From: Russ Combs Date: Mon, 17 Aug 2015 21:39:48 +0000 (-0400) Subject: fix rpc_decode tests X-Git-Tag: 3.0.0-233~867 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8b6a65e1be9a6a923aaafd4c36fb2ecba72df8cf;p=thirdparty%2Fsnort3.git fix rpc_decode tests --- diff --git a/src/service_inspectors/rpc_decode/rpc_decode.cc b/src/service_inspectors/rpc_decode/rpc_decode.cc index f0cc6e2ba..fe4ebe2f9 100644 --- a/src/service_inspectors/rpc_decode/rpc_decode.cc +++ b/src/service_inspectors/rpc_decode/rpc_decode.cc @@ -89,7 +89,6 @@ struct RpcSsnData int events; uint32_t frag_len; uint32_t ignore; - uint32_t nseq; RpcBuffer seg; RpcBuffer frag; }; @@ -195,7 +194,6 @@ static RpcStatus RpcStatefulInspection(RpcDecodeConfig* rconfig, { const uint8_t* data = p->data; uint16_t dsize = p->dsize; - uint32_t seq = ntohl(p->ptrs.tcph->th_seq); int need; RpcStatus status; @@ -204,34 +202,6 @@ static RpcStatus RpcStatefulInspection(RpcDecodeConfig* rconfig, DebugFormat(DEBUG_RPC, "STATEFUL: Ssn: %p\n", rsdata); - if ((rsdata->nseq != seq) && (rsdata->nseq != 0)) - { - uint32_t overlap; - - if (rsdata->nseq < seq) - { - /* Missed packets - stop tracking */ - DebugMessage(DEBUG_RPC, - "STATEFUL: Missed data\n"); - return RPC_STATUS__ERROR; - } - - overlap = rsdata->nseq - seq; - if (dsize <= overlap) - { - DebugMessage(DEBUG_RPC, - "STATEFUL: All data overlapped\n"); - return RPC_STATUS__SUCCESS; - } - - data += overlap; - dsize -= (uint16_t)overlap; - - seq += overlap; - } - - rsdata->nseq = seq + dsize; - if (rsdata->ignore) { if (dsize < rsdata->ignore) @@ -448,6 +418,8 @@ static RpcStatus RpcPrepRaw(const uint8_t* data, uint32_t fraglen, Packet*) return RPC_STATUS__ERROR; } + DecodeBuffer.len = (RPC_FRAG_HDR_SIZE + fraglen); + return RPC_STATUS__SUCCESS; } @@ -478,6 +450,8 @@ static RpcStatus RpcPrepFrag(RpcSsnData* rsdata, Packet*) if (RpcBufLen(&rsdata->frag) > RPC_MAX_BUF_SIZE) RpcBufClean(&rsdata->frag); + DecodeBuffer.len = RpcBufLen(&rsdata->frag); + return RPC_STATUS__SUCCESS; } @@ -505,6 +479,8 @@ static RpcStatus RpcPrepSeg(RpcSsnData* rsdata, Packet*) RpcBufClean(&rsdata->seg); } + DecodeBuffer.len = (uint16_t)RpcBufLen(&rsdata->seg); + return RPC_STATUS__SUCCESS; } @@ -939,6 +915,7 @@ static int ConvertRPC(RpcDecodeConfig* rconfig, RpcSsnData* rsdata, Packet* p) DebugMessage(DEBUG_RPC, "converted data:\n"); //LogNetData(data, decoded_len, p); + DecodeBuffer.len = (uint16_t)decoded_len; return 0; } @@ -1044,9 +1021,7 @@ void RpcDecode::eval(Packet* p) rsdata = RpcSsnDataNew(p); } - if (RpcSsnIsActive(rsdata) - && ((p->packet_flags & PKT_REBUILT_STREAM) - || (rsdata->nseq == 0))) + if ( RpcSsnIsActive(rsdata) and (p->packet_flags & PKT_REBUILT_STREAM) ) { RpcStatus ret = RpcStatefulInspection(&config, rsdata, p); diff --git a/src/stream/tcp/tcp_reassembly.cc b/src/stream/tcp/tcp_reassembly.cc index baa1fb0a3..1a954c3cb 100644 --- a/src/stream/tcp/tcp_reassembly.cc +++ b/src/stream/tcp/tcp_reassembly.cc @@ -1379,52 +1379,54 @@ int CheckFlushPolicyOnAck(TcpSession *tcpssn, TcpTracker *talker, DebugFormat(DEBUG_STREAM_STATE, "Talker flush policy: %s\n", flush_policy_names[talker->flush_policy]); DebugFormat(DEBUG_STREAM_STATE, "Listener flush policy: %s\n", flush_policy_names[listener->flush_policy]); - switch (talker->flush_policy) { - case STREAM_FLPOLICY_IGNORE: - DebugMessage(DEBUG_STREAM_STATE, "STREAM_FLPOLICY_IGNORE\n"); - return 0; + switch (talker->flush_policy) + { + case STREAM_FLPOLICY_IGNORE: + DebugMessage(DEBUG_STREAM_STATE, "STREAM_FLPOLICY_IGNORE\n"); + return 0; - case STREAM_FLPOLICY_ON_ACK: - { - uint32_t flags = GetReverseDir(p); - int32_t flush_amt = flush_pdu_ackd(tcpssn, talker, &flags); + case STREAM_FLPOLICY_ON_ACK: + { + uint32_t flags = GetReverseDir(p); + int32_t flush_amt = flush_pdu_ackd(tcpssn, talker, &flags); - while (flush_amt >= 0) - { - if (!flush_amt) - flush_amt = talker->seglist_next->seq - - talker->seglist_base_seq; + while (flush_amt >= 0) + { + if (!flush_amt) + flush_amt = talker->seglist_next->seq + - talker->seglist_base_seq; - talker->seglist_next = talker->seglist; - talker->seglist_base_seq = talker->seglist->seq; + talker->seglist_next = talker->seglist; + talker->seglist_base_seq = talker->seglist->seq; - // for consistency with other cases, should return total - // but that breaks flushing pipelined pdus - flushed = flush_to_seq(tcpssn, talker, flush_amt, p, flags); + // for consistency with other cases, should return total + // but that breaks flushing pipelined pdus + flushed = flush_to_seq(tcpssn, talker, flush_amt, p, flags); - // ideally we would purge just once after this loop - // but that throws off base + // ideally we would purge just once after this loop + // but that throws off base + if ( flushed and talker->seglist ) purge_to_seq(tcpssn, talker, talker->seglist->seq + flushed); - // if we didn't flush as expected, bail - // (we can flush less than max dsize) - if (!flushed) - break; + // if we didn't flush as expected, bail + // (we can flush less than max dsize) + if (!flushed) + break; - flags = GetReverseDir(p); - flush_amt = flush_pdu_ackd(tcpssn, talker, &flags); - } - if (!flags && talker->splitter->is_paf()) - { - fallback(talker); - return CheckFlushPolicyOnAck(tcpssn, talker, listener, p); - } + flags = GetReverseDir(p); + flush_amt = flush_pdu_ackd(tcpssn, talker, &flags); } - break; + if (!flags && talker->splitter->is_paf()) + { + fallback(talker); + return CheckFlushPolicyOnAck(tcpssn, talker, listener, p); + } + } + break; - case STREAM_FLPOLICY_ON_DATA: - purge_flushed_ackd(tcpssn, talker); - break; + case STREAM_FLPOLICY_ON_DATA: + purge_flushed_ackd(tcpssn, talker); + break; } return flushed;