suricata/src/app-layer-smb.c

/*
 * Copyright (c) 2009, 2010 Open Information Security Foundation
 * app-layer-smb.c
 *
 * \author Kirby Kuehl <kkuehl@gmail.com>
 */
#include "suricata-common.h"

#include "debug.h"
#include "decode.h"
#include "threads.h"

#include "util-print.h"
#include "util-pool.h"
#include "util-debug.h"

#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream.h"

#include "app-layer-protos.h"
#include "app-layer-parser.h"

#include "util-spm.h"
#include "util-unittest.h"

#include "app-layer-smb.h"

enum {
    SMB_FIELD_NONE = 0,
    SMB_PARSE_NBSS_HEADER,
    SMB_PARSE_SMB_HEADER,
    SMB_PARSE_GET_WORDCOUNT,
    SMB_PARSE_WORDCOUNT,
    SMB_PARSE_GET_BYTECOUNT,
    SMB_PARSE_BYTECOUNT,
    /* must be last */
    SMB_FIELD_MAX,
};

/**
 *  \brief SMB Write AndX Request Parsing
 */
/* For WriteAndX we need to get writeandxdataoffset */
static uint32_t SMBParseWriteAndX(Flow *f, void *smb_state,
        AppLayerParserState *pstate, uint8_t *input, uint32_t input_len,
        AppLayerParserResult *output) {
    SCEnter();
    SMBState *sstate = (SMBState *) smb_state;
    uint8_t *p = input;
    switch (sstate->andx.andxbytesprocessed) {
        case 0:
            sstate->andx.paddingparsed = 0;
            if (input_len >= 28) {
                sstate->andx.andxcommand = *p;
                sstate->andx.andxoffset = *(p + 2);
                sstate->andx.andxoffset |= *(p + 3) << 8;
                sstate->andx.datalength = *(p + 18);
                sstate->andx.datalength |= *(p + 19) << 8;
                sstate->andx.datalength |= *(p + 20) << 16;
                sstate->andx.datalength |= *(p + 21) << 24;
                sstate->andx.dataoffset = *(p + 22);
                sstate->andx.dataoffset |= *(p + 23) << 8;
                sstate->andx.dataoffset |= (uint64_t) *(p + 24) << 56;
                sstate->andx.dataoffset |= (uint64_t) *(p + 25) << 48;
                sstate->andx.dataoffset |= (uint64_t) *(p + 26) << 40;
                sstate->andx.dataoffset |= (uint64_t) *(p + 27) << 32;
                sstate->bytesprocessed += 28;
                SCReturnUInt(28U);
            } else {
                sstate->andx.andxcommand = *(p++);
                if (!(--input_len))
                    break;
            }
        case 1:
            p++; // Reserved
            if (!(--input_len))
                break;
        case 2:
            sstate->andx.andxoffset = *(p++) << 8;
            if (!(--input_len))
                break;
        case 3:
            sstate->andx.andxoffset |= *(p++);
            if (!(--input_len))
                break;
        case 4:
            // SMB_COM_WRITE_ANDX Fid 1
            p++;
            if (!(--input_len))
                break;
        case 5:
            // SMB_COM_WRITE_ANDX Fid 2
            p++;
            if (!(--input_len))
                break;
        case 6:
            // SMB_COM_WRITE_ANDX Offset 1
            p++;
            if (!(--input_len))
                break;
        case 7:
            // SMB_COM_WRITE_ANDX Offset 2
            p++;
            if (!(--input_len))
                break;
        case 8:
            // SMB_COM_WRITE_ANDX Offset 3
            p++;
            if (!(--input_len))
                break;
        case 9:
            // SMB_COM_WRITE_ANDX Offset 4
            p++;
            if (!(--input_len))
                break;
        case 10:
            // SMB_COM_WRITE_ANDX Reserved 1
            p++;
            if (!(--input_len))
                break;
        case 11:
            // SMB_COM_WRITE_ANDX Reserved 2
            p++;
            if (!(--input_len))
                break;
        case 12:
            // SMB_COM_WRITE_ANDX Reserved 3
            p++;
            if (!(--input_len))
                break;
        case 13:
            // SMB_COM_WRITE_ANDX Reserved 4
            p++;
            if (!(--input_len))
                break;
        case 14:
            // SMB_COM_WRITE_ANDX WriteMode 1
            p++;
            if (!(--input_len))
                break;
        case 15:
            // SMB_COM_WRITE_ANDX WriteMode 2
            p++;
            if (!(--input_len))
                break;
        case 16:
            // SMB_COM_WRITE_ANDX BytesRemaining 1
            p++;
            if (!(--input_len))
                break;
        case 17:
            // SMB_COM_WRITE_ANDX BytesRemaining 2
            p++;
            if (!(--input_len))
                break;
        case 18:
            // DataLengthHigh 1
            sstate->andx.datalength = *(p++) << 16;
            if (!(--input_len))
                break;
        case 19:
            // DataLengthHigh 2
            sstate->andx.datalength |= *(p++) << 24;
            if (!(--input_len))
                break;
        case 20:
            // DataLength 1
            sstate->andx.datalength |= *(p++) << 8;
            if (!(--input_len))
                break;
        case 21:
            // DataLength 2
            sstate->andx.datalength |= *(p++);
            if (!(--input_len))
                break;
        case 22:
            sstate->andx.dataoffset = *(p++) << 8;
            if (!(--input_len))
                break;
        case 23:
            sstate->andx.dataoffset |= *(p++);
            if (!(--input_len))
                break;
        case 24:
            sstate->andx.dataoffset |= (uint64_t) *(p++) << 56;
            if (!(--input_len))
                break;
        case 25:
            sstate->andx.dataoffset |= (uint64_t) *(p++) << 48;
            if (!(--input_len))
                break;
        case 26:
            sstate->andx.dataoffset |= (uint64_t) *(p++) << 40;
            if (!(--input_len))
                break;
        case 27:
            sstate->andx.dataoffset |= (uint64_t) *(p++) << 32;
            --input_len;
            break;
    }
    sstate->bytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

