/* Copyright (C) 2020-2022 Open Information Security Foundation

 *

 * You can copy, redistribute or modify this Program under the terms of

 * the GNU General Public License version 2 as published by the Free

 * Software Foundation.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * version 2 along with this program; if not, write to the Free Software

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA

 * 02110-1301, USA.

 */

use crate::applayer::{self, *};

use crate::core::{self, *};

use crate::dcerpc::parser;

use nom7::error::{Error, ErrorKind};

use nom7::number::Endianness;

use nom7::{Err, IResult, Needed};

use std;

use std::cmp;

use std::ffi::CString;

use std::collections::VecDeque;

use crate::conf::{conf_get, get_memval};

pub static mut DCERPC_MAX_STUB_SIZE: u32 = 1048576;

// Constant DCERPC UDP Header length

pub const DCERPC_HDR_LEN: u16 = 16;

// FIRST flag set on the packet

pub const DCERPC_UUID_ENTRY_FLAG_FF: u16 = 0x0001;

// Flag bits in connection-oriented PDU header

// Value to indicate first fragment

pub const PFC_FIRST_FRAG: u8 = 0x01;

// Value to indicate last fragment

pub const PFC_LAST_FRAG: u8 = 0x02;

// Cancel was pending at sender

pub const PFC_PENDING_CANCEL: u8 = 0x04;

pub const PFC_RESERVED_1: u8 = 0x08;

// supports concurrent multiplexing of a single connection.

pub const PFC_CONC_MPX: u8 = 0x10;

// only meaningful on `fault' packet; if true, guaranteed

//  call did not execute.

pub const PFC_DID_NOT_EXECUTE: u8 = 0x20;

// `maybe' call semantics requested

pub const PFC_MAYBE: u8 = 0x40;

// if true, a non-nil object UUID was specified in the handle, and

//  is present in the optional object field. If false, the object field

// is omitted.

pub const PFC_OBJECT_UUID: u8 = 0x80;

// Flag bits in first flag field in connectionless PDU header.

pub const PFCL1_RESERVED_01: u8 = 0x01; // Reserved for use by implementations

pub const PFCL1_LASTFRAG: u8 = 0x02; // If set, the PDU is the last fragment

                                     // of a multi-PDU transmission

pub const PFCL1_FRAG: u8 = 0x04; // If set, the PDU is a fragment

                                 // of a multi-PDU transmission

pub const PFCL1_NOFACK: u8 = 0x08; // If set, the receiver is not requested

                                   // to send a `fack' PDU for the fragment

pub const PFCL1_MAYBE: u8 = 0x10; // If set, the PDU is for a `maybe' request

pub const PFCL1_IDEMPOTENT: u8 = 0x20; // If set, the PDU is for

                                       // an idempotent request

pub const PFCL1_BROADCAST: u8 = 0x40; // If set, the PDU is for

                                      // a broadcast request

pub const PFCL1_RESERVED_80: u8 = 0x80; // Reserved for use by implementations

// Flag bits in second flag field in connectionless PDU header.

pub const PFCL2_RESERVED_01: u8 = 0x01; // Reserved for use by implementations

pub const PFCL2_CANCEL_PENDING: u8 = 0x02; // Cancel pending at the call end

pub const PFCL2_RESERVED_04: u8 = 0x04; // Reserved for future use

pub const PFCL2_RESERVED_08: u8 = 0x08; // Reserved for future use

pub const PFCL2_RESERVED_10: u8 = 0x10; // Reserved for future use

pub const PFCL2_RESERVED_20: u8 = 0x20; // Reserved for future use

pub const PFCL2_RESERVED_40: u8 = 0x40; // Reserved for future use

pub const PFCL2_RESERVED_80: u8 = 0x80; // Reserved for future use

pub const REASON_NOT_SPECIFIED: u8 = 0;

pub const TEMPORARY_CONGESTION: u8 = 1;

pub const LOCAL_LIMIT_EXCEEDED: u8 = 2;

pub const CALLED_PADDR_UNKNOWN: u8 = 3; /* not used */

pub const PROTOCOL_VERSION_NOT_SUPPORTED: u8 = 4;

pub const DEFAULT_CONTEXT_NOT_SUPPORTED: u8 = 5; /* not used */

pub const USER_DATA_NOT_READABLE: u8 = 6; /* not used */

pub const NO_PSAP_AVAILABLE: u8 = 7; /* not used */

// DCERPC Header packet types

pub const DCERPC_TYPE_REQUEST: u8 = 0;

pub const DCERPC_TYPE_PING: u8 = 1;

pub const DCERPC_TYPE_RESPONSE: u8 = 2;

pub const DCERPC_TYPE_FAULT: u8 = 3;

pub const DCERPC_TYPE_WORKING: u8 = 4;

