diff --git a/rust/src/smb/events.rs b/rust/src/smb/events.rs index 22d65acb05..c89b0664b6 100644 --- a/rust/src/smb/events.rs +++ b/rust/src/smb/events.rs @@ -30,6 +30,21 @@ pub enum SMBEvent { NegotiateMalformedDialects = 6, } +impl SMBEvent { + pub fn from_i32(value: i32) -> Option { + match value { + 0 => Some(SMBEvent::InternalError), + 1 => Some(SMBEvent::MalformedData), + 2 => Some(SMBEvent::RecordOverflow), + 3 => Some(SMBEvent::MalformedNtlmsspRequest), + 4 => Some(SMBEvent::MalformedNtlmsspResponse), + 5 => Some(SMBEvent::DuplicateNegotiate), + 6 => Some(SMBEvent::NegotiateMalformedDialects), + _ => None, + } + } +} + pub fn smb_str_to_event(instr: &str) -> i32 { SCLogDebug!("checking {}", instr); match instr { diff --git a/rust/src/smb/smb.rs b/rust/src/smb/smb.rs index 7ae9fcf49e..5671a0d807 100644 --- a/rust/src/smb/smb.rs +++ b/rust/src/smb/smb.rs @@ -2111,6 +2111,32 @@ pub extern "C" fn rs_smb_state_get_events(tx: *mut std::os::raw::c_void) return tx.events; } +#[no_mangle] +pub extern "C" fn rs_smb_state_get_event_info_by_id(event_id: std::os::raw::c_int, + event_name: *mut *const std::os::raw::c_char, + event_type: *mut AppLayerEventType) + -> i8 +{ + if let Some(e) = SMBEvent::from_i32(event_id as i32) { + let estr = match e { + SMBEvent::InternalError => { "internal_error\0" }, + SMBEvent::MalformedData => { "malformed_data\0" }, + SMBEvent::RecordOverflow => { "record_overflow\0" }, + SMBEvent::MalformedNtlmsspRequest => { "malformed_ntlmssp_request\0" }, + SMBEvent::MalformedNtlmsspResponse => { "malformed_ntlmssp_response\0" }, + SMBEvent::DuplicateNegotiate => { "duplicate_negotiate\0" }, + SMBEvent::NegotiateMalformedDialects => { "netogiate_malformed_dialects\0" }, + }; + unsafe{ + *event_name = estr.as_ptr() as *const std::os::raw::c_char; + *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION; + }; + 0 + } else { + -1 + } +} + #[no_mangle] pub extern "C" fn rs_smb_state_get_event_info(event_name: *const std::os::raw::c_char, event_id: *mut std::os::raw::c_int, diff --git a/src/app-layer-smb.c b/src/app-layer-smb.c index 95d5a58926..807876cc9c 100644 --- a/src/app-layer-smb.c +++ b/src/app-layer-smb.c @@ -194,9 +194,7 @@ static AppLayerDecoderEvents *SMBGetEvents(void *tx) static int SMBGetEventInfoById(int event_id, const char **event_name, AppLayerEventType *event_type) { - *event_name = "SMB event name (generic)"; - *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION; - return 0; + return rs_smb_state_get_event_info_by_id(event_id, event_name, event_type); } static int SMBGetEventInfo(const char *event_name, int *event_id,