f;
int r = 0;
uint8_t request1[] = {
0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
0x2C, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00,
0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
0x09, 0x0A, 0x0B, 0x0C
};
uint32_t request1_len = sizeof(request1);
uint8_t request2[] = {
0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14
};
uint32_t request2_len = sizeof(request2);
TcpSession ssn;
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
FlowL7DataPtrInit(&f);
r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER|STREAM_START,
request1, request1_len);
if (r != 0) {
printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
result = 0;
goto end;
}
DCERPCState *dcerpc_state = f.aldata[AlpGetStateIdx(ALPROTO_DCERPC)];
if (dcerpc_state == NULL) {
printf("no dcerpc state: ");
result = 0;
goto end;
}
result &= (dcerpc_state->dcerpc.bytesprocessed == 36);
result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL &&
dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 12);
r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER,
request2, request2_len);
if (r != 0) {
printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
result = 0;
goto end;
}
result &= (dcerpc_state->dcerpc.bytesprocessed == 0);
result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL &&
dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 20);
end:
FlowL7DataPtrFree(&f);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
return result;
}
/**
* \test DCERPC fragmented PDU.
*/
int DCERPCParserTest07(void) {
int result = 1;
Flow f;
int r = 0;
uint8_t fault[] = {
0x05, 0x00, 0x03, 0x03, 0x10, 0x00, 0x00, 0x00,
0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00,
0xf7, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};
uint32_t fault_len = sizeof(fault);
uint8_t request1[] = {
0x05, 0x00
};
uint32_t request1_len = sizeof(request1);
uint8_t request2[] = {
0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x24, 0x00,
0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00,
0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x02,
0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A,
0x0B, 0x0C
};
uint32_t request2_len = sizeof(request2);
TcpSession ssn;
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
FlowL7DataPtrInit(&f);
r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER|STREAM_START,
fault, fault_len);
if (r != 0) {
printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
result = 0;
goto end;
}
DCERPCState *dcerpc_state = f.aldata[AlpGetStateIdx(ALPROTO_DCERPC)];
if (dcerpc_state == NULL) {
printf("no dcerpc state: ");
result = 0;
goto end;
}
r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER,
request1, request1_len);
if (r != 0) {
printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
result = 0;
goto end;
}
result &= (dcerpc_state->dcerpc.bytesprocessed == 2);
result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer == NULL);
r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER,
request2, request2_len);
if (r != 0) {
printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
result = 0;
goto end;
}
result &= (dcerpc_state->dcerpc.bytesprocessed == 0);
result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL &&
dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 12);
end:
FlowL7DataPtrFree(&f);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
return result;
}
/**
* \test DCERPC fragmented bind PDU(one PDU which is frag'ed)
*/
int DCERPCParserTest08(void) {
int result = 1;
Flow f;
int r = 0;
uint8_t bind1[] = {
0x05, 0x00, 0x0b, 0x01, 0x10, 0x00, 0x00, 0x00,
0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
0xb8, 0x4a, 0x9f, 0x4d, 0x1c, 0x7d, 0xcf, 0x11,
0x86, 0x1e, 0x00, 0x20, 0xaf, 0x6e, 0x7c, 0x57,
0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00
};
uint32_t bind1_len = sizeof(bind1);
uint8_t bind2[] = {
0x05, 0x00, 0x0b, 0x02, 0x10, 0x00, 0x00, 0x00,
0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00,
0xb8, 0x4a, 0x9f, 0x4d, 0x1c, 0x7d, 0xcf, 0x11,
0x86, 0x1e, 0x00, 0x20, 0xaf, 0x6e, 0x7c, 0x67,
0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00
};
uint32_t bind2_len = sizeof(bind2);
TcpSession ssn;
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
FlowL7DataPtrInit(&f);
r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START,
bind1, bind1_len);
if (r != 0) {
printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
result = 0;
goto end;
}
DCERPCState *dcerpc_state = f.aldata[AlpGetStateIdx(ALPROTO_DCERPC)];
if (dcerpc_state == NULL) {
printf("no dcerpc state: ");
result = 0;
goto end;
}
DCERPCUuidEntry *item = NULL;
int m = 0;
TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.uuid_list, next) {
printf("%d ", m);
printUUID("BIND",item);
m++;
}
r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER,
bind2, bind2_len);
if (r != 0) {
printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
result = 0;
goto end;
}
item = NULL;
m = 0;
TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.uuid_list, next) {
printf("%d ", m);
printUUID("BIND",item);
m++;
}
/* we will need this test later for fragged bind pdus. keep it */
result = 1;
end:
FlowL7DataPtrFree(&f);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
return result;
}
void DCERPCParserRegisterTests(void) {
printf("DCERPCParserRegisterTests\n");
UtRegisterTest("DCERPCParserTest01", DCERPCParserTest01, 1);
UtRegisterTest("DCERPCParserTest02", DCERPCParserTest02, 1);
UtRegisterTest("DCERPCParserTest03", DCERPCParserTest03, 1);
UtRegisterTest("DCERPCParserTest04", DCERPCParserTest04, 1);
UtRegisterTest("DCERPCParserTest05", DCERPCParserTest05, 1);
UtRegisterTest("DCERPCParserTest06", DCERPCParserTest06, 1);
UtRegisterTest("DCERPCParserTest07", DCERPCParserTest07, 1);
UtRegisterTest("DCERPCParserTest08", DCERPCParserTest08, 1);
}
#endif

23
src/detect-dce-iface.c
Unescape Escape View File

@ -279,7 +279,6 @@ int DetectDceIfaceMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f,
int i = 0;
DetectDceIfaceData *dce_data = (DetectDceIfaceData *)m->ctx;
DCERPCState *dcerpc_state = (DCERPCState *)state;
int avoid_uuids = 0;
if (dcerpc_state == NULL) {
SCLogDebug("No DCERPCState for the flow");
return 0;
@ -287,24 +286,16 @@ int DetectDceIfaceMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f,
SCMutexLock(&f->m);
///* if any_frag is not enabled, we need to match only against the first
// * fragment */
//if (!dce_data->any_frag &&
// !(dcerpc_state->dcerpc.dcerpchdr.pfc_flags & PFC_FIRST_FRAG)) {
// /* any_frag has not been set, and apparently it's not the first fragment */
// ret = 0;
// goto end;
//}
if (!dce_data->any_frag) {
avoid_uuids = dcerpc_state->dcerpc.dcerpcbindbindack.non_first_frag_uuids_count;
/* if any_frag is not enabled, we need to match only against the first
* fragment */
if (!dce_data->any_frag &&
!(dcerpc_state->dcerpc.dcerpchdr.pfc_flags & PFC_FIRST_FRAG)) {
/* any_frag has not been set, and apparently it's not the first fragment */
ret = 0;
goto end;
}
int count = 0;
TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.uuid_list, next) {
if (count++ < avoid_uuids)
continue;
ret = 1;
/* if the uuid has been rejected(item->result == 1), we skip to the

Write Preview
Loading…
Cancel
Save