detect/dcerpc: apply dcerpc to smb as well

So 'alert dcerpc' also matches if the DCERPC is over SMB.

Explicitly refuse smb keywords for the 'dcerpc' app proto setting:
`alert dceprc ... smb.share; ...` is rejected.

Remove a now useless special case in the stateless rule processing
matching for dcerpc/smb.

Bug: #5208.
(cherry picked from commit 7d38f5667d1fe7dccd355f85434d2fb709578f57)

diff --git a/src/app-layer-protos.h b/src/app-layer-protos.h
index 36b69ddcfa92d2801a0dbf8599da3ba7a77b7208..6b677611e27bee6e68843b08528236ac0995b0e4 100644 (file)
--- a/src/app-layer-protos.h
+++ b/src/app-layer-protos.h
@@ -85,6 +85,8 @@ static inline bool AppProtoEquals(AppProto sigproto, AppProto alproto)
     if (alproto == ALPROTO_HTTP2 && g_config_http1keywords_http2traffic &&
             sigproto == ALPROTO_HTTP) {
         return true;
+    } else if (sigproto == ALPROTO_DCERPC) {
+        return (alproto == ALPROTO_DCERPC || alproto == ALPROTO_SMB);
     }
     return (sigproto == alproto);
 }

diff --git a/src/detect-parse.c b/src/detect-parse.c
index 7f0174a973f3296631f5435fc0bc8bfe7f83182b..cf495bf051d8942f28694b821604657c48d1d236 100644 (file)
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -1499,6 +1499,14 @@ int DetectSignatureSetAppProto(Signature *s, AppProto alproto)
             AppProtoToString(alproto), AppProtoToString(s->alproto));
         return -1;
     }
+    /* since AppProtoEquals is quite permissive wrt dcerpc and smb, make sure
+     * we refuse `alert dcerpc ... smb.share; content...` explicitly. */
+    if (alproto == ALPROTO_SMB && s->alproto == ALPROTO_DCERPC) {
+        SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS,
+                "can't set rule app proto to %s: already set to %s", AppProtoToString(alproto),
+                AppProtoToString(s->alproto));
+        return -1;
+    }
 
     // allow to keep HTTP2 as s->alproto with HTTP1 alproto keywords
     if (!AppProtoEquals(alproto, s->alproto)) {

diff --git a/src/detect.c b/src/detect.c
index 6084cb6bc5cdaebf1ba2c2da60bc10deaab4372c..1986c2671cf3ef13f8446654883de1a1213f7b24 100644 (file)
--- a/src/detect.c
+++ b/src/detect.c
@@ -772,15 +772,8 @@ static inline void DetectRulePacketRules(
         /* if the sig has alproto and the session as well they should match */
         if (likely(sflags & SIG_FLAG_APPLAYER)) {
             if (s->alproto != ALPROTO_UNKNOWN && !AppProtoEquals(s->alproto, scratch->alproto)) {
-                if (s->alproto == ALPROTO_DCERPC) {
-                    if (scratch->alproto != ALPROTO_SMB) {
-                        SCLogDebug("DCERPC sig, alproto not SMB");
-                        goto next;
-                    }
-                } else {
-                    SCLogDebug("alproto mismatch");
-                    goto next;
-                }
+                SCLogDebug("alproto mismatch");
+                goto next;
             }
         }