Merge pull request #1366 in SNORT/snort3 from offload_dce_endian to master

Squashed commit of the following:

commit 644b30b61449d3d1e08f09e1032e8c3a5ca72421
Author: Carter Waxman <cwaxman@cisco.com>
Date:   Wed Sep 19 16:44:10 2018 -0400

    DCERPC: fixed setting endianness on one packet and checking on another

diff --git a/src/service_inspectors/dce_rpc/dce_co.cc b/src/service_inspectors/dce_rpc/dce_co.cc
index cc6a42920f6972ff071364c400d70f6dcba18994..fbb222dfc86f3b56bf35beec037fbe5caaef32d2 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_co.cc
+++ b/src/service_inspectors/dce_rpc/dce_co.cc
@@ -147,8 +147,7 @@ void DCE2_CoCleanTracker(DCE2_CoTracker* cot)
  * The reassembly buffer used is big enough for the headers.
  *
  ********************************************************************/
-static inline void DCE2_CoSetRdata(DCE2_SsnData* sd, DCE2_CoTracker* cot,
-    uint8_t* co_ptr, uint16_t stub_len)
+static inline void DCE2_CoSetRdata(DCE2_CoTracker* cot, uint8_t* co_ptr, uint16_t stub_len)
 {
     DceRpcCoHdr* co_hdr = (DceRpcCoHdr*)co_ptr;
     /* If we've set the fragment tracker context id or opnum, use them. */
@@ -159,7 +158,7 @@ static inline void DCE2_CoSetRdata(DCE2_SsnData* sd, DCE2_CoTracker* cot,
         (cot->frag_tracker.opnum != DCE2_SENTINEL) ?
         (uint16_t)cot->frag_tracker.opnum : (uint16_t)cot->opnum;
 
-    if (DCE2_SsnFromClient(sd->wire_pkt))
+    if ( DetectionEngine::get_current_packet()->is_from_client() )
     {
         DceRpcCoRequest* co_req = (DceRpcCoRequest*)((uint8_t*)co_hdr + sizeof(DceRpcCoHdr));
         /* Doesn't really matter if this wraps ... it is basically just for presentation */
@@ -203,9 +202,9 @@ void DCE2_CoInitRdata(uint8_t* co_ptr, int dir)
         co_hdr->ptype = DCERPC_PDU_TYPE__RESPONSE;
 }
 
-static inline DCE2_CoSeg* DCE2_CoGetSegPtr(DCE2_SsnData* sd, DCE2_CoTracker* cot)
+static inline DCE2_CoSeg* DCE2_CoGetSegPtr(DCE2_CoTracker* cot)
 {
-    if (DCE2_SsnFromServer(sd->wire_pkt))
+    if ( DetectionEngine::get_current_packet()->is_from_server() )
         return &cot->srv_seg;
 
     return &cot->cli_seg;
@@ -404,7 +403,7 @@ static DCE2_Ret DCE2_CoHdrChecks(DCE2_SsnData* sd, DCE2_CoTracker* cot, const Dc
         return DCE2_RET__ERROR;
     }
 
-    if (DCE2_SsnFromClient(sd->wire_pkt) && (cot->max_xmit_frag != DCE2_SENTINEL))
+    if (DetectionEngine::get_current_packet()->is_from_client() && (cot->max_xmit_frag != DCE2_SENTINEL))
     {
         if (frag_len > cot->max_xmit_frag)
         {
@@ -1019,15 +1018,9 @@ static int DCE2_CoGetAuthLen(DCE2_SsnData* sd, const DceRpcCoHdr* co_hdr,
     return (int)auth_len;
 }
 
-/********************************************************************
- * Function: DCE2_CoGetFragBuf()
- *
- * Returns the appropriate fragmentation buffer.
- *
- ********************************************************************/
-static DCE2_Buffer* DCE2_CoGetFragBuf(DCE2_SsnData* sd, DCE2_CoFragTracker* ft)
+static DCE2_Buffer* DCE2_CoGetFragBuf(DCE2_CoFragTracker* ft)
 {
-    if (DCE2_SsnFromServer(sd->wire_pkt))
+    if ( DetectionEngine::get_current_packet()->is_from_server() )
         return ft->srv_stub_buf;
 
     return ft->cli_stub_buf;
@@ -1099,8 +1092,8 @@ static DCE2_RpktType DCE2_CoGetRpktType(DCE2_SsnData* sd, DCE2_BufType btype)
 static Packet* DCE2_CoGetRpkt(DCE2_SsnData* sd, DCE2_CoTracker* cot,
     DCE2_CoRpktType co_rtype, DCE2_RpktType* rtype)
 {
-    DCE2_CoSeg* seg_buf = DCE2_CoGetSegPtr(sd, cot);
-    DCE2_Buffer* frag_buf = DCE2_CoGetFragBuf(sd, &cot->frag_tracker);
+    DCE2_CoSeg* seg_buf = DCE2_CoGetSegPtr(cot);
+    DCE2_Buffer* frag_buf = DCE2_CoGetFragBuf(&cot->frag_tracker);
     const uint8_t* frag_data = nullptr, * seg_data = nullptr;
     uint32_t frag_len = 0, seg_len = 0;
     Packet* rpkt = nullptr;
@@ -1182,7 +1175,7 @@ static Packet* DCE2_CoGetRpkt(DCE2_SsnData* sd, DCE2_CoTracker* cot,
 
     if ( frag_data )
     {
-        rpkt = DCE2_GetRpkt(sd->wire_pkt, *rtype, frag_data, frag_len);
+        rpkt = DCE2_GetRpkt(DetectionEngine::get_current_packet(), *rtype, frag_data, frag_len);
 
         if ( rpkt and seg_data )
         {
@@ -1192,7 +1185,7 @@ static Packet* DCE2_CoGetRpkt(DCE2_SsnData* sd, DCE2_CoTracker* cot,
     }
     else if ( seg_data )
     {
-        rpkt = DCE2_GetRpkt(sd->wire_pkt, *rtype, seg_data, seg_len);
+        rpkt = DCE2_GetRpkt(DetectionEngine::get_current_packet(), *rtype, seg_data, seg_len);
     }
 
     return rpkt;
@@ -1202,10 +1195,10 @@ static Packet* dce_co_reassemble(DCE2_SsnData* sd, DCE2_CoTracker* cot,
     DCE2_CoRpktType co_rtype, const DceRpcCoHdr** co_hdr)
 {
     dce2CommonStats* dce_common_stats = dce_get_proto_stats_ptr(sd);
-    int co_hdr_len = DCE2_SsnFromClient(sd->wire_pkt) ? DCE2_MOCK_HDR_LEN__CO_CLI :
-        DCE2_MOCK_HDR_LEN__CO_SRV;
-    int smb_hdr_len = DCE2_SsnFromClient(sd->wire_pkt) ? DCE2_MOCK_HDR_LEN__SMB_CLI :
-        DCE2_MOCK_HDR_LEN__SMB_SRV;
+    bool from_client = DetectionEngine::get_current_packet()->is_from_client();
+
+    int co_hdr_len = from_client ? DCE2_MOCK_HDR_LEN__CO_CLI : DCE2_MOCK_HDR_LEN__CO_SRV;
+    int smb_hdr_len = from_client ? DCE2_MOCK_HDR_LEN__SMB_CLI : DCE2_MOCK_HDR_LEN__SMB_SRV;
 
     if (sd->trans == DCE2_TRANS_TYPE__TCP)
     {
@@ -1233,17 +1226,17 @@ static Packet* dce_co_reassemble(DCE2_SsnData* sd, DCE2_CoTracker* cot,
 
         if (rpkt_type == DCE2_RPKT_TYPE__SMB_CO_FRAG)
         {
-            DCE2_CoSetRdata(sd, cot, wrdata + smb_hdr_len,
+            DCE2_CoSetRdata(cot, wrdata + smb_hdr_len,
                 (uint16_t)(rpkt->dsize - (smb_hdr_len + co_hdr_len)));
 
