Bug #6191: if protocol dcerpc first packet type is Alter_context, it will not parse dcerpc - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #6191

closed

if protocol dcerpc first packet type is Alter_context, it will not parse dcerpc

Added by INTER xz 10 months ago. Updated 9 months ago.

Status:

Closed

Priority:

Normal

Assignee:

Shivani Bhardwaj

Target version:

7.0.1

Affected Versions:

6.0.6

Effort:

medium

Difficulty:

Label:

Description

When i use a dcerpc pcap, the first packet type is Alter_context, and next packet is Alter_context_resp. In this case, Suricata will not parse this pcap file.Because engine thought first packet is a response, and error is occurred.

file location is rust/src/dcerpc/dcerpc.rs:1337,
let is_request = hdr.hdrtype 0x00;

modify it as:
let is_request = hdr.hdrtype 0x00 || hdr.hdrtype == 0x0e;

it fix.

Files

opcda.pcap (12.9 KB) opcda.pcap

INTER xz, 06/30/2023 09:37 AM

Subtasks 1 (0 open — 1 closed)

Actions

Copy link

Updated by Victor Julien 10 months ago

Status changed from New to Assigned
Target version changed from TBD to 7.0.1

Pcap should be used to create a SV test. Backport should be considered.

Actions

Copy link

Updated by Shivani Bhardwaj 9 months ago

Status changed from Assigned to In Progress

Actions

Copy link

Updated by Shivani Bhardwaj 9 months ago

Hi @INTER xz ! Thank you for your report! Since you have already done the fix, would you like to make that code contribution yourself to Suricata? :)
I have created a test with the pcap you've uploaded here: https://github.com/OISF/suricata-verify/pull/1324

Please let me know if you cannot do that for some reason, then, I'll give the credit to you in the commit.

Actions

Copy link

Updated by Shivani Bhardwaj 9 months ago

Label Needs backport to 6.0 added

Actions

Copy link

Updated by OISF Ticketbot 9 months ago

Subtask #6236 added

Actions

Copy link

Updated by OISF Ticketbot 9 months ago

Label deleted (~~Needs backport to 6.0~~)

Actions

Copy link

Updated by INTER xz 9 months ago

Shivani Bhardwaj wrote in #note-3:

Hi @INTER xz ! Thank you for your report! Since you have already done the fix, would you like to make that code contribution yourself to Suricata? :)
I have created a test with the pcap you've uploaded here: https://github.com/OISF/suricata-verify/pull/1324

Please let me know if you cannot do that for some reason, then, I'll give the credit to you in the commit.

Thanks, there are some reasons why I can't commit the code, I'm happy to contribute to the open source community.

Actions

Copy link

Updated by Shivani Bhardwaj 9 months ago

Thanks, there are some reasons why I can't commit the code, I'm happy to contribute to the open source community.

No problem. Thanks a lot for reporting and proposing the fix. Would you want your name be credited in the commit? If yes, please let me know your name.
I have created a PR with the fix you proposed here: https://github.com/OISF/suricata/pull/9291

Actions

Copy link

Updated by Shivani Bhardwaj 9 months ago

Status changed from In Progress to In Review

Actions

Copy link

#10

Updated by INTER xz 9 months ago

Shivani Bhardwaj wrote in #note-8:

Thanks, there are some reasons why I can't commit the code, I'm happy to contribute to the open source community.

No problem. Thanks a lot for reporting and proposing the fix. Would you want your name be credited in the commit? If yes, please let me know your name.
I have created a PR with the fix you proposed here: https://github.com/OISF/suricata/pull/9291

My name in github is InterNALXz, use it alright. thank u!

Actions

Copy link

#11