From 6181459086a67a9592b814879c07225a3ac94ed2 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <contact@catenacyber.fr>
Date: Thu, 15 Oct 2020 22:51:52 +0200
Subject: [PATCH] smb: do not rely on one valid NBSS byte for probing

Need to have the SMB header so as to validate
---
 rust/src/smb/nbss_records.rs | 3 +++
 rust/src/smb/smb.rs          | 5 ++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/rust/src/smb/nbss_records.rs b/rust/src/smb/nbss_records.rs
index fba7557d36..ae66f10880 100644
--- a/rust/src/smb/nbss_records.rs
+++ b/rust/src/smb/nbss_records.rs
@@ -44,6 +44,9 @@ impl<'a> NbssRecord<'a> {
         };
         valid
     }
+    pub fn needs_more(&self) -> bool {
+        return self.is_valid() && self.length >= 4 && self.data.len() < 4;
+    }
     pub fn is_smb(&self) -> bool {
         let valid = self.is_valid();
         let smb = if self.data.len() >= 4 &&
diff --git a/rust/src/smb/smb.rs b/rust/src/smb/smb.rs
index bbb6685e1d..70262391cc 100644
--- a/rust/src/smb/smb.rs
+++ b/rust/src/smb/smb.rs
@@ -1977,9 +1977,8 @@ pub extern "C" fn rs_smb_probe_tcp(direction: u8,
             if hdr.is_smb() {
                 SCLogDebug!("smb found");
                 return 1;
-            } else if hdr.is_valid() {
-                SCLogDebug!("nbss found, assume smb");
-                return 1;
+            } else if hdr.needs_more(){
+                return 0;
             }
         },
         _ => { },