-            if (DCE2_SsnFromClient(sd->wire_pkt))
+            if ( from_client )
                 dce_common_stats->co_cli_frag_reassembled++;
             else
                 dce_common_stats->co_srv_frag_reassembled++;
         }
         else
         {
-            if (DCE2_SsnFromClient(sd->wire_pkt))
+            if ( from_client )
                 dce_common_stats->co_cli_seg_reassembled++;
             else
                 dce_common_stats->co_srv_seg_reassembled++;
@@ -1257,16 +1250,16 @@ static Packet* dce_co_reassemble(DCE2_SsnData* sd, DCE2_CoTracker* cot,
     case DCE2_RPKT_TYPE__TCP_CO_SEG:
         if (rpkt_type == DCE2_RPKT_TYPE__TCP_CO_FRAG)
         {
-            DCE2_CoSetRdata(sd, cot, wrdata, (uint16_t)(rpkt->dsize - co_hdr_len));
+            DCE2_CoSetRdata(cot, wrdata, (uint16_t)(rpkt->dsize - co_hdr_len));
 
-            if (DCE2_SsnFromClient(sd->wire_pkt))
+            if ( from_client )
                 dce_common_stats->co_cli_frag_reassembled++;
             else
                 dce_common_stats->co_srv_frag_reassembled++;
         }
         else
         {
-            if (DCE2_SsnFromClient(sd->wire_pkt))
+            if ( from_client )
                 dce_common_stats->co_cli_seg_reassembled++;
             else
                 dce_common_stats->co_cli_seg_reassembled++;
@@ -1319,6 +1312,7 @@ static DCE2_Ret dce_co_handle_frag(DCE2_SsnData* sd, DCE2_CoTracker* cot,
     DCE2_BufferMinAddFlag mflag = DCE2_BUFFER_MIN_ADD_FLAG__USE;
     DCE2_Ret status;
     dce2CommonStats* dce_common_stats = dce_get_proto_stats_ptr(sd);
+    Packet* p = DetectionEngine::get_current_packet();
 
     if (sd->trans == DCE2_TRANS_TYPE__TCP)
     {
@@ -1329,7 +1323,7 @@ static DCE2_Ret dce_co_handle_frag(DCE2_SsnData* sd, DCE2_CoTracker* cot,
         Profile profile(dce2_smb_pstat_co_frag);
     }
 
-    if (DCE2_SsnFromClient(sd->wire_pkt))
+    if ( p->is_from_client() )
     {
         if (frag_len > dce_common_stats->co_cli_max_frag_size)
             dce_common_stats->co_cli_max_frag_size = frag_len;
@@ -1350,7 +1344,7 @@ static DCE2_Ret dce_co_handle_frag(DCE2_SsnData* sd, DCE2_CoTracker* cot,
 
     if (frag_buf == nullptr)
     {
-        if (DCE2_SsnFromServer(sd->wire_pkt))
+        if ( p->is_from_server() )
         {
             cot->frag_tracker.srv_stub_buf =
                 DCE2_BufferNew(size, DCE2_CO__MIN_ALLOC_SIZE);
@@ -1419,14 +1413,14 @@ static void DCE2_CoHandleFrag(DCE2_SsnData* sd, DCE2_CoTracker* cot,
     const DceRpcCoHdr* co_hdr, const uint8_t* frag_ptr, uint16_t frag_len)
 {
     DCE2_Ret ret_val;
-    DCE2_Buffer* frag_buf = DCE2_CoGetFragBuf(sd, &cot->frag_tracker);
+    DCE2_Buffer* frag_buf = DCE2_CoGetFragBuf(&cot->frag_tracker);
     uint16_t max_frag_data;
 
     /* Check for potential overflow */
     if (sd->trans == DCE2_TRANS_TYPE__SMB)
-        max_frag_data = DCE2_GetRpktMaxData(sd, DCE2_RPKT_TYPE__SMB_CO_FRAG);
+        max_frag_data = DCE2_GetRpktMaxData(DCE2_RPKT_TYPE__SMB_CO_FRAG);
     else
-        max_frag_data = DCE2_GetRpktMaxData(sd, DCE2_RPKT_TYPE__TCP_CO_FRAG);
+        max_frag_data = DCE2_GetRpktMaxData(DCE2_RPKT_TYPE__TCP_CO_FRAG);
 
     ret_val = dce_co_handle_frag(sd, cot,co_hdr, frag_ptr, frag_len,frag_buf,max_frag_data);
     if (ret_val == DCE2_RET__SUCCESS)
@@ -1526,7 +1520,7 @@ static void DCE2_CoRequest(DCE2_SsnData* sd, DCE2_CoTracker* cot,
         int auth_len = DCE2_CoGetAuthLen(sd, co_hdr, frag_ptr, frag_len);
         if (auth_len == -1)
             return;
-        DCE2_CoSetRopts(sd, cot, co_hdr, sd->wire_pkt);
+        DCE2_CoSetRopts(sd, cot, co_hdr, DetectionEngine::get_current_packet() );
     }
     else
     {
@@ -1631,7 +1625,7 @@ static void DCE2_CoRequest(DCE2_SsnData* sd, DCE2_CoTracker* cot,
             break;
         }
 
-        DCE2_CoSetRopts(sd, cot, co_hdr, sd->wire_pkt);
+        DCE2_CoSetRopts(sd, cot, co_hdr, DetectionEngine::get_current_packet() );
 
         /* If we're configured to do defragmentation */
         if (DCE2_GcDceDefrag((dce2CommonProtoConf*)sd->config))
@@ -1729,13 +1723,15 @@ static void DCE2_CoResponse(DCE2_SsnData* sd, DCE2_CoTracker* cot,
     cot->ctx_id = ctx_id;
     cot->call_id = DceRpcCoCallId(co_hdr);
 
+    Packet* p = DetectionEngine::get_current_packet();
+
     if (DceRpcCoFirstFrag(co_hdr) && DceRpcCoLastFrag(co_hdr))
     {
         int auth_len = DCE2_CoGetAuthLen(sd, co_hdr, frag_ptr, frag_len);
 
         if (auth_len == -1)
             return;
-        DCE2_CoSetRopts(sd, cot, co_hdr, sd->wire_pkt);
+        DCE2_CoSetRopts(sd, cot, co_hdr, p);
     }
     else
     {
@@ -1746,7 +1742,7 @@ static void DCE2_CoResponse(DCE2_SsnData* sd, DCE2_CoTracker* cot,
         if (auth_len == -1)
             return;
 
-        DCE2_CoSetRopts(sd, cot, co_hdr, sd->wire_pkt);
+        DCE2_CoSetRopts(sd, cot, co_hdr, p);
 
         /* If we're configured to do defragmentation */
         if (DCE2_GcDceDefrag((dce2CommonProtoConf*)sd->config))
@@ -1779,7 +1775,7 @@ static void DCE2_CoDecode(DCE2_SsnData* sd, DCE2_CoTracker* cot,
     DCE2_MOVE(frag_ptr, frag_len, sizeof(DceRpcCoHdr));
 
     /* Client specific pdu types - some overlap with server */
-    if (DCE2_SsnFromClient(sd->wire_pkt))
+    if ( DetectionEngine::get_current_packet()->is_from_client() )
     {
         switch (pdu_type)
         {
@@ -1981,9 +1977,9 @@ static DCE2_Ret DCE2_CoSegEarlyRequest(DCE2_CoTracker* cot,
  ********************************************************************/
 static void DCE2_CoEarlyReassemble(DCE2_SsnData* sd, DCE2_CoTracker* cot)
 {
-    DCE2_Buffer* frag_buf = DCE2_CoGetFragBuf(sd, &cot->frag_tracker);
+    DCE2_Buffer* frag_buf = DCE2_CoGetFragBuf(&cot->frag_tracker);
 
