dcerpc: save version info in tx

to make it available for logging.

diff --git a/rust/src/dcerpc/dcerpc.rs b/rust/src/dcerpc/dcerpc.rs
index f12021da261c0c5f47bb8653f19fa162202013d6..51f980ec670a60f2d0586b0368bca890ee4d8fba 100644 (file)
--- a/rust/src/dcerpc/dcerpc.rs
+++ b/rust/src/dcerpc/dcerpc.rs
@@ -172,6 +172,7 @@ pub struct DCERPCTransaction {
     pub ctxid: u16,
     pub opnum: u16,
     pub first_request_seen: u8,
+    pub min_version: u8,
     pub call_id: u32, // ID to match any request-response pair
     pub frag_cnt_ts: u16,
     pub frag_cnt_tc: u16,
@@ -368,6 +369,9 @@ impl DCERPCState {
             }
             self.tx_index_completed = index;
         }
+        if let Some(hdr) = &self.header {
+            tx.min_version = hdr.rpc_vers_minor;
+        }
         tx
     }
 

diff --git a/rust/src/dcerpc/detect.rs b/rust/src/dcerpc/detect.rs
index e976391dfe7c97cc340f369e46811d5f5b59aa9e..2a3049058837f48759b0ea366226ffade30ffaf3 100644 (file)
--- a/rust/src/dcerpc/detect.rs
+++ b/rust/src/dcerpc/detect.rs
@@ -211,12 +211,9 @@ pub extern "C" fn rs_dcerpc_iface_match(
         return 0;
     }
 
-    match state.get_hdr_type() {
-        Some(DCERPC_TYPE_REQUEST | DCERPC_TYPE_RESPONSE) => {}
-        _ => {
+    if !(tx.req_cmd == DCERPC_TYPE_REQUEST || tx.resp_cmd == DCERPC_TYPE_RESPONSE) {
             return 0;
-        }
-    };
+    }
 
     return match_backuuid(tx, state, if_data);
 }

diff --git a/rust/src/dcerpc/log.rs b/rust/src/dcerpc/log.rs
index 297a1df2ef783705adfc45665506e35d93d7b91b..bbcd00111a4b7eb51c1d3d190555dadd414ec92a 100644 (file)
--- a/rust/src/dcerpc/log.rs
+++ b/rust/src/dcerpc/log.rs
@@ -69,11 +69,9 @@ fn log_dcerpc_header_tcp(
         jsb.set_string("response", "UNREPLIED")?;
     }
 
-    if let Some(ref hdr) = state.header {
-        jsb.set_uint("call_id", tx.call_id as u64)?;
-        let vstr = format!("{}.{}", hdr.rpc_vers, hdr.rpc_vers_minor);
-        jsb.set_string("rpc_version", &vstr)?;
-    }
+    jsb.set_uint("call_id", tx.call_id as u64)?;
+    let vstr = format!("5.{}", tx.min_version);
+    jsb.set_string("rpc_version", &vstr)?;
 
     return Ok(());
 }