aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix bug 61

Browse Source
remotes/origin/master-1.0.x
root 17 years ago committed by Victor Julien
parent 7aac64f262
commit 706bb95209
2 changed files with 204 additions and 98 deletions
Show Stats Download Patch File Download Diff File

74
src/app-layer-dcerpc.c
Unescape Escape View File

@ -457,7 +457,8 @@ static uint32_t DCERPCParseBINDACKCTXItem(Flow *f, void *dcerpc_state,
sstate->result = *p; sstate->result = *p;
sstate->result |= *(p + 1) << 8; sstate->result |= *(p + 1) << 8;
TAILQ_FOREACH(uuid_entry, &sstate->uuid_list, next) { TAILQ_FOREACH(uuid_entry, &sstate->uuid_list, next) {
if(uuid_entry->ctxid == sstate->numctxitems - sstate->numctxitemsleft) { if (uuid_entry->ctxid == sstate->numctxitems
- sstate->numctxitemsleft) {
uuid_entry->result = sstate->result; uuid_entry->result = sstate->result;
//printUUID("BIND_ACK", uuid_entry); //printUUID("BIND_ACK", uuid_entry);
break; break;
@ -564,7 +565,8 @@ static uint32_t DCERPCParseBINDACKCTXItem(Flow *f, void *dcerpc_state,
break; break;
case 23: case 23:
TAILQ_FOREACH(uuid_entry, &sstate->uuid_list, next) { TAILQ_FOREACH(uuid_entry, &sstate->uuid_list, next) {
if(uuid_entry->ctxid == sstate->numctxitems - sstate->numctxitemsleft) { if (uuid_entry->ctxid == sstate->numctxitems
- sstate->numctxitemsleft) {
uuid_entry->result = sstate->result; uuid_entry->result = sstate->result;
//printUUID("BIND_ACK", uuid_entry); //printUUID("BIND_ACK", uuid_entry);
break; break;
@ -983,8 +985,14 @@ static int DCERPCParse(Flow *f, void *dcerpc_state,
&& input_len) { && input_len) {
retval = DCERPCParseBIND(f, dcerpc_state, pstate, input + parsed, retval = DCERPCParseBIND(f, dcerpc_state, pstate, input + parsed,
input_len, output); input_len, output);
if (retval) {
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
} else if (input_len) {
SCLogDebug("Error Parsing DCERPC BIND");
parsed -= input_len;
input_len = 0;
}
} }
SCLogDebug( SCLogDebug(
"Done with DCERPCParseBIND bytesprocessed %u/%u -- Should be 12\n", "Done with DCERPCParseBIND bytesprocessed %u/%u -- Should be 12\n",
@ -994,14 +1002,21 @@ static int DCERPCParse(Flow *f, void *dcerpc_state,
< sstate->dcerpc.frag_length && input_len) { < sstate->dcerpc.frag_length && input_len) {
retval = DCERPCParseBINDCTXItem(f, dcerpc_state, pstate, input retval = DCERPCParseBINDCTXItem(f, dcerpc_state, pstate, input
+ parsed, input_len, output); + parsed, input_len, output);
if (retval) {
if (sstate->ctxbytesprocessed == 44) { if (sstate->ctxbytesprocessed == 44) {
sstate->ctxbytesprocessed = 0; sstate->ctxbytesprocessed = 0;
} }
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
}
SCLogDebug("BIND processed %u/%u\n", sstate->bytesprocessed, SCLogDebug("BIND processed %u/%u\n", sstate->bytesprocessed,
sstate->dcerpc.frag_length); sstate->dcerpc.frag_length);
} else if (input_len) {
SCLogDebug("Error Parsing CTX Item");
parsed -= input_len;
input_len = 0;
sstate->numctxitemsleft = 0;
}
}
if (sstate->bytesprocessed == sstate->dcerpc.frag_length) { if (sstate->bytesprocessed == sstate->dcerpc.frag_length) {
sstate->bytesprocessed = 0; sstate->bytesprocessed = 0;
sstate->ctxbytesprocessed = 0; sstate->ctxbytesprocessed = 0;
@ -1014,24 +1029,36 @@ static int DCERPCParse(Flow *f, void *dcerpc_state,
