|
|
|
@ -1450,10 +1450,62 @@ static void SMBStateFree(void *s)
|
|
|
|
|
|
|
|
|
|
DCERPCCleanup(&sstate->ds.dcerpc);
|
|
|
|
|
|
|
|
|
|
if (sstate->ds.de_state) {
|
|
|
|
|
DetectEngineStateFree(sstate->ds.de_state);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
SCFree(s);
|
|
|
|
|
SCReturn;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int SMBStateHasTxDetectState(void *state)
|
|
|
|
|
{
|
|
|
|
|
SMBState *smb_state = (SMBState *)state;
|
|
|
|
|
if (smb_state->ds.de_state)
|
|
|
|
|
return 1;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int SMBSetTxDetectState(void *state, void *vtx, DetectEngineState *de_state)
|
|
|
|
|
{
|
|
|
|
|
SMBState *smb_state = (SMBState *)state;
|
|
|
|
|
smb_state->ds.de_state = de_state;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static DetectEngineState *SMBGetTxDetectState(void *vtx)
|
|
|
|
|
{
|
|
|
|
|
SMBState *smb_state = (SMBState *)vtx;
|
|
|
|
|
return smb_state->ds.de_state;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void SMBStateTransactionFree(void *state, uint64_t tx_id)
|
|
|
|
|
{
|
|
|
|
|
/* do nothing */
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void *SMBGetTx(void *state, uint64_t tx_id)
|
|
|
|
|
{
|
|
|
|
|
SMBState *smb_state = (SMBState *)state;
|
|
|
|
|
return smb_state;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static uint64_t SMBGetTxCnt(void *state)
|
|
|
|
|
{
|
|
|
|
|
/* single tx */
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int SMBGetAlstateProgressCompletionStatus(uint8_t direction)
|
|
|
|
|
{
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int SMBGetAlstateProgress(void *tx, uint8_t direction)
|
|
|
|
|
{
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#define SMB_PROBING_PARSER_MIN_DEPTH 8
|
|
|
|
|
|
|
|
|
|
static uint16_t SMBProbingParser(uint8_t *input, uint32_t ilen, uint32_t *offset)
|
|
|
|
@ -1547,6 +1599,20 @@ void RegisterSMBParsers(void)
|
|
|
|
|
AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_SMB, STREAM_TOSERVER, SMBParseRequest);
|
|
|
|
|
AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_SMB, STREAM_TOCLIENT, SMBParseResponse);
|
|
|
|
|
AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_SMB, SMBStateAlloc, SMBStateFree);
|
|
|
|
|
|
|
|
|
|
AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_SMB, SMBStateTransactionFree);
|
|
|
|
|
|
|
|
|
|
AppLayerParserRegisterDetectStateFuncs(IPPROTO_TCP, ALPROTO_SMB, SMBStateHasTxDetectState,
|
|
|
|
|
SMBGetTxDetectState, SMBSetTxDetectState);
|
|
|
|
|
|
|
|
|
|
AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_SMB, SMBGetTx);
|
|
|
|
|
|
|
|
|
|
AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_SMB, SMBGetTxCnt);
|
|
|
|
|
|
|
|
|
|
AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_SMB, SMBGetAlstateProgress);
|
|
|
|
|
|
|
|
|
|
AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_SMB,
|
|
|
|
|
SMBGetAlstateProgressCompletionStatus);
|
|
|
|
|
} else {
|
|
|
|
|
SCLogInfo("Parsed disabled for %s protocol. Protocol detection "
|
|
|
|
|
"still on.", proto_name);
|
|
|
|
|