Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 23:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Adding one more case to the DCE_RPC defrag logic.

Browse source 
(and fixing a couple of compiler warnings)
This commit is contained in:
Robin Sommer 2016-10-25 16:44:50 -07:00
parent aab3819c70
commit 1f36ae61ba
4 changed files with 24 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

2
aux/btest

@ -1 +1 @@
Subproject commit 17d1c1547678bfd54ef1202db5415bc85c7ae794 Subproject commit 625dbecfd63022d79a144b9651085e68cdf99ce4

13
src/analyzer/protocol/dce-rpc/dce_rpc-protocol.pac
View file

@ -182,6 +182,15 @@ flow DCE_RPC_Flow(is_orig: bool) {
%{ %{
if ( ${header.firstfrag} ) if ( ${header.firstfrag} )
{ {
if ( fb.count(${header.call_id}) > 0 )
{
// We already had a first frag earlier.
reporter->Weird(connection()->bro_analyzer()->Conn(),
"multiple_first_fragments_in_dce_rpc_reassembly");
connection()->bro_analyzer()->SetSkip(true);
return false;
}
if ( ${header.lastfrag} ) if ( ${header.lastfrag} )
{ {
// all-in-one packet // all-in-one packet
@ -201,7 +210,7 @@ flow DCE_RPC_Flow(is_orig: bool) {
connection()->bro_analyzer()->SetSkip(true); connection()->bro_analyzer()->SetSkip(true);
} }
if ( fb[${header.call_id}]->data_length() > BifConst::DCE_RPC::max_frag_data ) if ( fb[${header.call_id}]->data_length() > (int)BifConst::DCE_RPC::max_frag_data )
{ {
reporter->Weird(connection()->bro_analyzer()->Conn(), reporter->Weird(connection()->bro_analyzer()->Conn(),
"too_much_dce_rpc_fragment_data"); "too_much_dce_rpc_fragment_data");
@ -216,7 +225,7 @@ flow DCE_RPC_Flow(is_orig: bool) {
// not the first frag, but we have a flow buffer so add to it // not the first frag, but we have a flow buffer so add to it
fb[${header.call_id}]->BufferData(frag.begin(), frag.end()); fb[${header.call_id}]->BufferData(frag.begin(), frag.end());
if ( fb[${header.call_id}]->data_length() > BifConst::DCE_RPC::max_frag_data ) if ( fb[${header.call_id}]->data_length() > (int)BifConst::DCE_RPC::max_frag_data )
{ {
reporter->Weird(connection()->bro_analyzer()->Conn(), reporter->Weird(connection()->bro_analyzer()->Conn(),
"too_much_dce_rpc_fragment_data"); "too_much_dce_rpc_fragment_data");