-    if (DCE2_SsnFromServer(sd->wire_pkt))
+    if ( DetectionEngine::get_current_packet()->is_from_server() )
         return;
 
     if (!DCE2_BufferIsEmpty(frag_buf))
@@ -2050,9 +2046,9 @@ static void DCE2_CoEarlyReassemble(DCE2_SsnData* sd, DCE2_CoTracker* cot)
 static Packet* DCE2_CoGetSegRpkt(DCE2_SsnData* sd,
     const uint8_t* data_ptr, uint32_t data_len)
 {
+    Packet* p = DetectionEngine::get_current_packet();
     Packet* rpkt = nullptr;
-    int smb_hdr_len = DCE2_SsnFromClient(sd->wire_pkt) ? DCE2_MOCK_HDR_LEN__SMB_CLI :
-        DCE2_MOCK_HDR_LEN__SMB_SRV;
+    int smb_hdr_len = p->is_from_client() ? DCE2_MOCK_HDR_LEN__SMB_CLI : DCE2_MOCK_HDR_LEN__SMB_SRV;
 
     if (sd->trans == DCE2_TRANS_TYPE__TCP)
     {
@@ -2066,7 +2062,7 @@ static Packet* DCE2_CoGetSegRpkt(DCE2_SsnData* sd,
     switch (sd->trans)
     {
     case DCE2_TRANS_TYPE__SMB:
-        rpkt = DCE2_GetRpkt(sd->wire_pkt, DCE2_RPKT_TYPE__SMB_CO_SEG, data_ptr, data_len);
+        rpkt = DCE2_GetRpkt(p, DCE2_RPKT_TYPE__SMB_CO_SEG, data_ptr, data_len);
 
         if ( !rpkt )
             return nullptr;
@@ -2077,7 +2073,7 @@ static Packet* DCE2_CoGetSegRpkt(DCE2_SsnData* sd,
 
     case DCE2_TRANS_TYPE__TCP:
         // FIXIT-M add HTTP cases when it is ported
-        rpkt = DCE2_GetRpkt(sd->wire_pkt, DCE2_RPKT_TYPE__TCP_CO_SEG, data_ptr, data_len);
+        rpkt = DCE2_GetRpkt(p, DCE2_RPKT_TYPE__TCP_CO_SEG, data_ptr, data_len);
         break;
 
     default:
@@ -2101,13 +2097,19 @@ static void DCE2_CoSegDecode(DCE2_SsnData* sd, DCE2_CoTracker* cot, DCE2_CoSeg*
     const uint8_t* frag_ptr = nullptr;
     uint16_t frag_len = 0;
     dce2CommonStats* dce_common_stats = dce_get_proto_stats_ptr(sd);
-    int smb_hdr_len = DCE2_SsnFromClient(sd->wire_pkt) ? DCE2_MOCK_HDR_LEN__SMB_CLI :
-        DCE2_MOCK_HDR_LEN__SMB_SRV;
-
-    if (DCE2_SsnFromClient(sd->wire_pkt))
+    int smb_hdr_len;
+    
+    if ( DetectionEngine::get_current_packet()->is_from_client() )
+    {
+        smb_hdr_len = DCE2_MOCK_HDR_LEN__SMB_CLI;
         dce_common_stats->co_cli_seg_reassembled++;
+    }
     else
+    {
+        smb_hdr_len = DCE2_MOCK_HDR_LEN__SMB_SRV;
         dce_common_stats->co_srv_seg_reassembled++;
+    }
+
 
     Packet* rpkt = DCE2_CoGetSegRpkt(sd, DCE2_BufferData(seg->buf), DCE2_BufferLength(seg->buf));
 
@@ -2252,7 +2254,7 @@ static DCE2_Ret DCE2_CoHandleSegmentation(DCE2_SsnData* sd, DCE2_CoSeg* seg,
 void DCE2_CoProcess(DCE2_SsnData* sd, DCE2_CoTracker* cot,
     const uint8_t* data_ptr, uint16_t data_len)
 {
-    DCE2_CoSeg* seg = DCE2_CoGetSegPtr(sd, cot);
+    DCE2_CoSeg* seg = DCE2_CoGetSegPtr(cot);
     dce2CommonStats* dce_common_stats = dce_get_proto_stats_ptr(sd);
     uint32_t num_frags = 0;
 

diff --git a/src/service_inspectors/dce_rpc/dce_common.cc b/src/service_inspectors/dce_rpc/dce_common.cc
index a9ef1abcf55790b51ffa1a8486c40c681630b9e1..2798fe6ad6549f209d0a230c7a855215f3934984 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_common.cc
+++ b/src/service_inspectors/dce_rpc/dce_common.cc
@@ -245,9 +245,9 @@ bool DceEndianness::get_offset_endianness(int32_t offset, uint8_t& endian)
     return true;
 }
 
-uint16_t DCE2_GetRpktMaxData(DCE2_SsnData* sd, DCE2_RpktType rtype)
+uint16_t DCE2_GetRpktMaxData(DCE2_RpktType rtype)
 {
-    snort::Packet* p = sd->wire_pkt;
+    snort::Packet* p = DetectionEngine::get_current_packet();
     uint16_t overhead = 0;
 
     switch (rtype)
@@ -257,14 +257,14 @@ uint16_t DCE2_GetRpktMaxData(DCE2_SsnData* sd, DCE2_RpktType rtype)
         break;
 
     case DCE2_RPKT_TYPE__SMB_CO_SEG:
-        if (DCE2_SsnFromClient(p))
+        if (p->is_from_client())
             overhead += DCE2_MOCK_HDR_LEN__SMB_CLI;
         else
             overhead += DCE2_MOCK_HDR_LEN__SMB_SRV;
         break;
 
     case DCE2_RPKT_TYPE__SMB_CO_FRAG:
-        if (DCE2_SsnFromClient(p))
+        if (p->is_from_client())
             overhead += DCE2_MOCK_HDR_LEN__SMB_CLI + DCE2_MOCK_HDR_LEN__CO_CLI;
         else
             overhead += DCE2_MOCK_HDR_LEN__SMB_SRV + DCE2_MOCK_HDR_LEN__CO_SRV;
@@ -273,7 +273,7 @@ uint16_t DCE2_GetRpktMaxData(DCE2_SsnData* sd, DCE2_RpktType rtype)
     case DCE2_RPKT_TYPE__TCP_CO_SEG:
         break;
     case DCE2_RPKT_TYPE__TCP_CO_FRAG:
-        if (DCE2_SsnFromClient(p))
+        if (p->is_from_client())
             overhead += DCE2_MOCK_HDR_LEN__CO_CLI;
         else
             overhead += DCE2_MOCK_HDR_LEN__CO_SRV;
@@ -316,7 +316,7 @@ snort::Packet* DCE2_GetRpkt(snort::Packet* p,DCE2_RpktType rpkt_type,
 
     case DCE2_RPKT_TYPE__SMB_TRANS:
         rpkt->pseudo_type = PSEUDO_PKT_SMB_TRANS;
-        if (DCE2_SsnFromClient(p))
+        if (p->is_from_client())
         {
             data_overhead = DCE2_MOCK_HDR_LEN__SMB_CLI;
             memset(wrdata, 0, data_overhead);
@@ -332,7 +332,7 @@ snort::Packet* DCE2_GetRpkt(snort::Packet* p,DCE2_RpktType rpkt_type,
 
     case DCE2_RPKT_TYPE__SMB_CO_SEG:
         rpkt->pseudo_type = PSEUDO_PKT_DCE_SEG;
-        if (DCE2_SsnFromClient(p))
+        if (p->is_from_client())
         {
             data_overhead = DCE2_MOCK_HDR_LEN__SMB_CLI;
             memset(wrdata, 0, data_overhead);
@@ -348,7 +348,7 @@ snort::Packet* DCE2_GetRpkt(snort::Packet* p,DCE2_RpktType rpkt_type,
 
     case DCE2_RPKT_TYPE__SMB_CO_FRAG:
         rpkt->pseudo_type = PSEUDO_PKT_DCE_FRAG;
-        if (DCE2_SsnFromClient(p))
+        if (p->is_from_client())
         {
             data_overhead = DCE2_MOCK_HDR_LEN__SMB_CLI + DCE2_MOCK_HDR_LEN__CO_CLI;
             memset(wrdata, 0, data_overhead);
@@ -378,7 +378,7 @@ snort::Packet* DCE2_GetRpkt(snort::Packet* p,DCE2_RpktType rpkt_type,
         if (rpkt_type == DCE2_RPKT_TYPE__TCP_CO_FRAG)
         {
             rpkt->pseudo_type = PSEUDO_PKT_DCE_FRAG;
-            if (DCE2_SsnFromClient(p))
+            if (p->is_from_client())
             {
                 data_overhead = DCE2_MOCK_HDR_LEN__CO_CLI;
                 memset(wrdata, 0, data_overhead);

diff --git a/src/service_inspectors/dce_rpc/dce_common.h b/src/service_inspectors/dce_rpc/dce_common.h
index 10d414cb84331746953e33f3d983731b538ccbce..b43ba2c9bfcb37cf9a2d2189ee5eaeaa2959f1e1 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_common.h
+++ b/src/service_inspectors/dce_rpc/dce_common.h
@@ -200,7 +200,6 @@ struct DCE2_SsnData
     DCE2_Policy server_policy;
     DCE2_Policy client_policy;
     int flags;
-    snort::Packet* wire_pkt;
     uint64_t alert_mask;
     DCE2_Roptions ropts;
     void* config;
@@ -261,21 +260,11 @@ inline uint16_t DCE2_GcMaxFragLen(dce2CommonProtoConf* config)
     return UINT16_MAX;
 }
 