/**
 * \brief SMB Read AndX Response Parsing
 */
static uint32_t SMBParseReadAndX(Flow *f, void *smb_state,
        AppLayerParserState *pstate, uint8_t *input, uint32_t input_len,
        AppLayerParserResult *output) {
    SCEnter();
    SMBState *sstate = (SMBState *) smb_state;
    uint8_t *p = input;
    switch (sstate->andx.andxbytesprocessed) {
        case 0:
            sstate->andx.paddingparsed = 0;
            if (input_len >= 24) {
                sstate->andx.andxcommand = *p;
                sstate->andx.andxoffset = *(p + 2);
                sstate->andx.andxoffset |= *(p + 3) << 8;
                sstate->andx.datalength = *(p + 10);
                sstate->andx.datalength |= *(p + 11) << 8;
                sstate->andx.dataoffset = *(p + 12);
                sstate->andx.dataoffset |= *(p + 13) << 8;
                sstate->andx.datalength |= (uint64_t) *(p + 14) << 32;
                sstate->andx.datalength |= (uint64_t) *(p + 15) << 40;
                sstate->andx.datalength |= (uint64_t) *(p + 16) << 48;
                sstate->andx.datalength |= (uint64_t) *(p + 17) << 56;
                sstate->bytesprocessed += 24;
                SCReturnUInt(24U);
            } else {
                sstate->andx.andxcommand = *(p++);
                if (!(--input_len))
                    break;
            }
        case 1:
            p++; // Reserved
            if (!(--input_len))
                break;
        case 2:
            sstate->andx.andxoffset |= *(p++);
            if (!(--input_len))
                break;
        case 3:
            sstate->andx.andxoffset |= *(p++) << 8;
            if (!(--input_len))
                break;
        case 4:
            // SMB_COM_READ_ANDX Remaining Reserved must be 0xff
            p++;
            if (!(--input_len))
                break;
        case 5:
            // SMB_COM_READ_ANDX Remaining Reserved must be 0xff
            p++;
            if (!(--input_len))
                break;
        case 6:
            // SMB_COM_READ_ANDX DataCompactionMode 1
            p++;
            if (!(--input_len))
                break;
        case 7:
            // SMB_COM_READ_ANDX DataCompactionMode 1
            p++;
            if (!(--input_len))
                break;
        case 8:
            // SMB_COM_READ_ANDX Reserved
            p++;
            if (!(--input_len))
                break;
        case 9:
            // SMB_COM_READ_ANDX Reserved
            p++;
            if (!(--input_len))
                break;
        case 10:
            sstate->andx.datalength = *(p++);
            if (!(--input_len))
                break;
        case 11:
            sstate->andx.datalength |= *(p++) << 8;
            if (!(--input_len))
                break;
        case 12:
            sstate->andx.dataoffset = *(p++);
            if (!(--input_len))
                break;
        case 13:
            sstate->andx.dataoffset |= *(p++) << 8;
            if (!(--input_len))
                break;
        case 14:
            sstate->andx.datalength |= *(p++) << 16;
            if (!(--input_len))
                break;
        case 15:
            sstate->andx.datalength |= *(p++) << 24;
            if (!(--input_len))
                break;
        case 16:
            // SMB_COM_READ_ANDX Reserved
            p++;
            if (!(--input_len))
                break;
        case 17:
            // SMB_COM_READ_ANDX Reserved
            p++;
            if (!(--input_len))
                break;
        case 18:
            // SMB_COM_READ_ANDX Reserved
            p++;
            --input_len;
            break;
    }
    sstate->bytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