&& input_len) { && input_len) {
retval = DCERPCParseBINDACK(f, dcerpc_state, pstate, retval = DCERPCParseBINDACK(f, dcerpc_state, pstate,
input + parsed, input_len, output); input + parsed, input_len, output);
if (retval) {
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
}
SCLogDebug("DCERPCParseBINDACK processed %u/%u left %u\n", SCLogDebug("DCERPCParseBINDACK processed %u/%u left %u\n",
sstate->bytesprocessed, sstate->dcerpc.frag_length, input_len); sstate->bytesprocessed, sstate->dcerpc.frag_length, input_len);
} else if (input_len) {
SCLogDebug("Error parsing BIND_ACK");
parsed -= input_len;
input_len = 0;
}
}
while (sstate->bytesprocessed < DCERPC_HDR_LEN + 10 while (sstate->bytesprocessed < DCERPC_HDR_LEN + 10
+ sstate->secondaryaddrlen && input_len + sstate->secondaryaddrlen && input_len
&& sstate->bytesprocessed < sstate->dcerpc.frag_length) { && sstate->bytesprocessed < sstate->dcerpc.frag_length) {
retval = DCERPCParseSecondaryAddr(f, dcerpc_state, pstate, input retval = DCERPCParseSecondaryAddr(f, dcerpc_state, pstate, input
+ parsed, input_len, output); + parsed, input_len, output);
if (retval) {
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
}
SCLogDebug( SCLogDebug(
"DCERPCParseSecondaryAddr %u/%u left %u secondaryaddr len(%u)\n", "DCERPCParseSecondaryAddr %u/%u left %u secondaryaddr len(%u)\n",
sstate->bytesprocessed, sstate->dcerpc.frag_length, input_len, sstate->bytesprocessed, sstate->dcerpc.frag_length, input_len,
sstate->secondaryaddrlen); sstate->secondaryaddrlen);
} else if (input_len) {
SCLogDebug("Error parsing Secondary Address");
parsed -= input_len;
input_len = 0;
}
}
if (sstate->bytesprocessed == DCERPC_HDR_LEN + 10 if (sstate->bytesprocessed == DCERPC_HDR_LEN + 10
+ sstate->secondaryaddrlen) { + sstate->secondaryaddrlen) {
@ -1044,12 +1071,18 @@ static int DCERPCParse(Flow *f, void *dcerpc_state,
&& sstate->bytesprocessed < sstate->dcerpc.frag_length) { && sstate->bytesprocessed < sstate->dcerpc.frag_length) {
retval = PaddingParser(f, dcerpc_state, pstate, input + parsed, retval = PaddingParser(f, dcerpc_state, pstate, input + parsed,
input_len, output); input_len, output);
if (retval) {
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
}
SCLogDebug("PaddingParser %u/%u left %u pad(%u)\n", SCLogDebug("PaddingParser %u/%u left %u pad(%u)\n",
sstate->bytesprocessed, sstate->dcerpc.frag_length, input_len, sstate->bytesprocessed, sstate->dcerpc.frag_length, input_len,
sstate->pad); sstate->pad);
} else if (input_len) {
SCLogDebug("Error parsing DCERPC Padding");
parsed -= input_len;
input_len = 0;
}
}
while (sstate->bytesprocessed >= DCERPC_HDR_LEN + 10 + sstate->pad while (sstate->bytesprocessed >= DCERPC_HDR_LEN + 10 + sstate->pad
+ sstate->secondaryaddrlen && sstate->bytesprocessed + sstate->secondaryaddrlen && sstate->bytesprocessed
@ -1057,11 +1090,17 @@ static int DCERPCParse(Flow *f, void *dcerpc_state,
&& sstate->bytesprocessed < sstate->dcerpc.frag_length) { && sstate->bytesprocessed < sstate->dcerpc.frag_length) {
retval = DCERPCGetCTXItems(f, dcerpc_state, pstate, input + parsed, retval = DCERPCGetCTXItems(f, dcerpc_state, pstate, input + parsed,
input_len, output); input_len, output);
if (retval) {
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