-inline int DCE2_SsnFromServer(snort::Packet* p)
-{
-    return p->is_from_server();
-}
-
-inline int DCE2_SsnFromClient(snort::Packet* p)
-{
-    return p->is_from_client();
-}
-
 inline DCE2_Policy DCE2_SsnGetPolicy(DCE2_SsnData* sd)
 {
     assert(sd);
 
-    if (DCE2_SsnFromClient(sd->wire_pkt))
+    if ( snort::DetectionEngine::get_current_packet()->is_from_client() )
         return sd->server_policy;
     else
         return sd->client_policy;
@@ -283,7 +272,7 @@ inline DCE2_Policy DCE2_SsnGetPolicy(DCE2_SsnData* sd)
 
 inline void DCE2_SsnSetPolicy(DCE2_SsnData* sd, DCE2_Policy policy)
 {
-    if (DCE2_SsnFromClient(sd->wire_pkt))
+    if ( snort::DetectionEngine::get_current_packet()->is_from_client() )
         sd->client_policy = policy;
     else
         sd->server_policy = policy;
@@ -405,7 +394,7 @@ void print_dce2_co_config(dce2CoProtoConf&);
 bool dce2_paf_abort(snort::Flow*, DCE2_SsnData*);
 void DCE2_Detect(DCE2_SsnData*);
 snort::Packet* DCE2_GetRpkt(snort::Packet*, DCE2_RpktType, const uint8_t*, uint32_t);
-uint16_t DCE2_GetRpktMaxData(DCE2_SsnData*, DCE2_RpktType);
+uint16_t DCE2_GetRpktMaxData(DCE2_RpktType);
 DCE2_Ret DCE2_AddDataToRpkt(snort::Packet*, const uint8_t*, uint32_t);
 DCE2_TransType get_dce2_trans_type(const snort::Packet* p);
 

diff --git a/src/service_inspectors/dce_rpc/dce_smb.cc b/src/service_inspectors/dce_rpc/dce_smb.cc
index 0a5dfdbdc6d32c07af0c1ec42231c16a906c18b8..652929deae3edf1135f67c1c1873a5d2047da83d 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_smb.cc
+++ b/src/service_inspectors/dce_rpc/dce_smb.cc
@@ -395,7 +395,7 @@ void Dce2Smb::eval(snort::Packet* p)
         p->packet_flags |= PKT_ALLOW_MULTIPLE_DETECT;
         dce2_detected = 0;
 
-        p->endianness = (snort::Endianness*)new DceEndianness();
+        p->endianness = new DceEndianness();
 
         DCE2_SmbProcess(dce2_smb_sess);
 

diff --git a/src/service_inspectors/dce_rpc/dce_smb2.cc b/src/service_inspectors/dce_rpc/dce_smb2.cc
index 2dc3ae4514a4af435a9b3c5b4af915c6b5a47e68..c36988d358e2321165c50563804cd9eff67548bb 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_smb2.cc
+++ b/src/service_inspectors/dce_rpc/dce_smb2.cc
@@ -201,12 +201,13 @@ static inline void DCE2_Smb2ResetFileName(DCE2_SmbFileTracker* ftracker)
     ftracker->file_name_size = 0;
 }
 
-static inline FileContext* get_file_context(DCE2_SmbSsnData* ssd, uint64_t file_id)
+static inline FileContext* get_file_context(uint64_t file_id)
 {
-    assert(ssd->sd.wire_pkt);
-    FileFlows* file_flows = FileFlows::get_file_flows((ssd->sd.wire_pkt)->flow);
-    if(!file_flows)
+    FileFlows* file_flows = FileFlows::get_file_flows(DetectionEngine::get_current_packet()->flow);
+
+    if ( !file_flows )
         return nullptr;
+
     return file_flows->get_file_context(file_id, true);
 }
 
@@ -234,9 +235,8 @@ static inline void DCE2_Smb2ProcessFileData(DCE2_SmbSsnData* ssd, const uint8_t*
         DCE2_FileDetect();
     }
 
-    assert(ssd->sd.wire_pkt);
-    FileFlows* file_flows = FileFlows::get_file_flows((ssd->sd.wire_pkt)->flow);
-    if(!file_flows)
+    FileFlows* file_flows = FileFlows::get_file_flows(DetectionEngine::get_current_packet()->flow);
+    if ( !file_flows )
         return;
 
     file_flows->file_process(ssd->ftracker.fid_v2, file_data, data_size,
@@ -347,7 +347,7 @@ static void DCE2_Smb2CreateResponse(DCE2_SmbSsnData* ssd, const Smb2Hdr*,
 
     if (ssd->ftracker.file_name && ssd->ftracker.file_name_size)
     {
-        FileContext* file = get_file_context(ssd, ssd->ftracker.fid_v2);
+        FileContext* file = get_file_context(ssd->ftracker.fid_v2);
         if (file)
         {
             file->set_file_size(file_size);
@@ -419,10 +419,12 @@ static void DCE2_Smb2CloseCmd(DCE2_SmbSsnData* ssd, const Smb2Hdr*,
         !ssd->ftracker.tracker.file.file_size
         && ssd->ftracker.tracker.file.file_offset)
     {
-        FileDirection dir = DCE2_SsnFromClient(ssd->sd.wire_pkt) ? FILE_UPLOAD : FILE_DOWNLOAD;
+        FileDirection dir = DetectionEngine::get_current_packet()->is_from_client() ?
+            FILE_UPLOAD : FILE_DOWNLOAD;
+
         ssd->ftracker.tracker.file.file_size = ssd->ftracker.tracker.file.file_offset;
         uint64_t fileId_persistent = alignedNtohq(&(smb_close_hdr->fileId_persistent));
-        FileContext* file = get_file_context(ssd, fileId_persistent);
+        FileContext* file = get_file_context(fileId_persistent);
         if (file)
         {
             file->set_file_size(ssd->ftracker.tracker.file.file_size);
@@ -458,7 +460,7 @@ static void DCE2_Smb2SetInfo(DCE2_SmbSsnData* ssd, const Smb2Hdr*,
             uint64_t file_size = alignedNtohq((const uint64_t*)file_data);
             ssd->ftracker.tracker.file.file_size = file_size;
             uint64_t fileId_persistent = alignedNtohq(&(smb_set_info_hdr->fileId_persistent));
-            FileContext* file = get_file_context(ssd, fileId_persistent);
+            FileContext* file = get_file_context(fileId_persistent);
             if (file)
             {
                 file->set_file_size(ssd->ftracker.tracker.file.file_size);
@@ -698,7 +700,7 @@ static void DCE2_Smb2Inspect(DCE2_SmbSsnData* ssd, const Smb2Hdr* smb_hdr, const
 // This is the main entry point for SMB2 processing.
 void DCE2_Smb2Process(DCE2_SmbSsnData* ssd)
 {
-    Packet* p = ssd->sd.wire_pkt;
+    Packet* p = DetectionEngine::get_current_packet();
     const uint8_t* data_ptr = p->data;
     uint16_t data_len = p->dsize;
 
