diff --git a/rust/src/dcerpc/dcerpc.rs b/rust/src/dcerpc/dcerpc.rs index 01296c0cb5..b22d2bffe6 100644 --- a/rust/src/dcerpc/dcerpc.rs +++ b/rust/src/dcerpc/dcerpc.rs @@ -618,7 +618,7 @@ impl DCERPCState { Ok((leftover_bytes, back)) => { for (uuid_internal_id, r) in back.ctxitems.iter().enumerate() { for uuid in self.interface_uuids.iter_mut().rev() { - if uuid.internal_id == uuid_internal_id as u16 && uuid.call_id == call_id{ + if uuid.internal_id == uuid_internal_id as u16 && uuid.call_id == call_id { uuid.result = r.ack_result; uuid.acked = true; if uuid.result == 0 { @@ -940,8 +940,10 @@ impl DCERPCState { } } DCERPC_TYPE_BINDACK | DCERPC_TYPE_ALTER_CONTEXT_RESP => { - let retval = - self.process_bindack_pdu(&cur_i[parsed as usize..fraglen as usize], hdr.call_id); + let retval = self.process_bindack_pdu( + &cur_i[parsed as usize..fraglen as usize], + hdr.call_id, + ); if retval == -1 { return AppLayerResult::err(); } diff --git a/rust/src/dcerpc/dcerpc_udp.rs b/rust/src/dcerpc/dcerpc_udp.rs index 27766e051a..cf72ff2dc3 100644 --- a/rust/src/dcerpc/dcerpc_udp.rs +++ b/rust/src/dcerpc/dcerpc_udp.rs @@ -15,23 +15,23 @@ * 02110-1301, USA. */ -use crate::core; use crate::applayer::{self, *}; +use crate::core; use crate::dcerpc::dcerpc::{ - DCERPCTransaction, DCERPC_MAX_TX, DCERPC_TYPE_REQUEST, DCERPC_TYPE_RESPONSE, PFCL1_FRAG, PFCL1_LASTFRAG, - get_alstate_progress, ALPROTO_DCERPC, PARSER_NAME, cfg_max_stub_size, + cfg_max_stub_size, get_alstate_progress, DCERPCTransaction, ALPROTO_DCERPC, DCERPC_MAX_TX, + DCERPC_TYPE_REQUEST, DCERPC_TYPE_RESPONSE, PARSER_NAME, PFCL1_FRAG, PFCL1_LASTFRAG, }; +use crate::dcerpc::parser; use crate::direction::{Direction, DIR_BOTH}; use crate::flow::Flow; use nom8::Err; +use std; +use std::collections::VecDeque; +use std::ffi::CString; use suricata_sys::sys::{ AppLayerParserState, AppProto, SCAppLayerParserConfParserEnabled, SCAppLayerProtoDetectConfProtoDetectionEnabled, SCAppLayerProtoDetectPMRegisterPatternCSwPP, }; -use std; -use std::ffi::CString; -use std::collections::VecDeque; -use crate::dcerpc::parser; // Constant DCERPC UDP Header length pub const DCERPC_UDP_HDR_LEN: i32 = 80; @@ -82,7 +82,7 @@ impl DCERPCUDPState { Default::default() } - fn create_tx(&mut self, hdr: &DCERPCHdrUdp) -> DCERPCTransaction { + fn create_tx(&mut self, hdr: &DCERPCHdrUdp) -> DCERPCTransaction { let mut tx = DCERPCTransaction::new(); tx.id = self.tx_id; tx.endianness = hdr.drep[0] & 0x10; @@ -107,13 +107,14 @@ impl DCERPCUDPState { } pub fn free_tx(&mut self, tx_id: u64) { - SCLogDebug!("Freeing TX with ID {} TX.ID {}", tx_id, tx_id+1); + SCLogDebug!("Freeing TX with ID {} TX.ID {}", tx_id, tx_id + 1); let len = self.transactions.len(); let mut found = false; let mut index = 0; for i in 0..len { let tx = &self.transactions[i]; - if tx.id == tx_id { //+ 1 { + if tx.id == tx_id { + //+ 1 { found = true; index = i; SCLogDebug!