pub const DCERPC_TYPE_NOCALL: u8 = 5;

pub const DCERPC_TYPE_REJECT: u8 = 6;

pub const DCERPC_TYPE_ACK: u8 = 7;

pub const DCERPC_TYPE_CL_CANCEL: u8 = 8;

pub const DCERPC_TYPE_FACK: u8 = 9;

pub const DCERPC_TYPE_CANCEL_ACK: u8 = 10;

pub const DCERPC_TYPE_BIND: u8 = 11;

pub const DCERPC_TYPE_BINDACK: u8 = 12;

pub const DCERPC_TYPE_BINDNAK: u8 = 13;

pub const DCERPC_TYPE_ALTER_CONTEXT: u8 = 14;

pub const DCERPC_TYPE_ALTER_CONTEXT_RESP: u8 = 15;

pub const DCERPC_TYPE_AUTH3: u8 = 16;

pub const DCERPC_TYPE_SHUTDOWN: u8 = 17;

pub const DCERPC_TYPE_CO_CANCEL: u8 = 18;

pub const DCERPC_TYPE_ORPHANED: u8 = 19;

pub const DCERPC_TYPE_RTS: u8 = 20;

pub const DCERPC_TYPE_UNKNOWN: u8 = 99;

pub(super) static mut DCERPC_MAX_TX: usize = 1024;

pub static mut ALPROTO_DCERPC: AppProto = ALPROTO_UNKNOWN;

pub fn dcerpc_type_string(t: u8) -> String {

    match t {

        DCERPC_TYPE_REQUEST => "REQUEST",

        DCERPC_TYPE_PING => "PING",

        DCERPC_TYPE_RESPONSE => "RESPONSE",

        DCERPC_TYPE_FAULT => "FAULT",

        DCERPC_TYPE_WORKING => "WORKING",

        DCERPC_TYPE_NOCALL => "NOCALL",

        DCERPC_TYPE_REJECT => "REJECT",

        DCERPC_TYPE_ACK => "ACK",

        DCERPC_TYPE_CL_CANCEL => "CL_CANCEL",

        DCERPC_TYPE_FACK => "FACK",

        DCERPC_TYPE_CANCEL_ACK => "CANCEL_ACK",

        DCERPC_TYPE_BIND => "BIND",

        DCERPC_TYPE_BINDACK => "BINDACK",

        DCERPC_TYPE_BINDNAK => "BINDNAK",

        DCERPC_TYPE_ALTER_CONTEXT => "ALTER_CONTEXT",

        DCERPC_TYPE_ALTER_CONTEXT_RESP => "ALTER_CONTEXT_RESP",

        DCERPC_TYPE_AUTH3 => "AUTH3",

        DCERPC_TYPE_SHUTDOWN => "SHUTDOWN",

        DCERPC_TYPE_CO_CANCEL => "CO_CANCEL",

        DCERPC_TYPE_ORPHANED => "ORPHANED",

        DCERPC_TYPE_RTS => "RTS",

        DCERPC_TYPE_UNKNOWN => "UNKNOWN",

        _ => {

            return (t).to_string();

        }

    }

    .to_string()

}

pub fn get_resp_type_for_req(t: u8) -> u8 {

    match t {

        DCERPC_TYPE_REQUEST => DCERPC_TYPE_RESPONSE,

        DCERPC_TYPE_BIND => DCERPC_TYPE_BINDACK,

        DCERPC_TYPE_ALTER_CONTEXT => DCERPC_TYPE_ALTER_CONTEXT_RESP,

        _ => DCERPC_TYPE_UNKNOWN,

    }

}

pub fn get_req_type_for_resp(t: u8) -> u8 {

    match t {

        DCERPC_TYPE_RESPONSE => DCERPC_TYPE_REQUEST,

        DCERPC_TYPE_BINDACK => DCERPC_TYPE_BIND,

        DCERPC_TYPE_ALTER_CONTEXT_RESP => DCERPC_TYPE_ALTER_CONTEXT,

        _ => DCERPC_TYPE_UNKNOWN,

    }

}

#[inline(always)]

pub fn cfg_max_stub_size() -> u32 {

    unsafe { DCERPC_MAX_STUB_SIZE }

}

#[derive(Default, Debug)]