}
SCLogDebug("DCERPCGetCTXItems %u/%u (%u)\n", sstate->bytesprocessed, SCLogDebug("DCERPCGetCTXItems %u/%u (%u)\n", sstate->bytesprocessed,
sstate->dcerpc.frag_length, sstate->numctxitems); sstate->dcerpc.frag_length, sstate->numctxitems);
} else if (input_len) {
SCLogDebug("Error parsing CTX Items");
parsed -= input_len;
input_len = 0;
}
}
if (sstate->bytesprocessed == DCERPC_HDR_LEN + 14 + sstate->pad if (sstate->bytesprocessed == DCERPC_HDR_LEN + 14 + sstate->pad
+ sstate->secondaryaddrlen) { + sstate->secondaryaddrlen) {
@ -1072,11 +1111,19 @@ static int DCERPCParse(Flow *f, void *dcerpc_state,
< sstate->dcerpc.frag_length) { < sstate->dcerpc.frag_length) {
retval = DCERPCParseBINDACKCTXItem(f, dcerpc_state, pstate, input retval = DCERPCParseBINDACKCTXItem(f, dcerpc_state, pstate, input
+ parsed, input_len, output); + parsed, input_len, output);
if (retval) {
if (sstate->ctxbytesprocessed == 24) { if (sstate->ctxbytesprocessed == 24) {
sstate->ctxbytesprocessed = 0; sstate->ctxbytesprocessed = 0;
} }
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
} else if (input_len) {
SCLogDebug("Error parsing CTX Items");
parsed -= input_len;
input_len = 0;
sstate->numctxitemsleft = 0;
}
} }
SCLogDebug("BINDACK processed %u/%u\n", sstate->bytesprocessed, SCLogDebug("BINDACK processed %u/%u\n", sstate->bytesprocessed,
sstate->dcerpc.frag_length); sstate->dcerpc.frag_length);
@ -1092,16 +1139,29 @@ static int DCERPCParse(Flow *f, void *dcerpc_state,
&& input_len) { && input_len) {
retval = DCERPCParseREQUEST(f, dcerpc_state, pstate, retval = DCERPCParseREQUEST(f, dcerpc_state, pstate,
input + parsed, input_len, output); input + parsed, input_len, output);
if (retval) {
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
} else if (input_len) {
SCLogDebug("Error parsing DCERPC Request");
parsed -= input_len;
input_len = 0;
}
} }
while (sstate->bytesprocessed >= DCERPC_HDR_LEN + 8 while (sstate->bytesprocessed >= DCERPC_HDR_LEN + 8
&& sstate->bytesprocessed < sstate->dcerpc.frag_length && sstate->bytesprocessed < sstate->dcerpc.frag_length
&& input_len) { && input_len) {
retval = StubDataParser(f, dcerpc_state, pstate, input + parsed, retval = StubDataParser(f, dcerpc_state, pstate, input + parsed,
input_len, output); input_len, output);
if (retval) {
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
} else if (input_len) {
SCLogDebug("Error parsing DCERPC Stub Data");
parsed -= input_len;
input_len = 0;
}
} }
SCLogDebug("REQUEST processed %u/%u\n", sstate->bytesprocessed, SCLogDebug("REQUEST processed %u/%u\n", sstate->bytesprocessed,
sstate->dcerpc.frag_length); sstate->dcerpc.frag_length);

60
src/app-layer-smb.c
Unescape Escape View File

@ -553,9 +553,19 @@ static uint32_t PaddingParser(void *smb_state, AppLayerParserState *pstate,
SCEnter(); SCEnter();
SMBState *sstate = (SMBState *) smb_state; SMBState *sstate = (SMBState *) smb_state;
uint8_t *p = input; uint8_t *p = input;
printf("Inside Padding Parser");
/* Check for validity of dataoffset */
if (sstate->bytesprocessed > sstate->andx.dataoffset) {
printf("The offset was not valid.");
sstate->andx.paddingparsed = 1;
SCReturnUInt((uint32_t)(p - input));
}
printf("bytesprocessed %u data offset %"PRIu64" input_len %u\n",