("tx {} progress {}/{}", tx.id, tx.req_done, tx.resp_done); @@ -121,8 +122,14 @@ impl DCERPCUDPState { } } if found { - SCLogDebug!("freeing TX with ID {} TX.ID {} at index {} left: {} max id: {}", - tx_id, tx_id+1, index, self.transactions.len(), self.tx_id); + SCLogDebug!( + "freeing TX with ID {} TX.ID {} at index {} left: {} max id: {}", + tx_id, + tx_id + 1, + index, + self.transactions.len(), + self.tx_id + ); self.tx_index_completed = 0; self.transactions.remove(index); } @@ -165,7 +172,13 @@ impl DCERPCUDPState { let mut otx = self.find_incomplete_tx(hdr); if otx.is_none() { let ntx = self.create_tx(hdr); - SCLogDebug!("new tx id {}, last tx_id {}, {} {}", ntx.id, self.tx_id, ntx.seqnum, ntx.activityuuid[0]); + SCLogDebug!( + "new tx id {}, last tx_id {}, {} {}", + ntx.id, + self.tx_id, + ntx.seqnum, + ntx.activityuuid[0] + ); self.transactions.push_back(ntx); otx = self.transactions.back_mut(); } @@ -182,7 +195,8 @@ impl DCERPCUDPState { if input.len() + tx.stub_data_buffer_ts.len() < max_size { tx.stub_data_buffer_ts.extend_from_slice(input); } else if tx.stub_data_buffer_ts.len() < max_size { - tx.stub_data_buffer_ts.extend_from_slice(&input[..max_size - tx.stub_data_buffer_ts.len()]); + tx.stub_data_buffer_ts + .extend_from_slice(&input[..max_size - tx.stub_data_buffer_ts.len()]); } if done { tx.req_done = true; @@ -194,7 +208,8 @@ impl DCERPCUDPState { if input.len() + tx.stub_data_buffer_tc.len() < max_size { tx.stub_data_buffer_tc.extend_from_slice(input); } else if tx.stub_data_buffer_tc.len() < max_size { - tx.stub_data_buffer_tc.extend_from_slice(&input[..max_size - tx.stub_data_buffer_tc.len()]); + tx.stub_data_buffer_tc + .extend_from_slice(&input[..max_size - tx.stub_data_buffer_tc.len()]); } if done { tx.resp_done = true; @@ -223,7 +238,11 @@ impl DCERPCUDPState { return AppLayerResult::err(); } if leftover_bytes.len() < header.fraglen as usize { - SCLogDebug!("Insufficient data: leftover_bytes {}, fraglen {}", leftover_bytes.len(), header.fraglen); + SCLogDebug!( + "Insufficient data: leftover_bytes {}, fraglen {}", + leftover_bytes.len(), + header.fraglen + ); return AppLayerResult::err(); } if !self.handle_fragment_data(&header, &leftover_bytes[..header.fraglen as usize]) { @@ -247,8 +266,7 @@ impl DCERPCUDPState { unsafe extern "C" fn parse( _flow: *mut Flow, state: *mut std::os::raw::c_void, _pstate: *mut AppLayerParserState, - stream_slice: StreamSlice, - _data: *mut std::os::raw::c_void, + stream_slice: StreamSlice, _data: *mut std::os::raw::c_void, ) -> AppLayerResult { let state = cast_pointer!