pub struct DCERPCTransaction {

    pub id: u64, // internal transaction ID

    pub ctxid: u16,

    pub opnum: u16,

    pub first_request_seen: u8,

    pub call_id: u32, // ID to match any request-response pair

    pub frag_cnt_ts: u16,

    pub frag_cnt_tc: u16,

    pub endianness: u8,

    pub stub_data_buffer_ts: Vec<u8>,

    pub stub_data_buffer_tc: Vec<u8>,

    pub stub_data_buffer_reset_ts: bool,

    pub stub_data_buffer_reset_tc: bool,

    pub req_done: bool,

    pub resp_done: bool,

    pub req_lost: bool,

    pub resp_lost: bool,

    pub req_cmd: u8,

    pub resp_cmd: u8,

    pub activityuuid: Vec<u8>,

    pub seqnum: u32,

    pub tx_data: AppLayerTxData,

}

impl Transaction for DCERPCTransaction {

    fn id(&self) -> u64 {

        // need +1 to match state.tx_id

        self.id + 1

    }

}

impl DCERPCTransaction {

    pub fn new() -> Self {

        return Self {

            stub_data_buffer_ts: Vec::new(),

            stub_data_buffer_tc: Vec::new(),

            req_cmd: DCERPC_TYPE_REQUEST,

            resp_cmd: DCERPC_TYPE_RESPONSE,

            activityuuid: Vec::new(),

            tx_data: AppLayerTxData::new(),

            ..Default::default()

        }

    }

    pub fn get_req_ctxid(&self) -> u16 {

        self.ctxid

    }

    pub fn get_first_req_seen(&self) -> u8 {

        self.first_request_seen

    }

    pub fn get_req_opnum(&self) -> u16 {

        self.opnum

    }

    pub fn get_endianness(&self) -> u8 {

        self.endianness

    }

}

#[derive(Debug)]

pub struct DCERPCRequest {

    pub ctxid: u16,

    pub opnum: u16,

    pub first_request_seen: u8,

}

#[derive(Default, Debug, Clone)]

pub struct DCERPCUuidEntry {

    pub ctxid: u16,

    pub internal_id: u16,

    pub result: u16,

    pub uuid: Vec<u8>,

    pub version: u16,

    pub versionminor: u16,

    pub flags: u16,

}

impl DCERPCUuidEntry {

    pub fn new() -> Self {

        Default::default()

    }

}

#[derive(Debug, PartialEq, Eq)]

pub struct Uuid {

    pub time_low: Vec<u8>,

    pub time_mid: Vec<u8>,

    pub time_hi_and_version: Vec<u8>,

    pub clock_seq_hi_and_reserved: u8,

    pub clock_seq_low: u8,

    pub node: Vec<u8>,

}

#[derive(Debug)]

pub struct DCERPCHdr {

    pub rpc_vers: u8,

    pub rpc_vers_minor: u8,

    pub hdrtype: u8,

    pub pfc_flags: u8,

    pub packed_drep: Vec<u8>,

    pub frag_length: u16,

    pub auth_length: u16,

    pub call_id: u32,

}

#[derive(Debug)]

pub struct DCERPCBind {

    pub numctxitems: u8,

    pub uuid_list: Vec<DCERPCUuidEntry>,

}

#[derive(Debug)]

pub struct BindCtxItem {

    pub ctxid: u16,

    pub uuid: Vec<u8>,

    pub version: u16,

    pub versionminor: u16,

}

#[derive(Debug, PartialEq, Eq)]

pub struct DCERPCBindAckResult {

    pub ack_result: u16,

    pub ack_reason: u16,

    pub transfer_syntax: Vec<u8>,

    pub syntax_version: u32,

}

#[derive(Debug)]

pub struct DCERPCBindAck {

    pub accepted_uuid_list: Vec<DCERPCUuidEntry>,

    pub sec_addr_len: u16,

    pub numctxitems: u8,

    pub ctxitems: Vec<DCERPCBindAckResult>,

}

#[derive(Default, Debug)]

pub struct DCERPCState {

    pub header: Option<DCERPCHdr>,

    pub bind: Option<DCERPCBind>,

    pub bindack: Option<DCERPCBindAck>,

    pub transactions: VecDeque<DCERPCTransaction>,

    tx_index_completed: usize,

    pub buffer_ts: Vec<u8>,

    pub buffer_tc: Vec<u8>,

    pub pad: u8,

    pub padleft: u16,

    pub bytes_consumed: i32,

    pub tx_id: u64,

    pub query_completed: bool,

    pub data_needed_for_dir: Direction,

    pub prev_dir: Direction,

    pub ts_gap: bool,

    pub tc_gap: bool,

    pub ts_ssn_gap: bool,

    pub tc_ssn_gap: bool,

    pub ts_ssn_trunc: bool, /// true if Truncated in this direction

    pub tc_ssn_trunc: bool,

    pub flow: Option<*const core::Flow>,

    state_data: AppLayerStateData,

}

impl State<DCERPCTransaction> for DCERPCState {

    fn get_transaction_count(&self) -> usize {

        self.transactions.len()

    }

    fn get_transaction_by_index(&self, index: usize) -> Option<&DCERPCTransaction> {

        self.transactions.get(index)