static uint32_t SMBParseTransact(Flow *f, void *smb_state,
        AppLayerParserState *pstate, uint8_t *input, uint32_t input_len,
        AppLayerParserResult *output) {
    SCEnter();
    SMBState *sstate = (SMBState *) smb_state;
    uint8_t *p = input;
    switch (sstate->andx.andxbytesprocessed) {
        case 0:
            sstate->andx.paddingparsed = 0;
            if (input_len >= sstate->wordcount.wordcount) {
                sstate->andx.datalength = *(p + 22);
                sstate->andx.datalength |= *(p + 23) << 8;
                sstate->andx.dataoffset = *(p + 24);
                sstate->andx.dataoffset |= *(p + 25) << 8;
                sstate->andx.datalength |= (uint64_t) *(p + 14) << 56;
                sstate->andx.datalength |= (uint64_t) *(p + 15) << 48;
                sstate->andx.datalength |= (uint64_t) *(p + 16) << 40;
                sstate->andx.datalength |= (uint64_t) *(p + 17) << 32;
                sstate->bytesprocessed += sstate->wordcount.wordcount;
                sstate->andx.andxbytesprocessed += sstate->wordcount.wordcount;
                SCReturnUInt(sstate->wordcount.wordcount);
            } else {
                /* total parameter count 1 */
                p++;
                if (!(--input_len))
                    break;
            }
        case 1:
            /* total parameter count 2 */
            p++;
            if (!(--input_len))
                break;
        case 2:
            /* total data count 1 */
            p++;
            if (!(--input_len))
                break;
        case 3:
            /* total data count 2 */
            p++;
            if (!(--input_len))
                break;
        case 4:
            /* max parameter count 1 */
            p++;
            if (!(--input_len))
                break;
        case 5:
            /* max parameter count 2 */
            p++;
            if (!(--input_len))
                break;
        case 6:
            /* max data count 1 */
            p++;
            if (!(--input_len))
                break;
        case 7:
            /* max data count 2 */
            p++;
            if (!(--input_len))
                break;
        case 8:
            /* max setup count */
            p++;
            if (!(--input_len))
                break;
        case 9:
            /* Reserved */
            p++;
            if (!(--input_len))
                break;
        case 10:
            /* Flags */
            p++;
            if (!(--input_len))
                break;
        case 11:
            /* Flags */
            p++;
            if (!(--input_len))
                break;
        case 12:
            /* Timeout */
            p++;
            if (!(--input_len))
                break;
        case 13:
            /* Timeout */
            p++;
            if (!(--input_len))
                break;
        case 14:
            /* Timeout */
            p++;
            if (!(--input_len))
                break;
        case 15:
            /* Timeout */
            p++;
            if (!(--input_len))
                break;
        case 16:
            /* Reserved */
            p++;
            if (!(--input_len))
                break;
        case 17:
            /* Reserved */
            p++;
            if (!(--input_len))
                break;
        case 18:
            /* Parameter Count */
            p++;
            if (!(--input_len))
                break;
        case 19:
            /* Parameter Count */
            p++;
            if (!(--input_len))
                break;
        case 20:
            /* Parameter Offset */
            p++;
            if (!(--input_len))
                break;
        case 21:
            /* Parameter Offset */
            p++;
            if (!(--input_len))
                break;
        case 22:
            /* Data Count */
            sstate->andx.datalength = *(p++);
            if (!(--input_len))
                break;
        case 23:
            /* Data Count */
            sstate->andx.datalength |= *(p++) << 8;
            if (!(--input_len))
                break;
        case 24:
            /* Data Offset */
            sstate->andx.dataoffset = *(p++);
            if (!(--input_len))
                break;
        case 25:
            /* Data Offset */
            sstate->andx.dataoffset |= *(p++) << 8;
            if (!(--input_len))
        case 26:
                /* Setup Count */
                p++;
                if (!(--input_len))
        case 27:
				/* Reserved */
                p++;
                if (!(--input_len))
        case 28:
                p++;
                if (!(--input_len))
        case 29:
                p++;
                if (!(--input_len))
        case 30:
                p++;
                if (!(--input_len))
        case 31:
                p++;
                --input_len;
                break;
    }
    sstate->bytesprocessed += (p - input);
    sstate->andx.andxbytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

/**
 * Handle variable length padding for WriteAndX and ReadAndX
 */
static uint32_t PaddingParser(void *smb_state, AppLayerParserState *pstate,
        uint8_t *input, uint32_t input_len, AppLayerParserResult *output) {
    SCEnter();
    SMBState *sstate = (SMBState *) smb_state;
    uint8_t *p = input;
    /* Check for validity of dataoffset */
    if (sstate->bytesprocessed > sstate->andx.dataoffset) {
        sstate->andx.paddingparsed = 1;
        SCReturnUInt((uint32_t)(p - input));
    }
    while ((uint32_t) ((sstate->bytesprocessed - NBSS_HDR_LEN) + (p - input))
            < sstate->andx.dataoffset && sstate->bytecount.bytecount--
            && input_len--) {
        p++;
    }
    if ((uint32_t) ((sstate->bytesprocessed - NBSS_HDR_LEN) + (p - input))
            == sstate->andx.dataoffset) {
        sstate->andx.paddingparsed = 1;
    }
    sstate->bytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

