Pull request #3755: appid: add validation for rpcbind universal address

Merge in SNORT/snort3 from ~SATHIRKA/snort3:rpc_bind_uaddr_validate to master

Squashed commit of the following:

commit fff62286d419f493c0882fb1d94b4f3fe21f843a
Author: Sreeja Athirkandathil Narayanan <sathirka@cisco.com>
Date:   Wed Feb 1 10:29:32 2023 -0500

    appid: add validation for rpcbind universal address

diff --git a/src/network_inspectors/appid/service_plugins/service_rpc.cc b/src/network_inspectors/appid/service_plugins/service_rpc.cc
index 409ccc2d720e95e2c396b303e545e65bac850a57..2d20186fac5b58c7c34e7b058ceedfebfa224a00 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_rpc.cc
+++ b/src/network_inspectors/appid/service_plugins/service_rpc.cc
@@ -96,6 +96,8 @@ enum RPCReplyState
 #define PROGRAM_LENGTH 4
 #define VERSION_LENGTH 4
 
+#define RPCB_UNIVERSAL_ADDR_LENGTH 6
+
 #pragma pack(1)
 
 struct ServiceRPCFragment
@@ -322,6 +324,8 @@ static bool  validate_and_parse_universal_address(string& data, uint32_t &addres
     string tok;
     while (getline(tokenizer, tok, '.'))
     {
+        if (!all_of(tok.begin(), tok.end(), ::isdigit))
+            return false;
         int tmp = stoi(tok);
         if (tmp > 255)
             return false;
@@ -485,7 +489,8 @@ int RpcServiceDetector::validate_packet(const uint8_t* data, uint16_t size, Appi
                     uint16_t port = 0;
                     data += sizeof(UniversalAddress);
                     string uaddr(data, data + tmp);
-                    if (validate_and_parse_universal_address(uaddr, address, port))
+                    if ((count(uaddr.begin(), uaddr.end(), '.') == (RPCB_UNIVERSAL_ADDR_LENGTH - 1)) and
+                        validate_and_parse_universal_address(uaddr, address, port))
                     {
                         SfIp sip;
                         uint32_t addr = htonl(address);