sstate->bytesprocessed, sstate->andx.dataoffset, input_len);
while ((uint32_t) (sstate->bytesprocessed + (p - input)) while ((uint32_t) (sstate->bytesprocessed + (p - input))
< sstate->andx.dataoffset && sstate->bytecount.bytecount-- < sstate->andx.dataoffset && sstate->bytecount.bytecount--
&& input_len--) { && input_len--) {
printf("0x%02x", *p);
p++; p++;
} }
if ((uint32_t) (sstate->bytesprocessed + (p - input)) if ((uint32_t) (sstate->bytesprocessed + (p - input))
@ -697,14 +707,15 @@ static uint32_t SMBParseByteCount(Flow *f, void *smb_state,
if (((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) && sstate->smb.command if (((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) && sstate->smb.command
== SMB_COM_READ_ANDX) || (((sstate->smb.flags == SMB_COM_READ_ANDX) || (((sstate->smb.flags
& SMB_FLAGS_SERVER_TO_REDIR) == 0) && sstate->smb.command & SMB_FLAGS_SERVER_TO_REDIR) == 0) && sstate->smb.command
== SMB_COM_WRITE_ANDX) || == SMB_COM_WRITE_ANDX) || (sstate->smb.command
(sstate->smb.command == SMB_COM_TRANSACTION)) { == SMB_COM_TRANSACTION)) {
if (sstate->andx.paddingparsed == 0) { if (sstate->andx.paddingparsed == 0) {
retval = PaddingParser(sstate, pstate, input + parsed, input_len, retval = PaddingParser(sstate, pstate, input + parsed, input_len,
output); output);
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
} }
if (sstate->andx.datalength) { if (sstate->andx.datalength) {
retval = DataParser(sstate, pstate, input + parsed, input_len, retval = DataParser(sstate, pstate, input + parsed, input_len,
output); output);
@ -715,12 +726,13 @@ static uint32_t SMBParseByteCount(Flow *f, void *smb_state,
} }
while (sstate->bytecount.bytecount && input_len) { while (sstate->bytecount.bytecount && input_len) {
SCLogDebug("0x%02x bytecount %u input_len %u", *p, printf("0x%02x bytecount %u input_len %u", *p,
sstate->bytecount.bytecount, input_len); sstate->bytecount.bytecount, input_len);
p++; p++;
sstate->wordcount.wordcount--; sstate->bytecount.bytecount--;
input_len--; input_len--;
} }
printf("\n");
sstate->bytesprocessed += (p - input); sstate->bytesprocessed += (p - input);
SCReturnUInt((uint32_t)(p - input)); SCReturnUInt((uint32_t)(p - input));
} }
@ -971,13 +983,18 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
retval retval
= NBSSParseHeader(f, smb_state, pstate, input, input_len, = NBSSParseHeader(f, smb_state, pstate, input, input_len,
output); output);
if (retval) {
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
SCLogDebug( SCLogDebug(
"NBSS Header (%u/%u) Type 0x%02x Length 0x%04x parsed %ld input_len %u", "NBSS Header (%u/%u) Type 0x%02x Length 0x%04x parsed %ld input_len %u",
sstate->bytesprocessed, NBSS_HDR_LEN, sstate->nbss.type, sstate->bytesprocessed, NBSS_HDR_LEN, sstate->nbss.type,
sstate->nbss.length, parsed, input_len); sstate->nbss.length, parsed, input_len);
} else if (input_len) {
SCLogDebug("Error parsing NBSS Header\n");
parsed += input_len;
input_len = 0;
}
} }
switch (sstate->nbss.type) { switch (sstate->nbss.type) {
@ -986,12 +1003,18 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
&& sstate->bytesprocessed < NBSS_HDR_LEN + SMB_HDR_LEN)) { && sstate->bytesprocessed < NBSS_HDR_LEN + SMB_HDR_LEN)) {
retval = SMBParseHeader(f, smb_state, pstate, input + parsed, retval = SMBParseHeader(f, smb_state, pstate, input + parsed,