/**
 * \brief Parse WriteAndX and ReadAndX Data
 * \todo Hand off to DCERPC parser for DCERPC over SMB
 */
static uint32_t DataParser(void *smb_state, AppLayerParserState *pstate,
        uint8_t *input, uint32_t input_len, AppLayerParserResult *output) {
    SCEnter();
    SMBState *sstate = (SMBState *) smb_state;
    uint32_t parsed = 0;
    if (sstate->andx.paddingparsed) {
	parsed = DCERPCParser(&sstate->dcerpc, input, input_len);
	sstate->bytesprocessed += parsed;
	sstate->bytecount.bytecount -= parsed;
	input_len -= parsed;
    }
    SCReturnUInt(parsed);
}

/**
 * \brief Obtain SMB WordCount which is 2 times the value.
 * Reset bytecount.bytecountbytes to 0.
 * Determine if this is an SMB AndX Command
 */
static uint32_t SMBGetWordCount(Flow *f, void *smb_state,
        AppLayerParserState *pstate, uint8_t *input, uint32_t input_len,
        AppLayerParserResult *output) {
    SCEnter();
    if (input_len) {
        SMBState *sstate = (SMBState *) smb_state;
        sstate->wordcount.wordcount = *(input) * 2;
        sstate->bytesprocessed++;
        sstate->bytecount.bytecountbytes = 0;
        sstate->andx.isandx = isAndX(sstate);
        SCLogDebug("Wordcount (%u):", sstate->wordcount.wordcount);
        SCReturnUInt(1U);
    }
    SCReturnUInt(0);
}

/*
 * Obtain SMB Bytecount. Handle the corner obfuscation case where a packet boundary
 * is after the first bytecount byte.
 */

static uint32_t SMBGetByteCount(Flow *f, void *smb_state,
        AppLayerParserState *pstate, uint8_t *input, uint32_t input_len,
        AppLayerParserResult *output) {
    SCEnter();
    SMBState *sstate = (SMBState *) smb_state;
    uint8_t *p = input;
    if (input_len && sstate->bytesprocessed == NBSS_HDR_LEN + SMB_HDR_LEN + 1
            + sstate->wordcount.wordcount) {
        sstate->bytecount.bytecount = *(p++);
        sstate->bytesprocessed++;
        --input_len;
    }
    if (input_len && sstate->bytesprocessed == NBSS_HDR_LEN + SMB_HDR_LEN + 2
            + sstate->wordcount.wordcount) {
        sstate->bytecount.bytecount |= *(p++) << 8;
        sstate->bytesprocessed++;
        SCLogDebug("Bytecount %u", sstate->bytecount.bytecount);
        --input_len;
    }
    SCReturnUInt((uint32_t)(p - input));
}

/**
 * \brief SMBParseWordCount parses the SMB Wordcount portion of the SMB Transaction.
 * until sstate->wordcount.wordcount bytes are parsed.
 */
static uint32_t SMBParseWordCount(Flow *f, void *smb_state,
        AppLayerParserState *pstate, uint8_t *input, uint32_t input_len,
        AppLayerParserResult *output) {
    SCEnter();
    SMBState *sstate = (SMBState *) smb_state;
    uint8_t *p = input;
    uint32_t retval = 0;
    uint32_t parsed = 0;
    if ((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) && sstate->smb.command
            == SMB_COM_READ_ANDX) {
        retval = SMBParseReadAndX(f, sstate, pstate, input + parsed, input_len,
                output);
        parsed += retval;
        input_len -= retval;
        SCReturnUInt(retval);
    } else if (((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) == 0)
            && sstate->smb.command == SMB_COM_WRITE_ANDX) {
        retval = SMBParseWriteAndX(f, sstate, pstate, input + parsed,
                input_len, output);
        parsed += retval;
        input_len -= retval;
        SCReturnUInt(retval);
    } else if (sstate->smb.command == SMB_COM_TRANSACTION) {
	retval = SMBParseTransact(f, sstate, pstate, input + parsed, input_len,
			output);
	parsed += retval;
	input_len -= retval;
        SCReturnUInt(retval);
    } else { /* Generic WordCount Handler */
        while (sstate->wordcount.wordcount-- && input_len--) {
            SCLogDebug("0x%02x ", *p);
            p++;
        }
        sstate->bytesprocessed += (p - input);
        SCReturnUInt((uint32_t)(p - input));
    }
}

/**
 * \brief SMBParseByteCount parses the SMB ByteCount portion of the SMB Transaction.
 * until sstate->bytecount.bytecount bytes are parsed.
 */

static uint32_t SMBParseByteCount(Flow *f, void *smb_state,
        AppLayerParserState *pstate, uint8_t *input, uint32_t input_len,
        AppLayerParserResult *output) {
    SCEnter();
    SMBState *sstate = (SMBState *) smb_state;
    uint8_t *p = input;
    uint32_t retval = 0;
    uint32_t parsed = 0;
    if (((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) && sstate->smb.command
                == SMB_COM_READ_ANDX) || (((sstate->smb.flags
                            & SMB_FLAGS_SERVER_TO_REDIR) == 0) && sstate->smb.command
                    == SMB_COM_WRITE_ANDX) || (sstate->smb.command
                        == SMB_COM_TRANSACTION)) {
        if (sstate->andx.paddingparsed == 0) {
            retval = PaddingParser(sstate, pstate, input + parsed, input_len,
                    output);
            parsed += retval;
            input_len -= retval;
        }