    }

}

impl DCERPCState {

    pub fn new() -> Self {

        return Self {

            data_needed_for_dir: Direction::ToServer,

            prev_dir: Direction::ToServer,

            ..Default::default()

        }

    }

    fn create_tx(&mut self, call_id: u32) -> DCERPCTransaction {

        let mut tx = DCERPCTransaction::new();

        let endianness = self.get_hdr_drep_0() & 0x10;

        tx.id = self.tx_id;

        tx.call_id = call_id;

        tx.endianness = endianness;

        self.tx_id += 1;

        tx.req_done = self.ts_ssn_trunc;

        tx.resp_done = self.tc_ssn_trunc;

        if self.transactions.len() > unsafe { DCERPC_MAX_TX } {

            let mut index = self.tx_index_completed;

            for tx_old in &mut self.transactions.range_mut(self.tx_index_completed..) {

                index += 1;

                if !tx_old.req_done || !tx_old.resp_done {

                    tx_old.tx_data.updated_tc = true;

                    tx_old.tx_data.updated_ts = true;

                    tx_old.req_done = true;

                    tx_old.resp_done = true;

                    break;

                }

            }

            self.tx_index_completed = index;

        }

        tx

    }

    pub fn free_tx(&mut self, tx_id: u64) {

        SCLogDebug!("Freeing TX with ID {} TX.ID {}", tx_id, tx_id+1);

        let len = self.transactions.len();

        let mut found = false;

        let mut index = 0;

        for i in 0..len {

            let tx = &self.transactions[i];

            if tx.id == tx_id { //+ 1 {

                found = true;

                index = i;

                SCLogDebug!("tx {} progress {}/{}", tx.id, tx.req_done, tx.resp_done);

                break;

            }

        }

        if found {

            SCLogDebug!("freeing TX with ID {} TX.ID {} at index {} left: {} max id: {}",

                            tx_id, tx_id+1, index, self.transactions.len(), self.tx_id);

            self.tx_index_completed = 0;

            self.transactions.remove(index);

        }

    }

    fn get_hdr_drep_0(&self) -> u8 {

        if let Some(ref hdr) = &self.header {

            return hdr.packed_drep[0];

        }

        0

    }

    fn get_endianness(&self) -> Endianness {

        let drep_0 = self.get_hdr_drep_0();

        if drep_0 & 0x10 == 0 {

            return Endianness::Big;

        }

        Endianness::Little

    }

    fn get_hdr_fraglen(&self) -> Option<u16> {

        debug_validate_bug_on!(self.header.is_none());

        if let Some(ref hdr) = self.header {

            return Some(hdr.frag_length);

        }

        // Shouldn't happen

        None

    }

    fn get_hdr_pfcflags(&self) -> Option<u8> {

        debug_validate_bug_on!(self.header.is_none());

        if let Some(ref hdr) = self.header {

            return Some(hdr.pfc_flags);

        }

        // Shouldn't happen

        None

    }

    pub fn get_hdr_type(&self) -> Option<u8> {

        debug_validate_bug_on!(self.header.is_none());

        if let Some(ref hdr) = self.header {

            return Some(hdr.hdrtype);

        }

        // Shouldn't happen

        None

    }

    pub fn get_hdr_call_id(&self) -> Option<u32> {

        debug_validate_bug_on!(self.header.is_none());

        if let Some(ref hdr) = self.header {

            return Some(hdr.call_id);

        }

        // Shouldn't happen

        None

    }

    pub fn clean_buffer(&mut self, direction: Direction) {

        match direction {

            Direction::ToServer => {

                self.buffer_ts.clear();

                self.ts_gap = false;

            }

            Direction::ToClient => {

                self.buffer_tc.clear();

                self.tc_gap = false;

            }

        }

        self.bytes_consumed = 0;

    }

    pub fn reset_direction(&mut self, direction: Direction) {

        if direction == Direction::ToServer {

            self.data_needed_for_dir = Direction::ToClient;

        } else {

            self.data_needed_for_dir = Direction::ToServer;

        }

    }

    /// Get transaction as per the given transaction ID. Transaction ID with

    /// which the lookup is supposed to be done as per the calls from AppLayer

    /// parser in C. This requires an internal transaction ID to be maintained.

    ///

    /// Arguments:

    /// * `tx_id`: internal transaction ID to track transactions

    ///

    /// Return value:

    /// Option mutable reference to DCERPCTransaction

    pub fn get_tx(&mut self, tx_id: u64) -> Option<&mut DCERPCTransaction> {

        for tx in &mut self.transactions {

            let found = tx.id == tx_id;

            if found {

                return Some(tx);

            }

        }

        None

    }

    /// Find the transaction as per call ID defined in header. If the tx is not

    /// found, create one.