input_len, output); input_len, output);
if (retval) {
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
SCLogDebug( SCLogDebug(
"SMB Header (%u/%u) Command 0x%02x parsed %ld input_len %u", "SMB Header (%u/%u) Command 0x%02x parsed %ld input_len %u",
sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN, sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN,
sstate->smb.command, parsed, input_len); sstate->smb.command, parsed, input_len);
} else if (input_len) {
SCLogDebug("Error parsing SMB Word Count\n");
parsed += input_len;
input_len = 0;
}
} }
do { do {
@ -999,10 +1022,14 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
+ SMB_HDR_LEN)) { + SMB_HDR_LEN)) {
retval = SMBGetWordCount(f, smb_state, pstate, input + parsed, retval = SMBGetWordCount(f, smb_state, pstate, input + parsed,
input_len, output); input_len, output);
if (retval) {
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
SCLogDebug("wordcount (%u) parsed %ld input_len %u", } else if (input_len) {
sstate->wordcount.wordcount, parsed, input_len); SCLogDebug("Error parsing SMB Word Count\n");
parsed += input_len;
input_len = 0;
}
} }
while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN
@ -1010,8 +1037,14 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
+ SMB_HDR_LEN + 1 + sstate->wordcount.wordcount)) { + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount)) {
retval = SMBParseWordCount(f, smb_state, pstate, retval = SMBParseWordCount(f, smb_state, pstate,
input + parsed, input_len, output); input + parsed, input_len, output);
if (retval) {
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
} else if (input_len) {
SCLogDebug("Error parsing SMB Word Count Data\n");
parsed += input_len;
input_len = 0;
}
} }
while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN
@ -1020,8 +1053,14 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
+ sstate->wordcount.wordcount)) { + sstate->wordcount.wordcount)) {
retval = SMBGetByteCount(f, smb_state, pstate, input + parsed, retval = SMBGetByteCount(f, smb_state, pstate, input + parsed,
input_len, output); input_len, output);
if (retval) {
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
} else if (input_len) {
SCLogDebug("Error parsing SMB Byte Count\n");
parsed += input_len;
input_len = 0;
}
} }
while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN
@ -1029,10 +1068,17 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
&& sstate->bytesprocessed < NBSS_HDR_LEN + SMB_HDR_LEN + 3 && sstate->bytesprocessed < NBSS_HDR_LEN + SMB_HDR_LEN + 3
+ sstate->wordcount.wordcount + sstate->wordcount.wordcount
+ sstate->bytecount.bytecount)) { + sstate->bytecount.bytecount)) {
retval = SMBParseByteCount(f, smb_state, pstate, retval = SMBParseByteCount(f, smb_state, pstate,
input + parsed, input_len, output); input + parsed, input_len, output);
if (retval) {
parsed += retval; parsed += retval;
input_len -= retval; input_len -= retval;
} else if (input_len) {
SCLogDebug("Error parsing SMB Byte Count Data\n");
parsed += input_len;
input_len = 0;
}
} }
} while (sstate->andx.andxcommand != SMB_NO_SECONDARY_ANDX_COMMAND } while (sstate->andx.andxcommand != SMB_NO_SECONDARY_ANDX_COMMAND
&& input_len); && input_len);

Write Preview
Loading…
Cancel
Save