@@ -727,7 +729,7 @@ void DCE2_Smb2Process(DCE2_SmbSsnData* ssd)
     else if (ssd->pdu_state == DCE2_SMB_PDU_STATE__RAW_DATA)
     {
         /*continue processing raw data*/
-        FileDirection dir = DCE2_SsnFromClient(ssd->sd.wire_pkt) ? FILE_UPLOAD : FILE_DOWNLOAD;
+        FileDirection dir = p->is_from_client() ? FILE_UPLOAD : FILE_DOWNLOAD;
         DCE2_Smb2ProcessFileData(ssd, data_ptr, data_len, dir);
         ssd->ftracker.tracker.file.file_offset += data_len;
     }

diff --git a/src/service_inspectors/dce_rpc/dce_smb_commands.cc b/src/service_inspectors/dce_rpc/dce_smb_commands.cc
index c6ea3f37901c1f942807f706fd4e16ce4daecde7..ff36d48e28dd6657c7f74f4e64b996f3de2a7e4b 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_smb_commands.cc
+++ b/src/service_inspectors/dce_rpc/dce_smb_commands.cc
@@ -640,7 +640,7 @@ DCE2_Ret DCE2_SmbClose(DCE2_SmbSsnData* ssd, const SmbNtHdr*,
 
         if ((ssd->fb_ftracker != nullptr) && (ssd->fb_ftracker == ssd->cur_rtracker->ftracker))
         {
-            FileVerdict verdict = DCE2_get_file_verdict(ssd);
+            FileVerdict verdict = DCE2_get_file_verdict();
 
             if ((verdict == FILE_VERDICT_BLOCK) || (verdict == FILE_VERDICT_REJECT))
                 ssd->block_pdus = true;

diff --git a/src/service_inspectors/dce_rpc/dce_smb_utils.cc b/src/service_inspectors/dce_rpc/dce_smb_utils.cc
index 7e661b3fa67ff7a23fcde9f56746032c8d6aee7a..f2a8c527cb60bd766c0e99678298abc7524b8aaa 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_smb_utils.cc
+++ b/src/service_inspectors/dce_rpc/dce_smb_utils.cc
@@ -43,7 +43,7 @@ static uint8_t dce2_smb_delete_pdu[65535];
  ********************************************************************/
 static void DCE2_SmbSetNewFileAPIFileTracker(DCE2_SmbSsnData* ssd);
 static void DCE2_SmbResetFileChunks(DCE2_SmbFileTracker* ssd);
-static void DCE2_SmbFinishFileAPI(DCE2_SmbSsnData* ssd);
+static void DCE2_SmbFinishFileAPI(DCE2_SmbSsnData*);
 static void DCE2_SmbFinishFileBlockVerdict(DCE2_SmbSsnData* ssd);
 
 /********************************************************************
@@ -1160,7 +1160,7 @@ void DCE2_SmbSetRdata(DCE2_SmbSsnData* ssd, uint8_t* nb_ptr, uint16_t co_len)
     smb_hdr->smb_uid = SmbHtons((const uint16_t*)&uid);
     smb_hdr->smb_tid = SmbHtons((const uint16_t*)&tid);
 
-    if (DCE2_SsnFromClient(ssd->sd.wire_pkt))
+    if ( DetectionEngine::get_current_packet()->is_from_client() )
     {
         SmbWriteAndXReq* writex =
             (SmbWriteAndXReq*)((uint8_t*)smb_hdr + sizeof(SmbNtHdr));
@@ -1213,7 +1213,7 @@ Packet* DCE2_SmbGetRpkt(DCE2_SmbSsnData* ssd,
         || (data_len == nullptr) || (*data_len == 0))
         return nullptr;
 
-    Packet* rpkt = DCE2_GetRpkt(ssd->sd.wire_pkt, rtype, *data, *data_len);
+    Packet* rpkt = DCE2_GetRpkt(DetectionEngine::get_current_packet(), rtype, *data, *data_len);
 
     if ( !rpkt )
         return nullptr;
@@ -1225,7 +1225,7 @@ Packet* DCE2_SmbGetRpkt(DCE2_SmbSsnData* ssd,
     switch (rtype)
     {
     case DCE2_RPKT_TYPE__SMB_TRANS:
-        if (DCE2_SmbType(ssd) == SMB_TYPE__REQUEST)
+        if (DCE2_SmbType() == SMB_TYPE__REQUEST)
             header_len = DCE2_MOCK_HDR_LEN__SMB_CLI;
         else
             header_len = DCE2_MOCK_HDR_LEN__SMB_SRV;
@@ -1309,7 +1309,7 @@ bool DCE2_SmbIsSegBuffer(DCE2_SmbSsnData* ssd, const uint8_t* ptr)
 {
     DCE2_Buffer* seg_buf;
 
-    if (DCE2_SsnFromServer(ssd->sd.wire_pkt))
+    if ( DetectionEngine::get_current_packet()->is_from_server() )
         seg_buf = ssd->srv_seg;
     else
         seg_buf = ssd->cli_seg;
@@ -1346,7 +1346,7 @@ void DCE2_SmbSegAlert(DCE2_SmbSsnData* ssd, uint32_t rule_id)
 {
     DCE2_Buffer* buf;
 
-    if (DCE2_SsnFromClient(ssd->sd.wire_pkt))
+    if ( DetectionEngine::get_current_packet()->is_from_client() )
         buf = ssd->cli_seg;
     else
         buf = ssd->srv_seg;
@@ -1381,17 +1381,16 @@ void DCE2_SmbAbortFileAPI(DCE2_SmbSsnData* ssd)
     ssd->fapi_ftracker = nullptr;
 }
 
-static FileContext* DCE2_get_main_file_context(DCE2_SmbSsnData* ssd)
+static FileContext* DCE2_get_main_file_context()
 {
-    assert(ssd->sd.wire_pkt);
-    FileFlows* file_flows = FileFlows::get_file_flows((ssd->sd.wire_pkt)->flow);
+    FileFlows* file_flows = FileFlows::get_file_flows(DetectionEngine::get_current_packet()->flow);
     assert(file_flows);
     return file_flows->get_current_file_context();
 }
 
-FileVerdict DCE2_get_file_verdict(DCE2_SmbSsnData* ssd)
+FileVerdict DCE2_get_file_verdict()
 {
-    FileContext* file = DCE2_get_main_file_context(ssd);
+    FileContext* file = DCE2_get_main_file_context();
     if ( !file )
         return FILE_VERDICT_UNKNOWN;
     return file->verdict;
@@ -1427,10 +1426,12 @@ void DCE2_SmbInitDeletePdu()
     *del_req_fmt = SMB_FMT__ASCII;
 }
 
-static void DCE2_SmbInjectDeletePdu(DCE2_SmbSsnData* ssd, DCE2_SmbFileTracker* ftracker)
+static void DCE2_SmbInjectDeletePdu(DCE2_SmbFileTracker* ftracker)
 {
     Packet* inject_pkt = snort::Snort::get_packet();
-    if ( inject_pkt->flow != ssd->sd.wire_pkt->flow )
+    Packet* p = DetectionEngine::get_current_packet();
+
+    if ( inject_pkt->flow != p->flow )
         return;
 
     NbssHdr* nb_hdr = (NbssHdr*)dce2_smb_delete_pdu;
@@ -1462,11 +1463,11 @@ static void DCE2_SmbInjectDeletePdu(DCE2_SmbSsnData* ssd, DCE2_SmbFileTracker* f
     Active::inject_data(inject_pkt, 0, (uint8_t*)nb_hdr, len);
 }
 
-static FileVerdict DCE2_SmbLookupFileVerdict(DCE2_SmbSsnData* ssd)
+static FileVerdict DCE2_SmbLookupFileVerdict()
 {
     Profile profile(dce2_smb_pstat_smb_file_api);
 