    ///

    /// Arguments:

    /// * `call_id`: call_id param derived from TCP Header

    /// * `dir`: description: direction of the flow

    ///

    /// Return value:

    /// Option mutable reference to DCERPCTransaction

    pub fn get_tx_by_call_id(&mut self, call_id: u32, dir: Direction) -> Option<&mut DCERPCTransaction> {

        let cmd = self.get_hdr_type().unwrap_or(0);

        for tx in &mut self.transactions {

            let found = tx.call_id == call_id;

            if found {

                match dir {

                    Direction::ToServer => {

                        if tx.req_done || tx.req_lost {

                            continue;

                        }

                        let resp_cmd = get_resp_type_for_req(cmd);

                        if resp_cmd != tx.resp_cmd {

                            continue;

                        }

                    }

                    Direction::ToClient => {

                        if tx.resp_done || tx.resp_lost {

                            continue;

                        }

                        let req_cmd = get_req_type_for_resp(cmd);

                        if req_cmd != tx.req_cmd {

                            continue;

                        }

                    }

                }

                tx.tx_data.updated_tc = true;

                tx.tx_data.updated_ts = true;

                return Some(tx);

            }

        }

        None

    }

    pub fn parse_data_gap(&mut self, direction: Direction) -> AppLayerResult {

        match direction {

            Direction::ToServer => {

                self.ts_gap = true;

                self.ts_ssn_gap = true;

            },

            Direction::ToClient => {

                self.tc_gap = true;

                self.tc_ssn_gap = true;

            },

        }

        AppLayerResult::ok()

    }

    pub fn post_gap_housekeeping(&mut self, dir: Direction) {

        SCLogDebug!("ts ssn gap: {:?}, tc ssn gap: {:?}, dir: {:?}", self.ts_ssn_gap, self.tc_ssn_gap, dir);

        if self.ts_ssn_gap && dir == Direction::ToServer {

            for tx in &mut self.transactions {

                if tx.id >= self.tx_id {

                    SCLogDebug!("post_gap_housekeeping: done");

                    break;

                }

                if !tx.req_done {

                    tx.req_lost = true;

                }

                tx.req_done = true;

                if let Some(flow) = self.flow {

                    sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32);

                }

            }

        } else if self.tc_ssn_gap && dir == Direction::ToClient {

            for tx in &mut self.transactions {

                if tx.id >= self.tx_id {

                    SCLogDebug!("post_gap_housekeeping: done");

                    break;

                }

                if !tx.req_done {

                    tx.req_lost = true;

                }

                if !tx.resp_done {

                    tx.resp_lost = true;

                }

                tx.req_done = true;

                tx.resp_done = true;

                if let Some(flow) = self.flow {

                    sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32);

                }

            }

        }

    }

    pub fn search_dcerpc_record<'a>(&mut self, i: &'a[u8]) -> IResult<&'a[u8], &'a[u8]> {

        let mut d = i;

        while d.len() >= 2 {

            if d[0] == 0x05 && d[1] == 0x00 {

                return Ok((&d[2..], d));

            }

            d = &d[1..];

        }

        Err(Err::Incomplete(Needed::new(2_usize - d.len())))

    }

    /// Makes a call to the nom parser for parsing DCERPC Header.

    ///

    /// Arguments:

    /// * `input`: bytes from the beginning of the buffer.

    ///

    /// Return value:

    /// * Success: Number of bytes successfully parsed.

    /// * Failure:

    ///   * -1 in case of Incomplete data or Eof.

    ///   * -2 in case of Error while parsing.

    pub fn process_header(&mut self, input: &[u8]) -> i32 {

        match parser::parse_dcerpc_header(input) {

            Ok((leftover_bytes, header)) => {

                if header.rpc_vers != 5

                    || (header.rpc_vers_minor != 0 && header.rpc_vers_minor != 1)

                {

                    SCLogDebug!(

                        "DCERPC Header did not validate. Major version: {:?} Minor version: {:?}",

                        header.rpc_vers,

                        header.rpc_vers_minor

                    );

                    return -1;

                }

                self.header = Some(header);

                (input.len() - leftover_bytes.len()) as i32

            }

            Err(Err::Incomplete(_)) => {

                // Insufficient data.

                SCLogDebug!("Insufficient data while parsing DCERPC header");

                -1

            }

            Err(Err::Error(Error{code:ErrorKind::Eof, ..})) => {

                SCLogDebug!("EoF reached while parsing DCERPC header");

                -1

            }

            Err(_) => {

                // Error, probably malformed data.