        if (sstate->andx.datalength) {
            retval = DataParser(sstate, pstate, input + parsed, input_len,
                    output);
            parsed += retval;
            input_len -= retval;
        }
        SCReturnUInt(retval);
    }

    while (sstate->bytecount.bytecount && input_len) {
        SCLogDebug("0x%02x bytecount %u input_len %u", *p,
                sstate->bytecount.bytecount, input_len);
        p++;
        sstate->bytecount.bytecount--;
        input_len--;
    }
    sstate->bytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

static uint32_t NBSSParseHeader(Flow *f, void *smb_state,
        AppLayerParserState *pstate, uint8_t *input, uint32_t input_len,
        AppLayerParserResult *output) {
    SCEnter();
    SMBState *sstate = (SMBState *) smb_state;
    uint8_t *p = input;

    if (input_len && sstate->bytesprocessed < NBSS_HDR_LEN - 1) {
        switch (sstate->bytesprocessed) {
            case 0:
                /* Initialize */
                sstate->andx.andxcommand = SMB_NO_SECONDARY_ANDX_COMMAND;
                if (input_len >= NBSS_HDR_LEN) {
                    sstate->nbss.type = *p;
                    sstate->nbss.length = (*(p + 1) & 0x01) << 16;
                    sstate->nbss.length |= *(p + 2) << 8;
                    sstate->nbss.length |= *(p + 3);
                    sstate->bytesprocessed += NBSS_HDR_LEN;
                    SCReturnUInt(4U);
                } else {
                    sstate->nbss.type = *(p++);
                    if (!(--input_len))
                        break;
                }
            case 1:
                sstate->nbss.length = (*(p++) & 0x01) << 16;
                if (!(--input_len))
                    break;
            case 2:
                sstate->nbss.length |= *(p++) << 8;
                if (!(--input_len))
                    break;
            case 3:
                sstate->nbss.length |= *(p++);
                --input_len;
                break;
        }
        sstate->bytesprocessed += (p - input);
    }
    SCReturnUInt((uint32_t)(p - input));
}