-    FileContext* file = DCE2_get_main_file_context(ssd);
+    FileContext* file = DCE2_get_main_file_context();
 
     if ( !file )
         return FILE_VERDICT_UNKNOWN;
@@ -1474,7 +1475,7 @@ static FileVerdict DCE2_SmbLookupFileVerdict(DCE2_SmbSsnData* ssd)
     FileVerdict verdict = file->verdict;
 
     if (verdict == FILE_VERDICT_PENDING)
-        verdict = file->file_signature_lookup(ssd->sd.wire_pkt->flow);
+        verdict = file->file_signature_lookup(DetectionEngine::get_current_packet()->flow);
 
     return verdict;
 }
@@ -1483,10 +1484,10 @@ static void DCE2_SmbFinishFileBlockVerdict(DCE2_SmbSsnData* ssd)
 {
     Profile profile(dce2_smb_pstat_smb_file);
 
-    FileVerdict verdict = DCE2_SmbLookupFileVerdict(ssd);
+    FileVerdict verdict = DCE2_SmbLookupFileVerdict();
     if ((verdict == FILE_VERDICT_BLOCK) || (verdict == FILE_VERDICT_REJECT))
     {
-        DCE2_SmbInjectDeletePdu(ssd, ssd->fb_ftracker);
+        DCE2_SmbInjectDeletePdu(ssd->fb_ftracker);
     }
 
     ssd->fb_ftracker = nullptr;
@@ -1495,7 +1496,7 @@ static void DCE2_SmbFinishFileBlockVerdict(DCE2_SmbSsnData* ssd)
 
 static void DCE2_SmbFinishFileAPI(DCE2_SmbSsnData* ssd)
 {
-    Packet* p = ssd->sd.wire_pkt;
+    Packet* p = DetectionEngine::get_current_packet();
     DCE2_SmbFileTracker* ftracker = ssd->fapi_ftracker;
 
     if (ftracker == nullptr)
@@ -1517,7 +1518,7 @@ static void DCE2_SmbFinishFileAPI(DCE2_SmbSsnData* ssd)
             {
                 if (upload)
                 {
-                    FileVerdict verdict = DCE2_get_file_verdict(ssd);
+                    FileVerdict verdict = DCE2_get_file_verdict();
 
                     if ((verdict == FILE_VERDICT_BLOCK) || (verdict == FILE_VERDICT_REJECT))
                         ssd->fb_ftracker = ftracker;
@@ -1575,7 +1576,7 @@ static DCE2_Ret DCE2_SmbFileAPIProcess(DCE2_SmbSsnData* ssd,
     }
 
     Profile profile(dce2_smb_pstat_smb_file_api);
-    FileFlows* file_flows = FileFlows::get_file_flows(ssd->sd.wire_pkt->flow);
+    FileFlows* file_flows = FileFlows::get_file_flows(DetectionEngine::get_current_packet()->flow);
     if (!file_flows->file_process(data_ptr, (int)data_len, position, upload,
         DCE2_SmbIsVerdictSuspend(upload, position)))
     {
@@ -1597,7 +1598,7 @@ static DCE2_Ret DCE2_SmbFileAPIProcess(DCE2_SmbSsnData* ssd,
         {
             if (upload)
             {
-                FileVerdict verdict = DCE2_get_file_verdict(ssd);
+                FileVerdict verdict = DCE2_get_file_verdict();
 
                 if ((verdict == FILE_VERDICT_BLOCK) || (verdict == FILE_VERDICT_REJECT)
                     || (verdict == FILE_VERDICT_PENDING))

diff --git a/src/service_inspectors/dce_rpc/dce_smb_utils.h b/src/service_inspectors/dce_rpc/dce_smb_utils.h
index 7b62fcf58fae795a7ad795fc2081490f8a2935d9..99ab7dd10ec17e923875c7a974949835eaeda832 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_smb_utils.h
+++ b/src/service_inspectors/dce_rpc/dce_smb_utils.h
@@ -177,7 +177,7 @@ void DCE2_SmbProcessFileData(DCE2_SmbSsnData* ssd,
     DCE2_SmbFileTracker* ftracker, const uint8_t* data_ptr,
     uint32_t data_len, bool upload);
 void DCE2_FileDetect();
-FileVerdict DCE2_get_file_verdict(DCE2_SmbSsnData* );
+FileVerdict DCE2_get_file_verdict();
 void DCE2_SmbInitDeletePdu();
 void DCE2_Update_Ftracker_from_ReqTracker(DCE2_SmbFileTracker*, DCE2_SmbRequestTracker*);
 
@@ -202,9 +202,9 @@ void DCE2_Update_Ftracker_from_ReqTracker(DCE2_SmbFileTracker*, DCE2_SmbRequestT
  *  SMB_TYPE__RESPONSE if packet is from server
  *
  ********************************************************************/
-inline int DCE2_SmbType(DCE2_SmbSsnData* ssd)
+inline int DCE2_SmbType()
 {
-    if (DCE2_SsnFromClient(ssd->sd.wire_pkt))
+    if ( snort::DetectionEngine::get_current_packet()->is_from_client() )
         return SMB_TYPE__REQUEST;
     else
         return SMB_TYPE__RESPONSE;
@@ -341,7 +341,7 @@ inline bool DCE2_SmbIsTransactionComplete(DCE2_SmbTransactionTracker* ttracker)
 
 inline DCE2_Buffer** DCE2_SmbGetSegBuffer(DCE2_SmbSsnData* ssd)
 {
-    if (DCE2_SsnFromServer(ssd->sd.wire_pkt))
+    if ( snort::DetectionEngine::get_current_packet()->is_from_server() )
         return &ssd->srv_seg;
     return &ssd->cli_seg;
 }

diff --git a/src/service_inspectors/dce_rpc/dce_tcp.cc b/src/service_inspectors/dce_rpc/dce_tcp.cc
index d115753ce1e1f71e11ecfa0f61df065439adcbab..6b161ef80c1e8fae2ee9c24f36d56908c384db82 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_tcp.cc
+++ b/src/service_inspectors/dce_rpc/dce_tcp.cc
@@ -94,7 +94,6 @@ static DCE2_TcpSsnData* dce2_create_new_tcp_session(Packet* p, dce2TcpProtoConf*
         dce2_tcp_sess->sd.trans = DCE2_TRANS_TYPE__TCP;
         dce2_tcp_sess->sd.server_policy = config->common.policy;
         dce2_tcp_sess->sd.client_policy = DCE2_POLICY__WINXP;
-        dce2_tcp_sess->sd.wire_pkt = p;
         dce2_tcp_sess->sd.config = (void*)config;
     }
 

diff --git a/src/service_inspectors/dce_rpc/dce_tcp.h b/src/service_inspectors/dce_rpc/dce_tcp.h
index cae6febdaf1052f48cd411e0eb7bc400fc71afa5..9f48646de9fe0b124691384161680813d90d7b54 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_tcp.h
+++ b/src/service_inspectors/dce_rpc/dce_tcp.h
@@ -91,7 +91,7 @@ inline bool DCE2_TcpAutodetect(snort::Packet* p)
             && (DceRpcCoVersMin(co_hdr) == DCERPC_PROTO_MINOR_VERS__0)
             && ((p->is_from_client()
             && DceRpcCoPduType(co_hdr) == DCERPC_PDU_TYPE__BIND)
-            || (DCE2_SsnFromServer(p)
+            || (p->is_from_server()
             && DceRpcCoPduType(co_hdr) == DCERPC_PDU_TYPE__BIND_ACK))
             && (DceRpcCoFragLen(co_hdr) >= sizeof(DceRpcCoHdr)))
         {

diff --git a/src/service_inspectors/dce_rpc/dce_udp.cc b/src/service_inspectors/dce_rpc/dce_udp.cc
index f7991b326933987b053a8a16a40e3caf45d1c9c6..c32c4d04aa478360f3c11616f2c5027c0cb3497d 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_udp.cc
+++ b/src/service_inspectors/dce_rpc/dce_udp.cc
@@ -99,7 +99,6 @@ static DCE2_UdpSsnData* dce2_create_new_udp_session(Packet* p, dce2UdpProtoConf*
 
     dce2_udp_stats.udp_sessions++;
     dce2_udp_sess->sd.trans = DCE2_TRANS_TYPE__UDP;
-    dce2_udp_sess->sd.wire_pkt = p;
     dce2_udp_sess->sd.config = (void*)config;
 
