1 /****************************************************************************
2 * Copyright (C) 2014-2021 Cisco and/or its affiliates. All rights reserved.
3 * Copyright (C) 2008-2013 Sourcefire, Inc.
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License Version 2 as
7 * published by the Free Software Foundation. You may not use, modify or
8 * distribute this program under any other version of the GNU General
9 * Public License.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
19 *
20 ****************************************************************************
21 * Handles processing of events generated by the preprocessor.
22 *
23 * 8/17/2008 - Initial implementation ... Todd Wease <twease@sourcefire.com>
24 *
25 ****************************************************************************/
26
27 #ifndef _DCE2_EVENT_H_
28 #define _DCE2_EVENT_H_
29
30 #include "dce2_session.h"
31 #include "dce2_config.h"
32 #include "snort_debug.h"
33 #include "dcerpc.h"
34 #include "sf_types.h"
35
36 /********************************************************************
37 * Macros
38 ********************************************************************/
39 #define GENERATOR_DCE2 133
40
41 /********************************************************************
42 * Externs
43 ********************************************************************/
44 extern char *dce2_pdu_types[DCERPC_PDU_TYPE__MAX];
45
46 /********************************************************************
47 * Enumerations
48 ********************************************************************/
49 /* Since this is mirrored in generators.h via #defines, any
50 * additions to this should go at the end, just before
51 * DCE2_EVENT__MAX. It is important the the sids stay the
52 * same in generators.h as these are also in gen-msg.map */
53 typedef enum _DCE2_Event
54 {
55 DCE2_EVENT__NO_EVENT = 0,
56 DCE2_EVENT__MEMCAP,
57 DCE2_EVENT__SMB_BAD_NBSS_TYPE,
58 DCE2_EVENT__SMB_BAD_TYPE,
59 DCE2_EVENT__SMB_BAD_ID,
60 DCE2_EVENT__SMB_BAD_WCT,
61 DCE2_EVENT__SMB_BAD_BCC,
62 DCE2_EVENT__SMB_BAD_FORMAT,
63 DCE2_EVENT__SMB_BAD_OFF,
64 DCE2_EVENT__SMB_TDCNT_ZERO,
65 DCE2_EVENT__SMB_NB_LT_SMBHDR,
66 DCE2_EVENT__SMB_NB_LT_COM,
67 DCE2_EVENT__SMB_NB_LT_BCC,
68 DCE2_EVENT__SMB_NB_LT_DSIZE,
69 DCE2_EVENT__SMB_TDCNT_LT_DSIZE,
70 DCE2_EVENT__SMB_DSENT_GT_TDCNT,
71 DCE2_EVENT__SMB_BCC_LT_DSIZE,
72 DCE2_EVENT__SMB_INVALID_DSIZE,
73 DCE2_EVENT__SMB_EXCESSIVE_TREE_CONNECTS,
74 DCE2_EVENT__SMB_EXCESSIVE_READS,
75 DCE2_EVENT__SMB_EXCESSIVE_CHAINING,
76 DCE2_EVENT__SMB_MULT_CHAIN_SS,
77 DCE2_EVENT__SMB_MULT_CHAIN_TC,
78 DCE2_EVENT__SMB_CHAIN_SS_LOGOFF,
79 DCE2_EVENT__SMB_CHAIN_TC_TDIS,
80 DCE2_EVENT__SMB_CHAIN_OPEN_CLOSE,
81 DCE2_EVENT__SMB_INVALID_SHARE,
82 DCE2_EVENT__CO_BAD_MAJ_VERSION,
83 DCE2_EVENT__CO_BAD_MIN_VERSION,
84 DCE2_EVENT__CO_BAD_PDU_TYPE,
85 DCE2_EVENT__CO_FLEN_LT_HDR,
86 DCE2_EVENT__CO_FLEN_LT_SIZE,
87 DCE2_EVENT__CO_ZERO_CTX_ITEMS,
88 DCE2_EVENT__CO_ZERO_TSYNS,
89 DCE2_EVENT__CO_FRAG_LT_MAX_XMIT_FRAG,
90 DCE2_EVENT__CO_FRAG_GT_MAX_XMIT_FRAG,
91 DCE2_EVENT__CO_ALTER_CHANGE_BYTE_ORDER,
92 DCE2_EVENT__CO_FRAG_DIFF_CALL_ID,
93 DCE2_EVENT__CO_FRAG_DIFF_OPNUM,
94 DCE2_EVENT__CO_FRAG_DIFF_CTX_ID,
95 DCE2_EVENT__CL_BAD_MAJ_VERSION,
96 DCE2_EVENT__CL_BAD_PDU_TYPE,
97 DCE2_EVENT__CL_DATA_LT_HDR,
98 DCE2_EVENT__CL_BAD_SEQ_NUM,
99 DCE2_EVENT__SMB_V1,
100 DCE2_EVENT__SMB_V2,
101 DCE2_EVENT__SMB_INVALID_BINDING,
102 DCE2_EVENT__SMB2_EXCESSIVE_COMPOUNDING,
103 DCE2_EVENT__SMB_DCNT_ZERO,
104 DCE2_EVENT__SMB_DCNT_MISMATCH,
105 DCE2_EVENT__SMB_MAX_REQS_EXCEEDED,
106 DCE2_EVENT__SMB_REQS_SAME_MID,
107 DCE2_EVENT__SMB_DEPR_DIALECT_NEGOTIATED,
108 DCE2_EVENT__SMB_DEPR_COMMAND_USED,
109 DCE2_EVENT__SMB_UNUSUAL_COMMAND_USED,
110 DCE2_EVENT__SMB_INVALID_SETUP_COUNT,
111 DCE2_EVENT__SMB_MULTIPLE_NEGOTIATIONS,
112 DCE2_EVENT__SMB_EVASIVE_FILE_ATTRS,
113 DCE2_EVENT__SMB_INVALID_FILE_OFFSET,
114 DCE2_EVENT__SMB_BAD_NEXT_COMMAND_OFFSET,
115 DCE2_EVENT__MAX
116
117 } DCE2_Event;
118
119 /********************************************************************
120 * Structures
121 ********************************************************************/
122 typedef struct _DCE2_EventNode
123 {
124 DCE2_EventFlag eflag;
125 DCE2_Event event;
126 char *format;
127
128 } DCE2_EventNode;
129
130 /********************************************************************
131 * Public Function Prototypes
132 ********************************************************************/
133 void DCE2_EventsInit(void);
134 void DCE2_Alert(DCE2_SsnData *, DCE2_Event, ...);
135 void DCE2_EventsFree(void);
136
137 /********************************************************************
138 * Inline Function Prototypes
139 ********************************************************************/
140 static inline int DCE2_SsnAlerted(DCE2_SsnData *, DCE2_Event);
141
142 /******************************************************************
143 * Function: DCE2_SsnAlerted()
144 *
145 * Checks to see if we have already generated an alert on this
146 * session for the event type passed in.
147 *
148 * Arguments:
149 * DCE2_SsnData *
150 * The session data structure.
151 * DCE2_Event
152 * The event to check for.
153 *
154 * Returns:
155 * int
156 * 1 if we have already alerted for this event type on this
157 * session.
158 * 0 if we have not alerted for this event type on this
159 * session.
160 *
161 ******************************************************************/
DCE2_SsnAlerted(DCE2_SsnData * sd,DCE2_Event e)162 static inline int DCE2_SsnAlerted(DCE2_SsnData *sd, DCE2_Event e)
163 {
164 if (sd->alert_mask & (1 << e)) return 1;
165 return 0;
166 }
167
168 #endif /* _DCE2_EVENT_H_ */
169
170