/**
 * \brief SMBParseHeader parses and validates the 32 byte SMB Header
 */
static uint32_t SMBParseHeader(Flow *f, void *smb_state,
        AppLayerParserState *pstate, uint8_t *input, uint32_t input_len,
        AppLayerParserResult *output) {
    SCEnter();
    SMBState *sstate = (SMBState *) smb_state;
    uint8_t *p = input;
    if (input_len) {
        switch (sstate->bytesprocessed) {
            case 4:
                if (input_len >= SMB_HDR_LEN) {
                    if (memcmp(p, "\xff\x53\x4d\x42", 4) != 0) {
                        SCLogDebug("SMB Header did not validate");
                        SCReturnUInt(0);
                    }
                    sstate->smb.command = *(p + 4);
                    sstate->smb.status = *(p + 5) << 24;
                    sstate->smb.status |= *(p + 6) << 16;
                    sstate->smb.status |= *(p + 7) << 8;
                    sstate->smb.status |= *(p + 8);
                    sstate->smb.flags = *(p + 9);
                    sstate->smb.flags2 = *(p + 10) << 8;
                    sstate->smb.flags2 |= *(p + 11);
                    sstate->smb.pidhigh = *(p + 12) << 8;
                    sstate->smb.pidhigh |= *(p + 13);
                    sstate->smb.securitysignature = (uint64_t) *(p + 14) << 56;
                    sstate->smb.securitysignature |= (uint64_t) *(p + 15) << 48;
                    sstate->smb.securitysignature |= (uint64_t) *(p + 16) << 40;
                    sstate->smb.securitysignature |= (uint64_t) *(p + 17) << 32;
                    sstate->smb.securitysignature |= (uint64_t) *(p + 18) << 24;
                    sstate->smb.securitysignature |= (uint64_t) *(p + 19) << 16;
                    sstate->smb.securitysignature |= (uint64_t) *(p + 20) << 8;
                    sstate->smb.securitysignature |= (uint64_t) *(p + 21);
                    sstate->smb.tid = *(p + 24) << 8;
                    sstate->smb.tid |= *(p + 25);
                    sstate->smb.pid = *(p + 26) << 8;
                    sstate->smb.pid |= *(p + 27);
                    sstate->smb.uid = *(p + 28) << 8;
                    sstate->smb.uid |= *(p + 29);
                    sstate->smb.mid = *(p + 30) << 8;
                    sstate->smb.mid |= *(p + 31);
                    sstate->bytesprocessed += SMB_HDR_LEN;
                    SCReturnUInt(32U);
                    break;
                } else {
                    //sstate->smb.protocol[0] = *(p++);
                    if (*(p++) != 0xff)
                        SCReturnInt(0);
                    if (!(--input_len))
                        break;
                }
            case 5:
                //sstate->smb.protocol[1] = *(p++);
                if (*(p++) != 'S')
                    SCReturnInt(0);
                if (!(--input_len))
                    break;
            case 6:
                //sstate->smb.protocol[2] = *(p++);
                if (*(p++) != 'M')
                    SCReturnInt(0);
                if (!(--input_len))
                    break;
            case 7:
                //sstate->smb.protocol[3] = *(p++);
                if (*(p++) != 'B')
                    SCReturnInt(0);
                if (!(--input_len))
                    break;
            case 8:
                sstate->smb.command = *(p++);
                if (!(--input_len))
                    break;
            case 9:
                sstate->smb.status = *(p++) << 24;
                if (!(--input_len))
                    break;
            case 10:
                sstate->smb.status |= *(p++) << 16;
                if (!(--input_len))
                    break;
            case 11:
                sstate->smb.status |= *(p++) << 8;
                if (!(--input_len))
                    break;
            case 12:
                sstate->smb.status |= *(p++);
                if (!(--input_len))
                    break;
            case 13:
                sstate->smb.flags = *(p++);
                if (!(--input_len))
                    break;
            case 14:
                sstate->smb.flags2 = *(p++) << 8;
                if (!(--input_len))
                    break;
            case 15:
                sstate->smb.flags2 |= *(p++);
                if (!(--input_len))
                    break;
            case 16:
                sstate->smb.pidhigh = *(p++) << 8;
                if (!(--input_len))
                    break;
            case 17:
                sstate->smb.pidhigh |= *(p++);
                if (!(--input_len))
                    break;
            case 18:
                sstate->smb.securitysignature = (uint64_t) *(p++) << 56;
                if (!(--input_len))
                    break;
            case 19:
                sstate->smb.securitysignature |= (uint64_t) *(p++) << 48;
                if (!(--input_len))
                    break;
            case 20:
                sstate->smb.securitysignature |= (uint64_t) *(p++) << 40;
                if (!(--input_len))
                    break;
            case 21:
                sstate->smb.securitysignature |= (uint64_t) *(p++) << 32;
                if (!(--input_len))
                    break;
            case 22:
                sstate->smb.securitysignature |= (uint64_t) *(p++) << 24;
                if (!(--input_len))
                    break;
            case 23:
                sstate->smb.securitysignature |= (uint64_t) *(p++) << 16;
                if (!(--input_len))
                    break;
            case 24:
                sstate->smb.securitysignature |= (uint64_t) *(p++) << 8;
                if (!(--input_len))
                    break;
            case 25:
                sstate->smb.securitysignature |= (uint64_t) *(p++);
                if (!(--input_len))
                    break;
            case 26:
                p++; // UNUSED
                if (!(--input_len))
                    break;
            case 27:
                p++; // UNUSED
                if (!(--input_len))
                    break;
            case 28:
                sstate->smb.tid = *(p++) << 8;
                if (!(--input_len))
                    break;
            case 29:
                sstate->smb.tid |= *(p++);
                if (!(--input_len))
                    break;
            case 30:
                sstate->smb.pid = *(p++) << 8;
                if (!(--input_len))
                    break;
            case 31:
                sstate->smb.pid |= *(p++);
                if (!(--input_len))
                    break;
            case 32:
                sstate->smb.uid = *(p++) << 8;
                if (!(--input_len))
                    break;
            case 33:
                sstate->smb.uid |= *(p++);
                if (!(--input_len))
                    break;
            case 34:
                sstate->smb.mid = *(p++) << 8;
                if (!(--input_len))
                    break;
            case 35:
                sstate->smb.mid |= *(p++);
                --input_len;
                break;
        }
    }
    sstate->bytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
        uint8_t *input, uint32_t input_len, AppLayerParserResult *output) {
    SCEnter();

    SMBState *sstate = (SMBState *) smb_state;
    long int retval = 0;
    long int parsed = 0;

    if (pstate == NULL)
        SCReturnInt(-1);

    while (sstate->bytesprocessed < NBSS_HDR_LEN) {
        retval
            = NBSSParseHeader(f, smb_state, pstate, input, input_len,
                    output);
        if (retval) {
            parsed += retval;
            input_len -= retval;
            SCLogDebug(
                    "NBSS Header (%u/%u) Type 0x%02x Length 0x%04x parsed %ld input_len %u",
                    sstate->bytesprocessed, NBSS_HDR_LEN, sstate->nbss.type,
                    sstate->nbss.length, parsed, input_len);
        } else if (input_len) {
            SCLogDebug("Error parsing NBSS Header\n");
            parsed += input_len;
            input_len = 0;
        }
    }

    switch (sstate->nbss.type) {
        case NBSS_SESSION_MESSAGE:
            while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN
                        && sstate->bytesprocessed < NBSS_HDR_LEN + SMB_HDR_LEN)) {
                retval = SMBParseHeader(f, smb_state, pstate, input + parsed,
                        input_len, output);
                if (retval) {
                    parsed += retval;
                    input_len -= retval;
                    SCLogDebug(
                            "SMB Header (%u/%u) Command 0x%02x parsed %ld input_len %u",
                            sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN,
                            sstate->smb.command, parsed, input_len);
                } else if (input_len) {
                    SCLogDebug("Error parsing SMB Word Count\n");
                    parsed += input_len;
                    input_len = 0;
                }
            }

