diff --git a/rust/src/smb/smb.rs b/rust/src/smb/smb.rs index 9f55bf358a..2e96e448e7 100644 --- a/rust/src/smb/smb.rs +++ b/rust/src/smb/smb.rs @@ -1720,12 +1720,18 @@ pub extern "C" fn rs_smb_parse_request_tcp(_flow: *mut Flow, _pstate: *mut libc::c_void, input: *mut libc::uint8_t, input_len: libc::uint32_t, - _data: *mut libc::c_void) + _data: *mut libc::c_void, + flags: u8) -> libc::int8_t { let buf = unsafe{std::slice::from_raw_parts(input, input_len as usize)}; SCLogDebug!("parsing {} bytes of request data", input_len); + /* START with MISTREAM set: record might be starting the middle. */ + if flags & (STREAM_START|STREAM_MIDSTREAM) == (STREAM_START|STREAM_MIDSTREAM) { + state.ts_gap = true; + } + if state.parse_tcp_data_ts(buf) == 0 { return 1; } else { @@ -1752,12 +1758,18 @@ pub extern "C" fn rs_smb_parse_response_tcp(_flow: *mut Flow, _pstate: *mut libc::c_void, input: *mut libc::uint8_t, input_len: libc::uint32_t, - _data: *mut libc::c_void) + _data: *mut libc::c_void, + flags: u8) -> libc::int8_t { SCLogDebug!("parsing {} bytes of response data", input_len); let buf = unsafe{std::slice::from_raw_parts(input, input_len as usize)}; + /* START with MISTREAM set: record might be starting the middle. */ + if flags & (STREAM_START|STREAM_MIDSTREAM) == (STREAM_START|STREAM_MIDSTREAM) { + state.tc_gap = true; + } + if state.parse_tcp_data_tc(buf) == 0 { return 1; } else { diff --git a/src/app-layer-smb-tcp-rust.c b/src/app-layer-smb-tcp-rust.c index e8df01cdb8..634e90dc2a 100644 --- a/src/app-layer-smb-tcp-rust.c +++ b/src/app-layer-smb-tcp-rust.c @@ -45,7 +45,7 @@ static int RustSMBTCPParseRequest(Flow *f, void *state, res = rs_smb_parse_request_tcp_gap(state, input_len); } else { res = rs_smb_parse_request_tcp(f, state, pstate, input, input_len, - local_data); + local_data, flags); } if (res != 1) { SCLogNotice("SMB request%s of %u bytes, retval %d", @@ -68,7 +68,7 @@ static int RustSMBTCPParseResponse(Flow *f, void *state, res = rs_smb_parse_response_tcp_gap(state, input_len); } else { res = rs_smb_parse_response_tcp(f, state, pstate, input, input_len, - local_data); + local_data, flags); } if (res != 1) { SCLogNotice("SMB response%s of %u bytes, retval %d",