                SCLogDebug!("An error occurred while parsing DCERPC header");

                -2

            }

        }

    }

    pub fn handle_bindctxitem(&mut self, input: &[u8], uuid_internal_id: u16) -> i32 {

        let endianness = self.get_endianness();

        match parser::parse_bindctx_item(input, endianness) {

            Ok((leftover_bytes, ctxitem)) => {

                let mut uuidentry = DCERPCUuidEntry::new();

                uuidentry.uuid = ctxitem.uuid;

                uuidentry.internal_id = uuid_internal_id;

                uuidentry.ctxid = ctxitem.ctxid;

                uuidentry.version = ctxitem.version;

                uuidentry.versionminor = ctxitem.versionminor;

                let pfcflags = self.get_hdr_pfcflags().unwrap_or(0);

                // Store the first frag flag in the uuid as pfc_flags will

                // be overwritten by new packets

                if pfcflags & PFC_FIRST_FRAG > 0 {

                    uuidentry.flags |= DCERPC_UUID_ENTRY_FLAG_FF;

                }

                if let Some(ref mut bind) = self.bind {

                    SCLogDebug!("DCERPC BIND CtxItem: Pushing uuid: {:?}", uuidentry);

                    bind.uuid_list.push(uuidentry);

                }

                (input.len() - leftover_bytes.len()) as i32

            }

            Err(Err::Incomplete(_)) => {

                // Insufficient data.

                SCLogDebug!("Insufficient data while parsing DCERPC BIND CTXItem");

                -1

            }

            Err(_) => {

                // Error, probably malformed data.

                SCLogDebug!("An error occurred while parsing DCERPC BIND CTXItem");

                -1

            }

        }

    }

    pub fn process_bind_pdu(&mut self, input: &[u8]) -> i32 {

        let mut retval = 0;

        let mut idx = 12; // Bytes consumed if parser returns OK would be 12

        match parser::parse_dcerpc_bind(input) {

            Ok((leftover_bytes, header)) => {

                let numctxitems = header.numctxitems;

                self.bind = Some(header);

                for i in 0..numctxitems {

                    retval = self.handle_bindctxitem(&input[idx as usize..], i as u16);

                    if retval == -1 {

                        return -1;

                    }

                    idx += retval;

                }

                let call_id = self.get_hdr_call_id().unwrap_or(0);

                let mut tx = self.create_tx(call_id);

                tx.req_cmd = self.get_hdr_type().unwrap_or(0);

                tx.req_done = true;

                if let Some(flow) = self.flow {

                    sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32);

                }

                tx.frag_cnt_ts = 1;

                self.transactions.push_back(tx);

                // Bytes parsed with `parse_dcerpc_bind` + (bytes parsed per bindctxitem [44] * number

                // of bindctxitems)

                (input.len() - leftover_bytes.len()) as i32 + retval * numctxitems as i32

            }

            Err(Err::Incomplete(_)) => {

                // Insufficient data.

                SCLogDebug!("Insufficient data while parsing DCERPC BIND header");

                -1

            }

            Err(_) => {

                // Error, probably malformed data.

                SCLogDebug!("An error occurred while parsing DCERPC BIND header");

                -1

            }

        }

    }

    pub fn process_bindack_pdu(&mut self, input: &[u8]) -> i32 {

        match parser::parse_dcerpc_bindack(input) {

            Ok((leftover_bytes, mut back)) => {

                if let Some(ref mut bind) = self.bind {

                    for (uuid_internal_id, r) in back.ctxitems.iter().enumerate() {

                        for uuid in bind.uuid_list.iter_mut() {

                            if uuid.internal_id == uuid_internal_id as u16 {

                                uuid.result = r.ack_result;

                                if uuid.result != 0 {

                                    break;

                                }

                                back.accepted_uuid_list.push(uuid.clone());

                                SCLogDebug!("DCERPC BINDACK accepted UUID: {:?}", uuid);

                            }

                        }

                    }

                    self.bindack = Some(back);

                }

                (input.len() - leftover_bytes.len()) as i32

            }

            Err(Err::Incomplete(_)) => {

                // Insufficient data.

                SCLogDebug!("Insufficient data while parsing DCERPC BINDACK");

                -1

            }

            Err(_) => {

                // Error, probably malformed data.

                SCLogDebug!("An error occurred while parsing DCERPC BINDACK");

                -1

            }

        }

    }

    pub fn handle_stub_data(&mut self, input: &[u8], input_len: usize, dir: Direction) -> u16 {

        let retval;

        let hdrpfcflags = self.get_hdr_pfcflags().unwrap_or(0);

        let padleft = self.padleft;

        let call_id = self.get_hdr_call_id().unwrap_or(0);

        let hdrtype = self.get_hdr_type();

        let tx;

        if let Some(transaction) = self.get_tx_by_call_id(call_id, dir) {

            tx = transaction;

        } else {

            SCLogDebug!("No transaction found matching the call ID: {:?}", call_id);

            return 0;