            do {
                if (input_len && (sstate->bytesprocessed == NBSS_HDR_LEN
                            + SMB_HDR_LEN)) {
                    retval = SMBGetWordCount(f, smb_state, pstate, input + parsed,
                            input_len, output);
                    if (retval) {
                        parsed += retval;
                        input_len -= retval;
                    } else if (input_len) {
                        SCLogDebug("Error parsing SMB Word Count\n");
                        parsed += input_len;
                        input_len = 0;
                    }
                }
                SCLogDebug("SMB Header (%u/%u) Command 0x%02x WordCount %u parsed %ld input_len %u\n",
				sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1,
                        sstate->smb.command, sstate->wordcount.wordcount,
                        parsed, input_len);

                while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN
                            + SMB_HDR_LEN + 1 && sstate->bytesprocessed < NBSS_HDR_LEN
                            + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount)) {
                    retval = SMBParseWordCount(f, smb_state, pstate,
                            input + parsed, input_len, output);
                    if (retval) {
                        parsed += retval;
                        input_len -= retval;
                    } else if (input_len) {
                        SCLogDebug("Error parsing SMB Word Count Data\n");
                        parsed += input_len;
                        input_len = 0;
                    }
                }

                while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN
                            + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount
                            && sstate->bytesprocessed < NBSS_HDR_LEN + SMB_HDR_LEN + 3
                            + sstate->wordcount.wordcount)) {
                    retval = SMBGetByteCount(f, smb_state, pstate, input + parsed,
                            input_len, output);
                    if (retval) {
                        parsed += retval;
                        input_len -= retval;
                    } else if (input_len) {
                        SCLogDebug("Error parsing SMB Byte Count\n");
                        parsed += input_len;
                        input_len = 0;
                    }
                }

                while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN
                            + SMB_HDR_LEN + 3 + sstate->wordcount.wordcount
                            && sstate->bytesprocessed < NBSS_HDR_LEN + SMB_HDR_LEN + 3
                            + sstate->wordcount.wordcount
                            + sstate->bytecount.bytecount)) {

                    retval = SMBParseByteCount(f, smb_state, pstate,
                            input + parsed, input_len, output);
                    if (retval) {
                        parsed += retval;
                        input_len -= retval;
                    } else if (input_len) {
                        SCLogDebug("Error parsing SMB Byte Count Data\n");
                        parsed += input_len;
                        input_len = 0;
                    }
                }
            } while (sstate->andx.andxcommand != SMB_NO_SECONDARY_ANDX_COMMAND
                    && input_len);
            break;
        default:
            break;
    }
    pstate->parse_field = 0;
    pstate->flags |= APP_LAYER_PARSER_DONE;
    SCReturnInt(1);
}

/**
 * \brief determines if the SMB command is an ANDX command
 * \retval 1 if smb command is an AndX command
 * \retval 0 if smb command is not an AndX command
 */

int isAndX(SMBState *smb_state) {
    SCEnter();
    switch (smb_state->smb.command) {
        case SMB_NO_SECONDARY_ANDX_COMMAND:
        case SMB_COM_LOCKING_ANDX:
        case SMB_COM_OPEN_ANDX:
        case SMB_COM_READ_ANDX:
        case SMB_COM_WRITE_ANDX:
        case SMB_COM_SESSION_SETUP_ANDX:
        case SMB_COM_LOGOFF_ANDX:
        case SMB_COM_TREE_CONNECT_ANDX:
        case SMB_COM_NT_CREATE_ANDX:
            smb_state->andx.andxbytesprocessed = 0;
            SCReturnInt(1);
        default:
            SCReturnInt(0);
    }
}

static void *SMBStateAlloc(void) {
    void *s = malloc(sizeof(SMBState));
    if (s == NULL)
        return NULL;

    memset(s, 0, sizeof(SMBState));
    return s;
}

static void SMBStateFree(void *s) {
    if (s) {
        free(s);
        s = NULL;
    }
}

void RegisterSMBParsers(void) {
    AppLayerRegisterProto("smb", ALPROTO_SMB, STREAM_TOSERVER, SMBParse);
    AppLayerRegisterProto("smb", ALPROTO_SMB, STREAM_TOCLIENT, SMBParse);
    AppLayerRegisterStateFuncs(ALPROTO_SMB, SMBStateAlloc, SMBStateFree);
}