     return dce2_udp_sess;

diff --git a/src/service_inspectors/dce_rpc/dce_udp_processing.cc b/src/service_inspectors/dce_rpc/dce_udp_processing.cc
index 5bc75aa1fdd36911f9e5428b7defb98c5afac0ca..d96496e337d46316f1a6e94397181dc3200bc28b 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_udp_processing.cc
+++ b/src/service_inspectors/dce_rpc/dce_udp_processing.cc
@@ -106,8 +106,9 @@ void DCE2_ClProcess(DCE2_SsnData* sd, DCE2_ClTracker* clt)
 {
     const DceRpcClHdr* cl_hdr;
     DCE2_ClActTracker* at;
-    const uint8_t* data_ptr = sd->wire_pkt->data;
-    uint16_t data_len = sd->wire_pkt->dsize;
+    Packet* p = DetectionEngine::get_current_packet();
+    const uint8_t* data_ptr = p->data;
+    uint16_t data_len = p->dsize;
 
     if (data_len < sizeof(DceRpcClHdr))
     {
@@ -127,7 +128,7 @@ void DCE2_ClProcess(DCE2_SsnData* sd, DCE2_ClTracker* clt)
     if (at == nullptr)
         return;
 
-    if (DCE2_SsnFromClient(sd->wire_pkt))
+    if ( p->is_from_client() )
     {
         switch (DceRpcClPduType(cl_hdr))
         {
@@ -155,7 +156,6 @@ void DCE2_ClProcess(DCE2_SsnData* sd, DCE2_ClTracker* clt)
         case DCERPC_PDU_TYPE__RESPONSE:
         {
             trace_log(dce_udp, "Response from client.  Changing stream direction.\n");
-            Packet* p = sd->wire_pkt;
             ip::IpApi* ip_api = &p->ptrs.ip_api;
 
             p->flow->session->update_direction(SSN_DIR_FROM_SERVER,
@@ -349,7 +349,7 @@ static void DCE2_ClRequest(DCE2_SsnData* sd, DCE2_ClActTracker* at, const DceRpc
     sd->ropts.iface_vers = DceRpcClIfaceVers(cl_hdr);
     sd->ropts.opnum = DceRpcClOpnum(cl_hdr);
     sd->ropts.stub_data = (const uint8_t*)cl_hdr + sizeof(DceRpcClHdr);
-    DceEndianness* endianness = (DceEndianness*)sd->wire_pkt->endianness;
+    DceEndianness* endianness = (DceEndianness*)DetectionEngine::get_current_packet()->endianness;
     endianness->hdr_byte_order = DceRpcClByteOrder(cl_hdr);
     endianness->data_byte_order = DceRpcClByteOrder(cl_hdr);
     DCE2_Detect(sd);
@@ -486,7 +486,7 @@ static void DCE2_ClHandleFrag(DCE2_SsnData* sd, DCE2_ClActTracker* at, const Dce
     sd->ropts.first_frag = DceRpcClFirstFrag(cl_hdr);
     DCE2_CopyUuid(&sd->ropts.iface, &ft->iface, DCERPC_BO_FLAG__NONE);
     sd->ropts.iface_vers = ft->iface_vers;
-    DceEndianness* endianness = (DceEndianness*)sd->wire_pkt->endianness;
+    DceEndianness* endianness = (DceEndianness*)DetectionEngine::get_current_packet()->endianness;
     endianness->hdr_byte_order = DceRpcClByteOrder(cl_hdr);
 
     if (ft->data_byte_order != DCE2_SENTINEL)
@@ -562,8 +562,8 @@ static void DCE2_ClFragReassemble(
         stub_len += fnode->frag_len;
     }
 
-    Packet* rpkt = DCE2_GetRpkt(
-        sd->wire_pkt, DCE2_RPKT_TYPE__UDP_CL_FRAG, dce2_cl_rbuf, stub_len);
+    Packet* rpkt = DCE2_GetRpkt(DetectionEngine::get_current_packet(),
+        DCE2_RPKT_TYPE__UDP_CL_FRAG, dce2_cl_rbuf, stub_len);
 
     if ( !rpkt )
         return;
@@ -577,7 +577,7 @@ static void DCE2_ClFragReassemble(
     sd->ropts.first_frag = 1;
     DCE2_CopyUuid(&sd->ropts.iface, &ft->iface, DCERPC_BO_FLAG__NONE);
     sd->ropts.iface_vers = ft->iface_vers;
-    DceEndianness* endianness = (DceEndianness*)sd->wire_pkt->endianness;
+    DceEndianness* endianness = (DceEndianness*)DetectionEngine::get_current_packet()->endianness;
     endianness->hdr_byte_order = DceRpcClByteOrder(cl_hdr);
 
     if (ft->data_byte_order != DCE2_SENTINEL)

diff --git a/src/service_inspectors/dce_rpc/smb_message.cc b/src/service_inspectors/dce_rpc/smb_message.cc
index c089cdf8c27bd71dac8b364eba6b22f333b07ef5..98ac4f6ef91df27906ffab173a4db0f038fdc30a 100644 (file)
--- a/src/service_inspectors/dce_rpc/smb_message.cc
+++ b/src/service_inspectors/dce_rpc/smb_message.cc
@@ -124,7 +124,7 @@ static inline DCE2_Ret DCE2_SmbCheckAndXOffset(const uint8_t* off_ptr, const uin
  ********************************************************************/
 static inline uint32_t* DCE2_SmbGetIgnorePtr(DCE2_SmbSsnData* ssd)
 {
-    if (DCE2_SsnFromServer(ssd->sd.wire_pkt))
+    if ( DetectionEngine::get_current_packet()->is_from_server() )
         return &ssd->srv_ignore_bytes;
     return &ssd->cli_ignore_bytes;
 }
@@ -144,7 +144,7 @@ static inline uint32_t* DCE2_SmbGetIgnorePtr(DCE2_SmbSsnData* ssd)
  ********************************************************************/
 static inline DCE2_SmbDataState* DCE2_SmbGetDataState(DCE2_SmbSsnData* ssd)
 {
-    if (DCE2_SsnFromServer(ssd->sd.wire_pkt))
+    if ( DetectionEngine::get_current_packet()->is_from_server() )
         return &ssd->srv_data_state;
     return &ssd->cli_data_state;
 }
@@ -386,11 +386,11 @@ static uint32_t DCE2_IgnoreJunkData(const uint8_t* data_ptr, uint16_t data_len,
  ********************************************************************/
 static DCE2_Ret DCE2_SmbHdrChecks(DCE2_SmbSsnData* ssd, const SmbNtHdr* smb_hdr)
 {
-    Packet* p = ssd->sd.wire_pkt;
+    Packet* p = DetectionEngine::get_current_packet();
     bool is_seg_buf = DCE2_SmbIsSegBuffer(ssd, (const uint8_t*)smb_hdr);
 