(state, DCERPCUDPState); if !stream_slice.is_gap() { @@ -261,24 +279,23 @@ extern "C" fn state_free(state: *mut std::os::raw::c_void) { std::mem::drop(unsafe { Box::from_raw(state as *mut DCERPCUDPState) }); } -extern "C" fn state_new(_orig_state: *mut std::os::raw::c_void, _orig_proto: AppProto) -> *mut std::os::raw::c_void { +extern "C" fn state_new( + _orig_state: *mut std::os::raw::c_void, _orig_proto: AppProto, +) -> *mut std::os::raw::c_void { let state = DCERPCUDPState::new(); let boxed = Box::new(state); return Box::into_raw(boxed) as *mut _; } -unsafe extern "C" fn state_transaction_free( - state: *mut std::os::raw::c_void, tx_id: u64, -) { +unsafe extern "C" fn state_transaction_free(state: *mut std::os::raw::c_void, tx_id: u64) { let dce_state = cast_pointer!(state, DCERPCUDPState); SCLogDebug!("freeing tx {}", tx_id); dce_state.free_tx(tx_id); } unsafe extern "C" fn get_tx_data( - tx: *mut std::os::raw::c_void) - -> *mut suricata_sys::sys::AppLayerTxData -{ + tx: *mut std::os::raw::c_void, +) -> *mut suricata_sys::sys::AppLayerTxData { let tx = cast_pointer!(tx, DCERPCTransaction); return &mut tx.tx_data.0; } @@ -290,11 +307,11 @@ unsafe extern "C" fn get_tx( match dce_state.get_tx(tx_id) { Some(tx) => { return tx as *const _ as *mut _; - }, + } None => { return std::ptr::null_mut(); } - } + } } unsafe extern "C" fn get_tx_cnt(vtx: *mut std::os::raw::c_void) -> u64 { @@ -307,21 +324,21 @@ fn probe(input: &[u8]) -> (bool, bool) { match parser::parse_dcerpc_udp_header(input) { Ok((leftover_bytes, hdr)) => { let is_request = hdr.pkt_type == 0x00; - let is_dcerpc = hdr.rpc_vers == 0x04 && - hdr.fragnum == 0 && - leftover_bytes.len() >= hdr.fraglen as usize && - (hdr.flags2 & 0xfc == 0) && - (hdr.drep[0] & 0xee == 0) && - (hdr.drep[1] <= 3); + let is_dcerpc = hdr.rpc_vers == 0x04 + && hdr.fragnum == 0 + && leftover_bytes.len() >= hdr.fraglen as usize + && (hdr.flags2 & 0xfc == 0) + && (hdr.drep[0] & 0xee == 0) + && (hdr.drep[1] <= 3); return (is_dcerpc, is_request); - }, + } Err(_) => (false, false), } } -unsafe extern "C" fn probe_udp(_f: *const Flow, direction: u8, input: *const u8, - len: u32, rdir: *mut u8) -> AppProto -{ +unsafe extern "C" fn probe_udp( + _f: *const Flow, direction: u8, input: *const u8, len: u32, rdir: *mut u8, +) -> AppProto { SCLogDebug!("Probing the packet for DCERPC/UDP"); if len == 0 || input.is_null() { return core::ALPROTO_UNKNOWN; @@ -345,9 +362,18 @@ unsafe extern "C" fn probe_udp(_f: *const Flow, direction: u8, input: *const u8, fn register_pattern_probe() -> i8 { unsafe { - if SCAppLayerProtoDetectPMRegisterPatternCSwPP(core::IPPROTO_UDP, ALPROTO_DCERPC, - b"|04 00|\0".as_ptr() as *const std::os::raw::c_char, 2, 0, - Direction::ToServer.into(), Some(probe_udp), 0, 0) < 0 { + if SCAppLayerProtoDetectPMRegisterPatternCSwPP( + core::IPPROTO_UDP, + ALPROTO_DCERPC, + b"|04 00|\0".as_ptr() as *const std::os::raw::c_char, + 2, + 0, + Direction::ToServer.into(), + Some(probe_udp), + 0, + 0, + ) < 0 + { SCLogDebug!