/* UNITTESTS */
#ifdef UNITTESTS

/**
 * \test SMBParserTest01 tests the NBSS and SMB header decoding
 */
int SMBParserTest01(void) {
    int result = 1;
    Flow f;
    uint8_t smbbuf[] = "\x00\x00\x00\x85" // NBSS
        "\xff\x53\x4d\x42\x72\x00\x00\x00" // SMB
        "\x00\x18\x53\xc8\x00\x00\x00\x00"
        "\x00\x00\x00\x00\x00\x00\x00\x00"
        "\x00\x00\xff\xfe\x00\x00\x00\x00"
        "\x00" // WordCount
        "\x62\x00" // ByteCount
        "\x02\x50\x43\x20\x4e\x45\x54\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20"
        "\x31\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00\x02\x57\x69\x6e\x64\x6f\x77\x73"
        "\x20\x66\x6f\x72\x20\x57\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61\x00\x02\x4c"
        "\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54"
        "\x20\x4c\x4d\x20\x30\x2e\x31\x32\x00";

    uint32_t smblen = sizeof(smbbuf) - 1;
    TcpSession ssn;

    memset(&f, 0, sizeof(f));
    memset(&ssn, 0, sizeof(ssn));
    StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
    f.protoctx = (void *)&ssn;

    int r = AppLayerParse(&f, ALPROTO_SMB, STREAM_TOSERVER|STREAM_EOF, smbbuf, smblen);
    if (r != 0) {
        printf("smb header check returned %" PRId32 ", expected 0: ", r);
        result = 0;
        goto end;
    }

    SMBState *smb_state = ssn.aldata[AlpGetStateIdx(ALPROTO_SMB)];
    if (smb_state == NULL) {
        printf("no smb state: ");
        result = 0;
        goto end;
    }

    if (smb_state->nbss.type != NBSS_SESSION_MESSAGE) {
        printf("expected nbss type 0x%02x , got 0x%02x : ", NBSS_SESSION_MESSAGE, smb_state->nbss.type);
        result = 0;
        goto end;
    }

    if (smb_state->nbss.length != 133) {
        printf("expected nbss length 0x%02x , got 0x%02x : ", 133, smb_state->nbss.length);
        result = 0;
        goto end;
    }

    if (smb_state->smb.command != SMB_COM_NEGOTIATE) {
        printf("expected SMB command 0x%02x , got 0x%02x : ", SMB_COM_NEGOTIATE, smb_state->smb.command);
        result = 0;
        goto end;
    }

end:
    return result;
}

/**
 * \test SMBParserTest02 tests the NBSS, SMB, and DCERPC over SMB header decoding
 */
int SMBParserTest02(void) {
    int result = 1;
    Flow f;
    uint8_t smbbuf[] = {
    0x00, 0x00, 0x00, 0x92, 0xff, 0x53, 0x4d, 0x42,
    0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x64, 0x05,
    0x00, 0x08, 0x00, 0x00, 0x10, 0x00, 0x00, 0x48,
    0x00, 0x00, 0x04, 0xe0, 0xff, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x4a, 0x00, 0x48, 0x00, 0x4a, 0x00, 0x02,
    0x00, 0x26, 0x00, 0x00, 0x40, 0x4f, 0x00, 0x5c,
    0x50, 0x49, 0x50, 0x45, 0x5c, 0x00, 0x05, 0x00,
    0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00,
    0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xd0, 0x16,
    0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x40, 0xfd,
    0x2c, 0x34, 0x6c, 0x3c, 0xce, 0x11, 0xa8, 0x93,
    0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d, 0x00, 0x00,
    0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c,
    0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10,
    0x48, 0x60, 0x02, 0x00, 0x00, 0x00 };

    uint32_t smblen = sizeof(smbbuf);
    TcpSession ssn;

    memset(&f, 0, sizeof(f));
    memset(&ssn, 0, sizeof(ssn));
    StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
    f.protoctx = (void *)&ssn;

    int r = AppLayerParse(&f, ALPROTO_SMB, STREAM_TOSERVER|STREAM_EOF, smbbuf, smblen);
    if (r != 0) {
        printf("smb header check returned %" PRId32 ", expected 0: ", r);
        result = 0;
        goto end;
    }

    SMBState *smb_state = ssn.aldata[AlpGetStateIdx(ALPROTO_SMB)];
    if (smb_state == NULL) {
        printf("no smb state: ");
        result = 0;
        goto end;
    }

    if (smb_state->nbss.type != NBSS_SESSION_MESSAGE) {
        printf("expected nbss type 0x%02x , got 0x%02x : ", NBSS_SESSION_MESSAGE, smb_state->nbss.type);
        result = 0;
        goto end;
    }

    if (smb_state->nbss.length != 146) {
        printf("expected nbss length 0x%02x , got 0x%02x : ", 146, smb_state->nbss.length);
        result = 0;
        goto end;
    }

    if (smb_state->smb.command != SMB_COM_TRANSACTION) {
        printf("expected SMB command 0x%02x , got 0x%02x : ", SMB_COM_TRANSACTION, smb_state->smb.command);
        result = 0;
        goto end;
    }

    printUUID("BIND", smb_state->dcerpc.dcerpcbindbindack.uuid_entry);
end:
    return result;
}
void SMBParserRegisterTests(void) {
    printf("SMBParserRegisterTests\n");
    UtRegisterTest("SMBParserTest01", SMBParserTest01, 1);
    UtRegisterTest("SMBParserTest02", SMBParserTest02, 1);
}
#endif