aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixup smb/smb2/dcerpc wrt loops, debug printing, style.

Browse Source
remotes/origin/master-1.0.x
Victor Julien 17 years ago
parent 4c2782e971
commit f0be69dcd0
4 changed files with 134 additions and 124 deletions
Show Stats Download Patch File Download Diff File

1
src/Makefile.am
Unescape Escape View File

@ -148,6 +148,7 @@ app-layer-protos.h \
app-layer-htp.c app-layer-htp.h \
app-layer-tls.c app-layer-tls.h \
app-layer-smb.c app-layer-smb.h \
app-layer-smb2.c app-layer-smb2.h \
app-layer-dcerpc.c app-layer-dcerpc.h \
app-layer-ftp.c app-layer-ftp.h \
defrag.c defrag.h

18
src/app-layer-dcerpc.c
Unescape Escape View File

@ -250,7 +250,7 @@ static int DCERPCParseBIND(Flow *f, void *dcerpc_state, AppLayerParserState *pst
if (!(--input_len)) break;
case 24:
sstate->numctxitems = *(p++);
printf("numctxitems %d\n",sstate->numctxitems);
//printf("numctxitems %d\n",sstate->numctxitems);
//TAILQ_INIT(sstate.head);
if (!(--input_len)) break;
case 25:
@ -405,28 +405,34 @@ static int DCERPCParseHeader(Flow *f, void *dcerpc_state, AppLayerParserState
static int DCERPCParse(Flow *f, void *dcerpc_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, AppLayerParserResult *output) {
SCEnter();
DCERPCState *sstate = (DCERPCState *)dcerpc_state;
uint32_t retval = 0;
uint32_t parsed = 0;
if (pstate == NULL)
SCReturnInt(-1);
while (sstate->bytesprocessed < DCERPC_HDR_LEN) {
while (sstate->bytesprocessed < DCERPC_HDR_LEN && input_len) {
retval = DCERPCParseHeader(f, dcerpc_state, pstate, input, input_len,
output);
parsed += retval;
input_len -= retval;
}
switch (sstate->dcerpc.type) {
case BIND:
case ALTER_CONTEXT:
while (sstate->bytesprocessed < DCERPC_HDR_LEN + 12 &&
sstate->bytesprocessed < sstate->dcerpc.frag_length) {
sstate->bytesprocessed < sstate->dcerpc.frag_length &&
input_len) {
retval = DCERPCParseBIND(f, dcerpc_state, pstate, input + parsed, input_len,
output);
parsed += retval;
input_len -= retval;
}
while (sstate->numctxitems && sstate->bytesprocessed < sstate->dcerpc.frag_length) {
while (sstate->numctxitems && sstate->bytesprocessed < sstate->dcerpc.frag_length &&
input_len) {
retval = DCERPCParseCTXItem(f, dcerpc_state, pstate, input + parsed, input_len,
output);
if (sstate->ctxbytesprocessed == 44) {
@ -438,13 +444,13 @@ static int DCERPCParse(Flow *f, void *dcerpc_state, AppLayerParserState *pstate,
break;
case BIND_ACK:
case ALTER_CONTEXT_RESP:
while (sstate->bytesprocessed < DCERPC_HDR_LEN + 12) {
while (sstate->bytesprocessed < DCERPC_HDR_LEN + 12 && input_len) {
retval = DCERPCParseBINDACK(f, dcerpc_state, pstate, input + parsed, input_len,
output);
parsed += retval;
input_len -= retval;
}
while (sstate->numctxitems) {
while (sstate->numctxitems && input_len) {
retval = DCERPCParseCTXItem(f, dcerpc_state, pstate, input, input_len,
output);
parsed += retval;

4
src/app-layer-smb.c
Unescape Escape View File

@ -499,7 +499,7 @@ static int SMBParseByteCount(Flow *f, void *smb_state, AppLayerParserState *psta
SCReturnInt(p - input);
}
#define DEBUG 1
//#define DEBUG 1
static int NBSSParseHeader(Flow *f, void *smb_state, AppLayerParserState *pstate,
uint8_t *input, uint32_t input_len, AppLayerParserResult *output)
{
@ -778,7 +778,7 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
parsed += retval;
input_len -= retval;
}
} while (sstate->andx.andxcommand != SMB_NO_SECONDARY_ANDX_COMMAND);
} while (sstate->andx.andxcommand != SMB_NO_SECONDARY_ANDX_COMMAND && input_len);
break;
default:
break;

15
src/app-layer-smb2.c
Unescape Escape View File

@ -22,6 +22,7 @@
#include "util-binsearch.h"
#include "util-unittest.h"
#include "util-debug.h"
#include "app-layer-smb2.h"
@ -34,7 +35,7 @@ enum {
SMB_FIELD_MAX,
};
#define DEBUG 1
//#define DEBUG 1
static int NBSSParseHeader(void *smb2_state, AppLayerParserState *pstate,
uint8_t *input, uint32_t input_len, AppLayerParserResult *output) {
SMB2State *sstate = (SMB2State *) smb2_state;
@ -84,7 +85,7 @@ static int SMB2ParseHeader(void *smb2_state, AppLayerParserState *pstate,
case 4:
if (input_len >= SMB2_HDR_LEN) {
if (memcmp(p, "\xfe\x53\x4d\x42", 4) != 0) {
printf("SMB2 Header did not validate\n");
//printf("SMB2 Header did not validate\n");
return 0;
}
sstate->smb2.StructureSize = *(p + 4);
@ -361,7 +362,7 @@ static int SMB2ParseHeader(void *smb2_state, AppLayerParserState *pstate,
return (p - input);
}
static int SMB2Parse(void *smb2_state, AppLayerParserState *pstate,
static int SMB2Parse(Flow *f, void *smb2_state, AppLayerParserState *pstate,
uint8_t *input, uint32_t input_len, AppLayerParserResult *output) {
SMB2State *sstate = (SMB2State *) smb2_state;
uint32_t retval = 0;
@ -370,11 +371,12 @@ static int SMB2Parse(void *smb2_state, AppLayerParserState *pstate,
if (pstate == NULL)
return -1;
while (sstate->bytesprocessed < NBSS_HDR_LEN) {
while (sstate->bytesprocessed < NBSS_HDR_LEN && input_len) {
retval = NBSSParseHeader(smb2_state, pstate, input, input_len, output);
parsed += retval;
input_len -= retval;
printf("\nNBSS Header (%u/%u) Type 0x%02x Length 0x%04x parsed %u input_len %u\n",
SCLogDebug("NBSS Header (%u/%u) Type 0x%02x Length 0x%04x parsed %u input_len %u",
sstate->bytesprocessed, NBSS_HDR_LEN, sstate->nbss.type,
sstate->nbss.length, parsed, input_len);
}
@ -386,7 +388,8 @@ static int SMB2Parse(void *smb2_state, AppLayerParserState *pstate,
retval = SMB2ParseHeader(smb2_state, pstate, input + parsed, input_len, output);
parsed += retval;
input_len -= retval;
printf("SMB2 Header (%u/%u) Command 0x%04x parsed %u input_len %u\n",
SCLogDebug("SMB2 Header (%u/%u) Command 0x%04x parsed %u input_len %u",
sstate->bytesprocessed, NBSS_HDR_LEN + SMB2_HDR_LEN,
sstate->smb2.Command, parsed, input_len);
}

Write Preview
Loading…
Cancel
Save