        }

        // Update the stub params based on the packet type

        match hdrtype {

            Some(x) => match x {

                DCERPC_TYPE_REQUEST => {

                    retval = evaluate_stub_params(

                        input,

                        input_len,

                        hdrpfcflags,

                        padleft,

                        &mut tx.stub_data_buffer_ts,

                        &mut tx.stub_data_buffer_reset_ts,

                    );

                    tx.req_done = true;

                    tx.frag_cnt_ts = 1;

                    if let Some(flow) = self.flow {

                        sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32);

                    }

                }

                DCERPC_TYPE_RESPONSE => {

                    retval = evaluate_stub_params(

                        input,

                        input_len,

                        hdrpfcflags,

                        padleft,

                        &mut tx.stub_data_buffer_tc,

                        &mut tx.stub_data_buffer_reset_tc,

                    );

                    tx.resp_done = true;

                    tx.frag_cnt_tc = 1;

                    if let Some(flow) = self.flow {

                        sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32);

                    }

                }

                _ => {

                    SCLogDebug!("Unrecognized packet type");

                    return 0;

                }

            },

            None => {

                return 0;

            }

        }

        // Update the remaining fragment length

        self.padleft -= retval;

        retval

    }

    /// Handles stub data for both request and response.

    ///

    /// Arguments:

    /// * `input`: bytes left *after* parsing header.

    /// * `bytes_consumed`: bytes consumed *after* parsing header.

    /// * `dir`: direction whose stub is supposed to be handled.

    ///

    /// Return value:

    /// * Success: Number of bytes successfully parsed.

    /// * Failure: -1 in case fragment length defined by header mismatches the data.

    pub fn handle_common_stub(&mut self, input: &[u8], bytes_consumed: usize, dir: Direction) -> i32 {

        let fraglen = self.get_hdr_fraglen().unwrap_or(0);

        if (fraglen as usize) < bytes_consumed + (DCERPC_HDR_LEN as usize) {

            return -1;

        }

        // Above check makes sure padleft stays in u16 limits

        self.padleft = fraglen - DCERPC_HDR_LEN - bytes_consumed as u16;

        let mut input_left = input.len() - bytes_consumed;

        let mut parsed = bytes_consumed as i32;

        while input_left > 0 && parsed < fraglen as i32 {

            let retval = self.handle_stub_data(&input[parsed as usize..], input_left, dir);

            if retval > 0 && retval as usize <= input_left {

                parsed += retval as i32;

                input_left -= <u16 as std::convert::Into<usize>>::into(retval);

            } else if input_left > 0 {

                SCLogDebug!(

                    "Error parsing DCERPC {} stub data",

                    if dir == Direction::ToServer {

                        "request"

                    } else {

                        "response"

                    }

                );

                parsed -= input_left as i32;

                input_left = 0;

            }

        }

        parsed

    }

    pub fn process_request_pdu(&mut self, input: &[u8]) -> i32 {

        let endianness = self.get_endianness();

        match parser::parse_dcerpc_request(input, endianness) {

            Ok((leftover_input, request)) => {

                let call_id = self.get_hdr_call_id().unwrap_or(0);

                let hdr_type = self.get_hdr_type().unwrap_or(0);

                let mut transaction = self.get_tx_by_call_id(call_id, Direction::ToServer);

                match transaction {

                    Some(ref mut tx) => {

                        tx.req_cmd = hdr_type;

                        tx.ctxid = request.ctxid;

                        tx.opnum = request.opnum;

                        tx.first_request_seen = request.first_request_seen;

                    }

                    None => {

                        let mut tx = self.create_tx(call_id);

                        tx.req_cmd = hdr_type;

                        tx.ctxid = request.ctxid;

                        tx.opnum = request.opnum;

                        tx.first_request_seen = request.first_request_seen;

                        self.transactions.push_back(tx);

                    }

                }

                let parsed = self.handle_common_stub(

                    input,

                    input.len() - leftover_input.len(),

                    Direction::ToServer,

                );

                parsed

            }

            Err(Err::Incomplete(_)) => {

                // Insufficient data.

                SCLogDebug!("Insufficient data while parsing DCERPC REQUEST");

                -1

            }

            Err(_) => {

                // Error, probably malformed data.