("TOSERVER => SCAppLayerProtoDetectPMRegisterPatternCSwPP FAILED"); return -1; } diff --git a/rust/src/dcerpc/detect.rs b/rust/src/dcerpc/detect.rs index f0c31cd3bf..99498bdacb 100644 --- a/rust/src/dcerpc/detect.rs +++ b/rust/src/dcerpc/detect.rs @@ -113,7 +113,7 @@ fn match_backuuid( if let Some(x) = &if_data.du16 { if !detect_match_uint(x, uuidentry.version) { SCLogDebug!("Interface version did not match"); - continue + continue; } } @@ -408,7 +408,6 @@ unsafe extern "C" fn dcerpc_stub_data_setup( pub const DETECT_CI_FLAGS_DCE_LE: u8 = 1 << 2; pub const DETECT_CI_FLAGS_DCE_BE: u8 = 1 << 3; - unsafe extern "C" fn dcerpc_tx_get_stub_data( det_ctx: *mut DetectEngineThreadCtx, transforms: *const DetectEngineTransforms, _flow: *mut Flow, dir: u8, tx: *mut c_void, list_id: c_int, diff --git a/rust/src/dcerpc/mod.rs b/rust/src/dcerpc/mod.rs index 800d2ade73..68dbaf6899 100644 --- a/rust/src/dcerpc/mod.rs +++ b/rust/src/dcerpc/mod.rs @@ -19,6 +19,6 @@ pub mod dcerpc; pub mod dcerpc_udp; -pub mod parser; pub mod detect; pub mod log; +pub mod parser; diff --git a/rust/src/dcerpc/parser.rs b/rust/src/dcerpc/parser.rs index 23b95259cd..a80126b1c7 100644 --- a/rust/src/dcerpc/parser.rs +++ b/rust/src/dcerpc/parser.rs @@ -20,9 +20,9 @@ use crate::dcerpc::dcerpc::{ use crate::dcerpc::dcerpc_udp::DCERPCHdrUdp; use nom8::bytes::streaming::take; use nom8::combinator::cond; +use nom8::multi::count; use nom8::number::complete::{le_u16, le_u32, le_u8, u16, u32}; use nom8::number::Endianness; -use nom8::multi::count; use nom8::{IResult, Parser}; fn uuid_to_vec(uuid: Uuid) -> Vec { @@ -77,7 +77,11 @@ pub(super) fn parse_dcerpc_udp_header(i: &[u8]) -> IResult<&[u8], DCERPCHdrUdp> let (i, flags1) = le_u8.parse(i)?; let (i, flags2) = le_u8.parse(i)?; let (i, drep) = take(3_usize).parse(i)?; - let endianness = if drep[0] == 0 { Endianness::Big } else { Endianness::Little }; + let endianness = if drep[0] == 0 { + Endianness::Big + } else { + Endianness::Little + }; let (i, serial_hi) = le_u8.parse(i)?; let (i, objectuuid) = take(16_usize).parse(i)?; let (i, interfaceuuid) = take(16_usize).parse(i)?; @@ -104,21 +108,21 @@ pub(super) fn parse_dcerpc_udp_header(i: &[u8]) -> IResult<&[u8], DCERPCHdrUdp> Err(_e) => { SCLogDebug!("{}", _e); vec![0] - }, + } }, interfaceuuid: match parse_uuid(interfaceuuid) { Ok((_, vect)) => assemble_uuid(vect), Err(_e) => { SCLogDebug!("{}", _e); vec![0] - }, + } }, - activityuuid: match parse_uuid(activityuuid){ + activityuuid: match parse_uuid(activityuuid) { Ok((_, vect)) => assemble_uuid(vect), Err(_e) => { SCLogDebug!