From: Oleksandr Fedorych -X (ofedoryc - SOFTSERVE INC at Cisco) <ofedoryc@cisco.com>
Date: Fri, 19 Sep 2025 19:31:06 +0000 (+0000)
Subject: Pull request #4903: dce-rpc: proper proto-bits not set in DCE2_GetRpkt which causes... 
X-Git-Tag: 3.9.6.0~11
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=853409fb1585e21587546385ca8a885d07ec9046;p=thirdparty%2Fsnort3.git

Pull request #4903: dce-rpc: proper proto-bits not set in DCE2_GetRpkt which causes assertion fail in u2 logger

Merge in SNORT/snort3 from ~OFEDORYC/snort3:dce-rpc-proper-proto-bits to master

Squashed commit of the following:

commit 42a55ac05273a04b923e9fc43e3de949cd5573ea
Author: ofedoryc <ofedoryc@cisco.com>
Date:   Thu Sep 11 05:27:30 2025 -0400

    dce-rpc: proper proto-bits not set in DCE2_GetRpkt which causes assertion fail in u2 logger
---

diff --git a/src/service_inspectors/dce_rpc/dce_common.cc b/src/service_inspectors/dce_rpc/dce_common.cc
index 4937ce367..14efd6bef 100644
--- a/src/service_inspectors/dce_rpc/dce_common.cc
+++ b/src/service_inspectors/dce_rpc/dce_common.cc
@@ -275,6 +275,14 @@ static void dce2_fill_rpkt_info(Packet* rpkt, Packet* p)
     rpkt->ptrs = p->ptrs;
     rpkt->flow = p->flow;
     rpkt->proto_bits = p->proto_bits;
+
+    if (p->proto_bits & PROTO_BIT__VLAN)
+    {
+        memcpy(rpkt->layers, p->layers, p->num_layers * sizeof(Layer));
+        rpkt->num_layers = p->num_layers;
+        rpkt->vlan_idx = p->vlan_idx;
+    }
+
     rpkt->packet_flags = p->packet_flags;
     rpkt->packet_flags |= PKT_PSEUDO;
     rpkt->user_inspection_policy_id = p->user_inspection_policy_id;