Skip to content

Commit ad9d979

Browse files
committed
detect/dcerpc: avoids FP on dcerpc.iface keyword
When we got a bind without the first fragment flag, and did not set any_frag in the signature, the signature always matched, whatever the uuid value Ticket: 8457 (cherry picked from commit e388888)
1 parent abf9985 commit ad9d979

1 file changed

Lines changed: 9 additions & 11 deletions

File tree

rust/src/dcerpc/detect.rs

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -62,50 +62,48 @@ pub struct DCEOpnumData {
6262
fn match_backuuid(
6363
tx: &DCERPCTransaction, state: &mut DCERPCState, if_data: &mut DCEIfaceData,
6464
) -> u8 {
65-
let mut ret = 0;
6665
if !state.interface_uuids.is_empty() {
6766
for uuidentry in &state.interface_uuids {
68-
ret = 1;
6967
// if any_frag is not enabled, we need to match only against the first fragment
7068
if if_data.any_frag == 0 && (uuidentry.flags & DCERPC_UUID_ENTRY_FLAG_FF == 0) {
7169
SCLogDebug!("any frag not enabled");
7270
continue;
7371
}
7472
// if the uuid has been rejected(uuidentry->result == 1), we skip to the next uuid
7573
if !uuidentry.acked || uuidentry.result != 0 {
76-
ret = 0;
7774
SCLogDebug!("Skipping to next UUID");
7875
continue;
7976
}
8077

78+
let mut same = true;
8179
for i in 0..16 {
8280
if if_data.if_uuid[i] != uuidentry.uuid[i] {
8381
SCLogDebug!("Iface UUID and BINDACK Accepted UUID does not match");
84-
ret = 0;
82+
same = false;
8583
break;
8684
}
8785
}
86+
if !same {
87+
continue;
88+
}
8889
let ctxid = tx.get_req_ctxid();
89-
ret &= (uuidentry.ctxid == ctxid) as u8;
90-
if ret == 0 {
90+
if uuidentry.ctxid != ctxid {
9191
SCLogDebug!("CTX IDs/UUIDs do not match");
9292
continue;
9393
}
9494

9595
if let Some(x) = &if_data.du16 {
9696
if !detect_match_uint(x, uuidentry.version) {
9797
SCLogDebug!("Interface version did not match");
98-
ret &= 0;
98+
continue
9999
}
100100
}
101101

102-
if ret == 1 {
103-
return 1;
104-
}
102+
return 1;
105103
}
106104
}
107105

108-
return ret;
106+
return 0;
109107
}
110108

111109
fn parse_iface_data(arg: &str) -> Result<DCEIfaceData, ()> {

0 commit comments

Comments
 (0)