("{}", _e); vec![0] - }, + } }, server_boot, if_vers, @@ -136,9 +140,9 @@ pub(super) fn parse_dcerpc_udp_header(i: &[u8]) -> IResult<&[u8], DCERPCHdrUdp> pub(super) fn parse_dcerpc_bindack_result(i: &[u8]) -> IResult<&[u8], DCERPCBindAckResult> { let (i, ack_result) = le_u16.parse(i)?; - let (i, ack_reason) = le_u16.parse(i)?; - let (i, transfer_syntax) = take(16_usize).parse(i)?; - let (i, syntax_version) = le_u32.parse(i)?; + let (i, ack_reason) = le_u16.parse(i)?; + let (i, transfer_syntax) = take(16_usize).parse(i)?; + let (i, syntax_version) = le_u32.parse(i)?; let result = DCERPCBindAckResult { ack_result, ack_reason, @@ -154,7 +158,10 @@ pub(super) fn parse_dcerpc_bindack(i: &[u8]) -> IResult<&[u8], DCERPCBindAck> { let (i, _assoc_group) = take(4_usize).parse(i)?; let (i, sec_addr_len) = le_u16.parse(i)?; let (i, _) = take(sec_addr_len).parse(i)?; - let (i, _) = cond((sec_addr_len.wrapping_add(2)) % 4 != 0, |b| take(4 - (sec_addr_len.wrapping_add(2)) % 4).parse(b)).parse(i)?; + let (i, _) = cond((sec_addr_len.wrapping_add(2)) % 4 != 0, |b| { + take(4 - (sec_addr_len.wrapping_add(2)) % 4).parse(b) + }) + .parse(i)?; let (i, numctxitems) = le_u8.parse(i)?; let (i, _) = take(3_usize).parse(i)?; // Padding let (i, ctxitems) = count(parse_dcerpc_bindack_result, numctxitems as usize).parse(i)?; @@ -184,7 +191,9 @@ pub(super) fn parse_bindctx_item(i: &[u8], endianness: Endianness) -> IResult<&[ _ => uuid_to_vec(vect), }, // Shouldn't happen - Err(_e) => {vec![0]}, + Err(_e) => { + vec![0] + } }, version, versionminor, @@ -211,7 +220,11 @@ pub(super) fn parse_dcerpc_header(i: &[u8]) -> IResult<&[u8], DCERPCHdr> { let (i, hdrtype) = le_u8.parse(i)?; let (i, pfc_flags) = le_u8.parse(i)?; let (i, packed_drep) = take(4_usize).parse(i)?; - let endianness = if packed_drep[0] & 0x10 == 0 { Endianness::Big } else { Endianness::Little }; + let endianness = if packed_drep[0] & 0x10 == 0 { + Endianness::Big + } else { + Endianness::Little + }; let (i, frag_length) = u16(endianness).parse(i)?; let (i, auth_length) = u16(endianness).parse(i)?; let (i, call_id) = u32(endianness).parse(i)?; @@ -228,7 +241,9 @@ pub(super) fn parse_dcerpc_header(i: &[u8]) -> IResult<&[u8], DCERPCHdr> { Ok((i, header)) } -pub(super) fn parse_dcerpc_request(i: &[u8], endianness: Endianness) -> IResult<&[u8], DCERPCRequest> { +pub(super) fn parse_dcerpc_request( + i: &[u8], endianness: Endianness, +) -> IResult<&[u8], DCERPCRequest> { let (i, _pad) = take(4_usize).parse(i)?; let (i, ctxid) = u16(endianness).parse(i)?; let (i, opnum) = u16(endianness).parse(i)?; diff --git a/scripts/rustfmt.sh b/scripts/rustfmt.sh index 2472b46e81..75a81a740b 100755 --- a/scripts/rustfmt.sh +++ b/scripts/rustfmt.sh @@ -41,4 +41,4 @@ rustfmt --check rust/src/dns/*.rs rust/src/applayertemplate/*.rs rust/src/asn1/* rust/src/http2/*.rs rust/src/ike/*.rs rust/src/modbus/*.rs rust/src/mqtt/*.rs \ rust/src/nfs/*.rs rust/src/pgsql/*.rs rust/src/rdp/*.rs rust/src/sdp/*.rs \ rust/src/sip/*.rs rust/src/telnet/*.rs rust/src/tftp/*.rs rust/src/x509/*.rs \ - rust/src/snmp/*.rs rust/src/llmnr/*.rs rust/src/detect/*.rs + rust/src/snmp/*.rs rust/src/llmnr/*.rs rust/src/detect/*.rs rust/src/dcerpc/*.rs