-    if ((DCE2_SsnFromServer(p) && (SmbType(smb_hdr) == SMB_TYPE__REQUEST)) ||
-        (DCE2_SsnFromClient(p) && (SmbType(smb_hdr) == SMB_TYPE__RESPONSE)))
+    if ((p->is_from_server() && (SmbType(smb_hdr) == SMB_TYPE__REQUEST)) ||
+        (p->is_from_client() && (SmbType(smb_hdr) == SMB_TYPE__RESPONSE)))
     {
         if (is_seg_buf)
             DCE2_SmbSegAlert(ssd, DCE2_SMB_BAD_TYPE);
@@ -513,7 +513,7 @@ static DCE2_SmbRequestTracker* DCE2_SmbFindRequestTracker(DCE2_SmbSsnData* ssd,
             // Set this to the first matching request in the queue
             // where the Mid matches.  Don't set for Windows if from
             // client since PID/MID are necessary
-            if (((DCE2_SmbType(ssd) == SMB_TYPE__RESPONSE)
+            if (((DCE2_SmbType() == SMB_TYPE__RESPONSE)
                 || !DCE2_SsnIsWindowsPolicy(&ssd->sd))
                 && first_mid_rtracker == nullptr)
             {
@@ -722,7 +722,7 @@ static void DCE2_SmbCheckCommand(DCE2_SmbSsnData* ssd,
         }
     }
     else if ((smb_bcc == 0) && (SmbCom(smb_hdr) == SMB_COM_TRANSACTION)
-        && (DCE2_SmbType(ssd) == SMB_TYPE__REQUEST)
+        && (DCE2_SmbType() == SMB_TYPE__REQUEST)
         && (DCE2_SsnGetPolicy(&ssd->sd) == DCE2_POLICY__SAMBA))
     {
         // Current Samba errors on a zero byte count Transaction because it
@@ -767,9 +767,9 @@ static void DCE2_SmbProcessCommand(DCE2_SmbSsnData* ssd, const SmbNtHdr* smb_hdr
 
     while (nb_len > 0)
     {
-        if (ssd->block_pdus && (DCE2_SmbType(ssd) == SMB_TYPE__REQUEST))
+        if (ssd->block_pdus && (DCE2_SmbType() == SMB_TYPE__REQUEST))
         {
-            Active::drop_packet(ssd->sd.wire_pkt);
+            Active::drop_packet(DetectionEngine::get_current_packet());
             status = DCE2_RET__IGNORE;
             break;
         }
@@ -788,7 +788,7 @@ static void DCE2_SmbProcessCommand(DCE2_SmbSsnData* ssd, const SmbNtHdr* smb_hdr
         }
 
         DCE2_SmbComInfo com_info;
-        com_info.smb_type = DCE2_SmbType(ssd);
+        com_info.smb_type = DCE2_SmbType();
         com_info.cmd_error = DCE2_SMB_COM_ERROR__COMMAND_OK;
         com_info.word_count = 0;
         com_info.smb_com = smb_com;
@@ -911,7 +911,7 @@ static void DCE2_SmbProcessCommand(DCE2_SmbSsnData* ssd, const SmbNtHdr* smb_hdr
             case SMB_COM_WRITE_ANDX:
             case SMB_COM_TRANSACTION:
             case SMB_COM_READ_ANDX:
-                if (DCE2_SsnFromClient(ssd->sd.wire_pkt) && open_chain)
+                if ( DetectionEngine::get_current_packet()->is_from_client() && open_chain)
                 {
                     DCE2_SmbQueueTmpFileTracker(ssd, ssd->cur_rtracker,
                         SmbUid(smb_hdr), SmbTid(smb_hdr));
@@ -928,7 +928,7 @@ static void DCE2_SmbProcessCommand(DCE2_SmbSsnData* ssd, const SmbNtHdr* smb_hdr
         smb_com = smb_com2;
     }
 
-    int smb_type = DCE2_SmbType(ssd);
+    int smb_type = DCE2_SmbType();
     if (smb_type == SMB_TYPE__RESPONSE)
     {
         switch (smb_com)
@@ -1027,7 +1027,7 @@ static DCE2_SmbRequestTracker* DCE2_SmbInspect(DCE2_SmbSsnData* ssd, const SmbNt
     // See if this is something we need to inspect
     DCE2_Policy policy = DCE2_SsnGetServerPolicy(&ssd->sd);
     DCE2_SmbRequestTracker* rtracker = nullptr;
-    if (DCE2_SmbType(ssd) == SMB_TYPE__REQUEST)
+    if (DCE2_SmbType() == SMB_TYPE__REQUEST)
     {
         switch (smb_com)
         {
@@ -1174,7 +1174,7 @@ static void DCE2_SmbProcessRawData(DCE2_SmbSsnData* ssd, const uint8_t* nb_ptr,
         return;
     }
 
-    if (DCE2_SsnFromClient(ssd->sd.wire_pkt))
+    if ( DetectionEngine::get_current_packet()->is_from_client() )
     {
         if (nb_len > ssd->cur_rtracker->writeraw_remaining)
         {
@@ -1215,7 +1215,7 @@ static void DCE2_SmbProcessRawData(DCE2_SmbSsnData* ssd, const uint8_t* nb_ptr,
     }
     else
     {
-        bool upload = DCE2_SsnFromClient(ssd->sd.wire_pkt) ? true : false;
+        bool upload = DetectionEngine::get_current_packet()->is_from_client();
         DCE2_SmbProcessFileData(ssd, ftracker, nb_ptr, nb_len, upload);
     }
 
@@ -1337,7 +1337,6 @@ static DCE2_SmbSsnData* dce2_create_new_smb_session(Packet* p, dce2SmbProtoConf*
         dce2_smb_sess->sd.trans = DCE2_TRANS_TYPE__SMB;
         dce2_smb_sess->sd.server_policy = config->common.policy;
         dce2_smb_sess->sd.client_policy = DCE2_POLICY__WINXP;
-        dce2_smb_sess->sd.wire_pkt = p;
         dce2_smb_sess->sd.config = (void*)config;
     }
 
@@ -1371,7 +1370,7 @@ static DCE2_SmbSsnData* dce2_create_new_smb_session(Packet* p, dce2SmbProtoConf*
  ********************************************************************/
 static DCE2_Ret DCE2_NbssHdrChecks(DCE2_SmbSsnData* ssd, const NbssHdr* nb_hdr)
 {
-    Packet* p = ssd->sd.wire_pkt;
+    Packet* p = DetectionEngine::get_current_packet();
     bool is_seg_buf = DCE2_SmbIsSegBuffer(ssd, (const uint8_t*)nb_hdr);
 
     switch (NbssType(nb_hdr))
@@ -1399,7 +1398,7 @@ static DCE2_Ret DCE2_NbssHdrChecks(DCE2_SmbSsnData* ssd, const NbssHdr* nb_hdr)
         return DCE2_RET__SUCCESS;
 
     case NBSS_SESSION_TYPE__REQUEST:
-        if (DCE2_SsnFromServer(p))
+        if ( p->is_from_server() )
         {
             if (is_seg_buf)
                 DCE2_SmbSegAlert(ssd, DCE2_SMB_BAD_NBSS_TYPE);
@@ -1412,7 +1411,7 @@ static DCE2_Ret DCE2_NbssHdrChecks(DCE2_SmbSsnData* ssd, const NbssHdr* nb_hdr)
     case NBSS_SESSION_TYPE__POS_RESPONSE:
     case NBSS_SESSION_TYPE__NEG_RESPONSE:
     case NBSS_SESSION_TYPE__RETARGET_RESPONSE:
-        if (DCE2_SsnFromClient(p))
+        if ( p->is_from_client() )
         {
             if (is_seg_buf)
                 DCE2_SmbSegAlert(ssd, DCE2_SMB_BAD_NBSS_TYPE);
@@ -1442,7 +1441,7 @@ static void DCE2_Smb1Process(DCE2_SmbSsnData* ssd)
 {
     dce2_smb_stats.smb_pkts++;
 
-    const Packet* p = ssd->sd.wire_pkt;
+    const Packet* p = DetectionEngine::get_current_packet();
     const uint8_t* data_ptr = p->data;
     uint16_t data_len = p->dsize;
     DCE2_Buffer** seg_buf = DCE2_SmbGetSegBuffer(ssd);
@@ -1726,7 +1725,7 @@ static void DCE2_Smb1Process(DCE2_SmbSsnData* ssd)
                 nb_ptr = DCE2_BufferData(*seg_buf);
                 nb_len = DCE2_BufferLength(*seg_buf);
 
-                if (DCE2_SsnFromClient(ssd->sd.wire_pkt))
+                if ( p->is_from_client() )
                     dce2_smb_stats.smb_cli_seg_reassembled++;
                 else
                     dce2_smb_stats.smb_srv_seg_reassembled++;
@@ -2547,7 +2546,7 @@ void DCE2_SmbProcess(DCE2_SmbSsnData* ssd)
         return;
     }
 
-    snort::Packet* p = ssd->sd.wire_pkt;
+    Packet* p = DetectionEngine::get_current_packet();
     DCE2_SmbVersion smb_version = DCE2_Smb2Version(p);
     if (smb_version == DCE2_SMB_VERISON_1)
     {