                SCLogDebug!("An error occurred while parsing DCERPC REQUEST");

                -1

            }

        }

    }

    pub fn handle_input_data(&mut self, input: &[u8], direction: Direction) -> AppLayerResult {

        let mut parsed;

        let retval;

        let mut cur_i = input;

        let input_len = cur_i.len();

        let mut v: Vec<u8>;

        // Set any query's completion status to false in the beginning

        self.query_completed = false;

        // Skip the record since this means that its in the middle of a known length record

        if (self.ts_gap && direction == Direction::ToServer) || (self.tc_gap && direction == Direction::ToClient) {

            SCLogDebug!("Trying to catch up after GAP (input {})", cur_i.len());

            match self.search_dcerpc_record(cur_i) {

                Ok((_, pg)) => {

                    SCLogDebug!("DCERPC record found");

                    let offset = cur_i.len() - pg.len();

                    cur_i = &cur_i[offset..];

                    match direction {

                        Direction::ToServer => {

                            self.ts_gap = false;

                        },

                        Direction::ToClient => {

                            self.tc_gap = false;

                        }

                    }

                },

                _ => {

                    let mut consumed = cur_i.len();

                    // At least 2 bytes are required to know if a new record is beginning

                    if consumed < 2 {

                        consumed = 0;

                    } else {

                        consumed -= 1;

                    }

                    SCLogDebug!("DCERPC record NOT found");

                    return AppLayerResult::incomplete(consumed as u32, 2);

                },

            }

        }

        // Overwrite the dcerpc_state data in case of multiple complete queries in the

        // same direction

        if self.prev_dir == direction {

            self.data_needed_for_dir = direction;

        }

        let mut buffer = match direction {

            Direction::ToServer => {

                if self.buffer_ts.len() + input_len > 1024 * 1024 {

                    SCLogDebug!("DCERPC TOSERVER stream: Buffer Overflow");

                    return AppLayerResult::err();

                }

                v = std::mem::take(&mut self.buffer_ts);

                v.extend_from_slice(cur_i);

                v

            }

            Direction::ToClient => {

                if self.buffer_tc.len() + input_len > 1024 * 1024 {

                    SCLogDebug!("DCERPC TOCLIENT stream: Buffer Overflow");

                    return AppLayerResult::err();

                }

                v = std::mem::take(&mut self.buffer_tc);

                v.extend_from_slice(cur_i);

                v

            }

        };

        if self.data_needed_for_dir != direction && !buffer.is_empty() {

            return AppLayerResult::err();

        }

        // Set data_needed_for_dir in the same direction in case there is an issue with upcoming parsing

        self.data_needed_for_dir = direction;

        // Check if header data was complete. In case of EoF or incomplete data, wait for more

        // data else return error

        if self.bytes_consumed < DCERPC_HDR_LEN.into() && input_len > 0 {

            parsed = self.process_header(buffer.as_slice());

            if parsed == -1 {

                match direction {

                    Direction::ToServer => {

                        self.buffer_ts = std::mem::take(&mut buffer);

                    }

                    Direction::ToClient => {

                        self.buffer_tc = std::mem::take(&mut buffer);

                    }

                }

                return AppLayerResult::ok();

            }

            if parsed == -2 {

                return AppLayerResult::err();

            }

            self.bytes_consumed += parsed;

        }

        let fraglen = self.get_hdr_fraglen().unwrap_or(0);

        if (buffer.len()) < fraglen as usize {

            SCLogDebug!("Possibly fragmented data, waiting for more..");

                match direction {

                    Direction::ToServer => {

                        self.buffer_ts = std::mem::take(&mut buffer);

                    }

                    Direction::ToClient => {

                        self.buffer_tc = std::mem::take(&mut buffer);

                    }

                }

            return AppLayerResult::ok();

        } else {

            self.query_completed = true;

        }

        parsed = self.bytes_consumed;

        let current_call_id = self.get_hdr_call_id().unwrap_or(0);

        match self.get_hdr_type() {

            Some(x) => match x {

                DCERPC_TYPE_BIND | DCERPC_TYPE_ALTER_CONTEXT => {

                    retval = self.process_bind_pdu(&buffer[parsed as usize..]);

                    if retval == -1 {

                        return AppLayerResult::err();

                    }

                }

                DCERPC_TYPE_BINDACK | DCERPC_TYPE_ALTER_CONTEXT_RESP => {

                    retval = self.process_bindack_pdu(&buffer[parsed as usize..]);

                    if retval == -1 {

                        return AppLayerResult::err();

                    }

                    let tx = if let Some(tx) = self.get_tx_by_call_id(current_call_id, Direction::ToClient) {

                        tx.resp_cmd = x;

                        tx

                    } else {

                        let mut tx = self.create_tx(current_call_id);

                        tx.resp_cmd = x;

                        self.transactions.push_back(tx);

                        self.transactions.back_mut().unwrap()

                    };

                    tx.resp_done = true;

                    tx.frag_cnt_tc = 1;

                    if let Some(flow) = self.flow {

                        sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32);

                    }

                }

                DCERPC_TYPE_REQUEST => {

                    retval = self.process_request_pdu(&buffer[parsed as usize..]);

                    if retval < 0 {

                        return AppLayerResult::err();

                    }

                    // In case the response came first, the transaction would complete later when